COAD (hereinafter called “the company”) makes much of users’ personal information protection, and does the best to protect users’ personal information offered online at the time when they use the service of the company (hereinafter called “the website”). Therefore, the company complies with personal information protection rules in the laws relevant to information communication service providers, including PROTECTION OF COMMUNICATIONS SECRETS ACT, ELECOMMUNICATIONS BUSINESS ACT, and ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, ETC, and the personal information protection guidelines by Ministry of Information and Communication. The company informs users of how users’ personal information is used and how to handle the personal information for personal information protection in accordance with personal information protection policy.

The company posts personal information protection policy on the first page of the website in order for users to easily find the policy.

The personal information protection policy of the company can often be changed on account of the amendment of the governmental laws and guidelines, or the internal policy changes of the company. Accordingly, the company sets forth a procedure necessary to continue to improve personal information protection policy. To revise personal information protection policy, the company posts a notice on the website 7 days before the personal information protection policy is changed, and gives a version number and a revision date in order for users to easily find revised matters.

Personal information protection policy includes each of the following:

A. Agreement on personal information collection
B. Purposes of personal information collection and use
C. Personal information items collected by the company and the use period of the information
D. The retention and use periods of the personal information collected by the company
E. Sharing and offering of the personal information collected by the company
F. Matters about cookie operation
G. Technical-managerial measures of personal information
H. Personal information commission handling
I. Matters about opinion collect and complaint handling of personal information
J. Company information
K. Customer service of the company
L. Obligation of notification

A. Agreement on personal information collection
The company comes up with a procedure in which users are able to click ‘Agree’ button or ‘Disagree’ button to agree or disagree on the personal information policy or terms and conditions of the company. If users click ‘Agree’ button, they are considered to agree on the collection of their personal information.

B. Purposes of personal information collection and use
The term “personal information” means information on a living individual, such as the information to identify a person on the basis of a name, a residential registration number, and others (including information enable to be combined with other types of information easily for identification, even if the information is not enough to identify a person). Most of the company service can be used after separate user registration. The company does not open users’ personal information without any prior agreement of users, and uses the collected information as shown below.

First, based on the personal information offered by users, the company is able to develop more useful services. To develop new services or expand contents, the company is able to more effectively give priority to the services to develop on the basis of the personal information offered by users, and is able to select and provide the contents for users reasonably.

Secondly, each one of the collected information has the following collection purpose:
- Name, company information, e-mail, and contact: user’s identification for dealing with complaints arising service use, check of a real name through a credit-rating agency, and offering of age limit service
- E-mail address and telephone: delivery of notices, check of user’s intention, complaint handling, and security of communication paths
- Other optional items: data for providing personalized service
- IP Address and visit date: prevention of illegal use of bad members and prevention of not-permitted use

C. Personal information items collected by the company and the use period of the information
The company lets users enter their information essential for service offering when they subscribe to use its member service. The essential information for membership includes a name, a residential registration number, a passport number, or a foreigner registration number (only foreigners), and e-mail address. To provide quality service, the company collects users’ telephone numbers which are optional.

In addition, for statistical analysis in a questionnaire survey or gift offering in an event, the company is able to request personal information input selectively. Nevertheless, the company does not collect sensitive personal information (race, ethnic group, idea and creed, native place and legal domicile, political orientation and criminal record, health conditions and sexual life, etc.) that may violate users’ basic human rights, and always requests users’ prior agreement if such information needs to be collected inevitably. In any case, the company neither uses the input information of users for other purposes than the purpose already revealed, nor discloses them.

