8F, 3, Eunhaeng-ro, Yeongdeungpo-gu, Seoul, Republic of Korea
Tel : +82 2 - 2168 - 7500 / FAX : +82 2 - 769 - 1670

영상정보처리기기 운영관리 방침

주식회사 코나아이(이하 “회사”)은 영상정보처리기기 운영․관리 방침을 통해 회사에서 처리하는 영상정보가 어떠한 용도와 방식으로 이용․관리되고 있는지 알려드립니다. 또한 회사의 영상정보처리기기 운영ㆍ관리 방침이 변경되는 경우 변경된 사항에 대해서는 홈페이지를 통하여 정보주체가 쉽게 확인할 수 있도록 공지합니다.

제1조 [영상정보처리기기의 설치 근거 및 설치 목적]
- 회사는 개인정보보호법 제 25조 제 1항에 따라 다음과 같은 목적으로 영상정보처리기기를 설치ㆍ운영합니다.
- ① 시설안전 및 화재 예방
- ② 도난방지
- ③ 고객의 안전을 위한 범죄예방
제2조 [설치 대수, 설치 위치 및 촬영범위]
- 회사는 영상정보처리기기가 설치된 장소에는 정보주체가 쉽게 알아볼 수 있도록 안내판을 설치하고 있습니다.
- ① 설치 대수: 총 156대(본사: 30대, 전산운영센터: 14대, 김포 공장: 112개)
- ② 설치 위치: 회사 출입구 및 주요시설
- ③ 촬영 범위: 회사 내 동선 및 출입문
- 개인정보보호법 제 25조 5항에 의거 녹음기능을 제외한 화상정보만 촬영하고 있습니다.

제3조 [관리책임자, 담당부서 및 영상정보에 대한 접근 권한이 있는 사람]

정보주체의 영상정보를 보호하고 개인영상정보와 관련한 불만을 처리하기 위하여 회사는 관리책임자를 두고 있습니다.

구분	소속	성명	직위	연락처	이메일
관리 책임자	홍보팀	홍연수		매니저	02-2168-9851	ys.hong@ konai.com
접근 권한자	보안 책임자, 보안 담당자, 보안 요원

회사는 정보주체가 영상정보처리기기 설치•운영 중임을 쉽게 알아볼 수 있도록 다음과 같이 안내판을 설치•운영하고 있습니다.
- - 안내판은 촬영 범위 내에서 정보 주체가 알아보기 쉬운 장소에 누구라도 용이하게 판독 할 수 있게 설치되어 있습니다.
- - 회사에는 다수의 CCVT가 설치되어 있어 회사 전체가 영상정보기기 설치 지역임을 명시하여 안내판을 출입구에만 부착하였습니다.

제4조 [영상정보의 촬영시간, 보관기간, 보관장소 및 처리방법]
- 개인영상정보의 목적외 이용, 제3자 제공, 파기, 열람 등 요구에 관한 사항을 개인영상정보 관리대장에 기록ㆍ관리하고, 보관기간 만료 시 복원이 불가능한 방법으로 영구 삭제합니다.
- ① 영상정보의 촬영시간
  - - 24시간(정전 및 기타 정비를 위한 시간 제외)
- ② 영상정보의 보관기간
  - - 최소 30일 이상 녹화장치의 저장용량 범위 내에서 보관하며, 최대 180일(6개월) 이내로 함.
  - - 단, 회사의 운영 및 사건, 사고 등의 처리를 위하여 보존이 필요한 경우에는 해당 부분만 별도 관리할 수 있음.
- ③ 영상정보의 보관장소
  - - CCTV 모니터링 및 녹화기 설치장소인 서버실
- ④ 영상정보의 처리방법
  - - 영상정보의 보관은 녹화장치(DVR) 하드디스크에 보관
  - - 저장된 화상정보는 녹화장치(DVR) 저장용량에 따라 자동 삭제

제5조 [영상정보처리기기 설치 및 관리 등의 위탁에 관한 사항]

회사는 아래와 같이 영상정보처리기기 설치 및 관리 등을 위탁하고 있으며, 관계법령에 따라 위탁 계약시 개인정보가 안전하게 관리될 수 있도록 필요한 사항을 규정하고 있습니다.

수탁업체	연락처
㈜에스원	1588-3112

제6조 [개인영상정보의 확인 방법 및 장소에 관한 사항]
- 확인 방법: 관리 책임자에게 미리 연락하고 본사에 직접 방문하여 책임자 또는 접근 권한자 입회 하에 확인 가능합니다.
- 확인 장소: 회사 본사
제7조 [정보주체의 영상정보 열람 등 요구에 대한 조치]
- 정보주체는 회사가 처리하는 자신의 개인영상정보에 대하여 행정자치부령으로 정하는 바에 따라 개인영상정보 열람청구서를 회사에 제출하는 등의 방법으로 열람을 요구할 수 있습니다.
  단, 정보주체가 촬영된 개인영상정보 및 명백히 정보주체의 급박한 생명, 신체, 재산의 이익을 위하여 필요한 개인영상정보에 한정됩니다.
- 회사는 개인영상정보에 관하여 열람 또는 존재확인ㆍ삭제를 요구한 경우 지체없이 필요한 조치를 하겠습니다.
제8조 [영상정보의 안전성 확보조치]
- 회사는 개인영상정보를 보호하기 위하여 개인영상정보에 대한 접근 권한을 차등부여하고 있으며, 개인영상정보의 위•변조 방지를 위하여 개인영상정보의 이용•제공•열람•파기에 대하여 기록하여 관리하고 있습니다.
- 이 외에도 개인영상정보의 안전한 물리적 보관을 위하여 접근 권한이 없는 인원에 대해서는 접근을 차단하고 있습니다.
제9조 [영상정보처리기기 운영ㆍ관리 방침 변경에 관한 사항]
- 법령, 정책 또는 보안기술의 변경에 따라 내용의 추가, 삭제, 수정이 있을 경우에는 시행하기 최소 7일전에 회사 홈페이지를 통해 변경사항을 고지하겠습니다

