Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed is not used for any purpose other than the following, and if the purpose of use is changed, the Company will take the necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.

1. Website membership registration and management
   The Company processes personal information for the purposes of confirming the intent to register as a member, identifying and authenticating the individual in connection with the provision of membership services, maintaining and managing membership status, verifying identity under the limited identity verification system, preventing fraudulent use of services, confirming whether the consent of a legal representative has been obtained when processing the personal information of a child under 14 years of age, giving various notices and notifications, and handling grievances.
2. THE SHARP Ribbon
   THE SHARP Ribbon is a service that manages, in an app, information examined and measured by InBody and blood pressure monitor devices.
3. Provision of goods or services
   The Company processes personal information for the purposes of delivery of goods, provision of services, dispatch of contracts and invoices, provision of content, provision of customized services, identity verification, age verification, payment and settlement of fees, and debt collection.
4. Grievance handling
   The Company processes personal information for the purposes of verifying the identity of the complainant, confirming the details of the complaint, contacting and notifying the complainant for fact-finding, and notifying the complainant of the result of processing.

Article 2 (Processing and Retention Period of Personal Information)

①The Company processes and retains personal information within the retention and use period of personal information prescribed by statute, or within the retention and use period consented to by the data subject at the time the personal information was collected.

②The processing and retention period for each category of personal information is as follows.

1. Website membership registration and management: until withdrawal from the business/organization website
   
   However, in cases falling under any of the following grounds, until the end of the relevant period

   • Where an investigation or inquiry into a violation of relevant statutes is in progress, until that investigation or inquiry is concluded
   • Where a creditor-debtor relationship arising from use of the website remains, until that creditor-debtor relationship is settled
2. THE SHARP Ribbon
   
   • Items collected: membership number or mobile phone number, name, gender, date of birth, age, email, address, height, weight, InBody examination information, medical history, fingerprint
   • Purpose of collection and use: member identification, cumulative body composition analysis, and related services
   • Retention and use period: until withdrawal of membership
   • Method of collection: entered directly by the individual in the THE SHARP Ribbon app, with the data subject’s consent to the collection of personal information
3. Provision of goods or services: until the supply of the goods or services is completed and payment and settlement of fees are completed
   
   However, in cases falling under any of the following grounds, until the end of the relevant period

   • Records on transactions, such as labeling and advertising and the terms and performance of contracts, under the Act on the Consumer Protection in Electronic Commerce, Etc.
     – Records on labeling and advertising: 6 months
     – Records on contracts or withdrawal of subscription, payment, and supply of goods, etc.: 5 years
     – Records on consumer complaints or dispute handling: 3 years
   • Retention of communication confirmation data under Article 41 of the Protection of Communications Secrets Act
     – Date and time of a subscriber’s telecommunications, start and end times, the other party’s subscriber number, frequency of use, and location tracking data of the transmitting base station: 1 year
     – Computer communications, Internet log records, and access point tracking data: 3 months

Article 3 (Provision of Personal Information to Third Parties)

①The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only where the case falls under Article 17 of the Personal Information Protection Act or the Credit Information Use and Protection Act, such as with the consent of the data subject or under special provisions of statute.

Article 4 (Consignment and Re-consignment of Personal Information Processing)

①For the smooth handling of personal information tasks, the Company consigns personal information processing tasks as follows.

②The Company re-consigns some of the personal information processing tasks consigned to it by other personal information controllers, as follows.

③Where the Company re-consigns personal information processing tasks, it obtains the prior consent of the original consignor pursuant to Article 26 (6) of the Personal Information Protection Act.

④When concluding a consignment or re-consignment contract, the Company specifies in the contract or other document, pursuant to Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing personal information for any purpose other than performing the consigned tasks, measures to ensure safety such as restrictions on access to personal information, restrictions on re-consignment, inspection and supervision of the status of personal information management, and liability for damages arising from the consignee’s breach of its obligations.

⑤The Company regularly inspects and supervises whether consignees and re-consignees process personal information safely, and where the content of the consigned or re-consigned tasks or the consignee or re-consignee changes, the Company will disclose this without delay through this privacy policy.

Article 5 (Rights and Obligations of Data Subjects and Methods of Exercising Them)

①A data subject may exercise the following rights relating to the protection of personal information against the Company at any time.

1. Request to access personal information
2. Request for correction where there is an error or the like
3. Request for deletion
4. Request to suspend processing

②The rights under Paragraph 1 may be exercised against the Company in writing, by telephone, by email, or by facsimile (FAX), and the Company will act on them without delay.

③Where a data subject requests the correction or deletion of an error or the like in personal information, the Company does not use or provide the personal information concerned until the correction or deletion is completed.