D. The retention and use periods of the personal information collected by the company
While users as members of the company make use of the service offered by the company, the company continues to hold users’ personal information and to use it for service offering, etc. However, if a member directly deletes or changes information, or requests unsubscription in accordance with the procedure and method in “ F. Matters about users’ personal information management (opening, change, deletion, etc.)”, such information is deleted completely from disk in a non-reproducible method, and comes to the state where opening or use is impossible.
The personal information collected for temporary purposes (questionnaire survey, event, one’s identification, etc.) as shown in “C. Personal information items collected by the company and the use period of the information” comes to the state where reproduction is impossible after the purposes are achieved.
As a principle, users’ personal information is destroyed after the collection purpose of personal information is achieved. However, to prevent the recurrence of illegal use of bad members, the company is able to hold the residential registration number of a relevant member for 1 year from the termination date of use terms and conditions. If such information needs to be kept in accordance with relevant laws including Commercial Act and Act on Consumer Protection in the Electronic Commerce Transactions, Etc., the company keeps the member information for the period set forth by a relevant law. In this case, the company uses the information only for the purpose of retention, and each retention period is presented as follows:
- Record of contract or subscription withdrawal, etc.: 5 years
- Record of payment and supply of goods, etc.: 5 years
- Record of consumers’ complaints or dispute settlement: 3 years
The company safely handles the personal information of members and destroys them in each of the following in order to prevent leakage.
- The personal information printed in paper is shredded or incinerated for destruction.
- The personal information saved in a digital file format is deleted in a technical way to prevent record reproduction.

E. Sharing and offering of the personal information collected by the company
The company makes use of the personal information of users within the notified range of “B. Purposes of personal information collection and use”, and neither uses the personal information beyond the range without prior agreement of users nor discloses users’ personal information as a principle. However, each of the following is exceptional:
- If users agree on disclosure in advance
- If the personal information is needed for online payment of membership fee, etc.
- If a user violates the terms and conditions of company service use posted at the website, terms and conditions of other member service, etc., or operation principles
- If there are enough grounds for disclosing personal information in order to take legal measures for the psychological and physical damage to others through the use of the company service
- If there is any judgment of legal requests with good faith (e.g., requests of government/investigation offices, etc. in accordance with a legal procedure)
- If offered to partners or research groups in a form hard to identify a particular individual, in order for statistics, academic research, or market survey
- If offered to firms related to “K. Customer service of the company” in order to handle complaints and questions of service use
- If there is a member’s prior agreement on the specified information type, use purpose, use period, etc. which is offered to the contract firms for events and gift coupons service (more details of commission are offered in “K. Customer service of the company”.

The company is able to share users’ personal information in order to develop a new technology and provide a better service. In this case, before information collection or information offering, it is required to inform users of the organizations or groups with which the personal information is shared, which information is needed, why the information is needed, and by when or how the information is protected and managed, and to request them to make an agreement. If there is agreement of users, additional information is neither collected nor shared at the discretion of the company.
Users’ personal information is not offered to persons or firms requesting advertisements even if advertisements are posted and sent to a particular group by age and sex. In case of statistics, academic research, and market survey, personal information is offered in a form hard to identify a particular individual.

F. Matters about cookie operation
To provide customized service to users, the company saves users’ information and uses the ‘cookies’ called often. A cookie is a small amount of information sent to a user’s computer browser by a server (HTTP) for website operation. It can be saved in the hard disk of a user’s PC.
In order for users to log in the website of the company and use the member service, etc., it is required to permit a cookie. The company uses a cookie to find information on ID in order to provide useful service to users. With a cookie, it is possible to identify a user’s computer but impossible to identify a user individually.
A cookie includes a variety of information, such as ID, security access, and news edition items (press media selection and new edition setting). With the use of a cookie, it is possible to find each service of the companies visited by users, visit and use type of each website, and user size, and thereby create and provide a more convenient service and optimized information. Users are able to select whether a cookie can be used. By setting an option in web browser, it is possible to permit all cookies, make confirmation whenever a cookie is saved, or reject all cookies. If cookies are rejected, some services of the company that require log-in are not offered.

