Privacy Policy

Article 1Purpose

UNIPORT ('the Company') establishes this Privacy Policy ('this Policy') to protect the privacy of individuals ('Users' or 'Individuals') who use the services provided by the Company ('the Company Service'). This is in compliance with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. ('Information Communications Network Act'), and other relevant legislation, aiming to swiftly and efficiently address concerns related to the protection of personal information of service users.

Article 2Principles of Personal Information Processing

In accordance with relevant laws and this Policy, the Company may collect personal information from users. Collected personal information may be provided to third parties with the individual's consent. However, in cases enforced by legal regulations, the Company may provide collected personal information to third parties without prior consent of the individual.

Article 3Disclosure of this Policy

1. The Company discloses this Policy to ensure that users can easily access it at any time via the company's homepage or a linked screen from the homepage.
2. In disclosing this Policy as stated in clause 1, the Company employs user-friendly means such as font size and color to facilitate easy verification by users.

Article 4Amendment of this Policy

1. This Policy may be amended due to changes in laws, regulations, guidelines, notifications, or changes in government or company service policies.
2. When amending this Policy as stated in clause 1, the Company notifies users by one or more of the following methods:
   • Posting on the notice section of the homepage of the internet website operated by the Company or through a separate window
   • Notifying users through written documents, fax, email, or similar methods
3. The announcement of amendments as mentioned in clause 2 will be made at least 7 days prior to the effective date of the amendment. However, in cases of significant changes affecting user rights, the announcement will be made at least 30 days in advance.
4. Notwithstanding clause 3, when the Company adds or changes a processor (Article 13-2), it amends and discloses this Policy without delay. Where the change significantly affects user rights, the proviso of clause 3 applies, and where personal information is newly transferred overseas, the Company follows the requirements and procedures set by the relevant laws.

Article 5Information for Membership Registration

The Company collects the following information for user registration to the Company Service:

• Required information: Email address and password

Article 6Information for Identity Verification

The Company collects the following information for user identity verification:

• Required information: Email address, name, date of birth, gender, identity verification values (CI, DI), and nationality (domestic/foreign)
• Information collected when the User applies for identity document verification (KYC):
  • Images of the identity document chosen by the User (passport, alien registration card, student card or another document designated by the Company), including the back side for certain documents, and the information read from them, including country of birth
  • Selfie: a facial photo taken on the identity verification screen of the app, when the User applies with a document that requires a selfie
  • Face data: facial feature information generated from the selfie and the facial photo on the identity document, and the results of face comparison and spoof detection

The Company processes face data in accordance with Articles 34 and 34-2.

Article 7Information for Payment Services

The Company collects the following information to provide payment services to users:

• Required information: Card number, card password, expiration date, first six digits of birthdate (yy/mm/dd), bank name, and account number

Article 8Information for Issuing Cash Receipts

The Company collects the following information to issue cash receipts for users:

• Required information: Name of the cash receipt recipient, birthdate, address, mobile phone number, and cash receipt card number

Article 9Information for Providing Company Services

The Company collects the following information to provide services to users:

• Required information: ID, email address, name, date of birth, and contact number
• Optional information:
  • For physical product delivery: Name, phone number, address
  • For mobile product delivery: Phone number
  • For withholding tax processing: Name, resident registration number, phone number, address, email address
  • For the phone number activation service: Domestic address, domestic phone number, expected visit branch, expected branch visit time
  • For visa and stay status lookups: Passport number, name in English, date of birth, visa application number or invitation number
  • Identification photo (where the User registers it)

Article 9-2Personal Information Processed for the University Admission Service

1. When a User applies to a university through the Company Service, the Company collects and uses the following personal information.

2. Supporting documents may contain personal information of third parties such as the User's parents or financial guarantor. The User shall inform such third parties of the processing described in this Policy and obtain their consent before submission.

