Privacy Policy (“these Guidelines”)

• We collect the following personal information for purposes associated with membership subscription, business consultation, and service provision.

• Basic information
  1. Members’ personal information such as names, home addresses, phone/fax numbers, cellphone numbers, e-mail addresses/ID/passwords (when using a site), credit card numbers, DOBs, wedding anniversaries, etc.
  2. Payment-related information such as bank names, withdrawal account numbers, account holder names/resident registration numbers
• Information items automatically collected (when using a site)
  1. Records about using a service, connection logs, cookies

• We use personal information collected by us for the following purposes. No information provided by users is used for any purposes other than what is stated in the following. If there is a change in the stated purpose, we will obtain users’ consent in advance.

• Service provision-related contract execution; service-related content provision
  1. Affiliated stores management, transaction details inquiry, transaction details registration/establishment, service such as data audit, etc.
• Members management
  1. Member system-based service usage-related identification, prevention of unauthorized use, ascertainment of intention for subscription, complaint handling, etc.
• Use in marketing/advertisements
  1. Information communication and customized service provision associated with the development of new services and carrying out of special events, introduction/sale of our and affiliated businesses’ goods/services, checking access frequency, statistics compilation about members’ possession and use of personal information

• We destroy personal information upon attaining the purpose of collecting and using it, provided that we retain information on members during a period stated in the following as required under relevant laws.

• Records about cancelled contracts and withdrawn subscriptions, etc.
  1. Basis for retention: The Act on the Consumer Protection in the Electronic Commerce Transactions, etc.
  2. Retention period: 5 years
• Records about payment and goods supply
  1. Basis for retention: The Act on the Consumer Protection in the Electronic Commerce Transactions, etc.
  2. Retention period: 5 years
• Records about handling consumers’ complaints or disputes
  1. Basis for retention: The Act on the Consumer Protection in the Electronic Commerce Transactions, etc.
  2. Retention period: 3 years
• Records about collection, handling, and use of credit information
  1. Basis for retention: The Use and Protection of Credit Information Act
  2. Retention period: 3 years
• Records about visits to websites
  1. Basis for retention: The Protection of Communications Secrets Act
  2. Retention period: 3 months

• We make it a rule to handle customers’ personal information within the scope stated in Purpose of collecting and using personal information. We do not disclose or provide customers’ personal information to a third party without customers’ prior consent, except in the following occasions.

• When required for signing, maintaining, and executing contracts;
• When customers consent to our disclosure or provision in advance;
• When there is a special clause about disclosure or provision in relevant laws or when there is a request from a law enforcement agency under relevant laws;

• We provide personal information on customers subscribing to or using specifically combined or affiliated service and customers giving us a separate consent to disclosure or provision as follows.

* As for Lotte Rental, Korean Federation of Savings Banks, Alba Co., Kr, and Albain, we only provide SALT service subscriber information

* As for Double Save, we only provide information entrusted by BC Card

• We entrust personal information handling to another business for customers’ convenience and proper management of the business such as service contracts, provision of after sales service and ancillary business. We make the trustee observe personal information protection-related laws and not provide personal information to third parties, with the relevant contracts electronically maintained in good order. We will keep customers informed of any change in the trustee business through public notices and these Guidelines.

• We destroy personal information as follows upon attaining the purpose of collecting and using it.

• Destruction procedures
  1. We destroy information entered by users for member subscription and the like by relocating it to a separate database (or to a file in the case of paper documents) upon attaining the purpose per internal guidelines and relevant laws (Ref.: period for retention and use) after retaining it for a given period.
  2. The stated personal information is not used for any purpose other than what is designated unless otherwise stipulated by law.
• Destruction methods
  1. We destroy documents containing personal information with a shredder or through incineration.
  2. We delete personal information stored in the form of an electronic file, using an irrecoverable method.

