Personal information is processed for the following purposes. The processed personal information shall not be used for purposes other than those stated below. If the purpose of use is changed, prior consent will be obtained.

Provision of Services and Performance of Duties

Personal information is processed for the purpose of providing services such as content delivery and for performing duties related to the fulfillment of contracts.

Handling of Complaints

Personal information is processed for the purpose of handling complaints related to personal information, including requests for access to personal information, correction or deletion of personal information, suspension of processing, and reporting of personal information breaches.

Personal information is processed within the retention and use period prescribed by applicable laws and regulations, or within the retention and use period consented to by the data subject at the time the personal information is collected.
※ Major personal information collected and retained by the Korea Brain Research Institute pursuant to laws and regulations is described in Article 6 (Items of Personal Information Processed).

The Korea Brain Research Institute provides personal information to the following institutions or parties. The purpose and scope of provision are as follows.
In principle, the Institute processes personal information within the scope specified for collection and use. Except for the following cases, personal information shall not be processed beyond the original purpose or provided to third parties without prior consent from the data subject.
However, personal information may be provided to third parties within the scope of the purpose in the following cases:

The Korea Brain Research Institute outsources personal information processing tasks as follows to ensure smooth processing of personal information. Information on the responsible department, contractor, scope of outsourcing, and retention and usage period is provided.

When entering into outsourcing contracts, the Korea Brain Research Institute documents the following matters and supervises whether the contractors process personal information securely.

Matters concerning the prohibition of processing personal information for purposes other than the performance of outsourced tasks
Matters concerning technical and administrative protective measures for personal information
The purpose and scope of the outsourced tasks
Matters concerning restrictions on re-outsourcing
Matters concerning measures to ensure security, such as access restrictions to personal information
Matters concerning supervision, including inspection of the management status of personal information retained in relation to outsourced tasks
Matters concerning compensation for damages in cases where the contractor violates obligations to be observed

When entering into outsourcing contracts, the Institute clearly stipulates compliance with personal information protection laws, prohibition of third-party provision of personal information, and allocation of responsibility, and retains the contract contents in written and electronic form. Any changes to contractors will be announced through notices and the Privacy Policy.

Request for Access to Personal Information

Data subjects may request access to personal information files held by the Korea Brain Research Institute pursuant to Article 35 (Access to Personal Information) of the Personal Information Protection Act. However, requests for access to personal information may be restricted in accordance with Article 35(4) of the Act in the following cases

• A. When access is prohibited or restricted by law

• B. When access may cause harm to the life or body of another person, or unjustly infringe upon the property or other interests of another person

• C. When access would cause significant hindrance to the performance of any of the following tasks:

• ① Tasks related to the imposition, collection, or refund of taxes

• ② Tasks related to academic performance evaluation or admission selection at schools established under the Elementary and Secondary Education Act and the Higher Education Act, lifelong education facilities under the Lifelong Education Act, or higher education institutions established under other relevant laws

• ③ Tasks related to examinations for academic qualifications, skills, employment, or qualification screening

• ④ Ongoing evaluations or judgments related to the calculation of compensation or benefits

• ⑤ Audits or investigations in progress pursuant to other laws

Request for Correction or Deletion of Personal Information

Data subjects may request the correction or deletion of personal information files held by the Korea Brain Research Institute pursuant to Article 36 (Correction or Deletion of Personal Information) of the Personal Information Protection Act. However, deletion requests may not be granted if the personal information is explicitly required to be collected under other applicable laws.

Request for Suspension of Processing of Personal Information

Data subjects may request the suspension of processing of personal information files held by the Korea Brain Research Institute pursuant to Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act.
However, in accordance with Article 37(2) of the Act, requests for suspension of processing may be denied in the following cases:

• (a) When access to personal information is prohibited or restricted by law

• (b) When the suspension may harm the life or body of another person, or unjustly infringe upon the property or other interests of another person

• (c) When the suspension would cause significant hindrance to the performance of certain duties

• (d) When required by special provisions of law or unavoidable to comply with statutory obligations

• (e) When the suspension may harm the life or body of another person, or unjustly infringe upon the property or other interests of another person

• (f) When the suspension would make it impossible to perform duties prescribed by other laws

• (g) When the suspension would make it difficult to perform a contract with the data subject, such as being unable to provide agreed services, and the data subject has not clearly expressed an intention to terminate the contract. Personal information that is terminated or deleted at the request of the data subject shall be processed in accordance with the retention and processing period specified in Article 2.

① The Korea Brain Research Institute processes personal information within the scope specified in this Privacy Policy for the performance of its duties and the handling of civil complaints, and operates personal information files in accordance with Article 32 of the Personal Information Protection Act.