Article 10Information for Service Use and Fraudulent Use Check

The Company collects the following information for statistics, analysis of service use, and to confirm and analyze fraudulent use (Fraudulent use refers to acts such as re-registration after membership withdrawal, repeated purchase cancellations after buying products, and illegally receiving economic benefits such as discount coupons and event benefits provided by the Company, acts prohibited in terms and conditions, identity theft, etc.):

• Required information: Service usage records, cookies, access location information, and device information

Article 11Method of Collecting Personal Information

The Company collects personal information of users in the following ways:

• When users enter their personal information on the Company's website
• Through services provided outside the Company's website, such as applications, where users enter their personal information
• When users enter their personal information upon receiving emails sent by the Company
• Through user input while using the Company's services, such as during consultations at the customer center or activities on boards

Article 12Use of Personal Information

1. The Company uses personal information in the following cases:
   1. Necessary cases for company operation, such as delivering announcements.
   2. Cases for service improvement for users, such as replying to inquiries and handling complaints.
   3. Cases for providing the Company's services, including identity verification using face data to enhance security and prevent fraud.
   4. Cases for restricting the use of members who violate laws and Company terms, including measures against fraudulent use, acts that interfere with the smooth operation of services, and identity verification using face data.
   5. Cases for new service development.
   6. Cases for marketing, such as event and promotional notifications.
   7. Cases for demographic analysis, analysis of service visits and usage records.
   8. Cases for forming relationships between users based on personal information and interests.
   9. Cases for looking up visa issuance and stay status, obtaining the visa issuance confirmation, and informing the User.
2. The Company uses face data (Article 34) for the identity verification in subparagraphs 3 and 4 of paragraph 1, limits the purposes of using face data to those set out in Article 34, paragraph 2, and does not use face data for the purposes in subparagraphs 5 through 8 of paragraph 1.

Article 13Consent-Based Information Provision

1. Despite the general prohibition on providing personal information to third parties, the Company may provide personal information to third parties if the user discloses it in advance or consents to the provision. However, even in this case, the Company shall provide the minimum necessary personal information within the scope of relevant laws and regulations.
   • The one carrier or activation agency to which the User applies for phone number activation
     • Recipient: Only the one the User applies to, from the following:
       • Phone number activation: Force One Information & Communication Co., Ltd. (Woori Telecom, business registration number 206-86-70016) (주식회사 포스원정보통신), SK Telecom Co., Ltd. (business registration number 104-81-37225) (에스케이텔레콤 주식회사), KT Corporation (business registration number 102-81-42945) (주식회사 케이티), LG Uplus Corp. (business registration number 220-81-39938) (주식회사 엘지유플러스), KT M Mobile Co., Ltd. (business registration number 133-81-43410) (주식회사 케이티엠모바일), Toss Mobile Co., Ltd. (business registration number 106-86-67749) (토스모바일 주식회사)
     • Items provided: Name, date of birth, nationality, sex, passport number, passport expiry date, passport copy image, SIM serial number (ICCID), phone number, rate plan
     • Purpose of use: Activating the phone number and confirming the activation
     • Retention and use period: As set out in the recipient's privacy policy and applicable laws (including the Telecommunications Business Act)
   • Provide information collected for membership registration and use of the Service to Gwanghwamun, an administrative agency corporation (행정사법인 광화문), for the provision of visa services through an agency when using the Service.
   • The university to which the User applies (e.g., Jungwon University)
     • Items provided: All application form items and supporting documents under Article 9-2, paragraph 1, and information generated by AI-assisted review
     • Purpose of use: Admission screening, issuance of the certificate of admission, and management of international students' stay under the guidelines of the Ministry of Justice
     • Retention and use period: In accordance with the university's privacy policy and regulations, as stated in the university's consent form presented at the time of application
   • The university the User is linked to, and, where the User applied or enrolled through a study abroad agency, that agency (only where the User chooses to consent)
     • Items provided: A copy of the original identity verification (KYC) selfie
     • Purpose of use: Displaying an identification photo on the student information screen
     • Retention and use period: Until the User withdraws the consent or membership (on withdrawal of consent, the display stops immediately and the copy is deleted without delay)
     • This consent is optional, and refusing it does not affect the use of the service. Where the university has registered its own identification photo, that photo is displayed regardless of this consent.
   • National Institute for International Education (TOPIK)
     • Items provided: Name, date of birth, TOPIK examinee number or certificate verification number
     • Purpose of use: Verification of the authenticity of TOPIK scores and score certificates
     • Retention and use period: In accordance with the institution's policy
2. The Company will notify and obtain consent from the user in the same manner when there is a change in the third-party provision relationship described in the preceding clause or when the third-party provision relationship is terminated.

