Privacy Policy

1. Personal Information Collected

• Required: Email address, password, name, company name, mobile phone number
• Automatically collected: Service usage records, access logs, cookies, IP address, payment records
• Location data (GPS coordinates & accuracy): collected only at workplaces using GPS check-in and only with the employee's consent
• Additional employee item (optional): the email address entered by an employee who chose to receive estimated-pay notices by email (collected only with the employee’s consent)

2. Purpose of Collection and Use

The Company uses collected personal information for the following purposes:

• Identity verification for service provision, purchases, and payment processing
• Member verification, subscription confirmation, and handling complaints and inquiries
• Service validation, access frequency analysis, and usage statistics
• If an employee opts in, sending estimated-pay (pre-tax, reference-only) notices by email and verifying ownership of the recipient address

3. Retention Period

In principle, personal information is destroyed without delay after the purpose of collection and use has been achieved. However, when required by relevant laws, the Company retains member information for the period prescribed by law as follows:

• Records of contracts or subscription withdrawals: 5 years (E-Commerce Act)
• Records of payment and supply of goods: 5 years (E-Commerce Act)
• Records of consumer complaints or dispute resolution: 3 years (E-Commerce Act)
• Login records: 3 months (Communications Secrets Protection Act)
• Work and wage records (attendance logs, payroll ledger): 5 years (based on the tax-law retention period for withholding evidence; the longer of the Labor Standards Act wage-ledger retention of 3 years and the tax-law retention of 5 years is adopted)
• Dormant company and account information: automatically destroyed after 5 years with no activity such as login, attendance, or payment
• Employee email (when opted in to estimated-pay notices): retained while consent is maintained, and destroyed without delay upon unsubscribe, departure, or expiry of the retention period
• Employee check-in authentication cookie: valid for 7 days from last issuance or renewal (issued on authentication, auto-renewed on each successful attendance record), up to a maximum of 90 days from initial authentication. To explain the reason for expiry, the signed cookie containing an employee identifier and invite code may remain in the browser for up to 97 days from last issuance or renewal; the server never accepts expired cookies for authentication
• Store display mode cookie (contains company and device identifiers): retained for up to 3 years from issuance; once the owner revokes display mode entirely, previously issued cookies are no longer accepted for authentication
• Login session cookie (owner and expert accounts): expires after 30 days of inactivity from last use. Other temporary cookies used during authentication expire within 1 hour at most or are deleted when the browser is closed

4. Destruction Procedures and Methods

The Company destroys personal information without delay after the purpose of collection and use has been achieved. Electronic files are deleted using technical methods that prevent data recovery.

5. Privacy Officer

The Company has designated a privacy officer to protect customer personal information and handle related complaints:

6. Provision to Third Parties

As a rule the Company does not provide users' personal data to outside parties. However, when a member (employer) connects with an expert such as a tax accountant or labor attorney and consents to data sharing, the employee's attendance and payroll data is provided to that expert. Sharing follows the member's consent and stops upon withdrawal of consent.

7. Consignment of Personal Data Processing

To provide the service smoothly, the Company consigns personal-data processing as below. Some processors are located overseas, so personal data may be processed and stored abroad.

• PortOne: payment processing
• Amazon Web Services (overseas): data storage and backup
• Sentry (overseas): error diagnostics and service-stability analysis (screen/input information may be included when an error occurs)
• Email delivery service: sending notification and verification emails
• Telegram (overseas): operator notifications (name, email, and phone number are included on sign-up)
• Google Analytics (overseas): usage statistics (collected only with cookie consent)

8. Rights of Data Subjects and How to Exercise Them

Users and employees may at any time request access, correction, deletion, or suspension of processing of their personal data. Employees may exercise these rights through their company (employer) or customer support, and the Company will act without delay.

9. Measures to Ensure the Security of Personal Information

Pursuant to Article 29 of the Personal Information Protection Act, the Company takes the following security measures.

• Administrative: establishing and implementing an internal management plan, minimizing staff who handle personal data, and providing regular training.
• Technical: managing access privileges to the personal information processing system, installing access-control systems, encrypting passwords and unique identifiers, and installing/updating security software.
• Physical: access control to systems and storage areas where personal data is kept.

10. Remedies for Infringement of Rights

Data subjects may contact the following bodies for relief or counseling regarding personal-data infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office Cyber Investigation: 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)