내부정보관리규정

코나아이 주식회사

제 정 2009년 09월 07일
개 정 2017년 02월 06일

제1장 총 칙
- 제1조(목적)
- 이 규정은 ｢자본시장과 금융투자업에 관한 법률｣(이하 “법”이라 한다) 및 제반 법규에 따른 신속․정확한 공시 및 임원․직원의 내부자거래 방지를 위하여 코나아이 주식회사(이하 “회사”라 한다) 내부정보의 종합관리 및 적절한 공개 등에 관한 사항을 정함을 목적으로 한다.
- 제2조(용어의 정의)
- ①이 규정에서 “내부정보”라 함은 코스닥시장 공시규정(이하 “공시규정”이라 한다) 제1편에 의한 공시의무사항과 그 밖에 회사의 경영 또는 재산상황이나 투자자의 투자판단에 영향을 미칠 수 있는 사항을 말한다.
- ②이 규정에서 “공시책임자”라 함은 공시규정 제2조제4항에 따라 회사를 대표하여 신고업무를 수행할 수 있는 자를 말한다.
- ③이 규정에서 “임원”이라 함은 이사(｢상법｣ 제401조의2제1항 각 호의 어느 하나에 해당하는 자를 포함한다) 및 감사를 말한다.
- ④제1항부터 제3항 이외에 이 규정에서 사용하는 용어의 정의에 관하여는 관련 법령과 규정에서 사용하는 용어의 정의에 의한다.
- 제3조(적용범위)
- 공시, 내부자거래 및 내부정보관리에 관한 사항은 관련 법규 또는 정관에 정한 것을 제외하고는 이 규정에 따른다.
제2장 내부정보의 관리
- 제4조(내부정보의 관리)
- ①임원․직원은 업무상 알게 된 회사의 내부정보를 엄중히 관리하여야 하고, 업무상 필요한 경우를 제외하고는 내부정보를 사내 또는 사외에 유출하여서는 아니 된다.
- ②대표이사는 내부정보 및 그와 관련된 문서 등의 보관, 전달, 파기 등에 관한 구체적인 기준을 정하는 등 내부정보관리를 위해 필요한 조치를 취하여야 한다.
- 제5조(공시책임자)
- ①대표이사는 공시책임자를 정하여 이를 한국거래소에 신고하여야 한다. 공시책임자를 변경한 때에도 또한 같다.
- ②공시책임자는 내부정보관리제도의 수립 및 운영에 관련된 업무를 총괄하며 다음 각 호의 업무를 수행한다.
- 1. 공시의 집행
- 2. 내부정보관리제도의 운영 상황 점검 및 평가
- 3. 내부정보에 대한 검토 및 공시 여부의 결정
- 4. 임원․직원에 대한 교육 등 내부정보관리제도의 운영을 위해 필요한 조치
- 5. 내부정보의 관리를 담당하거나 공시업무를 담당하는 부서 또는 임원․직원에 대한 지휘 및 감독
- 6. 그 밖에 내부정보관리제도의 운영을 위해 필요하다고 대표이사가 인정한 업무
- ③공시책임자는 그 직무를 수행함에 있어서 다음 각 호의 권한을 가진다.
- 1. 내부정보와 관련된 각종 서류 및 기록의 제출을 요구하고 열람할 수 있는 권한
- 2. 회계 또는 감사업무를 담당하는 부서, 그 밖에 내부정보의 생성과 관련이 있는 업무를 담당하는 부서의 임원․직원으로부터 필요한 의견을 청취할 수 있는 권한
- ④공시책임자는 그 직무를 수행함에 있어 필요한 경우 관련 업무를 담당하는 임원과 협의할 수 있으며, 회사의 비용으로 전문가의 조력을 구할 수 있다.
- ⑤공시책임자는 내부정보관리제도의 운영 상황을 정기적으로 대표이사에게 보고하여야 한다.
- 제6조(공시담당자)
- ①대표이사는 공시담당자를 정하여 한국거래소에 신고하여야 한다. 공시담당자를 변경한 때에도 또한 같다.
- ②공시담당자는 내부정보관리와 관련하여 공시책임자의 지휘를 받으며 다음 각 호의 업무를 수행한다.
- 1. 내부정보의 수집과 검토 및 공시책임자에 대한 보고
- 2. 공시의 집행을 위해 필요한 업무
- 3. 공시 관련 법규의 변경 등 내부정보의 관리를 위해 필요한 사항의 확인 및 공시책임자에 대한 보고
- 4. 그 밖에 대표이사 또는 공시책임자가 필요하다고 인정한 사항
- 제7조(내부정보의 집중)
- 임원 및 각 부서의 장은 다음 각 호의 어느 하나에 해당하는 경우에 적시에 공시책임자에게 그에 관한 정보를 제공하여야 한다.
- 1. 내부정보가 발생한 경우
- 2. 내부정보 중 이미 공시된 사항을 취소 또는 변경해야 할 사유가 발생한 경우
- 3. 그 밖에 공시책임자의 요구가 있는 경우
- 제8조(내부정보의 사외제공)
- ①임원․직원이 업무상의 이유로 회사의 거래상대방․외부감사인․대리인, 회사와 법률자문․경영자문 등의 자문계약을 체결하고 있는 자 등에 대하여 불가피하게 내부정보를 제공해야 하는 경우 공시책임자에게 이에 관한 사항을 보고하여야 한다.
- ②제1항의 경우 공시책임자는 관련 내부정보의 비밀유지에 관한 계약을 체결하는 등 필요한 조치를 취하여야 한다.
제3장 내부정보의 공개
- 제9조(공시의 종류)
- 회사의 공시는 다음과 같이 구분한다.
