Usage guide

Pohang University of Science and Technology has the following management policies in compliance with the Personal Information Protection Act in order to protect users’ personal informationand interests and to handle user complaints efficiently. When the personal information management policies are revised, it will be notified through the website announcements (or individual notification).

Article 1 The Purpose of Managing Personal Information

Pohang University of Science and Technology manages personal information for the following purposes. The managed personal data shall not be used for any purpose other than the following and when the purpose is changed, POSTECH will ask for prior consent.

Article 2 Period for which Personal Information is Managed and Held and Items of Personal Information to be Managed

The items, management department, management basis and management period of personal informationfor the provision of POSTECH services and membership registration are as listed below.

* Other details of POSTECH’s personal information files status is available: visit the Personal Information Protection General Support Portal of the Ministry of Government Administration and Home Affairs (www.privacy.go.kr)
Civil petitions for personal information > Application for inspection of personal information > Personal information files list search. Then enter “Pohang University of Science and Technology” for the institute name to access the information.

Article 3 Personal Information Provided to Third Party

• In principle, Pohang University of Science and Technology, manages the user’s personal information under the purposes set forth in Article 1 (The Purpose of Managing Personal Information) and without the prior consent of users, shall not manage the user’s personal information for any purpose other than intended ones, nor provide them to any third party: Provided, however that management in the following subparagraphs may be allowed
• - Where the user has, in advance, agreed to provide to a third party or disclose to the public.
• - Where the provision is required by statues.
• - Where it is necessary for performing a contract and considerably difficult to obtain the usual consent of a subject for economic or technical reasons.
• - Where personal information is used in a form by which an individual cannot specifically be identified

Article 4 Entrustment of Personal Information Management

• Pohang University of Science and Technology entrusts the smooth management of personal information as follows. <College Newsletter Dispatch Management>
• Trustee: DUEEntrusted affairs: collecting and managing the recipients of the newsletter and dispatching the newsletter, etc.
• When Pohang University of Science and Technology concludes a contract for entrustment of personal information management,it clearly states in writing in accordance with Article 25 of the Korean Personal Information Protection Act;matters concerning prohibition of managing personal information for any purpose other than for performance of entrusted affairs;matters concerning technical and administrative protection measures;matters concerning the restriction on re-entrust; supervision and management of the trustee; and compensation for losses and any other liabilities.Moreover, it supervises whether the trustee safely manages the personal information.
• When there is a change of the affairs of management or trustee, it shall be immediately disclosed through this privacy policy.

Article 5 The Rights and Responsibilities of the Subject ofInformation and Methods of Exercising Rights

A user may exercise its rights as follows.

• A subject of information may exercise the following rights of personal information protection at any time towards Pohang University of Science and Technology.
• - To make a request for inspection of his/her personal information
• - To make a request for correction of errors, if necessary
• - To make a request for deletion
• - To make a request for suspension of management
• The exercise of the rights pursuant to Clause 1 shall be implemented through submitting a hand-written document, sending an e-mail or a fax, etc.Then Pohang University of Science and Technology shall take necessary measures immediately.
• When the subject of information makes a request for either correction or deletion of errors of personal information, Pohang University of Scienceand Technology shall not use or provide the corresponding personal information until the correction or deletion process is completed.
• The exercise of the rights pursuant to Clause 1 shall be conducted by his/her legal representative of the subject of information or a person who holds a delegation of authority. Provided, however that it is necessary to submit a power of attorney in Appendix 11 prescribed by Enforcement Ruleof the Personal Information Protection Act.

Article 6 Destruction of Personal information

• In principle, Pohang University of Science and Technology shall destroy the personal information immediately when management purpose of personal information is achieved.Methods, procedures and periods of destroying personal information are as follows.
• - Destruction Procedure
• Once the management purpose of the information that users registered is achieved, the information shall be destroyed immediately or after the lapse of time period for which the storage in a separate DB (or in a separate document, if it was in the form of papers) is allowed as prescribed in relevant acts or internal policy. At this time, the personal information transferred to the separate DB shall not be used for any other purpose other than the ones prescribed in the regulations.
• - Destruction Period
• When the personal information holding period is expired, the information shall be destroyed within 5 days from the expiration date. When the information becomes unnecessary as its management purpose is achieved, the relevant service is terminated, the relevant business is closed and any other ground shall destroy the personal information within five (5) days from the date that the personal information is acknowledged to be of no need.
• - Destruction Method
• Electronic file form of information shall be permanently deleted beyond recoverability through technical measures. Personal information printed on paper shall be shred or incinerated.

Article 7 Measures to Ensure Safety of Personal Information

• - Minimizing the numbers of managing employees of personal information and Educating them
  For personal information management, it is our policy to appoint and give an access authority to only the managing employees of personal information at a minimum level.
• - Enforcement of periodic internal audit
  To ensure safety in managing personal information, internal audit is carried out periodically (by quarter).
• - Establishment and enforcement of internal management plan
  POSTECH establishes and enforces the internal management plan to ensure safe management of personal information.
• - Encryption of personal information
  For the storage and management of user’s personal information, it is encrypted with passwords that only a user can identify. For more important data, additional security features are applied such as the encryption of files and transmitted data and the file lock-down, etc.
• - Technical measures against hacking, etc.
  To prevent the leak and damage of personal information through hacking or computer viruses, etc., Pohang University of Science and Technology installs, checks and renew periodically the security program. Moreover, the university installs the system in access control area from outside and manages the system with the technical and physical surveillance and interception measures.
• - Limited access to personal information
  We take necessary measures for access control to personal information through assigning, changing, terminating access authority to the database system managing personal information; and POSTECH controls unauthorized access from outside through firewall system.
• - Tamper-proof archiving of access records
  POSTECH stores and manages the access records to the personal information management system for at least 6 months. Moreover, the university adopts security features to prevent the forgery, illegal alteration, theft and loss of the access record.
• - Access control against unauthorized persons
  POSTECH installs physical space to store the personal information and establishes and enforces access control procedures.

Article 8 Personal Information Protection Officer

• Pohang University of Science and Technology appoints personal information protection officers as described belowwho are in charge of the personal information management to help deal with complaints from the subjects of information and remedy against injury.

Article 9 Remedies for Rights and Interests Infringement

• The subject of personal information may apply for dispute resolution or consultation to secure the remedies for personal information infringementtowards the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of the Korea Internet & SecurityAgency, etc. For other personal information infringement reporting and consultation, contact the following agencies.

Article 10 The Changes of Personal Information Policy

• This personal information policy applies from the date of enforcement and in the event of addition, deletion and amendment of its content. Following the change in the statutes and policies, the event will be notified via announcement on the website 7 days prior to the enforcement..