Personal Information Protection Processing Policy

All personal information handled by the online export platform (hereinafter referred to as “Trade On”) constructed and operated by the Seoul Business Agency (hereinafter referred to as “SBA”) shall be collected, retained, and processed based on relevant laws or agreement of the subjects of information.

The Personal Information Protection Act provides a general norm for handling of such personal information and the SBA shall legally and appropriately handle personal information collected, retained, and processed in accordance with the provisions of these laws.

This personal information protection processing policy shall be applied to Services provided and all information files processed by Trade On unless otherwise stated.

Trade On’s personal information protection processing policy is as follows.

Article 1 (Purpose and Period for Collecting and Processing Personal Information)

• The SBA processes personal information within the minimum range necessary for providing Trade On Services. When users do not agree to submit personal information necessary for providing Services, the SBA cannot provide Trade On Services.
• The SBA processes personal information for the following purposes. The processed personal information shall not be used other than the following purposes and prior consent is sought when the purposes of use are changed:
  • ① Joining Trade On and service provision
    Personal information is processed to verify the identity of a user who acquires membership and becomes eligible for Services (Online exhibition, rental and advice consultation service, online education content and webinar service, etc.);
  • ② Civil petitions treatment
    Personal information is processed to identify civil petitioners, confirm the petition details, contact & notice for fact finding, and notify the processing results;
  • ③ Export support service provision
    Personal information is processed to provide biz matching consultation meetings, export voucher business, etc., based on the information provided when joining;
  • ④ Utilization in marketing & advertisement
    Personal information is processed to develop new services (products), provide tailored services, events and advertising information and opportunities to participate, verify the validity of Services, identify the access frequency, or compile statistics of a user’s service use.
• The purposes of processing personal information by the subjects are as follows:

  	Subjects of personal information	Operational basis	Processing purpose
  1	Trade On Visitor	Agreement of subjects of information	① Joining Trade On and service provision ② Civil petitions treatment
  2	Trade On Exhibiting Company	Agreement of subjects of information	① Joining Trade On and service provision ② Civil petitions treatment ③ Export support service provision ④ Utilization in marketing & advertisement
  3	Trade On Buyer	Agreement of subjects of information	① Joining Trade On and service provision ② Civil petitions treatment

• The SBA shall retain and use the personal information of a user until the membership is withdrawn.

Article 2 (Collection & Processing Items and Method of Collecting Personal Information)

• The SBA processes the following personal information items for Trade On membership and the provision of various Services:

  	Subjects of personal information	Collection & processing items of information
  1	Trade On Visitor	· Mandatory: ID, password, name, company name, telephone number, email address
  2	Trade On Exhibiting Company	· Mandatory: Personal identification information and corporate information such as ID, password, name, gender, address, mobile phone number, company name, telephone number, email address and corporate registration number · Optional: Information provided by users other than personal information
  3	Trade On Buyer	· Mandatory: ID, password, country, name, company name, telephone number, email address

• The SBA collects information from Paragraph 1 on its homepage or Trade On website.

Article 3 (Processing and Retainment Period of Personal Information)

The SBA processes and retains personal information within the retention and use period of personal information according to laws or that are agreed to by the subjects of information when collecting the information.

• Personal information and corporate information related to the business on consignment by Seoul City shall be retained and used for the use purpose in Article 1 from the day of agreement for collection and use until the ending day of the business on consignment by Seoul City. However, after the ending day of the business on consignment by Seoul City, the information shall be retained and used only for dispute resolution, handling civil affairs, legal fulfillment of obligations and our Foundation risk management work.
• Personal information collected for the purpose of membership and management shall be retained and used from the day of members’ joining to the day of membership withdrawal. However, after the day of membership withdrawal, the information shall be retained and used only for business history, dispute resolution, handling civil affairs, and fulfillment of legal obligations.
• Personal information of employees of the Foundation, etc., shall be retained and used for prevention of accidents, inspection, dispute resolution, handling civil affairs, and fulfillment of legal obligations even after their retirement.

