Privacy Policy (Summary)

This Policy applies to the official website of KIBEX (Korea International Beer Expo) (the “Website”) and the services provided through it, such as exhibitor applications, pre-registration, ticket purchases and inquiries. It applies equally to the associated brand pages operated on the Website, including KIBA (Korea International Beer Awards) and DRINK SEOUL.

The Event host and organizer and the Website operator are as follows.

To be finalizedThe relationship between the two companies as data controller and processor (or joint controllers) will be specified in this Article after legal review. Until then, Article 13 is operated on the basis of the privacy officer of 주식회사 그리프 shown in the Website footer.

The Website collects the following items for each service. Required items are necessary to provide the service; optional items do not restrict use of the service if consent is not given.

The following information may be generated or collected automatically while using the services:

• ·Receipt and order numbers, admission QR tokens, submission time and processing status
• ·Access records collected by the visitor analytics tool (pages visited, referrer, device and browser type, etc.)
• ·Cookies for maintaining administrator login sessions and administrator activity records (processing history)

To be finalizedThe specific items collected by the visitor analytics tool and whether cookies are used will be reflected in this Article and Article 11 after review.

Personal information is collected when users enter it directly in the application, registration, purchase and inquiry forms on the Website, and when users provide it during email or telephone correspondence with the Secretariat.

Collected personal information is processed only for the purposes below. If a purpose changes, necessary measures such as obtaining separate consent are taken in accordance with Article 18 of the Personal Information Protection Act.

As a rule, personal information is destroyed without delay once the purpose of collection and use has been achieved.

To be finalizedThe specific retention periods for each service (e.g. exhibitor application data, pre-registration data, inquiry history, newsletter subscriptions) will be specified in this Article after legal review. Some exhibitor document forms already state “retained for 3 years” and obtain consent at the time of submission.

Information that must be retained for a certain period under the law is kept for that period and then destroyed:

As a rule, personal information is not provided to third parties. It is provided only where the user has given prior consent, where specifically required by law, or where an investigative agency requests it in accordance with the procedures and methods prescribed by law.

The buyer pre-registration service includes a third-party provision consent item for providing personal information to Exhibitors during business matching. This consent is not obtained at the time of pre-registration; the recipient, items and purpose are explained and separate consent is obtained when a match is confirmed.

To be finalizedThe recipients, items provided and the recipients’ retention period for business matching will be set out in a table in this Article once the operating method is finalized.

The processing of personal information is outsourced as follows to provide the services.

To be finalizedWhether an outsourcing contract has been concluded with each processor, the scope of outsourced work under the contract and any sub-outsourcing will be reflected in this Article after confirmation, together with the supervision matters required under Article 26 of the Personal Information Protection Act.

To be finalizedTicket payment is being prepared; the payment gateway will be added to the list of processors and announced in advance once confirmed.

To be finalizedWhether the map display service constitutes outsourcing of personal information processing will be corrected after review.

Any change to the outsourced work or processors is disclosed without delay through this Policy.

Some of the processors in Article 6 are headquartered outside Korea, so personal information is transferred overseas. Data stored in the database is kept in the Seoul (ap-northeast-2) region, but the operator of that database is a foreign entity.

To be finalizedThe exact legal name, country, time and method of transfer, privacy contact and retention period of each recipient will be entered in this Article after confirmation. Until then, they are shown as “Under confirmation”.

The use of visitor analytics and advertising measurement tools (Article 11) involves the following overseas transfer of personal information.

To be finalizedThe details of this transfer, including the retention period, will be finalized after the Secretariat confirms the analytics account settings.

Users may refuse the overseas transfer of their personal information; however, use of the services (applications, registration, purchases, etc.) through the Website may then be restricted. Requests to refuse may be sent to the contact in Article 13.

Users may exercise the following rights at any time:

• ·Request access to personal information
• ·Request correction of errors
• ·Request deletion
• ·Request suspension of processing
• ·Withdraw consent to the collection and use of personal information

Rights may be exercised by email, telephone or in writing through the contact in Article 13, and requests are handled without delay. Where a representative acts on the user’s behalf, a power of attorney in the form prescribed by the Notice on Personal Information Processing Methods (Form No. 11) must be submitted.

Requests for access or suspension of processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act, and personal information that other laws designate for collection cannot be deleted. The reasons are notified in such cases.

When personal information is no longer needed, for example because the retention period has expired or the purpose has been achieved, it is destroyed within 5 days in accordance with applicable law and the Standard Personal Information Protection Guidelines. Information that must be retained under other laws is moved to a separate database or storage location.

Electronic files are permanently deleted in a way that prevents recovery or reproduction; paper records are shredded or incinerated.

The measures currently in place are:

• ·Managerial — administrator accounts with access to personal information are kept to a minimum and granted tiered permissions.
• ·Technical — only authenticated accounts can access the administrator system, and all Website traffic is encrypted (HTTPS).
• ·Processing history — key administrator actions (status changes, etc.) are kept in a separate activity log so that misuse can be checked.
• ·Uploaded files — attachments are stored under paths containing hard-to-guess random identifiers, and the file list can only be viewed through the administrator screens.

To be finalizedThe access control method for uploaded files (switching to signed URLs) and the scope of other security measures (access log retention, encrypted storage, etc.) will be reflected in this Article after review. Unconfirmed measures are not listed.

A session cookie is used to keep administrators logged in. General users do not need to log in for applications, registration or purchases.

The following tools are used for visitor analytics and advertising measurement. They do not run on the administrator screens or the application lookup screens.

When a completed application or purchase is measured, only the form type, the event brand, the payment amount and the order number are sent; information entered in the forms, such as name, phone number or email, is not sent.

To see which channel (advertising, search, etc.) led to an application or purchase, when you arrive through an address with campaign information or from an external website, the referral details (campaign information, the domain of the previous site and the first page opened) are stored for 30 days in the Website’s own (first-party) cookie and kept with the application or purchase record. This cookie contains no information that identifies the user.

To be finalizedWhether the analytics tools are used, the items they collect and the items stored in the referral cookie will be finalized after confirmation by the Secretariat.

Users may refuse or delete cookies in their web browser settings. Google Analytics can also be refused with the Google Analytics Opt-out Browser Add-on. However, some functions such as administrator login may be restricted if cookies are refused.

Event news and notices are sent to users who have subscribed to the newsletter or consented to receive marketing communications, in accordance with Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. Consent is optional and does not restrict use of the services.

Opt-out (unsubscribe) requests sent to the Secretariat email in Article 13 are processed immediately.

To be finalizedWhether an unsubscribe link is included in emails and the related procedure will be reflected in this Article depending on implementation.

The privacy officer in charge of personal information processing, related complaints and remedies is as follows.

To be finalizedThe privacy officer’s company and title will be settled together with the confirmation of the data controller in Article 1.

Requests for access, correction, deletion or suspension of processing may be submitted to the contact above. General inquiries may also be left through the Contact page.

Users may apply for dispute resolution or consultation with the organizations below to obtain relief for infringement of personal information. Users whose rights or interests are infringed by a disposition or omission in response to a request under Articles 35, 36 or 37 of the Personal Information Protection Act may also file an administrative appeal under the Administrative Appeals Act.

Any addition, deletion or amendment to this Policy is announced on the Website at least 7 days before the effective date. Important changes to user rights are announced at least 30 days in advance.