1. PURPOSES OF COLLECTION AND USE OF PERSONAL INFORMATION
We may collect and process personal information about you for the following purposes. We do not otherwise share your personal information with third parties or use your personal information for any other purposes unless otherwise expressly provided herein.
1.1. Inquiry Response
We may use your personal information in connection with responding to your inquiries and grievances. That is, we may process personal information about you to confirm your identity, to review your questions or complaints and to communicate to you with our responses.
1.2. Provision of Products or Services
We may process your personal information to develop new services or provide more personalized and streamlined services based on demographic information or information about your interest and also to monitor statistics for your use of our Services.
1.3. Promotional Events
We may use or process personal information about you to invite you to our special promotional events from time to time.
1.4. User Verification and Registration
We may collect and use personal information about you as our User (as defined in our TGA Terms of Service) to verify your identity and status, to prevent unauthorized use or intrusion to our Services, to confirm your consent to join our Services, to verify registration status and prevent you from creating multiple accounts and also for our record keeping purposes in connection with dispute resolution and customer services.
2. COLLECTION AND USE OF PERSONAL INFORMATION
We may collect personal information about you in connection with providing the TGA Services through the following methods.
2.1. Collection Methods
We may use the following methods to collect personal information about you.
2.1.1. through our website, on paper forms, via facsimile and phone, or Q&A board on our website or by your entrance to our promotional events;
2.1.2. through our agents and third party partners; or
2.1.3. via information collecting tools.
2.2. Collection and Use Policy
The following information about you may be collected on our website (www.thegreatanatomy.com) and we only use such information for the purposes set forth under “1. Purposes of Collection and Use of Personal Information.“
2.2.1. Information collected: name and email address, country of residence
2.2.2. Other information automatically collected: cookie, IP address, usage history, visiting history, and device information (model number, operating system and unique identifiers of the device)
.2.2.4. Your Right to Review and Update Information on the Website.
You may access and review your personal information that you provided when you created your user account on the Website so that you can update your information from time to time. If you wish to cancel and delete your account, you may login and follow the instructions contained on our Website.
Unless we have a legal basis to store your personal information to comply with tax or accounting rules and regulations, we will delete or de-identify the personal information we have collected about you upon your request to delete or cancel your account.
2.2.5. Sharing of Personal Information of Our Users
We may disclose personal information about you if necessary to respond to the inquiries or verification requests that we receive in connection with the TGA Services. We may also share information about our Users within the Company to provide, understand, or improve our Services.
2.2.6. Withdrawal of Consent
After the User enabled the respective settings on the device as provided above, we will no longer collect, use, share, or otherwise process personal information from that device for personalized advertising experience.
Unless we have another legal basis for keeping the User’s personal information, we will also delete or de-identify the personal information we have collected about such User within 30 days from the date on which the User applied one of the above methods to withdraw consent.
2.2.7. Where Legally Required
We will process personal information as necessary to comply with applicable laws. For example, we will collect from the Users of IP addresses to identify a country location so that we know whether such Users are located in the European Economic Area, the United Kingdom, or Switzerland, but we will not share the Users’ full IP addresses or retain the same internally.
2.2.8. Minors Under the Age of 16
If a User resides in the European Economic Area, the United Kingdom, or Switzerland, then the User must be at least 16 years of age to give his/her consent to TGA Services. We do not collect or otherwise process personal information from individuals in the European Economic Area, the United Kingdom, and Switzerland whom we know are under the age of 16, except to comply with apply laws or to support our legitimate interests.
3. PERSONAL INFORMATION AND THIRD PARTIES
We use personal Information about our Users only to the extent provided under “2. Collection and Use of Personal Information.” Except where we are required to disclose or submit personal information to comply with applicable laws, regulations, legal processes, governmental requests or court orders, we will not use or disclose to any third-party personal information about the Users for any other purposes without their prior consent.
4. RETENTION AND USE OF PERSONAL INFORMATION
We will promptly delete or de-identify the personal information we have stored about our Users once we have accomplished the purposes for collecting and storing the personal information as provided above with exception of the following reasons (and no other reasons) in which cases, we may store the personal information for the duration set forth below.
Storing Personal Information Pursuant to Applicable Laws
To the extent required under applicable laws, including, without limitation, the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, etc., we may store personal information about you for certain period of time. We store such information only to be in compliance with applicable laws and only for the time period set forth below. In no case we use the information stored hereunder for any other purpose.