Article 4 (Provision of Personal Information to a Third Party)

The SBA provides personal information to a third party only when the information falls under Articles 17 and 18 of the Personal Information Protection Act such as agreement of the subjects of information or special provisions of laws.

Personal information file name	Recipient	Provision basis and purpose	Items provided	The period for retaining and using personal information	Department
Homepage Member information	NICE Investors Service Co	Member’s agreement Real-name authentication	Name, gender, Date of birth, mobile phone number	Not retained since the information has already been retained by a credit-rating agency	Information service
Homepage Member information	NICE Investors Service Co	Member’s agreement I-PIN authentication	I-PIN (Personal identification number)	Not retained since the information has already been retained by a credit-rating agency	Information service

(※ Other contents provided to a third party are informed through the SBA homepage)

Article 5 (Consignment of Personal Information Processing)

• The SBA entrusts personal information processing as follows for the smooth provision of Trade On Services:

  	Consignment work	Consignment company	Information category
  1	Development, management and repair of system (DB management)	Withsystem. Co., Ltd.	Users, company, product information
  2	Operation of Trade On Service	Korea Enterprise Data Co., Ltd.	Users, company, product information

• For consignment contracts, laws relating to personal information protection are observed, prohibition of providing personal information to a third party and responsibilities are clearly prescribed, and corresponding contract contents are stored. In addition, when the company is changed, users will be notified of such fact in compliance with the personal information protection processing policy.

Article 6 Rights and Obligations of Subjects of Information and Method of Exercising Such Rights.

A user can exercise the following rights as a subject of personal information.

• 1. The subject of information may exercise the following rights relating to personal information any time to the SBA:
  • ① Request to view information;
  • ② Request to revise or delete errors, etc.;
  • ③ Request to suspend information processing.
• For inquiry, modification, cancellation and deletion of personal information, the members may click [Modify Membership Information and Membership Withdrawal] and view, modify or withdraw after authenticating their membership.
• Exercising rights according to Paragraph 1 can be made through a written form, email or fax according to attached Form 8 of the Enforcement Rule of the Personal Information Protection Act and the SBA shall promptly take necessary measures.
• When a subject of information requests the revision or deletion of errors of personal information, etc., the SBA shall not use or provide the corresponding information to other parties until such revision or deletion is completed.
• Exercising rights according to Paragraph 1 can be made through an attorney such as a legal representative of the subject of information or his/her delegated person. In this case, a power of attorney form shall be submitted according to attached Form 11 of the Enforcement Rule of the Personal Information Protection Act.
• The subject of information shall not infringe on the personal information or privacy of others as well as themselves being processed by the SBA because such act would be a violation of relevant laws such as the Personal Information Protection Act.

Article 7 (Request of Suspension of Personal Information Processing)

• A user may request the SBA to suspend processing his/her personal information. However, in the following cases, the SBA may refuse such request to suspend personal information processing after notifying users of the corresponding reason:
  • ① When there are special regulations in laws or it is required to comply with legal obligations;
  • ② When it would threaten the life and health of the other person or damage his/her property or any other interests;
  • ③ When it is difficult to fulfill the contract such as a case where the service agreed to by a customer cannot be provided unless personal information is processed and the customer does not express his/her intention to cancel the contract.

Article 8 (Destruction of Personal Information)

