Paprika Data Lab Inc. is complying with the provisions of the "Personal Information Protection Act" and relevant laws to protect the freedoms and rights of information subjects, legally processing personal information and managing it securely. Accordingly, in accordance with Article 30 of the "Personal Information Protection Act", we establish and disclose the following personal information processing policy to guide information subjects on the procedures and criteria related to personal information processing, and to handle related grievances quickly and smoothly.

1. Purpose of Processing Personal Information

   Paprika Data Lab Inc. processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those stated below, and if the purpose of use changes, we will implement necessary measures such as obtaining separate consent in accordance with Article 18 of the "Personal Information Protection Act".

   1. Member registration and management: This includes confirmation of intention to register as a member, personal identification and authentication for member services, maintenance and management of membership qualifications, prevention of fraudulent use of services, verification of the consent of guardians for processing personal information of children under 14 years old, various notices, and grievance handling.

   2. Service provision: This includes service provision, sending contracts and invoices, providing content, offering customized services, identity verification, age verification, billing and settlement, and debt collection. (Statistical use of non-identifiable information)

   3. Personal information processing tasks of the corresponding personal information processor: Paprika Data Lab Inc. may access personal information after collecting inquiries and error handling for inquiries arising from the use of its services.

   4. For purposes of promoting a member's use of Walla when they have already conducted or are conducting surveys publicly.

   5. Utilization for marketing and advertising: Providing basic service information, promoting new services, providing information about events and advertisements, opportunities to participate, analyzing access frequency or user statistics regarding service utilization, verifying service validity, etc.
      
      

2. Processing and Retention Period of Personal Information

   Paprika Data Lab Inc. processes and retains personal information within the retention and usage period of personal information as prescribed by laws or collected from the information subject. The respective processing and retention periods for personal information are as follows.

   1. Website membership registration and management: Until withdrawal from the business website.

      However, in cases corresponding to the following reasons, until the end of such reasons:

      • If investigations for violations of relevant laws are ongoing, until the conclusion of those investigations.

      • If debts arising from website use remain, until settlement of those debts.

   2. Provision of goods or services: Until completion of supply and billing/settlement.

      However, in cases corresponding to the following reasons, until the end of that period:

      • Records related to advertising, contract contents, and execution under the "Act on Consumer Protection in Electronic Commerce".

        • Advertising records: 6 months

        • Records of contracts, withdrawal of applications, payments, and supply of goods: 5 years

        • Records of consumer complaints or dispute resolution: 3 years

      • Retention of communication fact confirmation materials under the "Act on the Protection of Communications Secrets".

        • Subscriber telecommunications date, start/end time, opposing subscriber number, frequency of use, and location tracking data of the transmission base station: 1 year

        • Computer communication, internet log data, access location tracking data: 3 months

      • Under the "Act on the Use and Protection of Credit Information".

        • Records related to the collection/processing and use of credit information: 3 years
          
          

3. Items of Personal Information Processed

   Paprika Data Lab Inc. processes the following items of personal information.

   1. The company processes the following items of personal information for membership registration.

      • Items: Google account email address, nickname, profile picture set.

      • Optional items: Organization information.

      • Collection method: User input on the site.

   2. The company processes the following items of personal information during the service use process or business processing.

      • IP address, cookies, visit date and time, records of fraudulent use, service usage records, etc.

      • Collection method: Automatically generated and collected.

   3. Additionally, for the provision of a stable service, the following items may be collected additionally through lawful procedures and user consent.

      • IP address, cookies, visit date, service usage records, records of poor usage, payment history, and the geographical location of your device at the time of service usage.

      • Collection method: Information collected through generation information collection tools.

   4. Access, use, storage, and sharing of Google user data are as follows.

      • Access to Google user data: Access email, nickname, and profile picture from the Google account.

      • Use of Google user data: Accessed data is used for membership registration, profile creation, and login.

      • Storage of Google user data: User data is stored on Google Firebase.

      • Sharing of Google user data: User data is not shared externally without the user's consent.

   5. Walla complies with the Google API Services User Data Policy, including limited use requirements when using and transmitting information received from the Google API.

   6. Walla uses GPT from OpenAI across its services and shares this with OpenAI.
      
      

4. Provision of Personal Information to Third Parties

   1. Paprika Data Lab Inc. processes personal information of information subjects only within the scope explicitly stated for the purpose of processing personal information and only provides personal information to third parties in cases where the consent of the information subject is obtained, where there are special provisions under law, or in accordance with Articles 17 and 18 of the "Personal Information Protection Act". Outside of this, personal information of the information subject will not be provided to third parties.

      • Information submitted by applicants wishing to use the Walla service for service progress.