② The purpose, retention period, and items of each personal information file are determined according to the characteristics of the respective file. Detailed information for each personal information file can be found on the Personal Information Protection Portal.

※ Personal Information Protection Portal → Personal Services → Data Subject Rights → Request for Access to Personal Information → Search Personal Information Files → Enter “Korea Brain Research Institute” as the institution name and search

(Korea Brain Research Institute Personal Information Files) Go to the Personal Information Portal

Once the purpose of processing personal information has been fulfilled, the relevant personal information will be destroyed without delay. The procedures, time limits, and methods for destruction are as follows.

Destruction Procedures

Personal information entered by users is transferred to a separate database (or to separate documents in the case of paper records) after the purpose of processing has been achieved, and is stored for a certain period or destroyed immediately in accordance with internal policies and other relevant laws. Personal information transferred to a database shall not be used for any other purpose unless required by law.

Destruction Deadline

Personal information shall be destroyed within five (5) days from the end date of the retention period if the retention period has expired. If personal information becomes unnecessary due to the fulfillment of the purpose of processing, termination of the relevant service, or closure of the business, such personal information shall be destroyed within five (5) days from the date on which it is deemed unnecessary.

Destruction Methods

Personal information in electronic file form is destroyed using technical methods that make recovery impossible. Personal information printed on paper is destroyed by shredding or incineration.

Korea Brain Research Institute> does not use cookies to store and retrieve usage information for the purpose of providing personalized services.

Pursuant to Article 29 of the Personal Information Protection Act, the Korea Brain Research Institute implements the following technical, administrative, and physical measures necessary to ensure the security of personal information.

Minimization and Training of Personnel Handling Personal Information

The Institute designates personnel who handle personal information and limits such handling to authorized staff only, thereby minimizing access and implementing measures to manage personal information securely.

Regular Internal Audits

To ensure the security of personal information processing, the Institute conducts regular internal audits (once per quarter).

Establishment and Implementation of Internal Management Plans

The Institute establishes and implements internal management plans to ensure the safe processing of personal information.

Encryption of Personal Information

Users’ personal information, including passwords, is stored and managed in encrypted form so that only the user can access it. For important data, additional security measures are applied, such as encryption of files and transmitted data or the use of file-locking functions.

Retention of Access Records and Prevention of Forgery or Alteration

Records of access to personal information processing systems are retained and managed for at least six (6) months, and security measures are applied to prevent such records from being forged, altered, stolen, or lost.

Use of Locking Devices for Document Security

Documents and auxiliary storage media containing personal information are stored in secure locations equipped with locking devices.

Access Control for Unauthorized Persons

Physical storage locations for personal information are separately designated, and access control procedures are established and operated for such locations.

Data subjects may apply for dispute resolution or consultation regarding personal information infringement through the following institutions.

• Personal Information Infringement Reporting Center (operated by the Korea Internet & Security Agency)

  • Scope of Services: Reporting of personal information infringement and consultation

  • Website: privacy.kisa.or.kr

  • Phone: 118 (without area code)

  • Address: Personal Information Infringement Reporting Center, Korea Internet & Security Agency,
    135 Jungdae-ro, Songpa-gu, Seoul 05719, Republic of Korea

• Personal Information Dispute Mediation Committee (operated by the Korea Internet & Security Agency)

  • Scope of Services: Application for personal information dispute mediation and collective dispute mediation (civil resolution)

  • Website: http://www.kopico.go.kr

  • Phone: 1833-6972

  • Address: 12F, Government Complex Seoul,
    209 Sejong-daero, Jongno-gu, Seoul 03171, Republic of Korea

• Cyber Investigation Division, Supreme Prosecutors’ Office

  • Website: www.spo.go.kr

  • Phone: 1301 (without area code)

• Cyber Bureau, National Police Agency

  • Website: cyberbureau.police.go.kr

  • Phone: 182

① Data subjects may submit requests for access to personal information pursuant to Article 35 of the Personal Information Protection Act to the department listed below. <Korea Brain Research Institute> will make every effort to ensure that requests for access to personal information are processed promptly.

② In addition to submitting requests for access to personal information pursuant to Paragraph (1), data subjects may also submit requests through the Personal Information Protection Commission’s “Integrated Support Portal for Personal Information” website (www.privacy.go.kr).
Personal Information Protection Commission Integrated Portal → Personal Information Complaints → Requests for Access to Personal Information, etc.

<Korea Brain Research Institute> designates a Personal Information Protection Officer and a 담당자 as follows in order to protect personal information and handle complaints related to personal information.

This Privacy Policy shall take effect as of May 1, 2024.
Previous versions of the Privacy Policy may be found below.