Article 13-2Entrustment of Personal Information Processing

1. The Company entrusts the processing of personal information as follows in order to provide the Company Service. The entrustment agreements provide for the protection of personal information, restrictions on sub-processing and liability for damages, and the Company supervises the processors.

2. "AI processing" means the following work performed with artificial intelligence and character recognition services:
   1. Document reading: reading documents to pre-fill the application form, text recognition and data item extraction from submitted documents, and reading the device information screen (IMEI, EID) for phone number activation;
   2. Identity verification and review assistance: reading identity documents for identity verification (Article 6), and AI-assisted review for university reviewers (Article 35);
   3. Work assistance: converting notices, help documents and search queries into search data, and generating responses in the chat and work-assistant features used by Company, university and agency staff.
3. The Company uses processors for AI processing as follows. The Company sends each processor only the information needed for the processing it handles, and may switch the same processing between Google and OpenAI, L.L.C. for reasons of quality, cost or availability.
   1. Google (Cloud Vision and Vertex AI Gemini): processing under subparagraphs 1 and 2 of paragraph 2 (document images, text recognition results, AI-assisted review material)
   2. OpenAI, L.L.C.: processing under subparagraphs 1 and 2 of paragraph 2 (identity document reading where Google is unavailable or cannot process the document, device information screen reading, and application document reading and AI-assisted review where the Company has changed the setting) and the search data conversion under subparagraph 3 of paragraph 2
   3. Anthropic, PBC: processing under subparagraph 3 of paragraph 2 of conversations entered by staff in the chat and work-assistant features and the information those features retrieve
4. If a processor or the scope of processing of a processor changes, the Company amends and discloses this Policy in accordance with Article 4.

Article 14Retention and Use Period of Personal Information

1. The Company retains and uses personal information for the period necessary to achieve the purpose of collecting and using personal information. Notwithstanding the previous clause, the Company stores records of fraudulent use for up to one year after membership withdrawal to prevent fraudulent registration and use, according to internal policies.
2. The retention and use period of face data and identity document verification images is set out in Article 34, paragraph 5.

Article 15Retention and Use Period of Personal Information According to Laws

The Company retains and uses personal information as follows according to related laws:

• Information and retention period according to the Act on Consumer Protection in Electronic Commerce, etc.
  • Records on contracts or withdrawal of offers: 5 years
  • Records on payment and supply of goods: 5 years
  • Records on consumer complaints or dispute resolution: 3 years
  • Records on advertisement: 6 months
• Information and retention period according to the Protection of Communications Secrets Act
  • Log record data of website visitors: 3 months
• Information and retention period according to the Electronic Financial Transactions Act
  • Records on electronic financial transactions: 5 years
• Information and retention period according to the Act on the Protection and Use of Location Information
  • Records on personal location information: 6 months

Article 16Principle of Destruction of Personal Information

The Company, in principle, immediately destroys the information when personal information is no longer needed, such as when the purpose of processing personal information is achieved or the retention and use period has elapsed.

Article 17Procedure for Destruction of Personal Information

1. Information entered by users for membership registration, etc., is transferred to a separate DB after the purpose of information processing is achieved (in the case of paper, to a separate document box) and is stored for a certain period according to internal policies and other related laws (see retention and use period) before being destroyed.
2. The Company destroys personal information upon occurrence of a destruction cause through the approval procedure of the personal information protection officer.

Article 18Method of Destruction of Personal Information

The Company deletes personal information stored in electronic file formats using a technical method that cannot reproduce the records, and personal information printed on paper is destroyed by shredding or incineration.