4.1. Pages Visited
4.1.1. Applicable Law: Protection of Communications Secret Act
4.1.2. Retention Period: 3 months
4.2. Records on Customer Complaints or Disputes
4.2.1. Applicable Law: Act on the Consumer Protection in Electronic Commerce, Etc.
4.2.2. Retention Period: 3 years
4.3. Records on Payments Made and Collected for Supply of Goods
4.3.1. Applicable Law: Act on the Consumer Protection in Electronic Commerce, Etc.
4.3.2. Retention Period: 5 years
4.4. Records on Entering into or Withdrawing from Contractual Relationship
4.4.1. Applicable Law: Act on the Consumer Protection in Electronic Commerce, Etc.
4.4.2. Retention Period: 5 years
4.5. Records on Collection and/or Processing of Credit Information
4.5.1. Applicable Law: Credit Information Use and Protection Act
4.5.2. Retention Period: 3 years
4.6. Records on Advertising and Display
4.6.1. Applicable Law: Act on the Consumer Protection in Electronic Commerce, Etc.
4.6.2. Retention Period: 6 months
5. DESTRUCTION OF PERSONAL INFORMATION
We will promptly destroy personal information that is no longer required to fulfil the identified purposes stated above. We apply the following procedures in destroying such personal information.
5.1. Destruction Procedures
We will move such personal information that is no longer required to fulfil the identified purposes to a separate DB (separate files in case of information in hard copies) and maintain it for set duration of time or promptly destroy as required by applicable laws. We will not use the personal information that is maintained in separate DB for any reasons except to comply with applicable laws.
5.2. Disposal Method
- Personal information stored in electronic format will be deleted by using a technical approach to prevent it from being restored.
- Information on paper form will be shredded or incinerated.
6. RIGHTS OF USERS
Users of TGA can login in to check and update their personal information registered on our system at any time. If they wish to withdraw their consent to our processing of personal information about them, then the Users can either withdraw their consent or request for cancellation of their accounts (please note that you may not be able to use our services or any part thereof upon your withdrawal of your consent or cancellation). To access or modify your personal information, you can login to your account and click on ‘update member information’ and to cancel your account (or to withdraw your consent), you can click on ‘closing account’ and follow the instructions. You can also write to us or call or e-mail us and make your request to modify or cancel. If you request a correction of your personal information registered on our system, we will not use or share your information until the correction is completed. Also, if we have already shared the personal information containing an error with any third party, we will promptly notify the third party of the correction.
7. How We Protect Your Personal Information
We strive to safeguard personal information of our Users by utilizing technology and management system as follows.
7.1. Encryption of Personal Information
Sensitive and critical information such as your password is encrypted and only you can check and modify such information.
7.2. Protection from Security Threats
We are doing our best to safeguard personal information of our Users from being leaked or damaged by hacking or computer viruses. In order to prevent the loss of personal information, we back up our data on a regular basis, use the latest anti-virus program, and use encryption technology to securely transmit personal information on our network. In addition, we use firewall to block unauthorized access from the outside, and we try to equip all possible technical devices to secure our system.
7.3. Limiting Access to Your Personal Information
To reduce the risk of security breach, we are limiting access to personal information of our Users to only those employees who are specifically trained for handling of such information. We also change the password to the access periodically and place emphasis on the importance of safeguarding the personal information and compliance with applicable laws and policies by training our employees on a regular basis.
7.4. Special Force Dedicated for Protection of Personal Information
We have a special task force dedicated solely for protection of personal information of our Users. We continuously monitor our compliance with applicable laws and regulations and we strive to correct any breach or problem immediately upon notice.
8. RESPONSIBLE PERSONNEL
We have designated the following persons as administrators of personal information that we collect and process. You many direct your inquiries or complaints on our processing of your personal information to them. You may contact the below named administrators with all your inquiries on personal information. We will attempt to respond to your inquiries in a timely manner.
8.1. Personal Information Administrator
- Name: HEORYONG CHUNG
- Title: Chief Personal Information Administrator
- E-MAIL: firstname.lastname@example.org
8.2. Relevant Agencies
You may also contact the following agencies to report any personal information breach or other related inquiries.
11. YOUR DATA PROTECTION RIGHTS UNDER GDPR
TGA makes the following efforts to comply with the EU GDPR (General Data Protection Regulation, “GDPR”).
