Privacy policy

명인랜드 (hereinafter the "Company") has established the following processing policy in accordance with the Personal Information Protection Act in order to protect users' personal information and their rights and interests, and to handle users' grievances relating to personal information smoothly.

Where the Company amends this Privacy Policy, it will give notice thereof through its internet shopping mall (https://boardgame.shockping.com) and mobile application (hereinafter collectively the "Site, etc.").

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information processed will not be used for any purpose other than the following, and prior consent will be sought where the purpose of use changes.

(a) Membership registration and management on the Site, etc.

Personal information is processed for purposes such as confirming the intention to register as a member, identification and authentication of the individual for the provision of membership services, maintenance and management of membership, identity verification under the limited identity verification system, prevention of fraudulent use of the services, delivery of various notices and notifications, handling of grievances, and retention of records for dispute mediation.

(b) Provision of goods or services

Personal information is processed for purposes such as delivery of goods, provision of services, sending of invoices, provision of content, provision of customized services, identity authentication, and payment and settlement of charges.

(c) Use for marketing and advertising

Personal information is processed for purposes such as development of new services (products) and provision of customized services, provision of event and advertising information and of opportunities to participate, provision of services and placement of advertisements based on demographic characteristics, verification of the effectiveness of services, identification of access frequency, and compilation of statistics on members' use of the services.

2. Items of Personal Information Collected and Methods of Collection

(a) Items of personal information collected

The Company collects the following minimum personal information as mandatory items for membership (or service) registration, smooth customer consultation, the provision of various services and the like.

(b) Methods of collection

1) Personal information may be collected through the Site, etc., written forms, fax, telephone, consultation boards, e-mail, event entries, delivery requests, and provision by partner companies.

2) The following information may be automatically generated or additionally collected in the course of using the services or processing the provision of services.

- IP Address, cookies, access logs, date and time of visits, service use records, records of improper use

3) In the course of using advertising or online services within the Company's marketing center, the following information may be additionally collected, but only from users of specific services.

- Where consent to the additional collection of personal information is obtained

4) Where identity verification is required for compliance with relevant laws when using the services, the following information may be collected.

- Name, date of birth, gender, duplicate registration verification information (DI), encrypted unique personal identification information (CI), mobile phone number (optional), domestic/foreign national status

5) The following payment information may be collected in the course of using paid services.

- For credit card payments: name of card issuer, card number, etc.

- For mobile phone payments: mobile phone number, carrier, payment approval number, etc.

- For account transfers: name of bank, account number, etc.

3. Processing and Retention Period of Personal Information

(a) Processing of personal information

The Company processes and retains personal information within the period of retention and use of personal information prescribed by law or the period of retention and use of personal information consented to by the data subject at the time of collection.

(b) Retention period of personal information

1) Records on contracts, withdrawal of orders, etc.: 5 years

2) Records on payment and the supply of goods, etc.: 5 years

3) Records on consumer complaints or dispute resolution: 3 years

4) Records on labeling/advertising: 6 months

5) Books and supporting documents for all transactions prescribed by tax laws: 5 years

6) Records on electronic financial transactions: 5 years

7) Financial transaction information: 5 years

8) Records on website visits: 3 months

4. Provision of Personal Information to Third Parties

The Company provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as where the data subject has consented or where there are special provisions in law. In addition, where a Buyer Member has purchased, or intends to purchase, goods from the individual mall of a particular Seller Member, the Company provides the necessary information of the relevant Buyer Member to that Seller Member within the scope of the purpose of sending information for marketing and promotion.

5. Rights and Obligations of Data Subjects and Methods of Exercise

(a) Rights of data subjects

Data subjects may at any time exercise the following rights relating to the protection of personal information against the Company.

1) Request for access to personal information

2) Request for correction in the case of errors, etc.

3) Request for deletion

4) Request for suspension of processing

(b) Method of exercise

The rights under the preceding paragraph may be exercised in writing or by e-mail using Form No. 8 annexed to the Enforcement Rule of the Personal Information Protection Act, and the Company will take action thereon without delay.

(c) Correction or deletion

Where a data subject requests the correction or deletion of errors or the like in personal information, the Company will not use or provide the relevant personal information until the correction or deletion has been completed.

(d) Exercise through a representative

The rights under paragraph (a) may be exercised through a representative, such as the legal representative of the data subject or a person authorized by the data subject. In this case, a power of attorney prepared in accordance with Form No. 11 annexed to the Enforcement Rule of the Personal Information Protection Act must be submitted.

6. Destruction of Personal Information

In principle, the Company destroys personal information without delay once the purpose of processing the personal information has been achieved. The procedure, deadline and method of destruction are as follows.

(a) Destruction procedure

Information entered by users is transferred to a separate DB after the purpose has been achieved, and is destroyed either after being stored for a certain period in accordance with internal policies and other relevant laws, or immediately. Personal information transferred to the DB is not used for any other purpose except as required by law.

(b) Destruction deadline

Users' personal information is destroyed within 5 days from the end of the retention period where the retention period of the personal information has expired, and, where the personal information becomes unnecessary due to the achievement of the purpose of processing, the discontinuation of the relevant service, the termination of business or the like, within 5 days from the date on which the processing of the personal information is deemed unnecessary.

(c) Destruction method

Information in the form of electronic files is destroyed using technical methods that make it impossible to reproduce the records. Personal information printed on paper is destroyed by shredding or incineration.

7. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative and physical measures necessary to ensure security.

(a) Minimization and training of staff handling personal information

The Company designates the staff who handle personal information and limits them to the persons in charge, thereby keeping their number to a minimum, and implements measures to manage personal information accordingly.

(b) Technical measures against hacking, etc.

In order to prevent the leakage and damage of personal information caused by hacking, computer viruses or the like, the Company installs security programs, updates and inspects them periodically, installs its systems in areas where access from outside is controlled, and monitors and blocks access by technical and physical means.

(c) Encryption of personal information

Among users' personal information, passwords are encrypted when stored and managed so that only the users themselves know them, and for important data, separate security functions are used, such as encrypting files and transmitted data or using file lock functions.

(d) Restriction of access to personal information

The Company takes the measures necessary to control access to personal information by granting, changing and revoking access rights to the database systems that process personal information, and controls unauthorized access from outside by means of an intrusion prevention system.

8. Personal Information Protection Officer

The Company has designated a Personal Information Protection Officer as set out below to take overall responsibility for matters relating to the processing of personal information and to handle complaints of, and provide redress for damage to, data subjects in connection with the processing of personal information. Data subjects may direct all inquiries, complaints, requests for redress and other matters relating to the protection of personal information arising from their use of the Company to the Personal Information Protection Officer and the department in charge. The Company will respond to and handle data subjects' inquiries without delay.

- Personal Information Protection Officer

Name: 서경호

Position: CEO

Contact: 031-422-7015

9. Remedies for Infringement of Rights and Interests

If you need to report, or seek advice on, any other infringement of personal information, please contact the following organizations.

Personal Information Dispute Mediation Committee (www.1336.or.kr / 1336)

Information Protection Mark Certification Committee (www.eprivacy.or.kr / 02-580-0533~4)

Internet Crime Investigation Center, Supreme Prosecutors' Office (http://icic.sppo.go.kr / 02-3480-3600)

Cyber Terror Response Center, Korean National Police Agency (www.ctrc.go.kr / 02-392-0330)

10. Changes to the Privacy Policy

This Privacy Policy applies from its effective date, and where there are any additions, deletions or corrections in accordance with laws and policies, notice thereof will be given through the announcements from 7 days before the changes take effect.