Article 19Measures for Sending Commercial Information

1. The Company obtains explicit prior consent from users when sending commercial information for profit-making purposes using electronic transmission media. However, prior consent is not required in the following cases:
   • When the Company has directly collected the contact information of the recipient through the transaction of goods, etc., and sends commercial information for profit-making purposes related to goods of the same kind within 6 months from the end of the transaction
   • When a telemarketer conducts telephone solicitation sales according to the Door-to-Door Sales Act and notifies the recipient of the source of personal information collection verbally
2. The Company does not send commercial information for profit-making purposes if the recipient has expressed refusal of receipt or withdrawn prior consent, and notifies the treatment result of refusal of receipt and withdrawal of consent.
3. The Company obtains separate prior consent from the recipient for sending commercial information for profit-making purposes using electronic transmission media from 9 PM to the next day 8 AM, despite the first clause.
4. When sending commercial information for profit-making purposes using electronic transmission media, the Company explicitly states the following information in the commercial information:
   • Company name and contact information
   • Indication of matters regarding the expression of refusal of receipt or withdrawal of consent
5. The Company does not take any of the following measures when sending commercial information for profit-making purposes using electronic transmission media:
   • Measures to evade or obstruct the recipient's refusal of receipt or withdrawal of consent
   • Measures to automatically generate contact information such as phone numbers and email addresses by combining numbers, symbols, or characters
   • Measures to automatically register phone numbers or email addresses for the purpose of sending commercial information for profit-making purposes
   • Various measures to conceal the identity of the sender of commercial information or the source of advertisement transmission
   • Various measures to deceive recipients and induce replies for the purpose of sending commercial information for profit-making purposes

Article 20Protection of Children's Personal Information

1. The Company allows membership registration only for users aged 14 and over to protect the personal information of children under 14 years old.
2. Despite the previous clause, if a user is a child under 14 years old, the Company obtains consent for the collection, use, and provision of the child's personal information from the child's legal representative.
3. In the case of the previous clause, the Company additionally collects the legal representative's name, date of birth, gender, duplicate registration check information (ID), mobile phone number, etc.

Article 21Inquiry and Withdrawal of Consent for Personal Information Collection

1. Users and legal representatives can inquire or modify their registered personal information at any time and request withdrawal of consent for personal information collection.
2. Users and legal representatives can withdraw their consent for the collection of their registration information by contacting the personal information protection officer or the person in charge by written document, phone, or email, and the Company will take immediate action.

Article 22Correction of Personal Information, etc.

1. Users can request correction of errors in personal information to the Company through the method mentioned in the previous article.
2. Before completing the correction of personal information, the Company does not use or provide the personal information, and if the wrong personal information has already been provided to a third party, the Company will immediately notify the third party of the correction processing results to ensure the correction is made.

Article 23User's Obligation

1. Users are responsible for keeping their personal information up to date and bear the responsibility for problems arising from inaccurate information entered by the user.
2. In the case of member registration using another person's personal information, the user may lose their membership or be punished according to relevant personal information protection laws.
3. Users are responsible for maintaining the security of email addresses, passwords, etc., and cannot transfer or lend them to third parties.

Article 24Company's Personal Information Management

The Company takes necessary technical and managerial protective measures to ensure the safety of personal information to prevent loss, theft, leakage, alteration, or damage.

Article 25Treatment of Deleted Information

The Company processes personal information that has been terminated or deleted at the request of the user or the legal representative according to the "Retention and Use Period of Personal Information" collected by the Company, and ensures that it is not viewed or used for any other purposes.

Article 26Encryption of Passwords

User passwords are stored and managed after being encrypted one-way, and personal information confirmation or modification is only possible by the person who knows the password.

Article 27Measures Against Hacking, etc.

1. The Company strives to prevent leakage or damage of users' personal information due to hacking or computer viruses.
2. The Company prevents leakage or damage of users' personal information or data using the latest antivirus programs.
3. The Company does its best to ensure security using intrusion prevention systems in case of an emergency.
4. The Company safely transmits personal information on the network through encrypted communication, etc., especially if sensitive personal information is collected and stored.

