Privacy Policy
Viewduc Insight (hereinafter, the “Company”) complies with applicable laws and regulations, including the Personal Information Protection Act (of Korea), and establishes and discloses this Privacy Policy to protect the personal information and rights and interests of Viewduc users and to facilitate the handling of grievances relating to personal information.
Table of Contents
- 1. Purposes of Processing Personal Information
- 2. Categories and Methods of Collection of Personal Information
- 3. Processing and Retention Periods for Personal Information
- 4. Provision of Personal Information to Third Parties
- 5. Entrustment of Personal Information Processing
- 6. Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercising Them
- 7. Procedures and Methods for Destruction of Personal Information
- 8. Measures to Ensure the Security of Personal Information
- 9. Operation and Refusal of Cookies
- 10. Personal Information Protection Officer
- 11. Methods of Seeking Remedies for Infringement of Rights and Interests
- 12. Changes to this Privacy Policy
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes and does not use the personal information processed for any purpose other than those purposes.
- Confirming the intent to register as a member, identifying and authenticating members, and maintaining and managing membership status
- Providing cosmetic information, reviews, and community features, as well as content and services tailored to each user
- Providing services reflecting profile and country/region settings
- Operating events, verifying winners, and shipping prizes
- Handling customer inquiries, reports, requests concerning infringement of rights, and complaints
- Preventing fraudulent use and unauthorized use, securing services, identifying errors, and improving quality
- Analyzing services and using personal information for marketing for users who have separately consented to the use of personal information for marketing
- Providing information about events and benefits to users who have separately consented to receive information about free events and benefits
Consent to the use of personal information for marketing and consent to receive information about free events and benefits are optional. Membership registration and use of basic services are available even without such consent.
2. Categories and Methods of Collection of Personal Information
| Category | Items Collected |
|---|---|
| Membership Registration and Management | Email address, nickname, gender, year of birth |
| Profile and Service Settings (Optional) | Country/region, skin type, skin concerns, personal color, and other profile information directly selected or entered by the user |
| Use of Personal Information for Marketing (Upon Separate Consent) | Email address, gender, year of birth, country/region, profile information, service usage records |
| Receipt of Information about Free Events and Benefits (Upon Separate Consent) | Email address, records of consent to and withdrawal from receipt |
| Shipping of Event Prizes (Applicable Users Only) | Name, country/region, mobile phone number, address |
| Automatically Generated and Collected During Service Use | Access IP address, cookies, date and time of access, service usage records, device and browser information, error- and security-related logs |
Personal information is collected when users directly enter it during membership registration, profile setup, event participation, or entry of a shipping address, or when it is automatically generated and collected during use of the services.
The Company does not permit users under 14 years of age to register as members.
3. Processing and Retention Period of Personal Information
The Company processes and retains personal information for the retention period prescribed by law or the period notified to and consented to by the user.
| Retained Information | Retention Period |
|---|---|
| Member and profile information | Until the member withdraws from membership. However, where retention is necessary due to a dispute or under applicable laws, until the end of the applicable period |
| Information used for personal information marketing | Until consent is withdrawn or the member withdraws from membership |
| Information for receiving free event and benefit information | Until consent to receive such information is withdrawn or the member withdraws from membership |
| Information for delivery of event prizes | Destroyed without delay after the purpose of delivering the prize and handling related inquiries has been achieved |
| Records of customer inquiries and reports | One year after processing is completed. However, if a dispute continues, until the dispute ends to the extent necessary |
| Access and security logs | In principle, three months from the date of collection; however, where necessary to respond to a security incident or dispute, until the end of the necessary period to the extent permitted by law |
Personal information for which the retention period has expired or the purpose of processing has been achieved is destroyed without delay, except where retention is necessary under applicable laws.
4. Provision of Personal Information to Third Parties
As a matter of principle, the Company processes users' personal information within the scope of the processing purposes specified in this Privacy Policy and does not provide users' personal information to third parties.
However, where the user has separately consented to the provision to a third party or where otherwise permitted under the Personal Information Protection Act (of Korea), including cases in which special provisions of law apply, the Company may provide such information within the scope prescribed by applicable laws.
If provision to a third party newly arises, the Company will provide notice of the necessary matters, including the recipient, purpose of provision, items provided, and retention and use period, in accordance with applicable laws.
5. Outsourcing of Personal Information Processing Operations
To provide services smoothly and securely, the Company outsources portions of its personal information processing operations to external service providers as follows.
| Entrusted Party | Outsourced Operations |
|---|---|
| Amazon Web Services, Inc. | Provision of cloud infrastructure and data storage for service operations |
| Cloudflare, Inc. | Content delivery, network traffic processing, web security, and attack protection |
| Google LLC | Analysis of service usage statistics and tag management (Google Analytics, Google Tag Manager) |
The Company incorporates obligations related to personal information protection into its outsourcing agreements and other arrangements and manages and supervises whether entrusted parties process personal information securely. If an entrusted party or outsourced operation changes, the Company will disclose the change through this Privacy Policy.