      • Information submitted for payment by those wishing to use the Walla service.

      • In cases other than those above, personal information will not be used beyond the explicitly stated scope or provided to third parties unless there are special provisions under any other laws.

   2. (주) 파프리카 데이터랩 may provide personal information to a minimal extent with the consent of the information subject for smooth service provision.

   3. (주) 파프리카 데이터랩 may provide personal information to relevant agencies without the consent of the information subject in cases of emergencies such as disasters, infectious diseases, incidents causing imminent danger to life and body, or urgent property loss.

   4. Moreover, under Article 59 of the Personal Information Protection Act (prohibited acts), personnel handling personal information from the company shall not perform the following acts:

      • Acquiring personal information through false or otherwise unfair means or methods, or obtaining consent regarding processing.

      • Disclosing personal information learned in the course of work or providing it to others without authorization.

      • Harming, destroying, altering, forging, or leaking another person's personal information without legitimate authorization or exceeding permitted authority.
        
        

5. Entrustment of Personal Information Processing

   1. Paprika Data Lab Inc. entrusts personal information processing tasks as follows for smooth processing of personal information work.

      • Stripe, Inc.

        • Entrusted party (trustee): Stripe, Inc.

        • Entrusted work: Use of PG company's payment service.

        • Retention and usage period: Click here.

      • Google Cloud Platform

        • Entrusted party (trustee): Google Cloud Platform.

        • Entrusted work: Server operation for service provision.

        • Retention and usage period: Until withdrawal from membership, until service termination, or until the end of the entrustment contract.

      • Cloudflare

        • Entrusted party (trustee): Cloudflare.

        • Entrusted work: Server operation for service provision.

        • Retention and usage period: Until withdrawal from membership, until service termination, or until the end of the entrustment contract.

      • OpenAI

        • Entrusted party (trustee): OpenAI.

        • Entrusted work: Automatic survey generation and automated analysis on the results page.

        • Retention and usage period: Click here.

   2. Paprika Data Lab Inc. specifies responsibilities regarding the prohibition of processing personal information beyond the purposes of entrusted work, technical and managerial protective measures, restrictions on re-entrustment, management and supervision of trustees, and liability in the documents such as contracts as per Article 26 of the "Personal Information Protection Act" upon entering into entrustment agreements, and supervises whether the entrusted party handles personal information safely.

   3. In case the contents of entrusted work or the entrusted party change, we will promptly disclose it through this personal information processing policy.

      
      

6. Transfer of Personal Information Abroad

   Paprika Data Lab Inc. entrusts payment work to the foreign corporation Stripe, Inc. as follows.

   1. Stripe, Inc.

      • Entrusted party (trustee): Stripe, Inc.

      • Entrusted work: Use of PG company's payment service.

      • Retention and usage period: Until withdrawal from membership, until service termination, or until the end of the entrustment contract.

   2. Google Cloud Platform

      • Entrusted party (trustee): Google Cloud Platform.

      • Entrusted work: Server operation for service provision.

      • Retention and usage period: Until withdrawal from membership, until service termination, or until the end of the entrustment contract.

   3. Cloudflare

      • Entrusted party (trustee): Cloudflare.

      • Entrusted work: Server operation for service provision.

      • Retention and usage period: Until withdrawal from membership, until service termination, or until the end of the entrustment contract.
        
        

7. Procedure and Method for Destruction of Personal Information

   1. Paprika Data Lab Inc. will promptly destroy personal information once it is no longer necessary due to the expiration of the retention period or achievement of the processing purpose.

   2. If the retention period of personal information consented to by the information subject has elapsed or if the processing purpose has been achieved, but personal information must still be preserved under other laws, the personal information will be moved to a separate database (DB) or preserved in another storage location.

   3. The procedure and method for destruction of personal information are as follows.

      • Destruction procedure

        • Paprika Data Lab Inc. selects the personal information for which the reason for destruction has occurred and obtains the approval of the personal information protection officer of Paprika Data Lab Inc. to destroy the personal information.

      • Destruction method

        • Paprika Data Lab Inc. will destroy personal information recorded and stored in electronic file format so that it cannot be restored, and will shred or incinerate personal information recorded and stored in paper documents.
          
          

8. Rights and Obligations of Information Subjects and Legal Representatives

   1. The information subject can exercise the right to access, correct, delete, and request to stop processing personal information at any time against <Personal Information Processor Name>.

   2. Request for access to personal information.

   3. Request for correction in case of errors.

   4. Request for deletion.

   5. Request to stop processing.

9. Exercise of rights can be done in writing, via email, or via fax in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the "Personal Information Protection Act" against Paprika Data Lab Inc., and Paprika Data Lab Inc. will take action without delay.