Article 28Minimization and Training of Personal Information Processing

The Company limits the number of personal information handlers to a minimum and emphasizes compliance with laws, internal policies, etc., through educational and managerial measures for personal information handlers.

Article 29Protection of Personal Information Transferred Overseas

1. The Company discloses in this Policy the entrustment and storage of personal information needed to conclude and perform its contract with the User (Article 28-8, paragraph 1, subparagraph 3, item (a) of the Personal Information Protection Act), and transfers personal information overseas as set out below. The items transferred to each AI processor follow the scope of processing set out in Article 13-2, paragraph 3.

   Selfies taken for identity verification and the facial feature information generated from them are processed only in Korea (Seoul region) and are not among the items transferred under this paragraph.

   In the table below, the items transferred for AI processing are marked as follows:

   • (a) All pages of the images and PDF files of the documents uploaded for pre-filling the application form: passport, parents' passports or national identification cards, language test reports, graduation certificates
   • (b) All pages of the images and PDF files of the documents subject to AI-assisted review: proof of finances, language test reports and course certificates, graduation certificates, transcripts and academic verification reports, entrance examination results, activity certificates, family relationship certificate, parents' passports or national identification cards
   • (c) Text recognized from those documents, including names, dates of birth, school names, grades, scores, amounts, account holder names, and parents' names and nationalities
   • (d) The personal statement and study plan, the department and track applied for, and a summary of activities
   • (e) The name and country of the school attended
   • (f) Rule-based review results (scores, reason codes and figures)
   • (g) Images of identity documents submitted for identity verification (passport, alien registration card, student card and similar documents under Article 6) and the text read from them
   • (h) Text of notices and help documents, and search queries
   • (i) Questions and conversation text entered in the chat and work-assistant features, including information retrieved through those features
   • (j) Screenshots of the device information screen (IMEI, EID) uploaded for phone number activation

   The User's identification photo, signature, application form PDF and visa documents are not transferred for AI processing, and the User's passport is not transferred for AI-assisted review.

2. The following recipients receive personal information to verify the authenticity of submitted language test scores.

3. Language test scores are verified only for the test submitted by the User, and only the items listed above for that test are entered. Consent to the overseas transfer for AI processing in the table in paragraph 1 and to the overseas transfer under paragraph 2 is required to use the University Admission Service. A User who does not consent cannot submit an application through the University Admission Service. Consent may be withdrawn by contacting the Personal Information Protection Officer (Article 32); after withdrawal no new transfer is made.
4. The Company transfers personal information under the data processing terms set by each recipient and limits the information transferred to the minimum necessary for the purpose.

Article 30Installation, Operation, and Rejection of Automatic Personal Information Collection Devices

1. The Company uses cookies, which are automatic personal information collection devices, to store and retrieve usage information from time to time to provide individualized customized services to users. Cookies are small amounts of information sent by the server (http) used to operate the website to the user's web browser (including PCs and mobile devices) and may also be stored on the user's storage space.
2. Users have the option to install cookies. Therefore, users can allow all cookies by setting options in the web browser, verify each time cookies are saved, or refuse to store all cookies.
3. However, if you refuse to store cookies, there may be difficulties in using some services of the Company that require login.
4. The Company installs and operates Google Firebase Analytics in the app for app usage statistics. It collects the app instance ID, app usage events, language setting and linked university code, and does not collect advertising identifiers or nationality. The app has no in-app switch to turn this collection off. The User can reset the app instance ID by clearing the app data in the device settings (Android: Settings > Apps > UNIPORT > Storage > Clear data) or by deleting the app, and can ask the Personal Information Protection Officer (Article 32) to delete the collected data.

Article 31Cookie Installation Allowance Setting Method

You can set cookie allowance, cookie blocking, etc., through web browser option settings.