Notice Regarding Processing Outside Korea
Due to the nature of the global network services used by the Company, some network information may be processed outside Korea during access to the services. Cloudflare states in its official guidance that it may process limited metadata, such as the IP addresses of visitors to customer websites, on behalf of customers at data centers located in the United States and Europe.
In addition, the Company uses Google Tag Manager and Google Analytics to understand how the Service is used and to improve it. In this process, cookie identifiers, access records, and similar information may be processed at data centers operated by Google LLC outside Korea.
| Recipient | Items Transferred | Country, Timing, and Method of Transfer | Purpose and Retention Period |
|---|---|---|---|
| Cloudflare, Inc. | IP addresses and limited metadata necessary for processing network requests and security | United States and Europe / During service access and security processing / Transmission over the network | Content delivery, network security, and service provision / The period necessary for Cloudflare's provision of services and under contracts and applicable laws |
| Google LLC | Cookie identifiers, IP addresses, device and browser information, and service usage records | The United States and other countries where Google operates data centers / During use of the Service / Transmission over the network | Analysis of service usage statistics and service improvement / The period necessary for Google's provision of services and under contracts and applicable laws |
The Company regularly verifies the status of processing outside Korea based on the service configuration actually in use and the processing policies of entrusted parties and provides any disclosures or notices required under applicable laws.
6. Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercising Them
- Users may at any time request that the Company allow them to access, correct or delete, suspend processing of, or withdraw consent to the use of their personal information.
- Consent to the use of personal information for marketing purposes and consent to receive information about free events and benefits may be withdrawn at any time. Withdrawal will not affect the use of the basic services.
- Rights may be exercised through the account and settings functions within the Service or via [email protected], and the Company will process such requests in accordance with applicable laws and regulations.
- The Company may request the minimum information necessary to verify whether the person requesting the exercise of rights is the data subject or an authorized representative.
- The Company does not permit individuals under 14 years of age to register as members.
7. Procedures and Methods for Destroying Personal Information
- The Company destroys personal information without delay when the retention period has expired or when the personal information is no longer necessary because the processing purpose has been achieved.
- Personal information that must be retained for a specified period under other laws and regulations is stored separately for the period necessary for that purpose and then destroyed.
- Personal information in electronic file form is deleted using secure methods that make recovery or reproduction difficult.
- If personal information is included in paper documents, it is destroyed using methods that make restoration difficult, such as shredding or incineration.
8. Measures to Ensure the Security of Personal Information
The Company implements the necessary administrative, technical, and physical safeguards in accordance with applicable laws and regulations to prevent the loss, theft, leakage, forgery, alteration, or damage of personal information.
- Administrative measures: Minimization of access rights to personal information and operation of internal management procedures
- Technical measures: Access-rights management, access controls, encryption of transmission sections, security updates, and protection of access logs
- Physical measures: Necessary access restrictions on physical materials or facilities in which personal information is stored
9. Operation of and Refusal of Cookies
The Company may use cookies or similar technologies to maintain login status, secure the Service, save the usage environment, analyze usage statistics, and improve the Service.
Users may allow or block the storage of cookies through their web browser settings. However, if cookies essential to providing the Service are blocked, some functions, such as login, may not operate properly.
10. Personal Information Protection Officer
The Company has designated the following Personal Information Protection Officer to oversee matters related to the processing of personal information and to handle inquiries, complaints, and requests for remedies concerning personal information.
- Company: Viewduc Insight
- Personal Information Protection Officer: Junoh Lee
- Email: [email protected]
- Address: 50, 3rd Floor, 128 Teheran-ro, Gangnam-gu, Seoul (Yeoksam-dong, Seonggok Building)
11. Remedies for Infringement of Rights and Interests
Users may contact the institutions below if they need consultation or remedies for damages resulting from a breach of personal information.
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code required) · www.kopico.go.kr
- Personal Information Infringement Report Center: 118 (no area code required) · privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301 (no area code required) · www.spo.go.kr
- Korean National Police Agency: 182 (no area code required) · ecrm.police.go.kr
The institutions above are separate from the Company. For general inquiries regarding personal information related to the Service, please contact [email protected].
12. Changes to the Privacy Policy
If content of this Privacy Policy is added, deleted, or changed, the Company will notify users of the changes through reasonable means, such as an announcement within the Service, before the changes take effect. Changes that materially affect users’ rights will be announced in accordance with the methods and periods required by applicable laws and regulations.
