1. Purpose of Personal Information Processing

KATCHUP Inc. ("Company") processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those listed below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

• Membership Registration and Management: Identity verification for membership-based service use, maintenance and management of membership status, prevention of fraudulent service use
• Service Provision: Student-company matching service, campaign information, recruitment information
• Marketing and Advertising: Development of new services and provision of customized services, provision of event information and participation opportunities

2. Personal Information Collected

※ Application form collection items vary depending on the event/project operator's settings, and applicants can review the collection items before submitting their application.

3. Retention Period of Personal Information

The Company processes and retains personal information within the retention/use period required by law or consented to by the data subject when collecting personal information.

• Member Information: Until membership withdrawal (destroyed within 30 days after withdrawal)
• Contract or Cancellation Records: 5 years (E-Commerce Act)
• Payment and Goods Supply Records: 5 years (E-Commerce Act)
• Consumer Complaint or Dispute Resolution Records: 3 years (E-Commerce Act)
• Website Visit Records: 3 months (Communications Privacy Act)

4. Provision of Personal Information to Third Parties

The Company processes personal information of data subjects only within the scope specified in Article 1 (Purpose of Personal Information Processing), and provides personal information to third parties only when the data subject consents or when special legal provisions apply, in accordance with Articles 17 and 18 of the Personal Information Protection Act.

• Provision to Company Members: When a student applies to a company's recruitment posting, profile information is provided to the company.
• Provision to Club Members: When a student applies to an event or project posted by a club, the information entered or attached in the application (name, email, school, major, year, GPA, attached files, and responses to additional questions specified by the operator) is provided to the club operating the event/project and to club members granted joint editing privileges, for review and contact purposes.
• Information Access by Company Members: Company Members may access the profiles and application information of students who apply to their postings.
• Provision to Student Members: Information about the publisher (club or company) of events/projects/recruitments to which a student has applied is displayed to the student.
• External Sharing by Operators (Share Links): Event and project operators may create and send read-only Share Links to share applicant lists and application contents with external collaborators (e.g., evaluators, joint operating team members).
  • Operators may optionally set a 6-digit password on the Share Link, and may regenerate or deactivate the link at any time to immediately block access.
  • The scope, recipients, and security level of information provided through Share Links are determined by the relevant event/project operator, and the Company provides this functionality as a platform provider.
  • Applicants are deemed to have consented at the time of application submission to the operator's review, management, and external sharing of such information.

5. Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.

• Electronic File Format: Deletion using technical methods that prevent recovery and reproduction
• Paper Documents: Shredded with a shredder or incinerated

6. Rights and Obligations of Data Subjects

Data subjects may exercise the following personal information protection rights against the Company at any time:

• Request to access personal information
• Request to correct errors
• Request for deletion
• Request to suspend processing

Rights may be exercised through written documents, email, etc., and the Company will take action without delay.

7. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information:

• Administrative Measures: Establishment and implementation of internal management plans, regular employee training
• Technical Measures: Access privilege management for personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
• Physical Measures: Access control to computer rooms, document storage rooms, etc.

8. Personal Information Protection Officer

Data subjects may direct all inquiries, complaints, and remedy requests related to personal information protection arising from the use of the Service to the Personal Information Protection Officer.

9. Remedies for Rights Violations

Data subjects may apply for dispute resolution or consultation to the following organizations to seek remedies for personal information violations:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)