Privacy Policy

1. Purposes of Processing Personal Information

Andineering (the "Company") processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those listed below. If the purposes change, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

• Providing services and fulfilling contracts: providing services, content, and personalized services
• Member management: verifying identity for membership services, identifying individuals, and preventing misuse by members
• Handling customer inquiries and complaints: responding to inquiries and resolving customer complaints
• Marketing and advertising: developing new services, providing personalized services, and providing information about events and promotions

2. Processing and Retention Periods

The Company processes and retains personal information within the retention and use periods prescribed by law or agreed to by the data subject when the information is collected.

• Membership registration and management: until membership withdrawal (if an investigation into a violation of applicable laws is ongoing, until the investigation is completed)
• Customer inquiries and complaints: from receipt of an inquiry until three years after its resolution
• Marketing and advertising: until membership withdrawal or withdrawal of consent

3. Categories of Personal Information Processed

The Company processes the following categories of personal information.

• Required information: email address, name, and service usage records
• Optional information: profile information and contact details
• Automatically collected information: IP address, cookies, access logs, and device information

4. Disclosure of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Section 1 (Purposes of Processing Personal Information). It discloses personal information to third parties only in circumstances covered by Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under specific legal provisions.

5. Outsourcing of Personal Information Processing

The Company outsources the following personal information processing activities to facilitate its operations.

• Cloud services: AWS, Vercel, and others (service operation and data storage)
• Email delivery: Resend (email delivery services)

When entering into outsourcing agreements, the Company documents matters required by Article 26 of the Personal Information Protection Act, including prohibitions on processing personal information for purposes other than the outsourced work, technical and administrative safeguards, restrictions on subcontracting, management and supervision of processors, and liability for damages. The Company supervises processors to ensure that they process personal information securely.

6. Rights and Obligations of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights concerning the protection of personal information with the Company at any time.

• The right to request suspension of personal information processing
• The right to request access to personal information
• The right to request correction or deletion of personal information
• The right to request suspension of personal information processing

You may exercise these rights by contacting the Company in writing, by telephone, or by email. The Company will act without delay.

7. Destruction of Personal Information

The Company destroys personal information without delay when it is no longer needed, such as when its retention period has expired or the purpose of processing has been fulfilled. The procedures and methods are as follows.

• Destruction procedure: the Company identifies personal information that is due for destruction and destroys it with approval from its personal information protection officer.
• Destruction method: information stored in electronic files is deleted using technical methods that prevent the records from being restored.

8. Personal Information Protection Officer

The Company has designated a personal information protection officer as follows to oversee personal information processing and handle complaints and remedies relating to the processing of personal information.

9. Measures to Safeguard Personal Information

The Company takes the following measures to safeguard personal information.

• Administrative measures: establishing and implementing internal management plans, regular employee training, and other measures
• Technical measures: managing access rights to personal information processing systems, installing access control systems, encrypting unique identifying information and other data, and installing security software
• Physical measures: controlling access to computer rooms, record storage rooms, and similar facilities

10. Changes to This Privacy Policy

This Privacy Policy takes effect on January 1, 2025. If provisions are added, deleted, or amended due to changes in laws or policies, notice will be provided through announcements beginning seven days before the changes take effect.