- 1. 공시규정 제1편 제2장 제1절에 따른 주요경영사항 신고 및 공시
- 2. 공시규정 제1편 제2장 제2절에 따른 조회공시
- 3. 공시규정 제1편 제2장 제3절에 따른 공정공시
- 4. 공시규정 제1편 제3장에 따른 자율공시
- 5. 법 제3편 제1장에 따른 증권신고서 등의 제출
- 6. 법 제159조, 제160조 및 제165조와 공시규정 제1편 제2장 제4절에 따른 사업보고서 등의 제출
- 7. 법 제161조에 따른 주요사항보고서의 제출
- 8. 그 밖에 다른 법규에 따른 공시
- 제10조(공시의 실행)
- ①공시담당자는 제9조에 정한 공시사항이 발생한 경우 필요한 내용을 작성하고 필요한 서류 등을 갖추어 공시책임자에게 보고하여야 한다.
- ②공시책임자는 제1항의 내용과 서류 등이 관련법규에 위반되지 않는지의 여부를 검토하여 이를 대표이사에게 보고한 후 공시하여야 한다.
- 제11조(공시 후의 사후조치)
- 공시책임자와 공시담당자는 공시한 내용에 오류나 누락이 있는 경우 지체 없이 이를 시정하기 위한 조치를 취하여야 한다.
- 제12조(언론사의 취재 등)
- ①언론사 등으로부터 회사에 대한 취재요청이 있는 경우 원칙적으로 대표이사 또는 공시책임자가 이에 응한다. 필요한 경우 관련 부서의 임원․직원이 취재에 응하게 할 수 있다.
- ②회사가 언론사 등에 보도자료를 배포하고자 하는 경우 공시책임자와 협의하여야 한다. 공시책임자는 필요한 경우 대표이사에게 보도자료의 배포와 관련된 사항을 보고하여야 한다.
- ③언론의 보도내용이 사실과 다르다는 것을 알게 된 임원․직원은 이를 공시책임자에게 보고하여야 한다. 공시책임자는 관련 사항을 대표이사에게 보고하고 필요한 조치를 취하여야 한다.
- 제13조(기업설명회)
- 회사의 경영내용, 사업계획 및 전망 등에 대한 기업설명회는 공시책임자와 협의하여 개최하여야 한다.
제4장 내부자 거래 등에 대한 규제
- 제14조(단기매매차익의 반환)
- ①임원과 법 제172조제1항 및 법 시행령 제194조가 정하는 직원은 법 제172조제1항의 특정증권등(이하 “특정증권등”이라 한다)을 매수한 후 6개월 이내에 매도하거나 특정증권등을 매도한 후 6개월 이내에 매수하여 이익을 얻은 경우에 그 이익(이하 “단기매매차익”이라 한다)을 회사에 반환하여야 한다.
- ②회사의 주주(주권 외의 지분증권 또는 증권예탁증권을 소유한 자를 포함한다. 이하 이 조에서 같다)가 회사에 대하여 제1항에 따른 단기매매차익을 얻은 자에게 단기매매차익의 반환청구를 하도록 요구한 경우 회사는 그 요구를 받은 날부터 2개월 이내에 필요한 조치를 취하여야 한다.
- ③증권선물위원회가 제1항에 따른 단기매매차익의 발생사실을 회사에 통보한 경우 공시책임자는 지체 없이 다음 각 호의 사항을 회사의 인터넷 홈페이지에 공시하여야 한다.
- 1. 단기매매차익을 반환해야 할 자의 지위
- 2. 단기매매차익 금액
- 3. 증권선물위원회로부터 단기매매차익 발생사실을 통보받은 날
- 4. 단기매매차익 반환 청구 계획
- 5. 회사의 주주가 회사로 하여금 단기매매차익을 얻은 자에게 단기매매차익의 반환청구를 하도록 요구할 수 있으며, 회사가 요구를 받은 날부터 2개월 이내에 그 청구를 하지 아니하는 경우에는 그 주주는 회사를 대위(代位)하여 청구를 할 수 있다는 뜻
- ④제3항의 공시기간은 증권선물위원회로부터 단기매매차익 발생 사실을 통보받은 날부터 2년간 또는 단기매매차익을 반환받은 날 중 먼저 도래하는 날까지로 한다.
- 제15조(특정증권등의 매매 등에 대한 통보)
- 임원과 법 제172조제1항 및 법 시행령 제194조가 정하는 직원은 특정증권등의 매매, 그 밖의 거래를 하는 경우 그 사실을 공시책임자에게 통보하여야 한다.
- 제16조(미공개중요정보의 이용행위 금지)
- 임원․직원은 법 제174조제1항이 정하는 미공개중요정보(계열회사의 미공개중요정보를 포함한다)를 특정증권등의 매매, 그 밖의 거래에 이용하거나 타인에게 이용하게 해서는 아니 된다.
제5장 보 칙
- 제17조(교육)
- 공시책임자와 공시담당자는 공시규정 제36조 및 제44조제5항에 따른 공시업무에 관한 교육 등을 이수하여야 하고, 공시책임자는 교육내용을 관련 임원․직원에게 알려야 한다.
- 제18조(규정의 개폐)
- 이 규정의 개정 또는 폐지는 이사회의 결의로 한다.
- 제19조(규정의 공표)
- 이 규정은 회사의 홈페이지에 공표한다. 규정을 개정한 때에도 또한 같다.
- 부 칙 (2009.09.07)
- 이 규정은 2009년 09월 07일부터 시행한다.
- 부 칙 (2017.02.06)
- 이 규정은 2017년 02월 06일부터 시행한다.