• Edge: Settings menu on the top right of the web browser > Cookies and site permissions > Manage and delete cookies and site data
• Chrome: Settings menu on the top right of the web browser > Privacy and security > Cookies and other site data
• Whale: Settings menu on the top right of the web browser > Privacy protection > Cookies and other site data

Article 32Designation of the Company's Personal Information Protection Officer

The Company designates the related department and the personal information protection officer as follows to protect users' personal information and handle complaints related to personal information.

• Personal Information Protection Officer
  • Name: Kim, Kyungjeon
  • Position: CTO
  • Email: kjkim@uniport.asia

Article 33Remedy for Rights Infringement

1. The information subject can apply for dispute resolution or consultation regarding personal information infringement to the Personal Information Dispute Mediation Committee and the Korea Internet & Security Agency's Personal Information Infringement Report Center. For other reports and consultations on personal information infringement, please contact the following agencies:
   • Personal Information Dispute Mediation Committee: 1833-6972 (without a country code) (www.kopico.go.kr)
   • Personal Information Infringement Report Center: 118 (without a country code) (privacy.kisa.or.kr)
   • Supreme Prosecutors' Office: 1301 (without a country code) (www.spo.go.kr)
   • Police Agency: 182 (without a country code) (ecrm.cyber.go.kr)
2. The Company guarantees the information subject's right to self-determination of personal information and strives to provide consultation and remedy for damages caused by personal information infringement. If you need to report or consult, please contact the department responsible mentioned in the previous clause.
3. If a person has suffered damage to rights or interests due to a disposition or omission by the head of a public institution according to the provisions of Article 35 (Access to Personal Information), Article 36 (Correction·Deletion of Personal Information), and Article 37 (Suspension of Processing Personal Information, etc.) of the Personal Information Protection Act, the person may file for administrative adjudication according to the Administrative Appeals Act.
   • Central Administrative Appeals Commission: 110 (without a country code) (www.simpan.go.kr)

Article 34Collection and Use of Face Data

1. Items: In the identity document verification (KYC) process, the Company processes the following face data:
   1. The original selfie photo
   2. The facial photo contained in the image of the identity document
   3. Facial feature information: numerical information generated from the photos in items 1 and 2 to identify a specific individual
   4. Results: face comparison score, spoof detection score, capture quality information (such as the number of faces detected), and a summary of the assessment
2. Purposes:
   1. Identity verification: checking whether the selfie and the facial photo on the identity document show the same person
   2. Fraud prevention: detecting whether the selfie was taken of a real person (detecting spoofing attempts such as re-photographing a photo or a screen)
   3. Service quality evaluation (validation before replacing the face comparison model; scores only): calculating the scores of a candidate model on the stored photos and comparing them with the current model. Facial feature information generated during the evaluation is destroyed without delay when the evaluation ends, and the results are kept as scores and aggregates that contain no identifiers.
   4. Digital ID photo display: displaying the verified original selfie on the User's digital ID in the app
   5. Identification photo on the student information screen (only where the User chooses to consent): a copy of the original selfie is made separately in the student photo storage and displayed, and can be seen by staff of the university the User is linked to and, where the User applied or enrolled through a study abroad agency, by staff of that agency. This consent is optional, and refusing it does not affect the use of the service. On withdrawal of consent, the display stops immediately and the copy is deleted without delay; identity verification (KYC) records are not deleted. Where the university has registered its own identification photo, that photo is displayed regardless of this consent.
3. Method of Collection: The Company collects face data when the User takes a selfie and submits images of the identity document on the identity verification screen of the app. Device biometric authentication in the app (Face ID, fingerprint, etc.) is processed within the User's device, and the Company receives only the resulting electronic signature value.
4. Place and Method of Processing: The Company generates facial feature information and results on the face comparison computing server it operates (Google Cloud, Seoul region). The computing server processes photos only in memory, destroys facial feature information immediately after the comparison, and stores neither photos nor facial feature information. The Company keeps original selfie and identity document images in storage in the Amazon Web Services Seoul region, and results in the Company's service database.
5. Retention and Destruction:
   1. Facial feature information: destroyed immediately after the comparison (not stored). Facial feature information generated during service quality evaluation is destroyed without delay when the evaluation ends.
   2. Original selfie and identity document images: retained until membership withdrawal (for digital ID photo display and re-verification) and deleted without delay after withdrawal. Backup copies are destroyed within 60 days. This applies equally to approved, rejected and incomplete applications.
   3. Selfie copy for the identification photo (paragraph 2, item 5): deleted without delay when the User withdraws the consent or membership.
   4. Results: retained until membership withdrawal. After withdrawal, identifying information (such as the application identifier and processing time) is deleted without delay, and the results are kept only as scores and statistics from which no individual can be identified, even with other information.
   5. Where relevant laws require longer preservation, the Company retains the data for that period.
6. Provision to Third Parties: The Company provides face data to third parties only in the following cases:
   1. Where the User has explicitly consented (including the identification photo display under paragraph 2, item 5)
   2. Where required by law or regulation for investigative purposes by relevant authorities

