Privacy Policy

1. What we collect and how

We collect only what you enter yourself through the enquiry form on this website. There is no account registration, no résumé upload, and no payment function.

Required — name (first and last), email address, area of interest, and your message.

Optional — company, job title, phone number, country, industry, and marketing consent.

The message field is free text, so anything you write there is collected and stored along with it. Please do not include personal information that is not needed for us to answer you.

Some information is generated automatically as you use the site, without you entering it — your IP address, device information (browser and operating system), and the time of access. See section 9 for details.

2. Why we process it

Responding to enquiries — to answer questions about our products, technology, partnerships, and hiring, and to send the materials you ask for.

Marketing communications — only if you separately consent, we send company news and product information by email. Declining does not affect our response to your enquiry in any way.

Keeping the service reliable — we process access records to block spam and abusive access and to diagnose system errors.

We do not use personal information for any purpose beyond those listed above. If the purpose changes, we will obtain your consent beforehand.

3. How long we keep it

Enquiry information (name, email, phone, message, and so on) — kept for three years from the date we receive it, then destroyed. This lets us look up past correspondence and answer follow-up enquiries consistently.

Marketing consent records — kept until you withdraw consent or until the enquiry information is destroyed.

Access records (sessions) — expire fifteen minutes after your last activity and are deleted on subsequent traffic.

IP values processed to prevent abuse — held temporarily for ten minutes, then deleted.

Error records (server logs) — kept for up to fourteen days.

Administrator activity records (audit log) — kept for three years. These record who handled which content and when, and may include administrator account details and identifiers of the records handled.

Where other legislation requires retention, we keep the information for the period that legislation prescribes.

If you ask us to delete your information, we do so without delay, regardless of the periods above.

4. Disclosure to third parties

We do not provide your personal information to third parties.

The only exceptions are where legislation expressly provides otherwise, or where an investigative authority makes a request following the procedures and methods prescribed by law.

We do not use third-party tools for advertising or behavioural analytics.

5. Processing entrusted to others

We entrust certain processing to the following parties in order to operate the service.

Website hosting and database operation — Cafe24 Corp. The entrustment lasts for as long as the service agreement remains in effect.

Sending enquiry notification email — ■■ to be filled in (the mail service provider actually used). When an enquiry arrives, a notification email is sent to our staff, and that email contains what you entered.

In each contract we set out what is required to keep personal information safe, and we supervise the processor. If a processor or the scope of entrusted work changes, we will announce it through this policy.

6. Third-party services

We use no external scripts for visitor analytics, advertising, or tracking. Every file needed to render the site — fonts, scripts, images — is served from our own servers, so simply opening a page does not transmit your information to any third party.

The site does carry outbound links — the map links on the contact page, and the LinkedIn and Facebook links in the footer. If you click one, your browser goes to that site, and from that point their own privacy policy applies.

7. Your rights and how to exercise them

You may at any time ask to access, correct, delete, or suspend the processing of your personal information. If you consented to marketing email, you may withdraw that consent.

Send your request by email to the privacy officer named in section 10. We will act on it and tell you the outcome within ten days of receiving it.

We may take minimal steps to verify that the request comes from you.

You may also exercise these rights through a legal representative or an authorised agent.

8. How we destroy personal information

We destroy personal information without delay once the retention period has passed or the purpose of processing has been achieved.

Information held as electronic files is deleted permanently by a method that prevents recovery. Anything printed on paper is shredded or incinerated.

Copies remaining in staff mailboxes, such as notification email already sent, are deleted as well.

Administrator activity records may retain minimal identifying details for the period stated in section 3, so that there is a record of what was done and when.

9. Cookies and other automatic collection

We use only the cookies the service needs to function. We do not use advertising or analytics cookies.

spex-session — keeps your session and screen state. It expires fifteen minutes after your last activity and is not readable by JavaScript.

XSRF-TOKEN — a security cookie that prevents forged requests. It lasts fifteen minutes and is not used to identify you.

You can refuse cookies in your browser settings. If you do, some functions — such as submitting the enquiry form — may not work.

In the administration screens, draft text is saved for up to seven days in the administrator's own browser so that work in progress is not lost. It is never sent to the server and is not used on the public site.

10. Privacy officer

We have appointed a privacy officer with overall responsibility for the processing of personal information and for handling enquiries and complaints related to it.

Privacy officer — Kwon Yong-gyun

Email — kwonyg@spexinspace.com

You may raise any privacy question arising from your use of the service with the privacy officer, and we will answer and act on it without delay.

11. Security measures

Administrative — we keep the number of staff who can access personal information to a minimum and manage their access by role.

Technical — the administration screens are reachable only after authentication; login attempts are rate-limited and an idle session is signed out automatically. Passwords are stored in a form that cannot be reversed.

Access logging — we record and retain what administrators viewed, changed, or deleted.

Physical — the systems holding personal information are operated in an access-controlled environment.

12. Where to seek redress

If you need advice or remedy regarding a privacy infringement, you may contact the following bodies in Korea.

Privacy Infringement Report Centre — 118 · privacy.kisa.or.kr

Personal Information Dispute Mediation Committee — 1833-6972 · kopico.go.kr

Cybercrime Investigation Division, Supreme Prosecutors' Office — 1301 · spo.go.kr

National Police Agency Cyber Bureau — 182 · ecrm.police.go.kr

If you disagree with how we handled a request under Articles 35, 36, or 37 of the Personal Information Protection Act, you may apply for administrative appeal.

13. Changes to this policy

This policy applies from its effective date.

If legislation or our practices change, we will announce the change on the website at least seven days before it takes effect.

Changes that materially affect your rights will be announced thirty days in advance.