Refusal of email collection without permission

This website refuses to collect email addresses without permission by using email address collecting programs or other technical devices. When violated, please note you are subjected to penal punishment pursuant to the Act of Information and Communication Network.

Privacy Policy

KONA I Co., Ltd. (Hereinafter the “Company”) values the personal information of users and complies with privacy regulations of relevant statutes such as the Personal Information Protection Act. The Company makes its privacy policy available to be viewed via the Company website, among other channels, at all times and, in the event of any revision to the privacy policy, the Company will provide notification regarding the rationale and modifications via an announcement or individual notifications on its website in accordance with the procedures prescribed under relevant statutes.

Article 1 (Personal Information Collected and Method of Collection)
The Company collects the minimal personal information necessary for the provision of the following services:
- 1. Collected items
  - ① Required items: Name, mobile number, email address, and company name
  - ② Optional items: Affiliation and position
- 2. Collection method: Collected via the inquiry menu for the KONA CARD and partnership on the website
Article 2 (Purpose of Collection and Use of Personal Information)
The Company uses the collected personal information for the following purposes:
- 1. Notification of inquiry results for the KONA CARD
- 2. Notification of inquiry results for partnership
Article 3 (Provision of Personal Information to Third Parties)
The Company uses the personal information of users within the scope delineated under Article 2 (Purpose of Collection and Use of Personal Information) above, and, in principle, the Company does not use the information outside of this described scope nor does it provide such information to any external agency without grounds for such provision according to relevant laws or the prior consent the user.
- ① Partnerships
- The Company may provide or share the personal information of users to external subcontractors (hereinafter referred to as “Partners”) so as to render better services to users. In the event that the personal information will be provided or shared, the Company will first obtain prior consent from users via electronic mail or letter by specifying the Partners that will be receiving the information, the provided items of personal information, the purpose of the personal information use by the Partners, the fact that users have the right to refuse to consent to the information provision, and the disadvantages they may face by refusing to consent. If any alteration occurs to the partnership relationship, the Company will notify or obtain user consent via the same procedure.
- ② Grounds according to the law
- If a request is made by an investigatory authority in accordance with the procedures and methods prescribed under the law for investigation purposes or in accordance with the relevant statutes;
- ③ Transfer of the Company's rights and duties
- In the event that the rights and duties of the Company are acquired or transferred due to a merger or transfer of the business, the Company shall notify the transfer of personal information in advance under the procedure and method stipulated in the relevant statutes, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., and grant users the right to withdraw their consent to transfer their personal information.
Article 4 (Outsourcing the Handling Personal Information)

The Company outsources some tasks, which are necessary to provide services, to external Partners (hereinafter referred to as “Outsourcees”), and at the time of an outsourcing contract conclusion, the Company specifies necessary terms and conditions in the contract so as to ensure that personal information is securely handled pursuant to relevant laws, such as the Personal Information Protection Act, and provides supervision to ensure that the Outsourcee securely handles personal information. In the event of any alteration to the details of the outsourced tasks or the Outsourcee itself, the Company shall notify such facts to users without delay via the Privacy Policy posted on the application screen, etc., or via electronic email. As for the outsourcing of giveaway promotional mailing tasks for marketing and events, additional user consent agreements will be obtained in order to handle the information. The tasks currently outsourced are as follows:


Outsourcee	Outsourced tasks	Period of retention and use of personal information
Narae Internet Co., Ltd.	080 ARS block sender	Until the termination of relevant services or the outsourcing contract
humusOn Inc.	SMS/email/notification talk transmission	Until membership cancellation or the termination of the outsourcing contract
BGF Networks Co., Ltd.	SMS transmission	Until membership cancellation or the termination of the outsourcing contract

Article 5 (Period of Retention and Use of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information as consented to by users, the Company shall, as a rule, destroy such information without delay. However, where it is necessary to preserve such information due to internal policies or the provisions in relevant laws, the Company will retain the personal information of users for a certain period provided below:
- 1. Records regarding use of the inquiry board
  - - Reason(s) for preservation: Internal control of answers to inquiries for Company services
  - - Preservation period: 1 year
- 2. Website visiting records
  - - Preservation Grounds: Protection of Communications Secrets Act
  - - Preservation period: 3 months
Article 6 (Destruction of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information, the Company shall, as a rule, destroy such information without delay. The procedure and method of destruction are as follows:
- ① Destruction procedure
- The information entered by users for service subscriptions, etc., is transferred to a separate database (or a separate filing cabinet for paper documents) subsequent to the fulfillment of their purpose and stored for a certain period, as specified under Article 5, for information protection matters pursuant to the Company's internal policies or other pertinent statutes before they are destroyed. The personal information transferred to a separate database shall not be used for any purpose other than its original retention purpose unless otherwise specified under the law.
- ② Destruction method
- Personal information printed on paper is shredded with a shredder or destroyed through incineration. Personal information stored in an electronic file format is deleted using a technical method that does not allow record restoration.
Article 7 (Rights of Users and their Legal Representatives and Methods to Exercise Such Rights)
① Users or their legal representatives may access or modify their own personal information of that or minors less than 14 years of age for which they are responsible at any time, and may withdraw their consent to the collection, use, and provision of the personal information via canceling of the service subscription (membership cancellation). However, as the Company only collects and uses essential information necessary to provide services, partial withdrawal of consent is not possible.
② If a user wishes to cancel their subscription, he/she may directly unsubscribe via the “Membership cancellation” menu in the application, and anyone who finds it difficult to unsubscribe directly via the method in question, he/she may contact customer support or the privacy officer via a letter, telephone call, or electronic mail and prompt measures will be enforced without delay.
③ If a user wishes to access or receive information on the status of the user's consent to the collection, use, and provision of personal information, personal information collected via consent, the use of such personal information, or the status of provision to third parties, the Company will take action without delay once the user contacts customer support or the privacy officer.
④ If a user requests the correction of a personal information error, the personal information shall not be used or provided to any third party until the correction is completed. In addition, in the event that incorrect personal information has already been provided to a third party, the Company will notify the third party of the results of the correction without delay to ensure that the correction is made.
⑤ The Company handles personal information that has been canceled or deleted at the request of users or their legal representatives as specified in Article 5 (Period of Retention and Use of Personal Information) and ensures that such information is not accessed or used for any other purposes.

