Privacy Policy
Privacy Policy
Privacy Policy (effective March 2025)
This English translation is provided for reference. The Korean version prevails.
Yonsei University Sangnam Institute of Management Privacy Policy
Sangnam Institute of Management, attached to the Yonsei University Graduate School of Business (“Sangnam”), establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
Article 1. Purposes of processing personal information
Sangnam processes personal information only in accordance with laws and regulations and with the consent of data subjects. The personal information we process is not used for any purpose other than those below. If a purpose changes, we will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act. The purposes of the personal information files that Sangnam registers and discloses under Article 32 of the Act are as follows.
| Personal information file | Legal basis | Purpose | Retention period |
|---|---|---|---|
| Sangnam program participants’ academic records | Article 4 (school rules) and Article 73 (processing of unique identifying information) of the Enforcement Decree of the Higher Education Act / university academic administration / consent of the data subject | Academic management and administration | Semi-permanent |
| Sangnam guest management | Consent of the data subject | Guest management | 3 years after the end of the relevant service |
| Sangnam facility management | Consent of the data subject | Facility rental management | 3 years after the end of the relevant service |
※ Other registered personal information files of Sangnam can also be found on the Personal Information Protection Portal of the Ministry of the Interior and Safety (www.privacy.go.kr): Personal information requests → Requests to access personal information → Search the list of personal information files → enter Yonsei University (in Korean) as the institution name.
Article 2. Processing and retention period
① Sangnam processes and retains personal information within the retention and use period set by law or agreed to by the data subject when the information was collected.
② The processing and retention period for each item of personal information is as stated in the personal information files in Article 1.
Article 3. Items of personal information processed
Sangnam processes only the minimum personal information that is required by law or needed to perform its duties. The items processed are as stated in the personal information files in Article 1.
| Personal information file | Items of personal information recorded |
|---|---|
| Sangnam website member management | Program, name, name in English, gender, date of birth, email, mobile phone, mailing address, photo, employment information, highest level of education, additional information, academic and completion records |
| Sangnam guest management | Booking information, payment method, recommender information, name of the person booking, their email and phone number, user information (when the user is different from the person booking), purpose of use, organizing department, event name, list of users, other requests |
| Sangnam facility management | Booking information, payment method, recommender information, name of the person booking, their email and phone number, user information (when the user is different from the person booking), purpose of use, organizing department, event name, event program, other requests |
Article 4. Provision of personal information to third parties
① Personal information processed by Sangnam is used only for the purposes stated in Article 1 and is not provided to third parties.
② Sangnam may use personal information for purposes other than those of the personal information file, or provide it to other institutions, in the following cases, except where this is likely to unfairly infringe the rights and interests of the data subject or a third party.
- Provision to a foreign government or international organization to implement a treaty or other international agreement
- Provision in a form that does not identify a specific individual, for purposes such as compiling statistics
- Where the data subject or their legal representative cannot express their intention, or cannot give consent because their address is unknown, and provision to a person other than the data subject is clearly in the data subject’s interest
- Where necessary to investigate a crime or to file and maintain a prosecution
- Where necessary for a court to conduct trial proceedings
- Where approved after deliberation by the Personal Information Protection Commission under Article 7(1) of the Personal Information Protection Act
Article 5. Entrustment of personal information processing
① When concluding an entrustment contract, Sangnam specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters of responsibility such as the prohibition of processing personal information beyond the purpose of the entrusted work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages, and supervises whether the trustee processes personal information safely.
② If the entrusted work or the trustee changes, we will disclose this without delay through this Privacy Policy.
③ Sangnam entrusts the processing of personal information as follows.
| Trustee | Entrusted work |
|---|---|
| Berisoft | Website and system maintenance |
| Oasis Story Co., Ltd. | Lease and maintenance of the room booking system |
| Industrial Education Research Institute | Outsourced operation of education programs |
Article 6. Rights and obligations of data subjects and how to exercise them
① Data subjects (or their legal representatives, if they are under 14) may exercise the following rights related to personal information protection at any time.
1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
② The rights in paragraph 1 can be exercised by completing the attached form “Request for access, correction, deletion or suspension of processing of personal information” and submitting it in writing, by email or by fax.
▶ Request form for access, correction, deletion or suspension of processing (in Korean)
③ If a data subject requests correction or deletion of errors in their personal information, we will not use or provide that personal information until the processing is completed. If incorrect personal information has already been used or provided, we will correct it without delay.
④ The rights in paragraph 1 may be exercised through a representative, such as the data subject’s legal representative or a person delegated by the data subject. In this case, the attached power of attorney must be submitted.
▶ Power of attorney (in Korean)
⑤ The right to request access and suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
⑥ Deletion of personal information cannot be requested where another law specifies that personal information as subject to collection.
⑦ When a request for access, correction or deletion, or suspension of processing is made, we check whether the person making the request is the data subject or a legitimate representative.
1. Identity is verified by checking an identity document such as a resident registration card, driver’s license or passport, or an accredited certificate.
2. For requests made through a representative, we confirm that the representative is legitimately delegated by receiving the data subject’s power of attorney together with a certificate of seal impression or a copy of an identity document such as a resident registration card, driver’s license or passport.