- GDPR awareness raising activities
- Perform data protection impact assessment
- Ensuring User Rights
- Report and Notification of Personal Data breach
11.1. GDPR awareness raising activities
TGA is committed to companywide efforts and attention to complying with the GDPR. We identify the impact GDPR will have on our organization and are committed to complying with GDPR on a job-by-job basis by:
- Participating Department: Customer Management, Human Resources, Finance, Marketing, System Development, etc.
- Surveys of employees on privacy knowledge levels
- Official declaration of management's commitment to comply with GDPR
- Encourage participation in GDPR conferences and seminars
- Manage check list of departmental performance items
11.2. Data Protection Impact Assessment
TGA conducts a data protection impact assessment if the following situations are likely to pose a high risk to the rights and freedoms of natural persons as provided by GDPR.
- Rating or grading
- Automated decision making with legal or similarly important effects
- Monitoring using the system
- Sensitive Information
- Information Processing at Scale
- Linked or combined set of information
- Information on Vulnerable Data subjects
- User Rights Guarantee
11.3. User Rights Guarantee
TGA is committed to ensuring the Right to Delete (Right to Be Forgotten) as defined by GDPR. The data subject has the right (delete right) to request the deletion of personal data related to him.
- When personal data is no longer needed for the purpose of collection or processing
- When the data subject withdraws consent for the processing of personal data and there is no legal basis for processing the personal data
- When the data subject opposes the processing of personal data pursuant to Article 21 (Right to object), Paragraph 1 of GDPR, and there is no justifiable reason to override the processing of related personal data, or the data subject opposes to direct marketing pursuant to Article 21, Paragraph 2 of GDPR
- When personal data is illegally processed
- When personal data needs to be deleted to comply with EU or EU member state legislation
- When personal data has been collected in connection with the provision of information and social services to children
11.4. Restrictions to the Right to Be Forgotten
However, TGA can reject a delete request if one of the following is true:
- For the exercise of the right to freedom of expression and information
- To comply with legal obligations of the EU or EU Member States, to perform public affairs, or to exercise public authority granted to TGA
- For public health purposes
- For public record keeping and scientific or historical research and statistical purposes
- For the purpose of demonstrating, exercising or defending a legal claim
- Right to move personal data
11.5. Report and Notification of Personal Data Breach
TGA will report to the supervisory authority within 72 hours of becoming aware of a breach if any of the following infringements occur that could pose a risk to an individual's rights and freedoms:
- Reputation damage
- Financial loss
- Secret leakage
- Other significant economic and social disadvantage risks
When there is a high risk of the freedom and rights of the data subject, the data subject is notified without delay.
12. YOUR DATA PROTECTION RIGHTS UNDER CCPA
If you are a California of USA resident, this Section shall apply only to the extent and when TGA is regulated under the California Consumer Privacy Act (the “CCPA”), as a business (as defined in the CCPA). [note: TGA may not be eligible as a business under CCPA until it satisfies some thresholds.]
12.1 Consumer Information Collected
We may collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with particular California residents, devices or households ("consumer information").
12.2 Use of Consumer Information
12.3 Disclosures of Consumer Information for a Business Purpose
- personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
- internet or other similar network activity
12.4 Sales of Consumer Information
12.5 California Residents’ Rights and Choices
The CCPA provides California residents with specific rights regarding their consumer information. This Section 12.5 describes your CCPA rights (to the extent applicable to you) and explains how to exercise those rights.
12.5.1 Access to Specific Information and Data Portability Rights
You may have the right to request that TGA disclose certain information to you about our collection and use of your consumer information over the past 12 months. Once we receive and confirm your verifiable consumer request (in the manner described in Section 12.6 below), to the extent required by the CCPA, we will disclose to you.
12.5.2 Deletion Request Rights
You have the right to request that TGA delete any of your consumer information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm a verifiable request from you (if you are a California resident) in the manner described in Section 12.6 below (“verifiable consumer request”), we will delete (and direct our service providers to delete) your consumer information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for our or our service provider(s)’ legitimate business purposes.
12.6 Exercising Access, Data Portability, and Deletion Rights
12.6.2 We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing.
We will not discriminate against you for exercising any of your CCPA rights, including, unless permitted by the CCPA, by:
12.7.1 denying you goods or services
12.7.2 charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties
12.7.3 providing you a different level or quality of goods or services
12.7.4 suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services