Article 8 (Installation and Operation of the Automatic Personal Information Collection Device and Pertinent Rejection)
The Company may use cookies that store and retrieve user information from time to time so as to provide personalized and tailored services. A cookie is a very small text file sent to the browser from the server used to operate the service, which is stored on the computer's hard disk or on an internal storage device on other access media (including mobile devices, such as smartphones and tablet PCs). The Company uses cookies for the following purposes, and users may refuse such use via settings.
- ① Purpose of using cookies, etc.
- The Company uses cookies to provide customized information to individuals, such as targeted marketing and personalized services, by analyzing users' frequency of access or visiting hours, identifying users tastes and interests, and tracking their traces to determine their degree of participation in various events, and the number of visits made.
- ② How to reject cookie settings
- A user has options regarding cookie settings. Users may allow all cookies, check each time a cookie is saved, or reject the storage of all cookies by modifying the option settings. However, if the user refuses to install cookies, he/she may have difficulty using the service.
Article 9 (Technical and Administrative Measures to Protect Personal Information)
The Company implements the following technical and administrative measures to ensure stability in handling the personal information of users so that the personal information is not lost, stolen, leaked, tampered with, or damaged.
- ① Encryption of personal information
- The Company encrypts and stores all fields of personal information in accordance with the relevant laws and the guidelines of relevant administrative agencies.
- ② Technical measures against hacking, etc.
- The Company installs and operates intrusion prevention systems and the latest security software to prevent the leakage of users' personal information via hacking of servers, networks, etc.
- ③ Minimal handling staff and implementation of training
- In order to minimize the leakage of users' personal information, the Company makes every effort to minimize the number of employees who have access to personal information by limiting them to those in charge, providing regular training on the importance of security, and verifying the implementation of the Privacy Policy and the compliance by personnel in charge so as to immediately modify and correct any issues upon discovery.
Article 10 (Privacy Officer and Responsible Department)
The Company has designated the following privacy officer and responsible department to protect users’ personal information and handle complaints related to personal information. The Company will take prompt actions and give full answers to any complaints filed by users.
- ① Privacy officer and responsible department
  - - Officer: Kim Nana
    - Responsible department: Business Strategy Group
    - Telephone No.: +82-2-2168-7520
    - Email: myhan@konai.com
- ② Privacy infringement reporting and consultation
- If you need to report or discuss any other personal information infringement related matters, please contact the organization provided below.
  - - Personal Information Infringement Report Center/Personal Information Dispute Mediation Committee (privacy.kisa.or.kr / 118 with no area code)
    - Cybercrime Investigation Division, Supreme Prosecutors’ Office (www.spo.go.kr / 1301 with no area code)
    - Cyber Bureau, National Police Agency (www.ctrc.go.kr / 182 with no area code)
Article 11 (Applicable Scope)
- ① This Privacy Policy is applicable to the scope of services provided by the KONA I website, and the Company's other brand services may be subject to separate privacy policies.
- ② The Company may expose links to a third party's website, application, or data (hereinafter "Application, etc.”) to the users, but in this case, the Company shall not be held liable for the usefulness of the services and data provided by those links as the Company has no control over the external application, and the said application shall not be subject to this Privacy Policy. If a user clicks on the link to go to a third-party application, the privacy policy for the said Application, etc. is unrelated to the Company, thus we request that you please review the policy of the newly visited Application, etc.
Article 12 (Duty to Notify)
- If any modification is to be made to this Privacy Policy, the Company will provide notification of this fact via an announcement on its website at least seven days prior to the revision. However, in the event of any modification to the Privacy Policy in terms of the collection, use, and third-party provision of personal information in which the change is adverse to users, the Company will notify such modification with a grace period of at least thirty days in advance.
- - Notified on: January 20, n_FOOTER_0462020
  - Effective from: February 17, 2020

Privacy Policy

The contents of the personal information processing policy are as follows
Article 1 (Items of Personal Information to be Collected and Used and Methods of Collection)
Article 2 (Purpose of Collection and Use of Personal Information)
Article 3 (Provision of Personal Information to third parties)
Article 4 (Consignment of Personal Information Processing)
Article 5 (Retention and Use Period of Personal Information)
Article 6 (Destruction of Personal Information)
Article 7 (Rights of the User and his/her Legal Representative and Methods of Exercising them)
Article 8 (Installation, Operation, and Refusal of the Automatic Collection Device for Personal Information)
Article 9 (Technical and Administrative Protection Measures for Personal Information)
Article 10 (Person and Department in Charge of Personal Information Protection)
Article 11 (Scope of Application)
Article 12 (Obligation to Notify)

