JC1 Corporation (the “Company”) operates eSignon (the “Service”). This Privacy Policy explains how the Company processes personal information in connection with the Service.
Notice date: November 8, 2023
Effective date: December 11, 2023
This English version is based on the Company's Korean Privacy Policy.
Article 1. Purpose
The Company complies with applicable Korean privacy laws for information and communications service providers, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Personal Information Protection Act, the Protection of Communications Secrets Act and the Telecommunications Business Act. It establishes and publishes this Policy under Article 30 of the Personal Information Protection Act to explain its procedures and standards for processing personal information, protect individuals' rights and promptly handle related complaints.
Article 2. Purposes of Processing
- Performing contracts for the Service and settling service charges.
- Verifying identity and preventing improper use.
- Providing materials for mediation in legal disputes.
- Developing new services, answering inquiries and complaints, and communicating notices.
- Providing notifications, including messages between Members.
- Recording service usage, access frequency and statistics.
- Establishing the service environment, providing personalized services and improving the Service.
- Running events and delivering prizes or goods.
- Collecting and processing personal information when the Service is used at the request of an entrusting organization.
Article 3. Information Processed and Retention Periods
1. The Company processes and retains the following information to provide the Service.
| Category / purpose | Information | Retention |
|---|---|---|
| Required: registration | Company name, name, email address and country | Until membership withdrawal |
| Required: social account registration | Kakao: email and name. Naver: email. Google: email, name and locale. | Until membership withdrawal |
| Required: identity verification to prevent identity theft | Name and mobile phone number | Until membership withdrawal |
| Optional: marketing | Name, email and mobile phone number | Until membership withdrawal |
| Optional: entering Signer information | Name and email address or mobile phone number | Until membership withdrawal |
| Optional: recipient identity verification | Name and mobile phone number | Until membership withdrawal |
| Required: service-generated information used to verify that a Signer matches the intended recipient and to support dispute resolution | IP addresses, cookies, service usage records, device information (PC/mobile), images and files attached when completing documents | Until membership withdrawal |
| Required: payment | Card payment: card name, card number and email. Bank deposit: company name, name, contact details and email. | Until membership withdrawal, or for five years after contract expiry before destruction |
| Optional: customer support through the website, Channel Talk or telephone | Company name, name, email and telephone number | For three years after membership withdrawal, then destroyed |
| Optional: newsletter subscription | Name and email | Until subscription consent is withdrawn |
2. Members must provide genuine information about themselves and information related to them. A Member who registers false information or misappropriates another person's information cannot assert rights relating to use of the Service and may be subject to penalties under applicable laws.
3. Personal information is destroyed without delay when its purpose has been fulfilled. The following information is retained for the stated periods under applicable laws or internal policies.
| Basis | Records | Period |
|---|---|---|
| Act on Consumer Protection in Electronic Commerce | Contracts or withdrawal of offers, payments, and supply of goods or services | 5 years |
| Act on Consumer Protection in Electronic Commerce | Consumer complaints or dispute handling | 3 years |
| Protection of Communications Secrets Act | Website visit records | 3 months |
| Electronic Financial Transactions Act | Electronic financial transaction records | 5 years |
| Prevention of improper use | Records of improper use | 5 years |
Article 4. Entrusted Processing
For smooth and secure operation, the Company entrusts processing as follows. Its processing agreements set out the measures necessary to protect personal information in accordance with applicable laws.
| Processor | Entrusted task |
|---|---|
| Korea Mobile Certification Co., Ltd. | Mobile phone identity verification |
| Korea Trade Network (KTNET) | Joint-certificate authentication and electronic signatures |
| MTS Company Co., Ltd. | Kakao Alimtalk and SMS delivery |
| KG Inicis | Payment processing |
| Channel Corporation | Customer consultation and marketing |
| Stibee | Delivery of eSignon news and event newsletters |
| Microsoft Azure Cloud Service | Cloud server operation |
| eSignon usage statistics and personalized advertising | |
| SendGrid | Email delivery during the eSignon contract workflow |
Article 5. Disclosure to Third Parties
The Company uses personal information within the purposes in Article 2. It does not process information beyond its original purposes or provide it to third parties except:
- With the individual's prior consent.