10. Rights can also be exercised through legal representatives or those delegated by the information subject. In this case, you must submit a power of attorney in accordance with the format prescribed in Appendix 11 of the "Notice on Personal Information Processing Methods (No. 2020-7)".

11. Requests for access and stopping of processing personal information can be limited according to Paragraph 4 of Article 35 and Paragraph 2 of Article 37 of the "Personal Information Protection Act".

12. Requests for correction and deletion of personal information cannot be made when the personal information is specified as a subject of collection under another law.

13. Paprika Data Lab Inc. will confirm whether the person requesting access, correction, deletion, or stopping of processing is the information subject or a legitimate representative.

    
    

• Measures to Ensure the Safety of Personal Information

  1. Paprika Data Lab Inc. takes the following measures to ensure the safety of personal information.

     • Administrative measures: Establishment and implementation of internal management plans, operation of dedicated organizations, regular employee training.

     • Technical measures: Access control of personal information processing systems, installation of access control systems, encryption of personal information, installation and updating of security programs.

  2. Paprika Data Lab Inc. also implements the following activities to secure the safety of personal information in addition to the matters stipulated by laws.

     • Minimization and education of staff handling personal information; measures are being implemented to limit personal information management to designated staff.

     • Regular self-audits; to secure stability regarding personal information handling, we conduct regular self-audits (quarterly).

     • Encryption of personal information; user information and passwords are securely stored, so only they know it. Important data is encrypted in files and data transmitted using separate security features such as file locking functions.

     • The company installs security programs and performs regular updates and checks to prevent leakage and destruction of personal information due to hacking or computer viruses, and controls access to the system installed in areas where access from outside is restricted while monitoring and blocking it technically and physically.

     • Access restrictions to personal information; necessary measures are taken to control access by granting, modifying, or deleting access rights to database systems handling personal information, and unauthorized access from outside is controlled using intrusion prevention systems.

     • Retention of access logs and prevention of tampering; we keep and manage access logs of the personal information processing system for at least 6 months, utilizing security functions to prevent modification, theft, or loss of access records.
       
       

• Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

  1. Paprika Data Lab Inc. may use "cookies" to store and retrieve user information frequently to provide individual customized services.

     • Providing differentiated information per member when creating surveys.

     • Analyzing the frequency of access or the time spent by members and non-members to understand users' tastes and interests, thereby providing specialized services.

     • Tracking the activity of answered surveys to provide individual response services.

     • Providing information about usage periods when utilizing paid services.

     • Analyzing user habits for service redevelopment etc.

• Cookies are small pieces of information sent from the server (http) operating the website to the user's computer browser and may be stored on the hard disk of users' PCs.

• Purpose of use of cookies: To provide optimized information to users by identifying the visit and usage patterns of each service and website visited, popular search terms, security access status, etc.

• Installation, operation, and refusal of cookies: You can refuse cookie storage through the option settings in the tools > Internet options > privacy menu at the top of the web browser.

• If you refuse to store cookies, you may experience difficulties in using customized services.
  
  

• Collection, Use, and Refusal of Behavioral Information

  1. Paprika Data Lab Inc. collects and uses behavioral information to provide optimized customized services, benefits, and online personalized advertisements to the information subject during service use.

  2. Paprika Data Lab Inc. collects behavioral information as described below.

     • Items of behavioral information collected: User's website/app service visit history, search history, purchase history.

     • Method of collecting behavioral information: Automatically collected when users visit/execute websites and apps.

     • Purpose of collecting behavioral information: To provide personalized product recommendation services (including advertisements) based on users' interests and preferences.

     • Retention/usage period and subsequent processing methods: Destroyed after 1 year from the date of collection.

  3. Paprika Data Lab Inc. only collects the minimum behavioral information necessary for online personalized advertisements and does not collect sensitive behavioral information that may significantly infringe on individual rights, interests, or privacy, such as ideology, beliefs, relationships with family or relatives, education/medical history, and other social activity experiences.

  4. Paprika Data Lab Inc. does not collect behavioral information for advertising purposes from children under 14 years of age known to be children, nor does it provide personalized advertisements to those children.

  5. Paprika Data Lab Inc. collects and uses advertising identifiers for mobile apps for online personalized advertisements. The information subject can block or allow personalized advertising through the setting changes of the mobile device.

  6. Blocking/Allowing advertising identifiers on smartphones.

     • (Android) ① Settings → ② Privacy → ③ Ads → ③ Reset or Delete Advertising ID.

     • (iPhone) ① Settings → ② Privacy → ③ Tracking → ④ Allow apps to request tracking. Note: The menu and methods may vary slightly depending on the mobile OS version.