Article 1 (Items of Personal Information to be Collected and Used and Methods of Collection)
The company collects and uses the minimum amount of personal information required for the provision of the service as follows:
- 1. Items to collect and use
  - ① Required items: Name, mobile number, email address, and company name
  - ② Optional items: Affiliation and position
- 2. Collection method: Collected via the inquiry menu for the KONA CARD and partnership on the website
Article 2 (Purpose of Collection and Use of Personal Information)
The Company uses the collected personal information for the following purposes:
- 1. Notification of inquiry results for the KONA CARD
- 2. Notification of inquiry results for partnership
Article 3 (Provision of Personal Information to Third Parties)
The Company uses the personal information of users within the scope delineated under Article 2 (Purpose of Collection and Use of Personal Information) above, and, in principle, the Company does not use the information outside of this described scope nor does it provide such information to any external agency without grounds for such provision according to relevant laws or the prior consent the user.
- ① Partnerships
- The Company may provide or share the personal information of users to external subcontractors (hereinafter referred to as “Partners”) so as to render better services to users. In the event that the personal information will be provided or shared, the Company will first obtain prior consent from users via electronic mail or letter by specifying the Partners that will be receiving the information, the provided items of personal information, the purpose of the personal information use by the Partners, the fact that users have the right to refuse to consent to the information provision, and the disadvantages they may face by refusing to consent. If any alteration occurs to the partnership relationship, the Company will notify or obtain user consent via the same procedure.
- ② Grounds according to the law
- If a request is made by an investigatory authority in accordance with the procedures and methods prescribed under the law for investigation purposes or in accordance with the relevant statutes;
- ③ Transfer of the Company's rights and duties
- If the rights and obligations of the company are inherited or transferred in the case of merger or sale of the company, the company shall notify the transfer of personal information in advance and grant the right of withdrawal of consent for the transfer of user personal information in accordance with procedures and methods established by relevant laws such as the Personal Information Protection Act .
Article 4 (Outsourcing the Handling Personal Information)


Outsourcee	Outsourced tasks	Period of retention and use of personal information
Narae Internet Co., Ltd.	080 ARS block sender	Until the termination of relevant services or the outsourcing contract
humusOn Inc.	SMS/email/notification talk transmission	Until membership cancellation or the termination of the outsourcing contract

Article 5 (Period of Retention and Use of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information as consented to by users, the Company shall, as a rule, destroy such information without delay. However, where it is necessary to preserve such information due to internal policies or the provisions in relevant laws, the Company will retain the personal information of users for a certain period provided below:
- 1. Records regarding use of the inquiry board
  - - Reason(s) for preservation: Internal control of answers to inquiries for Company services
  - - Preservation period: 1 year
- 2. Website visiting records
  - - Preservation Grounds: Protection of Communications Secrets Act
  - - Preservation period: 3 months
Article 6 (Destruction of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information, the Company shall, as a rule, destroy such information without delay. The procedure and method of destruction are as follows:
- ① Destruction procedure
- The information entered by users for service subscriptions, etc., is transferred to a separate database (or a separate filing cabinet for paper documents) subsequent to the fulfillment of their purpose and stored for a certain period, as specified under Article 5, for information protection matters pursuant to the Company's internal policies or other pertinent statutes before they are destroyed. The personal information transferred to a separate database shall not be used for any purpose other than its original retention purpose unless otherwise specified under the law.
- ② Destruction method
- Personal information printed on paper is shredded with a shredder or destroyed through incineration. Personal information stored in an electronic file format is deleted using a technical method that does not allow record restoration.
Article 7 (Rights of Users and their Legal Representatives and Methods to Exercise Such Rights)
① Users or their legal representatives may access or modify their own personal information of that or minors less than 14 years of age for which they are responsible at any time, and may withdraw their consent to the collection, use, and provision of the personal information via canceling of the service subscription (membership cancellation). However, as the Company only collects and uses essential information necessary to provide services, partial withdrawal of consent is not possible.
② If a user wishes to cancel their subscription, he/she may directly unsubscribe via the “Membership cancellation” menu in the application, and anyone who finds it difficult to unsubscribe directly via the method in question, he/she may contact customer support or the privacy officer via a letter, telephone call, or electronic mail and prompt measures will be enforced without delay.
③ If a user wishes to access or receive information on the status of the user's consent to the collection, use, and provision of personal information, personal information collected via consent, the use of such personal information, or the status of provision to third parties, the Company will take action without delay once the user contacts customer support or the privacy officer.
④ If a user requests the correction of a personal information error, the personal information shall not be used or provided to any third party until the correction is completed. In addition, in the event that incorrect personal information has already been provided to a third party, the Company will notify the third party of the results of the correction without delay to ensure that the correction is made.
⑤ The Company handles personal information that has been canceled or deleted at the request of users or their legal representatives as specified in Article 5 (Period of Retention and Use of Personal Information) and ensures that such information is not accessed or used for any other purposes.

Article 8 (Installation and Operation of the Automatic Personal Information Collection Device and Pertinent Rejection)
The Company may use cookies that store and retrieve user information from time to time so as to provide personalized and tailored services. A cookie is a very small text file sent to the browser from the server used to operate the service, which is stored on the computer's hard disk or on an internal storage device on other access media (including mobile devices, such as smartphones and tablet PCs). The Company uses cookies for the following purposes, and users may refuse such use via settings.
- ① Purpose of using cookies, etc.
- The Company uses cookies to provide customized information to individuals, such as targeted marketing and personalized services, by analyzing users' frequency of access or visiting hours, identifying users tastes and interests, and tracking their traces to determine their degree of participation in various events, and the number of visits made.
- ② How to reject cookie settings
- A user has options regarding cookie settings. Users may allow all cookies, check each time a cookie is saved, or reject the storage of all cookies by modifying the option settings. However, if the user refuses to install cookies, he/she may have difficulty using the service.
Article 9 (Technical and Administrative Measures to Protect Personal Information)
The company has implemented the following technical and administrative measures to secure the stability of personal information so that personal information may not be lost, stolen, leaked, falsified or damaged.
- ① Encryption of personal information
- The Company encrypts and stores all fields of personal information in accordance with the relevant laws and the guidelines of relevant administrative agencies.
- ② Technical measures against hacking, etc.
- The Company installs and operates intrusion prevention systems and the latest security software to prevent the leakage of users' personal information via hacking of servers, networks, etc.
- Personnel with access to personal information access and training
- In order to minimize the leakage of users' personal information, the Company makes every effort to minimize the number of employees who have access to personal information by limiting them to those in charge, providing regular training on the importance of security, and verifying the implementation of the Privacy Policy and the compliance by personnel in charge so as to immediately modify and correct any issues upon discovery.
Article 10 (Privacy Officer and Responsible Department)

The Company has designated the following privacy officer and responsible department to protect users’ personal information and handle complaints related to personal information. The Company will take prompt actions and give full answers to any complaints filed by users.