• In principle, the SBA shall immediately destroy personal information once the purpose of personal information processing has been achieved. However, the following information shall be retained for the stipulated period due to the following reasons:
  • ① Personal information and corporate information processed for the purpose of financial trade or consignment of Seoul City shall be retained and used until the purpose of financial trade or consignment of Seoul City is achieved. However, the information shall be retained and used only for prevention and investigation of financial accidents, dispute resolution, handling civil affairs, and legal fulfillment of obligations after the achievement of the purpose;
  • ② Personal information collected for the purpose of member joining and management shall be retained and used from the day of members’ joining until the day of membership withdrawal. However, it shall be retained and used only for the prevention and investigation of financial accidents, dispute resolution, handling civil affairs, and legal fulfillment of obligations even after the day of membership withdrawal. Once the purpose of personal information processing is achieved, the corresponding personal information shall be destroyed immediately. The procedures, deadline and methods for destroying personal information are as follows.
• The procedures, deadline and methods for destroying personal information are as follows:
  • ① Procedure for destruction
    Information input by users shall be transferred to a separate DB (separate document in the case of paper document) after the purpose of retention is achieved and stored for a certain period according to company policy and relevant laws or immediately destroyed. Here, personal information transferred to a DB shall not be used for other purposes except to fulfill legal obligations;
  • ② Deadline for destruction
    Personal information of users shall be destroyed within 5 days from the ending day of its retention period and if it becomes unnecessary due to the reasons such as achievement of purpose of its processing, abolishment of the corresponding service or closure of business, it shall be destroyed within 5 days from the day when its processing is acknowledged as unnecessary;
  • ③ Method of destruction
    • Information in the form of an electronic file shall be destroyed via technical methods that will prevent its recovery.
    • Printed or hard copy versions of personal information shall be shredded or incinerated.

Article 9 (Measures for the Protection of Personal Information)

The SBA shall take technical, managerial, and physical measures as follows to protect personal information according to Article 29 of the Personal Information Protection Act.

• Reducing the number of employees who handle personal information and their education
  Personal information is managed by designating employees to handle personal information and limiting the processing work to only those personnel so designated.
• Conducting regular self-audit
  Self-audit is conducted regularly (once per six months) to protect personal information.
• Setting up plan for internal management and its implementation
  Plan for internal management is set up and implemented for the safe processing of personal information.
• Encryption of personal information
  The user’s password for personal information is encrypted for storage and management, so only the user can know it. For important data, special security functions are used such as encryption of files and transmission data, and file locking function.
• Technical measures against hacking, etc.
  The SBA installs a security program to prevent leaks and damage to personal information caused by hacking, computer viruses, etc., and regularly inspects & renews it, and also installs the system in access control areas from outside and monitors & filters it technically/physically.
• Restricted access to personal information
  A necessary measure is taken to restrict access to personal information by granting, changing and erasing access authority for database systems that process personal information, and unauthorized access from outside is controlled using a firewall system.
• Storage of access records and forgery prevention
  The records of access to the personal information processing system are stored and managed for at least 6 months and a security function is used to prevent forgery, theft and loss of the access records.
• Use of locking device for document security
  Documents including personal information, subsidiary storage media, etc., are stored in a safe place with a locking device.
• Access control against unauthorized persons
  A physical storage place for storing personal information is installed and the procedure for access control to the place is established and operated.

Article 10 (Personal Information Protection Manager)

• The SBA assigns a personal information protection manager who oversees all work relating to personal information processing, handles complaints from the subjects of information, and relieves their damage as follows:
  • ① Personal information protection manager
    - Name: Kim Yong-sang
    - Position: Head of Marketing Support Center
    - Contact Number: 02-2657-5800
  • ② Personal information protection department
    - Department Name: Global Marketing Team
    - Person in Charge: Kim Min-jae
    - TEL No.: 02-2657-5725
    - Address : 29 Gonghang-daero 61-gil (Deungchon-dong), Gangseo-gu, Seoul, Republic of Korea (07563)
• Subjects of information may make inquiries about all matters relating to personal information protection, complaint handling, damage relief, etc., which have occurred while using Services (or projects) of the SBA to personal information protection manager or department. The SBA shall reply to and handle the inquiries of subjects of information immediately.

Article 11 (Changes of Personal Information Processing Policy)

The personal information protection policy shall take effect from the enforcement date, but if there is an addition, deletion or revision of contents according to laws and policies, such change shall be notified to users through a notice at least seven days before such change is enforced. However, when there are changes caused by a change in the number of personal information files managed by category, no notification shall be made.

