Project Inquiry
Legal

Privacy Policy

UPINTER Inc. handles the personal information it receives through its inquiry, careers and proposal forms according to the principles below.

Chief Privacy Officer
Kang Young-han, Executive Director (CTO)
Effective
From the date of posting on the website

General

UPINTER Inc. (the “Company”) establishes this Privacy Policy under Article 30 of the Korean Personal Information Protection Act to protect the personal information of data subjects and to handle related complaints promptly. This policy applies to the Company website (up-inter.com) and to its inquiry, company profile download, buyer inquiry, demo request, brand investment proposal, job application and newsletter functions, and applies equally to the Korean, English and Chinese pages. This English version is provided for convenience; if it differs from the Korean version, the Korean version prevails.

The Korean version prevails.

Article 1Personal information collected and how

  • Inquiries — Required: name, email. Optional: company or brand name, phone number, inquiry type, message
  • Company profile download — Required: email. Optional: company or brand name
  • Buyer inquiries — Country, channel, category, expected order size, website, WeChat ID, email, message
  • UPro demo requests — Company, name, email, company size, work areas to automate, tools currently used, message
  • Brand investment proposals — Brand name, category, annual revenue range, proposal type, link to materials, email, message
  • Job applications — Position, name, email, résumé link, portfolio link, message
  • Newsletter — Email
  • Collected automatically — Page visited, display language, traffic source (utm_source, utm_medium, utm_campaign, utm_term, utm_content, ad click IDs), first page visited (landing URL), previous page address (referrer), browser information (User-Agent), time of submission, server access logs (IP address)
  • Collection methods — Website forms; consultations by email, phone, KakaoTalk Channel or WeChat; business cards received at trade shows and meetings; recruitment platforms

Article 2Purposes of processing

The Company processes personal information only for the following purposes and, if a purpose changes, obtains separate consent under Article 18 of the Personal Information Protection Act.

  • Responding to inquiries and consultations, assigning the responsible team and replying
  • Proposing global marketing, sales and AX services; quotations; concluding and performing contracts
  • Providing materials such as the company profile and line sheets
  • Business discussions with buyers and distribution partners
  • Running the recruitment process and notifying results
  • Sending newsletters and news (where separately consented)
  • Statistics on inquiry traffic sources and service improvement
  • Preventing misuse (such as blocking automated submissions) and keeping records for dispute handling

Article 3Retention and use period

The Company destroys personal information without delay once the purpose of collection has been achieved, except that it is retained for the periods below.

  • Inquiry and consultation records: 3 years from receipt (consultation history management and dispute handling)
  • Records on contracts and transactions: 5 years (Act on the Consumer Protection in Electronic Commerce)
  • Records on consumer complaints and dispute resolution: 3 years (same Act)
  • Job application documents: 180 days after the hiring process ends, or destroyed immediately at the applicant’s request
  • Newsletter: until consent is withdrawn
  • Server access logs: 3 months (Protection of Communications Secrets Act)
  • Company profile download records: 1 year

Article 4Provision to third parties

The Company processes personal information only within the scope of the purposes in Article 2 and, as a rule, does not provide it to third parties, with the following exceptions.

  • Where the data subject has given prior consent
  • Where specially provided for by law, or where requested under investigative or judicial procedures
  • Where a connection with overseas buyers, distribution partners or partner companies is needed — in this case, before connecting, we inform the data subject of the recipient, the items, the purpose and the retention period, and obtain consent.

Article 5Outsourcing and cross-border transfers

The Company outsources processing to the companies below to operate its services; some of these companies have servers outside Korea.