  7. The information subject can block or allow online personalized advertisements uniformly by changing the cookie settings of the web browser. However, altering cookie settings may affect the use of certain services, such as automatic login on websites.

     1. Blocking/Allowing personalized advertisements through the web browser.

        • Internet Explorer (Windows 10 Internet Explorer 11)

          • Select the tools button in Internet Explorer and then select Internet Options.

          • Select the Privacy tab, choose Advanced in Settings, and select whether to block or allow cookies.

        • Microsoft Edge

          • Click on the right top “…” mark in Edge and select Settings.

          • On the settings page, click on “Privacy, search, and services” on the left, then select whether to allow tracking in the “Tracking prevention” section.

          • Select whether to always use strict tracking prevention when searching InPrivate.

          • Select whether to send a do not track request in the “Privacy” section below.

        • Chrome Browser

          • Click on the right top ‘⋮’ symbol (Chrome customization and control) in Chrome and select settings.

          • On the settings page, click on ‘Show advanced settings’ at the bottom and in the “Privacy” section, click on content settings.

          • Select the checkbox for “Block third-party cookies and site data” in the cookies section.

• The information subject can inquire about any questions regarding behavioral information, exercise refusal rights, or report damages to the following contacts.

  1. Personal Information Protection Department

     • Person in charge: Jo Yong-gwan

     • Contact: yonggwan@paprikadatalab.com
       
       

• Processing of Pseudonymous Information

  1. Paprika Data Lab Inc. processes personal information collected for statistics, scientific research, and public record compliance in a pseudonymized manner so that individuals cannot be identified, as follows.

     • Matters related to the processing of pseudonymous information.

     • Matters related to the provision of pseudonymous information to third parties (to be completed if applicable)
       
       

• Personal Information Protection Officer

  1. Paprika Data Lab Inc. has appointed a personal information protection officer as follows to be responsible for overall personal information processing and to handle complaints and remedies related to personal information processing.

  2. Personal Information Protection Officer

     • Name: Jo Yong-gwan

     • Title: Data Engineer

     • Contact: yonggwan@paprikadatalab.com (connects to the Personal Information Protection Department.)
       
       

• Remedies for Rights Infringement

  1. The information subject can apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korean Internet Security Agency Personal Information Infringement Report Center, etc., to receive remedies for damage from personal information infringement. For other reports or consultations of personal information infringement, please contact the institutions below.

     • Personal Information Dispute Mediation Committee: (No area code) 1833-6972 (www.kopico.go.kr)

     • Personal Information Infringement Report Center: (No area code) 118 (privacy.kisa.or.kr)

     • The Supreme Prosecutors' Office: (No area code) 1301 (www.spo.go.kr)

     • The National Police Agency: (No area code) 182 (ecrm.cyber.go.kr)

  2. Paprika Data Lab Inc. strives to ensure the information subject's right to self-determination regarding personal information and to provide consultations and remedies for damages caused by personal information infringement. If you require a report or consultation, please contact the department below.

     • Customer consultation and reporting related to personal information protection.

       • Person in charge: Jo Yong-gwan

       • Contact: yonggwan@paprikadatalab.com

  3. Those who have suffered harm or damage due to an action or omission by the head of a public institution regarding requests based on Articles 35 (Access to personal information), 36 (Correction and deletion of personal information), and 37 (Requests for cessation of processing) of the "Personal Information Protection Act" can file an administrative appeal in accordance with the provisions of the Administrative Appeals Act.

     • Central Administrative Appeals Committee: (No area code) 110 (www.simpan.go.kr)
       
       

• Changes to the Personal Information Processing Policy

  1. The company will post this privacy policy's contents, business name, representative name, business office address, email address, business registration number, and mail order sales report number on a linking screen.

  2. The company informs users that registering as a member indicates consent to the privacy policy through a linkage screen.

  3. The company can amend this privacy policy within the scope that does not violate relevant laws.

  4. If the company revises the privacy policy, it will specify the reason for revision and make both the current privacy policy and the revised privacy policy available on the service bulletin board, and notify users by individual emails of the revisions made at least 7 days before the effective date.

  5. The privacy policy of the company takes effect from the effective date, and in case of added, deleted, or corrected content due to changes in laws, government policies, or company's internal regulations, we will notify you of the changes at least 7 days prior to the effective date. If you do not express your objection to the company within the period from at least 7 days before the effective date, it will be considered that you agree to the revised privacy policy.
     
     
     

• This privacy policy applies from November 18, 2023.

• You can check the previous personal information processing policy below.

  • Applied from 2022.11.01 ~ 2023.11.17 (Click)

• Korean: Walla complies with the Google API Services User Data Policy including limited use requirements when using and transmitting information received from Google APIs.