Article 12 (Methods to Relieve Infringement on Rights and Interests)

Subjects of information may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of Korea Internet & Security Agency (KISA), etc., to be relieved from personal information infringement. Regarding other personal information infringement reports and consultations, make inquiries to the following organizations:

1. Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
2. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
3. High-Tech and Financial Crimes Investigation Division, Supreme Prosecutors' Office: 02-3480-2000 (www.spo.go.kr, cybercid@spo.go.kr)
4. Cyber Terror Response Center, Korean National Police Agency: 1566-0112 (www.netan.go.kr)

Consent to Provision of Personal Information to a Third Party

Limitation to Use and Provision of Personal Information and Refusal to Disclosure to a Third Party

The SBA shall not leak or distribute all information collected and acquired without the consent of the subjects of information according to Article 10 of the Personal Information Protection Act and shall not use the information for commercial purpose. However, exceptions are made in the following cases:

• When there is a request from a related organization for investigational purposes to comply with relevant laws;
• When the information is needed for statistics, academic research or market survey and specific personal information is processed into an unrecognizable form;
• When requested according to the procedure stipulated in relevant laws.

Matters on Homepage Access (Use of Cookie)

The SBA uses a “cookie” that stores and imports information of users frequently to provide specialized tailored Services to users. A cookie is the minimum amount of information sent to the user’s computer browser and stored on the user’s PC hard disc by the server (HTTP) to operate the website.

Users should permit cookies to simplify login and use membership services after accessing the SBA’s homepage. The SBA uses cookies to find information about ID to provide suitable and more useful Services to users. Cookies identify the users’ computer, but not the individual user’s identity.

Users may select whether or not to allow the use of cookies. By setting options in the web browser, users can permit all cookies, check whenever a cookie is stored, and refuse the storage of all cookies. However, when a user refuses to save cookies, some Services that require login cannot be used.

Use Purpose of Collected Personal Information

The SBA discloses the use purpose of personal information when collecting it, and the collected information shall be used for the following purposes.

Name, gender, ID, and password shall be used to provide user identification Service according to the use of Services. Email address and telephone number are needed to secure smooth communication channels such as delivery of notices, identification of user's intention, and handling of civil affairs. Other data are used for providing tailored personal Services.

Security Action Operated by Homepage

The SBA operates various programs to monitor network traffic and detect attempts to illegally change information that jeopardizes homepage security and the continuous provision of Services.
The SBA encrypts members’ personal information when storing and sending collected data to provide information security, and the collected personal information is stored on secure servers.

Link Site / Web Page

When users move to other sites or web pages by clicking on links or banners included in the webpages operated by the SBA and its affiliated centers (Seoul Animation Center, SETEC, Community, Startup School), users are responsible for checking the personal information handling policy of the site they newly visit because the policy posted on that site is applied.

Acquisition of Others’ Personal Information during Use of Website

Any acquisition of identifiable personal information such as email addresses in the webpages operated by the SBA and its affiliated centers shall not be allowed. A person who accesses or is provided with such personal information by false or unlawful means, is subject to punishment according to Article 71 of the Personal Information Protection Act.

Changes of Personal Information Protection Policy

If a user discovers potential violations of privacy and leakage of personal information during website use, such user must report such discovery to the below contacts:

- Personal information management officer of the SBA: Go Bong-jin, Management Planning Manager
- Personal Information staff of SBA: Ahn Sang-soo, Information Service Team
- Email: aply@sba.seoul.kr
- Telephone Number: 02-2222-3852
- Address: 14F 400 Worldcup Buk-ro (Sangam-dong), Mapo-gu, Seoul, Korea (03925)

Handling and Protection Policy of [Personal Information Processed by Computer]

Collection and Retention of Personal Information

The SBA shall collect and retain personal information in compliance with related regulations and laws and with the consent of the subjects of information.
The SBA will make efforts to prevent any infringement on the rights and interests of people by legally and appropriately processing the personal information of people it retains according to relevant laws.

