Privacy Policy (Summary)

This Policy applies to the official website of KIBEX (Korea International Beer Expo) (the “Website”) and the services provided through it, such as exhibitor applications, pre-registration, ticket purchases and inquiries. It applies equally to the associated brand pages operated on the Website, including KIBA (Korea International Beer Awards) and DRINK SEOUL.

The Event host and organizer and the Website operator are as follows.

The Website collects the following items for each service. Required items are necessary to provide the service; optional items do not restrict use of the service if consent is not given.

The following information may be generated or collected automatically while using the services:

• ·Receipt and order numbers, admission QR tokens, submission time and processing status
• ·Access records collected by the visitor analytics tool (pages visited, referrer, device and browser type, etc.)
• ·Cookies for maintaining administrator login sessions and administrator activity records (processing history)

Personal information is collected when users enter it directly in the application, registration, purchase and inquiry forms on the Website, and when users provide it during email or telephone correspondence with the Secretariat.

Collected personal information is processed only for the purposes below. If a purpose changes, necessary measures such as obtaining separate consent are taken in accordance with Article 18 of the Personal Information Protection Act.

As a rule, personal information is destroyed without delay once the purpose of collection and use has been achieved.

Information that must be retained for a certain period under the law is kept for that period and then destroyed:

As a rule, personal information is not provided to third parties. It is provided only where the user has given prior consent, where specifically required by law, or where an investigative agency requests it in accordance with the procedures and methods prescribed by law.

The buyer pre-registration service includes a third-party provision consent item for providing personal information to Exhibitors during business matching. This consent is not obtained at the time of pre-registration; the recipient, items and purpose are explained and separate consent is obtained when a match is confirmed.

The processing of personal information is outsourced as follows to provide the services.

Any change to the outsourced work or processors is disclosed without delay through this Policy.

Some of the processors in Article 6 are headquartered outside Korea, so personal information is transferred overseas. Data stored in the database is kept in the Seoul (ap-northeast-2) region, but the operator of that database is a foreign entity.

The use of visitor analytics and advertising measurement tools (Article 11) involves the following overseas transfer of personal information.

Users may refuse the overseas transfer of their personal information; however, use of the services (applications, registration, purchases, etc.) through the Website may then be restricted. Requests to refuse may be sent to the contact in Article 13.

Users may exercise the following rights at any time:

• ·Request access to personal information
• ·Request correction of errors
• ·Request deletion
• ·Request suspension of processing
• ·Withdraw consent to the collection and use of personal information

Rights may be exercised by email, telephone or in writing through the contact in Article 13, and requests are handled without delay. Where a representative acts on the user’s behalf, a power of attorney in the form prescribed by the Notice on Personal Information Processing Methods (Form No. 11) must be submitted.

Requests for access or suspension of processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act, and personal information that other laws designate for collection cannot be deleted. The reasons are notified in such cases.

When personal information is no longer needed, for example because the retention period has expired or the purpose has been achieved, it is destroyed within 5 days in accordance with applicable law and the Standard Personal Information Protection Guidelines. Information that must be retained under other laws is moved to a separate database or storage location.

Electronic files are permanently deleted in a way that prevents recovery or reproduction; paper records are shredded or incinerated.

The measures currently in place are:

• ·Managerial — administrator accounts with access to personal information are kept to a minimum and granted tiered permissions.
• ·Technical — only authenticated accounts can access the administrator system, and all Website traffic is encrypted (HTTPS).
• ·Processing history — key administrator actions (status changes, etc.) are kept in a separate activity log so that misuse can be checked.
• ·Uploaded files — attachments are stored under paths containing hard-to-guess random identifiers, and the file list can only be viewed through the administrator screens.

A session cookie is used to keep administrators logged in. General users do not need to log in for applications, registration or purchases.

The following tools are used for visitor analytics and advertising measurement. They do not run on the administrator screens or the application lookup screens.

When a completed application or purchase is measured, only the form type, the event brand, the payment amount and the order number are sent; information entered in the forms, such as name, phone number or email, is not sent.

To see which channel (advertising, search, etc.) led to an application or purchase, when you arrive through an address with campaign information or from an external website, the referral details (campaign information, the domain of the previous site and the first page opened) are stored for 30 days in the Website’s own (first-party) cookie and kept with the application or purchase record. This cookie contains no information that identifies the user.

Users may refuse or delete cookies in their web browser settings. Google Analytics can also be refused with the Google Analytics Opt-out Browser Add-on. However, some functions such as administrator login may be restricted if cookies are refused.

Event news and notices are sent to users who have subscribed to the newsletter or consented to receive marketing communications, in accordance with Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. Consent is optional and does not restrict use of the services.

Opt-out (unsubscribe) requests sent to the Secretariat email in Article 13 are processed immediately.

The privacy officer in charge of personal information processing, related complaints and remedies is as follows.

Requests for access, correction, deletion or suspension of processing may be submitted to the contact above. General inquiries may also be left through the Contact page.

Users may apply for dispute resolution or consultation with the organizations below to obtain relief for infringement of personal information. Users whose rights or interests are infringed by a disposition or omission in response to a request under Articles 35, 36 or 37 of the Personal Information Protection Act may also file an administrative appeal under the Administrative Appeals Act.

Any addition, deletion or amendment to this Policy is announced on the Website at least 7 days before the effective date. Important changes to user rights are announced at least 30 days in advance.