① Privacy officer and responsible department
- [Chief Privacy Officer]
  - Name: Nana Kim
  - Department: Business Management Team
  - Tel: 02 – 2168 - 7500
  - E-mail: privacyofficer@konai.com
  
  [Privacy Manager]
  - Name: Hyunseok Lee
  - Department: Business Management Team
  - Tel: 02 – 2168 - 7500
  - E-mail: privacyofficer@konai.com

② Privacy infringement reporting and consultation
If you need to report or discuss any other personal information infringement related matters, please contact the organization provided below.


Infringement of personal information Call center	Personal Information Dispute Mediation Committee	Supreme Prosecutor's Office Cyber Investigation Division	National Police Agency Cyber Investigation Bureau
(without area code) 118 privacy.kisa.or.kr	1833-6972 www.kopico.go.kr	(without area code) 1301 www.spo.go.kr	(without area code) 182 ecrm.cyber.go.kr

Article 11 (Applicable Scope)
- ① This Privacy Policy is applicable to the scope of services provided by the KONA I website, and the Company's other brand services may be subject to separate privacy policies.
- ② The Company may expose links to a third party's website, application, or data (hereinafter "Application, etc.”) to the users, but in this case, the Company shall not be held liable for the usefulness of the services and data provided by those links as the Company has no control over the external application, and the said application shall not be subject to this Privacy Policy. If a user clicks on the link to go to a third-party application, the privacy policy for the said Application, etc. is unrelated to the Company, thus we request that you please review the policy of the newly visited Application, etc.
Article 12 (Duty to Notify)
- If any modification is to be made to this Privacy Policy, the Company will provide notification of this fact via an announcement on its website at least seven days prior to the revision. However, in the event of any modification to the Privacy Policy in terms of the collection, use, and third-party provision of personal information in which the change is adverse to users, the Company will notify such modification with a grace period of at least thirty days in advance.
- Effective Date: January 03, 2023

Privacy Policy

Article 1 (Personal Information Collected and Method of Collection)
The Company collects the minimal personal information necessary for the provision of the following services:
- 1. Collected items
  - ① Required items: Name, mobile number, email address, and company name
  - ② Optional items: Affiliation and position
- 2. Collection method: Collected via the inquiry menu for the KONA CARD and partnership on the website
Article 2 (Purpose of Collection and Use of Personal Information)
The Company uses the collected personal information for the following purposes:
- 1. Notification of inquiry results for the KONA CARD
- 2. Notification of inquiry results for partnership
Article 3 (Provision of Personal Information to Third Parties)
The Company uses the personal information of users within the scope delineated under Article 2 (Purpose of Collection and Use of Personal Information) above, and, in principle, the Company does not use the information outside of this described scope nor does it provide such information to any external agency without grounds for such provision according to relevant laws or the prior consent the user.
- ① Partnerships
- The Company may provide or share the personal information of users to external subcontractors (hereinafter referred to as “Partners”) so as to render better services to users. In the event that the personal information will be provided or shared, the Company will first obtain prior consent from users via electronic mail or letter by specifying the Partners that will be receiving the information, the provided items of personal information, the purpose of the personal information use by the Partners, the fact that users have the right to refuse to consent to the information provision, and the disadvantages they may face by refusing to consent. If any alteration occurs to the partnership relationship, the Company will notify or obtain user consent via the same procedure.
- ② Grounds according to the law
- If a request is made by an investigatory authority in accordance with the procedures and methods prescribed under the law for investigation purposes or in accordance with the relevant statutes;
- ③ Transfer of the Company's rights and duties
- In the event that the rights and duties of the Company are acquired or transferred due to a merger or transfer of the business, the Company shall notify the transfer of personal information in advance under the procedure and method stipulated in the relevant statutes, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., and grant users the right to withdraw their consent to transfer their personal information.
Article 4 (Outsourcing the Handling Personal Information)


Outsourcee	Outsourced tasks	Period of retention and use of personal information
Narae Internet Co., Ltd.	080 ARS block sender	Until the termination of relevant services or the outsourcing contract
humusOn Inc.	SMS/email/notification talk transmission	Until membership cancellation or the termination of the outsourcing contract
BGF Networks Co., Ltd.	SMS transmission	Until membership cancellation or the termination of the outsourcing contract