④The rights under Paragraph 1 may be exercised through an agent, such as the data subject’s legal representative or a person duly authorized by the data subject. In such a case, a power of attorney in the form of Attached Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤A data subject must not infringe, in violation of the Personal Information Protection Act or other relevant statutes, the personal information or privacy of the data subject himself or herself or of another person that is being processed by the Company.

Article 6 (Items of Personal Information Processed)

The Company processes the following items of personal information.

1. Website product inquiries and partnership inquiries
   Required items: name, contact number, e-mail
2. THE SHARP Ribbon
   Membership number or mobile phone number, name, gender, date of birth, age, email, address, height, weight, InBody examination information, blood pressure, medical history, fingerprint
3. Provision of goods or services
   Required items: name, date of birth, ID, password, address, telephone number, email address, i-PIN number, credit card number, bank account information, and other payment information
4. Course of using Internet services
   IP address, cookies, MAC address, service use records, visit records, records of improper use, etc.

Article 7 (Destruction of Personal Information)

①Where personal information becomes unnecessary, such as upon the expiration of the retention period or the achievement of the processing purpose, the Company destroys the personal information concerned without delay.

②Where personal information must continue to be preserved under another statute even though the retention period consented to by the data subject has expired or the processing purpose has been achieved, the Company moves the personal information concerned to a separate database (DB) or preserves it in a different storage location.

③The procedure and method for destroying personal information are as follows.

1. Destruction procedure : The Company selects the personal information for which a ground for destruction has arisen and destroys the personal information with the approval of the Company’s personal information protection officer.
2. Destruction method : Personal information recorded and stored in the form of electronic files is destroyed using a method such as a low level format so that the records cannot be reproduced, and personal information recorded and stored on paper documents is destroyed by shredding with a shredder or by incineration.

Article 8 (Measures to Ensure the Safety of Personal Information)

The Company takes the following measures to ensure the safety of personal information.

1. Administrative measures : Establishment and implementation of an internal management plan, regular employee training, etc.
2. Technical measures : Management of access rights to the personal information processing system and the like, installation of an access control system, encryption of unique identifying information and the like, installation of security programs
3. Physical measures : Access control for the computer room, the document storage room, etc.

Article 9 (Installation and Operation of Devices That Automatically Collect Personal Information, and Refusal Thereof)

Uracle does not use “cookies,” which store and repeatedly retrieve the usage information of data subjects.

Article 10 (Personal Information Protection Officer)

①The Company designates a personal information protection officer as set out below, who takes overall responsibility for tasks relating to the processing of personal information and who handles complaints from data subjects and provides remedies for damage in connection with the processing of personal information.

②A data subject may direct to the personal information protection officer and the department in charge any matter relating to personal information protection inquiries, complaint handling, remedies for damage, and the like that arises while using the Company’s services (or business). The Company will answer and handle data subjects’ inquiries without delay.

Article 11 (Request to Access Personal Information)

A data subject may file a request to access personal information under Article 35 of the Personal Information Protection Act with the department below. The Company will endeavor to process data subjects’ requests to access personal information promptly.

Article 12 (Remedies for Infringement of Rights and Interests)

A data subject may contact the organizations below regarding remedies for damage caused by personal information infringement, counseling, and the like. The organizations below are separate from the Company; please contact them if you are not satisfied with the Company’s own handling of personal information complaints or its remedies for damage, or if you need more detailed assistance.

Article 13 (Installation and Operation of Video Information Processing Devices)

①The Company installs and operates video information processing devices as set out below.

1. Grounds and purpose of installation : Safety of the Company’s facilities and fire prevention
2. Number of devices installed, installation locations, and filming scope : 3 devices installed at key facilities such as the building lobby and parking lot and the exterior of the 4th floor; the filming scope covers the entire area of the key facilities
3. Person responsible for management, department in charge, and person with access rights to the video information : Kiyoung Kim, Deputy General Manager, General Affairs & Purchasing Team
4. Filming hours, retention period, storage location, and processing method : Filmed 24 hours a day, retained for 30 days from the time of filming, stored and processed in the equipment room of the General Affairs & Purchasing Team
5. Method and place for checking video information : Request to the person responsible for management
6. Measures in response to a data subject’s request to access video information and the like : An application must be made using a request form for access to, or confirmation of the existence of, personal video information; access is permitted only where the data subject himself or herself was filmed, or where it is clearly necessary for the life, body, or property interests of the data subject
7. Technical, administrative, and physical measures to protect video information : Establishment of an internal management plan, access control and restriction of access rights, application of technology for the safe storage and transmission of video information, retention of processing records and measures to prevent forgery and alteration, provision of storage facilities and installation of locking devices, etc.

Article 14 (Changes to the Privacy Policy)