1. Purpose of Personal Information Processing

KATCHUP Inc. ("Company") processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those listed below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

• Membership Registration and Management: Identity verification for membership-based service use, maintenance and management of membership status, prevention of fraudulent service use
• Service Provision: Student-company matching service, campaign information, recruitment information
• Application and Payment Management: Event/project application receipt, RSVP confirmation, payment status management, refunds, dispute handling, and applicant communication
• Google, NAVER, and External Service Integrations: Google Sign-In, Google Sheets Sync selected by event/project operators, Google Maps and Places and NAVER Maps used for event locations, and related account connection management
• Marketing and Advertising: Development of new services and provision of customized services, provision of event information, hiring information, participation opportunities, and promotional communications by email or push notification where the user has opted in

2. Personal Information Collected

※ Application form collection items vary depending on the event/project operator's settings, and applicants can review the collection items before submitting their application.

3. Retention Period of Personal Information

The Company processes and retains personal information within the retention/use period required by law or consented to by the data subject when collecting personal information.

• Member Information: Until membership withdrawal (destroyed within 30 days after withdrawal)
• Notification Endpoints: Until the user disconnects the device/browser, the endpoint is confirmed invalid, or membership is withdrawn. When account-level push delivery is turned off, the endpoint is retained in an inactive state for reconnection and security purposes and is not used to send notifications.
• Optional Hiring/Marketing Consent Records: Until consent withdrawal or membership withdrawal; decision history may be retained for the period necessary to demonstrate legal compliance or resolve disputes
• Google Sheets Connection Information: Until the user disconnects the Google account, deletes the connection, or withdraws membership, unless retention is required for legal compliance or dispute handling
• Contract or Cancellation Records: 5 years (E-Commerce Act)
• Payment and Goods Supply Records: 5 years (E-Commerce Act)
• Consumer Complaint or Dispute Resolution Records: 3 years (E-Commerce Act)
• Website Visit Records: 3 months (Communications Privacy Act)

4. Provision of Personal Information to Third Parties

The Company processes personal information of data subjects only within the scope specified in Article 1 (Purpose of Personal Information Processing), and provides personal information to third parties only when the data subject consents or when special legal provisions apply, in accordance with Articles 17 and 18 of the Personal Information Protection Act.

• Provision to Company Members: When a student applies to a company's recruitment posting, profile information is provided to the company.
• Provision to Club Members: When a student applies to an event or project posted by a club, the information entered or attached in the application (name, email, school, major, year, GPA, attached files, and responses to additional questions specified by the operator) is provided to the club operating the event/project and to club members granted joint editing privileges, for review and contact purposes.
• Information Access by Company Members: Company Members may access the profiles and application information of students who apply to their postings.
• Provision to Student Members: Information about the publisher (club or company) of events/projects/recruitments to which a student has applied is displayed to the student.
• External Sharing by Operators (Share Links): Event and project operators may create and send read-only Share Links to share applicant lists and application contents with external collaborators (e.g., evaluators, joint operating team members).
  • Operators may optionally set a 6-digit password on the Share Link, and may regenerate or deactivate the link at any time to immediately block access.
  • The scope, recipients, and security level of information provided through Share Links are determined by the relevant event/project operator, and the Company provides this functionality as a platform provider.
  • Applicants are deemed to have consented at the time of application submission to the operator's review, management, and external sharing of such information.

5. External Services, Processors, and Google User Data

The Company uses external service providers only to provide and operate user-facing Service features.

• Google Sign-In: When a user chooses Google Sign-In, the Company receives basic Google account information such as email, name, profile image, and Google account identifier to create or authenticate the KATCHUP account.
• Google Sheets Sync: When an operator connects Google Sheets, the Company uses the granted Google Sheets and Google Drive file permissions to create, select, open, and update Sheets requested by that operator. The Company does not sell Google user data, use it for advertising, or transfer it except as necessary to provide the visible Google Sheets Sync feature, comply with law, or protect security.
• Google Maps, Places, and Routes: Web event and project pages, including the inline Google map shown inside the native iOS app, may load Google Maps, and editors may use Google Places. If a user explicitly selects “Preview route,” the browser or native location bridge sends the current location directly to Google to calculate and display the requested Drive, Transit, or Walk route inside KATCHUP; changing the travel mode can request another calculation. Google may also receive technical information such as the user’s IP address under Google’s privacy terms. The current coordinates are not sent to KATCHUP servers, and KATCHUP does not store or log them or access location in the background. A destination-only Google Maps link remains available when an in-page preview cannot be completed.
• NAVER Maps and Driving Preview: For campaign sessions explicitly saved as located in Korea, web event and project pages and the inline Korean map in the native iOS app may load the NAVER Maps JavaScript API. Destination coordinates, map requests, and technical information such as the user’s IP address may be processed by NAVER under its terms, and NAVER’s required map attribution remains visible. Neither the web page nor the native app’s inline NAVER map sends the current location for route calculation until the user explicitly selects “Preview route.” For an in-page driving preview, the page sends the current coordinates to KATCHUP, which transiently forwards them to NAVER only to calculate and return that requested route. KATCHUP does not store or log those coordinates and does not access location in the background. Transit and walking options make no additional current-location request and do not send the current coordinates to KATCHUP servers. On the web, if a valid Korean current location from the explicit preview is no more than five minutes old when the user clicks NAVER Maps, the page constructs a one-time external NAVER Maps request with that starting point while the stored link remains destination-only; otherwise NAVER Maps opens with the destination only and the user can choose a starting point there. In the native iOS app, the NAVER Maps button sends only the destination and selected travel mode to the NAVER Maps app; NAVER obtains the starting point under its own location permission. NAVER processes the requested destination, starting point, and route data under its terms. The inline NAVER Drive preview uses the transient KATCHUP flow described above, while NAVER Transit and Walk directions continue in external NAVER Maps.
• Payment Providers: Online payment processing may be handled by Toss Payments or another payment service provider. The Company stores payment status and transaction references needed to confirm the RSVP, but detailed card or payment instrument information is processed by the payment provider according to its own policies.
• Email, Push, Hosting, Storage, and CDN Providers: The Company may use infrastructure providers to send emails and push notifications, host the Service, store uploaded files, deliver images/files, and maintain security and reliability.
• Users may withdraw optional hiring information or marketing consent and disable account-level push delivery directly in Notification Settings. Browser and app notification permission can also be revoked in the relevant browser or operating-system settings. Withdrawal does not disable essential in-service notices or Job Alerts that the user has chosen to keep active inside KATCHUP.
• Users may disconnect Google Sheets Sync where the Service provides a disconnect function, and may also manage connected app access from their Google account settings.

6. Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.

• Electronic File Format: Deletion using technical methods that prevent recovery and reproduction
• Paper Documents: Shredded with a shredder or incinerated

7. Rights and Obligations of Data Subjects

Data subjects may exercise the following personal information protection rights against the Company at any time:

• Request to access personal information
• Request to correct errors
• Request for deletion
• Request to suspend processing

Rights may be exercised through written documents, email, etc., and the Company will take action without delay.

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information:

• Administrative Measures: Establishment and implementation of internal management plans, regular employee training
• Technical Measures: Access privilege management for personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
• Physical Measures: Access control to computer rooms, document storage rooms, etc.

9. Personal Information Protection Officer

Data subjects may direct all inquiries, complaints, and remedy requests related to personal information protection arising from the use of the Service to the Personal Information Protection Officer.

10. Remedies for Rights Violations

Data subjects may apply for dispute resolution or consultation to the following organizations to seek remedies for personal information violations:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)