Article 34-2Processing of Sensitive Information

1. The Company protects the facial feature information in Article 34, paragraph 1, item 3 as sensitive information (biometric information) under Article 18, subparagraph 3 of the Enforcement Decree of the Personal Information Protection Act.
2. Immediately before the User takes a selfie, the Company informs the User in the app of the purposes, items and retention and use period under Article 34, the right to refuse consent and the result of refusal, and obtains consent separately from consent to other processing (Article 23, paragraph 1, subparagraph 1 of the Personal Information Protection Act).
3. The User has the right to refuse the consent in paragraph 2. This consent is necessary to complete identity verification with an identity document that requires a selfie.
4. The Company takes the following safety measures so that face data is not lost, stolen, leaked, forged, altered or damaged (Articles 23, paragraph 2 and 29 of the Personal Information Protection Act):
   1. Encryption in transit (TLS) between the app, the service server and the face comparison computing server
   2. Internal authentication so that only the Company's service server can call the computing server
   3. In-memory processing on the computing server, immediate destruction of facial feature information, and exclusion of photos from logs
   4. Access limited to staff with administrator authority and identity verification viewing permission, retention of access records, and photo display through addresses valid for 10 minutes
   5. Encryption of original images at rest

Article 35Processing of Personal Information Using Artificial Intelligence

1. The Company uses artificial intelligence (AI) in the University Admission Service for the following purposes.
   1. Reading the documents uploaded by the User (passport, parents' passports or national identification cards, language test reports, graduation certificates) and pre-filling the application form. The User reviews and corrects the pre-filled items before submission.
   2. To assist the reviewers of the universities to which Users apply, analyzing the submitted documents and application information and generating scores, assessments and comments by review category ("AI-Assisted Review"). The review categories are finances, Korean language, English language, academic ability, activities and personal statement, and consistency of documents. Scores are calculated by rules based on the admission criteria published by the university; AI is used for text recognition of documents, extraction of data items, assessment of the content of the personal statement, estimation of the level of the school attended, and drafting of comments.
2. AI-Assisted Review is reference information only. Decisions on admission, including acceptance or rejection, are made by the university's reviewers. Accordingly, this processing does not constitute a fully automated decision under Article 37-2 of the Personal Information Protection Act. The User may nevertheless request an explanation of, or object to, the content and criteria of the AI-Assisted Review applied to their application, and the Company shall respond in consultation with the university concerned (contact: Article 32).
3. The AI processing in paragraph 1 uses the processors set out in Article 13-2, paragraph 3 (Google and OpenAI, L.L.C.); the items transferred and their retention periods are stated in Article 29. The results of AI-Assisted Review are not displayed in the student application.
4. AI-Assisted Review is part of the screening process that the University Admission Service provides to universities, and consent to the AI processing in paragraph 1 is therefore required to use the University Admission Service; a User who does not consent cannot submit an application through the University Admission Service. Consent may be withdrawn in the manner set out in Article 21, and no new AI processing shall be run after withdrawal.

Addendum

This Policy takes effect on November 7, 2026.