Article 5 (Period of Retention and Use of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information as consented to by users, the Company shall, as a rule, destroy such information without delay. However, where it is necessary to preserve such information due to internal policies or the provisions in relevant laws, the Company will retain the personal information of users for a certain period provided below:
- 1. Records regarding use of the inquiry board
  - - Reason(s) for preservation: Internal control of answers to inquiries for Company services
  - - Preservation period: 1 year
- 2. Website visiting records
  - - Preservation Grounds: Protection of Communications Secrets Act
  - - Preservation period: 3 months
Article 6 (Destruction of Personal Information)
Subsequent to the fulfillment of the purpose of the collection and use of personal information, the Company shall, as a rule, destroy such information without delay. The procedure and method of destruction are as follows:
- ① Destruction procedure
- The information entered by users for service subscriptions, etc., is transferred to a separate database (or a separate filing cabinet for paper documents) subsequent to the fulfillment of their purpose and stored for a certain period, as specified under Article 5, for information protection matters pursuant to the Company's internal policies or other pertinent statutes before they are destroyed. The personal information transferred to a separate database shall not be used for any purpose other than its original retention purpose unless otherwise specified under the law.
- ② Destruction method
- Personal information printed on paper is shredded with a shredder or destroyed through incineration. Personal information stored in an electronic file format is deleted using a technical method that does not allow record restoration.
Article 7 (Rights of Users and their Legal Representatives and Methods to Exercise Such Rights)
① Users or their legal representatives may access or modify their own personal information of that or minors less than 14 years of age for which they are responsible at any time, and may withdraw their consent to the collection, use, and provision of the personal information via canceling of the service subscription (membership cancellation). However, as the Company only collects and uses essential information necessary to provide services, partial withdrawal of consent is not possible.
② If a user wishes to cancel their subscription, he/she may directly unsubscribe via the “Membership cancellation” menu in the application, and anyone who finds it difficult to unsubscribe directly via the method in question, he/she may contact customer support or the privacy officer via a letter, telephone call, or electronic mail and prompt measures will be enforced without delay.
③ If a user wishes to access or receive information on the status of the user's consent to the collection, use, and provision of personal information, personal information collected via consent, the use of such personal information, or the status of provision to third parties, the Company will take action without delay once the user contacts customer support or the privacy officer.
④ If a user requests the correction of a personal information error, the personal information shall not be used or provided to any third party until the correction is completed. In addition, in the event that incorrect personal information has already been provided to a third party, the Company will notify the third party of the results of the correction without delay to ensure that the correction is made.
⑤ The Company handles personal information that has been canceled or deleted at the request of users or their legal representatives as specified in Article 5 (Period of Retention and Use of Personal Information) and ensures that such information is not accessed or used for any other purposes.

Article 8 (Installation and Operation of the Automatic Personal Information Collection Device and Pertinent Rejection)
The Company may use cookies that store and retrieve user information from time to time so as to provide personalized and tailored services. A cookie is a very small text file sent to the browser from the server used to operate the service, which is stored on the computer's hard disk or on an internal storage device on other access media (including mobile devices, such as smartphones and tablet PCs). The Company uses cookies for the following purposes, and users may refuse such use via settings.
- ① Purpose of using cookies, etc.
- The Company uses cookies to provide customized information to individuals, such as targeted marketing and personalized services, by analyzing users' frequency of access or visiting hours, identifying users tastes and interests, and tracking their traces to determine their degree of participation in various events, and the number of visits made.
- ② How to reject cookie settings
- A user has options regarding cookie settings. Users may allow all cookies, check each time a cookie is saved, or reject the storage of all cookies by modifying the option settings. However, if the user refuses to install cookies, he/she may have difficulty using the service.
Article 9 (Technical and Administrative Measures to Protect Personal Information)
The Company implements the following technical and administrative measures to ensure stability in handling the personal information of users so that the personal information is not lost, stolen, leaked, tampered with, or damaged.
- ① Encryption of personal information
- The Company encrypts and stores all fields of personal information in accordance with the relevant laws and the guidelines of relevant administrative agencies.
- ② Technical measures against hacking, etc.
- The Company installs and operates intrusion prevention systems and the latest security software to prevent the leakage of users' personal information via hacking of servers, networks, etc.
- ③ Minimal handling staff and implementation of training
- In order to minimize the leakage of users' personal information, the Company makes every effort to minimize the number of employees who have access to personal information by limiting them to those in charge, providing regular training on the importance of security, and verifying the implementation of the Privacy Policy and the compliance by personnel in charge so as to immediately modify and correct any issues upon discovery.
Article 10 (Privacy Officer and Responsible Department)
The Company has designated the following privacy officer and responsible department to protect users’ personal information and handle complaints related to personal information. The Company will take prompt actions and give full answers to any complaints filed by users.
- ① Privacy officer and responsible department
  - - Officer: Kim Nana
    - Responsible department: Business Strategy Group
    - Telephone No.: +82-2-2168-7520
    - Email: myhan@konai.com
- ② Privacy infringement reporting and consultation
- If you need to report or discuss any other personal information infringement related matters, please contact the organization provided below.
  - - Personal Information Infringement Report Center/Personal Information Dispute Mediation Committee (privacy.kisa.or.kr / 118 with no area code)
    - Cybercrime Investigation Division, Supreme Prosecutors’ Office (www.spo.go.kr / 1301 with no area code)
    - Cyber Bureau, National Police Agency (www.ctrc.go.kr / 182 with no area code)
Article 11 (Applicable Scope)
- ① This Privacy Policy is applicable to the scope of services provided by the KONA I website, and the Company's other brand services may be subject to separate privacy policies.
- ② The Company may expose links to a third party's website, application, or data (hereinafter "Application, etc.”) to the users, but in this case, the Company shall not be held liable for the usefulness of the services and data provided by those links as the Company has no control over the external application, and the said application shall not be subject to this Privacy Policy. If a user clicks on the link to go to a third-party application, the privacy policy for the said Application, etc. is unrelated to the Company, thus we request that you please review the policy of the newly visited Application, etc.
Article 12 (Duty to Notify)
- If any modification is to be made to this Privacy Policy, the Company will provide notification of this fact via an announcement on its website at least seven days prior to the revision. However, in the event of any modification to the Privacy Policy in terms of the collection, use, and third-party provision of personal information in which the change is adverse to users, the Company will notify such modification with a grace period of at least thirty days in advance.
- - Notified on: January 20, n_FOOTER_0462020
  - Effective from: February 17, 2020

Our Business

Kona i Value
Kona I Write a history of
digital signatures

Kona Affiliates

Our Business

Kona i ValueKona I Write a history of digital signatures

Kona Affiliates

Kona i Value
Kona I Write a history of
digital signatures