Users and legal agents registered with us may access or revise personal information on the subject of information at any time. If they do not consent to the way we handle personal information, they may ask for withdrawal of subscription (or membership). In such case, it may be difficult for them to partially or wholly use the service.
If they wish to access or revise their personal information, they may do so within ten days by contacting our personal information management personnel in writing, by phone or by e-mail.
When a user has asked for correction of an error in his/her personal information, we will stop using or providing the information until the correction of the error is completed.
When we have provided incorrect personal information to third parties, we will immediately inform the third parties of the fact.
The personal information withdrawn or deleted by the request of the user or legal agent will be handled as per the Period for retaining and using personal information and will not be allowed to be accessed or used for any other purpose.

※ We do not provide service to children less than 14 years of age.

We use “cookies” to store and call users’ personal information from time to time. Cookies are a small amount of information transmitted by a website to users’ computer browser (Internet Explorer and the like). When users connect to our website, our website reads cookies information in the users’ browser and finds additional information on them and enables us to provide service without taking separate steps. Users have the right to reject our installation of cookies.
By setting an option in [Tools] > [Internet Options] > [Personal Information] tab on the upper part of the web browser, users may accept all cookies that we install, confirm each cookie to be saved or fully reject our use of any cookies. If you reject our use of cookies, it may be difficult for them to partially or wholly use our service.

• We take technological and management-related protection measures as follows to ensure the safety of users’ personal information, i.e. to prevent loss, theft, leakage, alternation or damage of the personal information

• Management-related protection measures
  1. We formulate personal information protection-related policies and guidelines and carry out periodic training for employees in charge. We remind employees of the importance of observing these Guidelines. We maintain the number of employees handling personal information to a minimum. We use a secret access code to personal information and change it periodically.
• Technological protection measures
  1. We do our best to prevent members’ personal information from being leaked or mishandled due to hacking or computer viruses. We periodically back up materials to protect against the possibility of personal information being damaged. We use updated anti-virus programs in an effort not to have users’ personal information leaked or damaged. We use coded communications for safe transmission of personal information in networks. We use an intrusion prevention system to block unauthorized outside access to personal information. We strive to use all available devices for systemic security. However, we will not be responsible for any problems caused by leakage of personal information such as ID or password due to users’ negligence or an internet problem beyond our control.
• Physical protection measures
  1. We operate an access control system and closed-circuit television (CCTV) to block unauthorized access to the computer room, where the personal information handling system is operated. We keep documents and media containing personal information in a locked cabinet.

• Our personal information manager and employees stated in the following strive to protect customers’ personal information and handle their personal information-related complaints. Users may contact us to discuss their complaints about the way their personal information is handled by us in their use of our service. We will remain responsive to their complaints.

• Personal information manager
  1. Dong Sanggwon (Senior Managing Director), the Management Strategy Division
  2. Tel : 02-2109-9020 / FAX : 02-2109-9197
  3. E-mail : sg.dong@smartro.co.kr
• Employee in charge
  1. Jang Oksul (Deputy Department Manager), the Business Support Team, the Management Support Office
  2. Tel : 02-2109-9163 / FAX : 02-2109-9197
  3. E-mail : osjang@smartro.co.kr

• You may contact one of the following outside agencies to discuss your complaint about the way your personal information is handled by us.

• Personal Information Infringement Reporting Center (www.1336.or.kr / 118 )
• Information Protection Mark Certification Committee (www.eprivacy.or.kr / 02-580-0533~4)
• The Internet Crime Investigation Center of the Supreme Prosecutors' Office (http://www.spo.go.kr / 02-3480-3600)
• Cyber Terror Response Center (www.ctrc.go.kr / 02-392-0330)

• In the event of a change (including addition, deletion or revision) in these Guidelines, we will post a relevant public notice at least seven days in advance or at least a month in advance in the event of a change that may affect users’ important rights such as collection and use of personal information or its provision to third parties.

• Date of notice: 3/8/2016
• Date of implementation: 3/8/2016