G. Technical-managerial measures of personal information
In handling users’ personal information, the company comes up with the following technical measures to secure safety in order to prevent personal information from being lost, stolen, leaked, modified, or damaged.
Users’ personal information is thoroughly protected with password. A user’s ID and password are exposed only to the user, and only a user is able to confirm and change its own password. Therefore, it is required for users not to get their password exposed to others. Therefore, the company recommends users to log out and exit web browser after their use in PC. In particular, if a PC is shared by multiple users or is used in a public place (company, school, library, internet game room, etc.), it is required to follow the above procedure in order to prevent a user’s personal information from getting exposed to others.
The company does the best to prevent members’ personal information from being leaked or damaged by hacking, computer virus, etc. In case of damage of personal information, the company often backs up data and uses the latest vaccine program in order to prevent users’ personal information or data from being leaked or damaged and to send the personal information safety over network through encryption communication. In addition, with the use of intrusion prevention system, the company controls unauthorized access from the outside and tries to be equipped with all technical devices to secure systematic security.
Users’ personal information is managed only by an employee in charge. For the management, a separate password is offered to the employee and is updated regularly. Through regular education of the employee, the company emphasizes the compliance with its personal information protection policy. In addition, the organization in charge of personal information in the company monitors execution of the personal information protection policy and a relevant employee’s compliance with the policy. If any problem is found, the company tries to solve the problem immediately.
The company is not responsible for any problems caused by users’ carelessness or for the leakage problem of personal information (ID, password, etc.) caused by internet trouble.

H. Personal information commission handling
For service improvement, the company is able to commission other firms to manage and process users’ personal information. In case of the commission, the company will notify users of the fact in advance. Through service contract, etc., the company will clearly define service provider’s compliance with personal information protection instructions, confidentiality of personal information, prohibition of offering to third parties, and responsibilities in case of accidents, and will keep a relevant contract in writing or digitally.

I. Matters about opinion collect and complaint handling of personal information
The company collects users’ opinions of personal information protection, and comes up with all procedures and methods to handle complaints. Users are able to report any complaints via phone or e-mail in reference to “J. Department, name, and contact information on chief manager and employee of personal information management in the company”, and the company will reply to the report immediately.
It is possible to report complaints to any of the following organizations operated by the government.
- Personal Information Violation Report Center (http://www.cyberprivacy.or.kr, Tel: 1336)
- Personal Information Dispute Mediation Committee (http://www.kopico.or.kr, Tel: 1336)
- Information Protection Mark Authentication Committee (http://www.privacymark.or.kr, Tel: 02-580-0533)
- National Police Agency (http://www.police.go.kr)

J. Department, name, and contact information on chief manager and employee of personal information management in the company
The company does the best in order for users to use good information safely. If an accident violating the noticed matters occurs in the way of protecting personal information, a person in charge of personal information management is responsible for the accident.
A user is responsible for the security of its own ID and password and personal information. The company never asks users their password directly. Therefore, users need to be careful of no exposure of their password to others. In particular, as specified in “G. Technical-managerial measures of personal information”, in a public place, it is more careful to prevent a user’s password from being leaked. The company appoints a chief manager and employee in charge of personal information management in order to collect users’ opinions of personal information and handle their complaints. Their information is presented as below:

K. Customer service of the company
As of now, the customer center under the judicial corporation handles members’ complaints. The company provides information to the customer center within the range necessary to handle customers’ complaints. In addition, for the safety of personal information protection at service contract, the company will clearly define service provider’s compliance with personal information protection instructions, confidentiality of personal information, prohibition of offering to third parties, and responsibilities in case of accidents, and will keep a relevant contract in writing or digitally.

Information on the service center operation and contact is presented as follows:
- Work hours : 09:00~18:00 on weekdays (no service on Saturdays, Sundays, and holidays)
- Tel :
- Fax :
- E-mail :
Postal :
Other inquiries: Q&A menu of the website
If more consultation of personal information is needed, it is possible to contact Personal Information Violation Report Center (Tel: 1336) operated by Korea Internet & Security Agency (KISA).

L. Obligation of notification
To add, delete, and change the contents of this personal information protection policy, the company will post a notice on ‘Notices’ of the website at least 7 days before revision.

Announcement Date: Nov. 11, 2014
Execution Date: Nov. 11, 2014