⑧ When we receive a request for access, correction, deletion or suspension of processing, we process it within 10 days of receiving the request form and notify the data subject of the result. If access is postponed or refused for reasons set out in the Personal Information Protection Act, we send the reasons and how to object in a notice of access, partial access, postponement or refusal. If access is refused without a justifiable reason, you may object to the Chief Privacy Officer.
⑨ Personal information deleted at the request of the data subject is handled according to the destruction procedures and methods in Article 9.
Article 7. Department handling requests for access
① Data subjects may request access to personal information under Article 35 of the Personal Information Protection Act from the following department.
| Personal information file | Department | Phone / email |
|---|---|---|
| Sangnam website member management | Administration Office, Sangnam Institute of Management | +82-2-2123-4273 / sangnam@yonsei.ac.kr |
| Sangnam academic management | Administration Office, Sangnam Institute of Management | +82-2-2123-4273 / sangnam@yonsei.ac.kr |
② In addition to the department above, data subjects may request access through the Personal Information Protection Portal of the Ministry of the Interior and Safety (www.privacy.go.kr).
▶ Personal Information Protection Portal → Personal information requests → Requests to access personal information (real-name verification through public i-PIN required)
Article 8. Devices that automatically collect personal information
The Sangnam website does not use cookies that store and retrieve usage information in order to provide individually customized services.
Article 9. Destruction of personal information
① In principle, Sangnam destroys personal information without delay once the purpose of processing has been achieved.
② If personal information must be kept under other laws even though the retention period agreed to by the data subject has passed or the purpose of processing has been achieved, the personal information (or personal information file) is moved to a separate database or stored in a different place, and the legal basis for keeping it is posted on the website.
③ The procedures and methods of destruction are as follows.
1. Procedure
Unnecessary personal information and personal information files are handled as follows under the responsibility of the Chief Privacy Officer, in accordance with internal guidelines and procedures.
○ Destruction of personal information: personal information whose retention period has passed is destroyed without delay from the end date.
○ Destruction of personal information files: when a personal information file is no longer needed because its purpose has been achieved or the relevant work has ended, the file is destroyed without delay from the date on which processing is recognized as unnecessary.
2. Method
○ Personal information in electronic form is destroyed by technical methods that make the records unrecoverable.
○ Personal information printed on paper is destroyed by shredding or incineration.
Article 10. Measures to ensure the security of personal information
In accordance with Article 29 of the Personal Information Protection Act, Sangnam takes the following technical, administrative and physical measures needed to ensure the security of personal information.
- Establishing and implementing an internal management plan: we establish and implement an internal management plan for the safe processing of personal information.
- Minimizing and training personal information handlers: staff who handle personal information are designated and managed only to the extent necessary and receive training on safe management.
- Restricting access to personal information: we take the measures necessary to control access by granting, changing and revoking access rights to the database systems that process personal information, and we use an intrusion prevention system to control unauthorized access from outside.
- Keeping access records and preventing forgery: records of access to personal information processing systems are kept and managed for at least six months, and security functions are used to prevent forgery, alteration, theft or loss of the records.
- Encrypting personal information: data subjects’ unique identifying information and passwords are encrypted. Important data is also protected by additional security functions, such as encryption when stored and transmitted.
- Technical measures against hacking: to prevent leakage or damage of personal information through hacking or computer viruses, we install security programs, update and check them regularly, place systems in areas with controlled access from outside, and monitor and block access technically and physically.
- Controlling access by unauthorized persons: the personal information systems are kept in a separate physical location, and access-control procedures are established and operated for it.
Article 11. Chief Privacy Officer and contact
① Sangnam has designated the following Chief Privacy Officer and staff member to take overall responsibility for the processing of personal information and to handle complaints and remedies of data subjects related to personal information processing.
| Chief Privacy Officer, Yonsei University Sangnam Institute of Management | Privacy staff member, Yonsei University Sangnam Institute of Management |
|---|---|
| Name: Se-Bum Park Title: Dean, Sangnam Institute of Management Contact: +82-2-2123-4260, seapark@yonsei.ac.kr | Department: Administration Office, Sangnam Institute of Management Staff member: Deok-Gyu Heo Contact: +82-2-2123-4273, sangnam@yonsei.ac.kr |
② Please direct all inquiries, complaints and requests for remedies related to personal information protection arising from your use of the Sangnam website to the Chief Privacy Officer and staff member above.
Article 12. Remedies for infringement of rights
① To seek remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and other organizations.
② The following organizations are separate from Yonsei University. Please contact them if you are not satisfied with the results of Yonsei University’s own handling of complaints and remedies, or if you need more help.
▶ Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
▶ Personal Information Infringement Report Center: 118, no area code (privacy.kisa.or.kr)
▶ Cyber Investigation Division, Supreme Prosecutors’ Office: 1301, no area code (www.spo.go.kr)
▶ Cyber Bureau, Korean National Police Agency: 182, no area code (cyberbureau.police.go.kr)
Article 13. Changes to this Privacy Policy
① This Privacy Policy applies from 23 April 2021. If content is added, deleted or corrected because of changes in laws or policy, we will announce the changes in website notices from 7 days before they take effect.
② Previous versions of the Privacy Policy can be found in the version list.
Names of people and companies are romanized for reference. See the Korean version for the official names.