Limitation to Use and Provision of Personal Information

Personal information collected and retained by the SBA and its affiliated centers have strict limitations on its provision unlike general administrative information. Article 18 (Limitation to Out-of-Purpose Use and Provision of Personal Information) of the Personal Information Protection Act provides as follows with respect to this:

• When the retention organization uses the information internally or provides it to others according to other laws;
• The following cases:
  * Where additional consent is obtained from the subject of information;
  * Where special provisions in other laws so require;
  * Where it is deemed manifestly necessary for the protection of life, bodily or property interests of the subject of information or third party from imminent danger where the subject of information or his or her legal representative is not in a position to express intention, or prior consent cannot be obtained owing to unknown addresses;
  * Where it is impossible to perform the duties under its jurisdiction as provided for in any Act, unless the personal information controller uses personal information for other purpose than the intended one, or provides it to a third party, and it is subject to the deliberation and resolution by the Commission;
  * Where it is necessary to provide personal information to a foreign government or international organization to perform a treaty or other international convention;
  * Where it is necessary for the investigation of a crime, indictment and prosecution;
  * Where it is necessary for a court to proceed with trial-related duties;
  * Where it is necessary for the execution of punishment, custody, and rotective disposition
• The SBA and its affiliated centers will make efforts not to use personal information unduly by strictly observing the relevant laws regarding the use and provision of personal information.

Claim for Access/Modification/Deletion of Personal Information File

For the following personal information files, only the subjects of information can claim the access in accordance with the provisions of the Personal Information Protection Act:

Retention Department	Personal Information File Name	Access Place	Contact	Remarks
Information Service Team	Members’ Information	Information Service Team	02-2222-3852

* Procedure of Access Claim


* In the following cases, access may be denied according to Article 35 of the Act:

• Where access is prohibited or limited by Acts;
• Where access may cause damage to the life or body of a third party, or unjustified infringement of property and other interests of any other person;
• Where a public institution has grave difficulties in performing any of the following duties:
  • A. Imposition, collection or refund of taxes;
  • B. Evaluation of academic achievements or admission affairs at the schools of each level established under the Elementary and Secondary Education Act and the Higher Education Act, lifelong educational facilities established under the Lifelong Education Act, and other higher educational institutions established under other Acts;
  • C. Testing and qualification examination regarding academic competence, technical capability and employment;
  • D. Ongoing evaluation or decision-making in relation to compensation or grant assessment;
  • F. Ongoing audit and examination under other Acts.
    

- Subjects of information who access their personal information may demand revision in the following cases:
* Range of revision demand;
* Revision of information recorded differently from fact;
* Deletion of contents that are not applicable to specific items;
* Procedure of revision demand.

User’s Consent for Personal Information Protection

Collection and Use Purpose of Personal Information

- To use personal information for security identification, user authentication, confirmation of intention to join and service use
- To deliver notices, handle complaints, and secure a communication route
- To use personal information as data for guiding the latest information regarding new services, etc., and personal tailored services
- To prevent any recurrence of misbehavior by a member’s unjust and unauthorized use
- To smoothly provide good quality Services

Items of Collected Personal Information

Name, date of birth, ID, email address, telephone number, address, gender, and other selection items

Retention and Use Period of Personal Information

In principle, personal information shall be destroyed immediately once the purpose of collection and provision of personal information is achieved. However, personal information may be retained for three months after the cancellation of the service contract to prevent any recurrence of misbehavior like a member’s unjust use and such information shall be retained for a certain period as specified in other laws such as the Act on the Consumer Protection in Electronic Commerce, Etc.

Contact Information Such as the Email Address of the Personal Information Protection Manager

- The SBA and its affiliated centers designate and operate personal information protection managers as follows to protect the members’ rights and interests and promote the proper implementation of public works by securing legitimacy of personal information and appropriateness of procedures. If there are inquiries or confirmation about the personal information files retained in the SBA and its affiliated centers and their personal information handling policy, make contact with the personnel listed below:
- Trade On personal information management officer: Kim Yong-sang, Head of Marketing Support Center
- Person in charge for Trade On personal information protection: Kim Min-jae, Global Marketing Team
- Email: tradeon@sba.seoul.kr
- Telephone: 02-2657-5725
- Address: 29 Gonghang-daero 61-gil (Deungchon-dong), Gangseo-gu, Seoul, Republic of Korea (07563)

We will always guide and supervise the collection of personal information according to regulations and laws governing the proper use and purpose of processing.