  • Google LLC (Google data centers in the United States and elsewhere) — Google Workspace, Sheets, Drive and Apps Script: storing inquiry records, sending automatic replies and notification emails, and storing company profile files. Items: all inquiry, download and application information in Article 1. Time and method of transfer: sent over encrypted communication (TLS) when a form is submitted. Retention: the periods in Article 3.
  • Google Cloud (Seoul, asia-northeast3) — Website hosting and server access logs.
  • Kakao (Republic of Korea) — KakaoTalk Channel consultations.
  • Tencent (China) — WeChat consultations. The account information and conversations of data subjects who contact us via WeChat pass through servers in China.

Data subjects who do not want a cross-border transfer may contact us by email or phone instead of those channels, and may ask the officer in Article 10 to refuse the transfer. Any change of outsourcing company will be disclosed in this policy.

Article 6Destruction procedure and method

Personal information is destroyed without delay once the retention period expires or the purpose has been achieved. Information that must be kept under law is moved to a separate sheet with restricted access and kept there.

  • Electronic files: deleted in a way that cannot be recovered (deleting sheet rows, permanent deletion from Drive, deleting emails)
  • Paper documents: shredded or incinerated
  • Destruction is carried out by the responsible department with the approval of the Chief Privacy Officer, and a record is kept.

Article 7Rights and duties of data subjects and legal representatives, and how to exercise them

Data subjects may at any time request access to, correction, deletion or suspension of processing of their personal information, or withdraw consent. Requests made by email, phone or in writing to the contacts in Article 10 are handled within 10 days after identity verification, and the result is communicated. Legal representatives or authorized persons must also submit a power of attorney. Where other laws restrict access or similar rights, we explain the reason.

The Company does not collect personal information from children under 14 and, if it learns that such information has been collected, destroys it without delay.

Article 8Automatic collection tools: installation, operation and refusal

The website uses the web analytics tool Google Analytics 4 (Google LLC) for visit statistics, and this tool stores cookies (such as _ga) in the visitor’s browser. The information collected is usage data such as pages visited, time spent, traffic source, device and browser type, approximate region and button clicks; inquiry content such as names and email addresses is not sent to Google Analytics. Traffic source values attached when arriving from ads or search (UTM parameters and ad click IDs) and the first page visited are kept in the visitor’s browser storage (localStorage and sessionStorage) and are sent only together with a submitted inquiry.

If you do not want cookies stored, you can block or delete them in your browser settings, and you can opt out of collection with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). Refusing cookies does not limit your use of the website or your ability to send inquiries.

Article 9Security measures

  • Administrative measures — Establishing and implementing an internal management plan, limiting access rights to the responsible team (only designated staff can access the inquiry sheet and admin), regular training, oversight of outsourcing companies
  • Technical measures — Encryption in transit (TLS), Google Workspace two-step verification, admin passwords and expiring access tokens, blocking of automated submissions, retention of access and processing logs
  • Physical measures — Office access control, locked storage of paper documents

Article 10Chief Privacy Officer and responsible department

The Company has designated a Chief Privacy Officer who oversees the processing of personal information and handles data subjects’ complaints and remedies for damage.

Data subjects may direct any inquiries, complaints or requests for remedies regarding personal information to the contacts above, and the Company will respond without delay.

Article 11Remedies for infringement of rights

To report or seek advice on an infringement of personal information, you may contact the following organizations.

  • Personal Information Infringement Report Center — 118 (no area code), privacy.kisa.or.kr
  • Personal Information Dispute Mediation Committee — 1833-6972, www.kopico.go.kr
  • Supreme Prosecutors’ Office, Cyber Investigation Division — 1301 (no area code), www.spo.go.kr
  • Korean National Police Agency, Cyber Investigation Bureau — 182 (no area code), ecrm.police.go.kr

A person whose rights have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (access), Article 36 (correction and deletion) or Article 37 (suspension of processing) of the Personal Information Protection Act may file an administrative appeal under the Administrative Appeals Act.

Article 12Changes to this policy and effective date

If this policy changes, we will post a notice on the website 7 days before the change takes effect (30 days before for material changes, such as to the items collected, purposes or provision to third parties). Previous versions are available on request.