- Where provided by law, or requested by an investigative authority for investigative purposes following legally prescribed procedures and methods.
- Where the information is necessary to perform a contract for the Service and obtaining ordinary consent is significantly difficult for economic or technical reasons.
Article 6. Destruction of Personal Information
- The Company destroys personal information when it is no longer necessary, including when the retention period expires or its processing purpose has been achieved.
- Electronic files are permanently deleted using a method that prevents recovery. Records, printed materials, written documents and other recording media are shredded or incinerated.
- If another law requires continued retention after the agreed retention period or purpose has ended, the information is moved to a separate database or retained in a different storage location.
Article 7. Individual Rights and How to Exercise Them
- The Company does not disclose, publish or distribute personal information obtained through the Service to others without the individual's prior consent.
- Members may view or correct their registered information or withdraw membership at any time. Rights may be exercised in writing, by email or through customer support.
- To view, correct or delete account information, sign in to the website and use Settings → My Information. The Company will not use or provide the relevant information to others until processing of the request is complete. Withdrawal of consent and deletion may restrict some or all of the Service. It may not be possible to withdraw consent for information collected under other laws.
For privacy requests, including access, correction, consent withdrawal or account deletion assistance, email support@esignon.net.
Article 8. Security Measures
Under Article 29 of Korea's Personal Information Protection Act, the Company takes the following technical, administrative and physical measures.
Technical measures
- Security programs and periodic checks to prevent leakage or damage caused by hacking and computer viruses.
- Encrypted storage and management of personal information and passwords, and additional protection for important data through file and transmission encryption or file-locking functions.
- Granting, changing and revoking access rights to personal-information databases and controlling unauthorized external access.
Administrative measures
- Designating and limiting personnel who handle personal information and providing training.
- Establishing and implementing privacy guidelines and internal management plans for safe processing.
Physical measures
- Keeping documents and removable storage media containing personal information in secure, locked locations.
- Preventing unauthorized access to important Company facilities.
- Maintaining personal-information protection liability insurance to compensate for harm to Users from privacy incidents.
Article 9. Cookies and Your Choices
- The Company uses cookies to store and retrieve information about Users when providing web-based services. Cookies are small text strings sent by a website server to a browser, such as Internet Explorer, Safari, Chrome or Firefox. They identify a Member's computer, rather than identifying the Member personally.
- Cookies help the website retain settings and provide convenient access. Website visit history and usage patterns are also used to provide personalized information, including optimized advertising.
- Users can configure their browser to accept all cookies, ask before storing a cookie, or reject all cookies. Rejecting cookies may prevent some login-dependent functions from working properly, for which the Company is not responsible.
- The Korean source provides these browser-setting routes: Internet Explorer — Tools → Internet Options → Privacy; Chrome — Customize and control Chrome → Settings → Advanced → Privacy and security → Content settings → Cookies. The names and location of these controls may differ by browser version.
Article 10. Changes to This Policy
Additions, deletions or amendments are announced on the website at least seven days before taking effect. Material changes to Users' rights are announced at least 30 days in advance.
Article 11. Privacy Officer and Remedies
The Company has designated the following officer and department to protect personal information and handle complaints.
- Chief Privacy Officer: Jong-ho Shin, CEO.
- Privacy complaints and access requests: eSignon Team.
- Contact: support@esignon.net.
For reports or advice concerning privacy infringements in Korea, the source policy also identifies the following authorities:
- KISA Privacy Infringement Report Center
- Supreme Prosecutors' Office — cybercrime investigations
- Korean National Police Agency — cyber safety
Earlier versions of the Privacy Policy are available through the Korean policy page.