Privacy policy

The Company processes personal data for the following purposes and does not use it for any other purpose.

• Membership registration and management: identity verification, maintaining membership, preventing fraudulent use, and notices
• Exam registration and operation: candidate registration and identity verification, schedule notices, and exam supervision
• Score processing: calculating, issuing, and looking up scores and sending score reports
• Payment: processing and refunding exam fees and managing transaction records
• Customer support: receiving and handling enquiries and complaints and delivering announcements
• Organisation membership and Cambridge preparation centre registration: verifying and approving organisations, processing preparation centre registration applications, and contacting organisations about group exams

The online registration form does not collect a portrait photo or a photo of an ID document. ID information, test-day captures and other unique-identifier or sensitive data are processed with the data subject's separate consent as required under PIPA.

The Company destroys personal data without delay once the processing purpose is achieved or the retention period lapses, and retains it for the required period where the law so requires.

• Member information: until account withdrawal
• Organisation member information: until the organisation membership is withdrawn (preparation centre details registered with Cambridge are kept for the period set by Cambridge's retention policy)
• Organisation registration drafts: 30 days after the last change, or until the registration is completed
• Online-registration date of birth and ID information, and candidate photos retained from earlier applications: automatically destroyed once the exam session is marked completed or cancelled
• Test-day photo and recording materials: the period stated in the applicable exam notice and Cambridge retention policy (Linguaskill recordings are retained for 6 months)
• Exam and score records: the period set by relevant laws and Cambridge retention policy
• Enquiry and support records: 3 years after the enquiry is closed (the retention period for consumer complaint and dispute records under the E-Commerce Act)
• Statutory retention: contract and payment records 5 years, consumer complaint and dispute records 3 years (E-Commerce Act), access logs 3 months (Protection of Communications Secrets Act)
• Method of destruction: electronic files are deleted so recovery is impossible; paper documents are shredded or incinerated

The Company does not provide personal data to third parties without the data subject's consent. However, for exam operation and preparation centre registration it provides personal data to Cambridge as follows, which constitutes an overseas transfer.

Timing and method of transfer: candidate data after the registration is confirmed, and organisation data after the organisation is approved, are entered by Company staff into Cambridge's centre administration system (Cambridge English for Centres).

Data subjects may refuse the above provision and overseas transfer; if they do so, exam registration, organisation membership registration and preparation centre registration may be restricted.

Data subjects may at any time request to view, correct, delete, or halt the processing of their personal data and may withdraw consent.

• Rights may be exercised directly via My Page or by writing or email to the data protection officer, and the Company acts without delay.
• Rights may also be exercised through a legal representative or an authorised agent.
• For children under 14, personal data is processed with the legal representative's consent, and the legal representative may exercise these rights.
• Viewing, deletion, and other rights may be restricted under relevant laws.

• Administrative: establishing and implementing an internal management plan, staff training, and minimising access rights
• Technical: access control, encryption of personal data such as passwords, operation of security programs, and storage of access logs
• Physical: controlling access to areas where personal data is stored

The Company may use cookies to keep login sessions and improve its services. Users may refuse cookie storage in their web browser settings; in that case, use of some services that require login may be restricted.

The Company uses Google Analytics to analyse site usage; information collected via cookies may be transferred to and processed by Google (in the United States). Users may refuse this via their browser's cookie settings or Google's opt-out tools.

For enquiries, complaints, or remedies regarding personal data processing, please contact the data protection officer below; the Company will respond and act without delay.

Data subjects may apply to the following bodies for consultation or dispute mediation regarding infringement of their personal data.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Complaint Centre (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cybercrime Investigation Division: 1301 (www.spo.go.kr)
• National Police Agency Cyber Investigation Bureau: 182 (ecrm.police.go.kr)

Any change to this policy will be announced on this page at least 7 days before it takes effect.