Controller and Contact Information
The service provider and controller of personal data is as follows:
Sentech Korea Corp. (“the Company”)
21-6, Jimok-ro 75beon-gil, Paju-si, Gyeonggi-do, 10880, Republic of Korea
The DPO of the Company is as follows:
Keun Hyung Park
+82 31 8071 4400 / firstname.lastname@example.org
• If you have questions about your account in general, how to contact customer service for assistance, questions specifically about this Privacy Notices, or our use of your personal data, cookies or similar technologies, please contact our Data Protection Officer(DPO, Keun Hyung Park, Director). If you contact us for assistance, we may need to authenticate your identity before fulfilling you request for your safety and ours.
Collection and Use of data
We receive and store data about users such as:
- To verify and authenticate of user identity and for user contact; user ID (email address) of the SNS account(Facebook, Google) the user linked to KETOSCAN application,
- To provide KETOSCAN services; name, telephone number, gender, height, weight, body fat, year of birth, diet and exercise comments, Information of KETOSCAN device
- To provide third-party application gearing services; Health kit datas – Fatsecret ( Weight, Calories, carbohydrate, protein, fat ), Google Fit ( Weight, Calories ), Apple Health ( Weight, Calories )
· Personal data produced or automatically collected by the Company: Besides the personal data directly provided by users, the Company can produce or automatically collect data related to KETOSCAN services which includes:
- To provide KETOSCAN services; Keton level data measured via KETOSCAN application.
- Log information such as IP address, mobile’s model and OS version, usage time, and user input.
Method of collection
The Company collects the personal data of users in the following manner (Article 6(1)(a)):
• Collection through mobile devices with the prior consent of the users
Disclosure of Personal Data
We may disclose users’ personal data for certain purposes and to third parties, as described below:
· Service Providers: We use other companies, agents or contractors ("Service Providers") to perform services on our behalf or to assist us with the provision of services to you. For example, we engage Service Providers to provide marketing, advertising, communications, infrastructure and IT services, to personalize and optimize our service, to provide customer service, to analyze and enhance data (including data about users' interactions with our service), and to process and administer consumer surveys. In the course of providing such services, these Service Providers may have access to your personal data or other information. We do not authorize them to use or disclose your personal data except in connection with providing their services.
· Partners: Users may have a relationship with one or more of our Partners, in which case we may share certain data with them in order to coordinate with them on providing the service to members and providing information about the availability of the service.
Necessity of personal data
The personal data provided by users is necessary for the service use contract between a user and the Company and the smooth delivery of the services therein. Users are restricted from using the Company’s services unless they give consent to the collection of essential personal data. However, users may refuse to provide optional personal data, and in such case, they will still be able to use the Company’s services except those that require the provision of optional personal data.
Transfer of Personal Data to Third Countries
The Company may transfer users’ personal data to companies located in other countries or other companies for any purpose specified in this Policy. It will take reasonable measures to the companies where the information is transmitted, retained or processed in order to protect the information.
Based on the above notice, the Company may transfer users’ personal data to the Republic of Korea after obtaining explicit consent for transfer of personal data to third countries (Article 49 Paragraph 1 (a)).
Users or their legal representatives, as data subjects, can exercise the following rights regarding the collection, use and disclosure of personal data by the Company:
• Right of access by the data subject (Article 15);
• Right to rectification (Article 16)
• Right to erasure (‘right to be forgotten’) (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated individual decision-making, including profiling (Article 22)
• Right to withdraw prior consent (Article 7(3))
In order to exercise any of the foregoing rights, make a written request to the Company (or the DPO, representative) using the data subject request form provided by the Company. In such case, the Company shall immediately make actions accordingly: provided, however, that the Company may reject such request if and to the extent there are reasonable grounds prescribed in law or equivalent thereto.
Upon the request from a data subject, the Company must take the following actions:
· To take actions regarding a request only after authenticating the identity of the data subject (or his or her legal representative);
· To ask if a subject requires the information to be provided in writing or whether he or she will accept it in an electronic form;
· To have a standard process for the company to effectively inspect all relevant systems and to communicate with other departments;
· To notify a data subject if there is no information that he or she has requested;
· To formulate reasonable criteria to determine whether to correct or disclose personal data if the personal data requested by a data subject includes the information of other individuals; provided however, such data can be disclosed if the other individuals explicitly give the consent thereto. The company should consider the impact of such disclosure and the possible breach of others’ personal data if no explicit consent is available, in which case, it should document the justification of such disclosure;
· To take actions in accordance with the request of a data subject in such a manner as he or she can understand, including the requirements under Article 15;
· To make no available the transfer system which can be traceable in case of providing a data subject with the information he or she has requested. Such information should be disclosed in a safe electronic means if individually agreed upon with the data subject; or
· To document the actions which have been taken for the request of a data subject.
Also users or their legal representatives have the right to lodge a complaint with a supervisory authority (Article 13(2) and 14(2)(e)).
The Company takes the security of personal data seriously. It has the following security measures to prevent the unauthorized access to, or disclosure, use or change of the personal data (Article 32).
· To formulate countermeasures against hacking
- To install a system in the zone to which the external access is strictly restricted so as to prevent users' personal data from leakage or damage by hacking or computer viruses
· To establish and implement internal management plans
- To conduct regular internal audit (semiannual) to safely process personal data
- To keep minimal the number of employees processing personal data and educate them
· To install and operate access control systems
- To take necessary actions to restrict the access to the personal data, such as the grant, change or termination of the right to access the data base system of personal data processing
- To keep the documents, storage devices, etc. which include personal data in a safe place with a lock
- To designate a physical place of storing personal data to restrict the access by unauthorized persons and to establish and operate such access control procedure
- Enterprise-wide DLP solution installation and operation
· Take measures to prevent forgery or alteration of access records and store and collect log records through the installation of Endpoint Protector, a security program.
The Company’s products and services are intended for use by individuals 14 years of age and older, and those under the age of 14 are not eligible to use any of our service. In principle, the Company does not collect any personal data from children. However, if the Company learns that any personal data of children has been collected through KETOSCAN application, it will comply with the following procedures for the protection of children’s personal data (Article 8):
· To verify if a child is subject to the guardian’s consent and such guardian is authorized, within the scope of reasonable efforts;
· To have the consent from a child’s parent or guardian to collect the child’s personal data or to provide the child with product information and the Company’s services directly;
· To grant a child’s legal representative the right to access, correct or delete or temporally suspend the processing of, the child’s personal data or the right to withdraw the prior consent of the representative; and
· To limit the collection of personal data to the extent solely required for the participation in online activities
Profiling and automated decisions
The Company does not use users’ personal data to create individual or collective profiles (hereinafter referred to as “profiling”) for the purpose of profiling and making automated decisions.
Data Retention Policy
For the purpose of protecting users’ data, the Company complies with the principle of Data Minimisation where the processing of personal data should be appropriate and limited to the extent solely necessary for the purposes for which the data are processed (Article 5 Paragraph 1 (c)). To this end, the Company abides by the following retention policy:
· All personal data processed by the Company is subject to and protected by the Company’s Members’ retention policy.
· Personal data are retained for no longer than is necessary for the purposes for which the personal data are processed. The Company will immediately destroy the personal data once the user deletes his or her account on KETOSCAN application. However, the personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (Article 5 Paragraph 1 (e));
· The Data Protection Officer designates the strict retention period regarding the storage of users’ personal data and does not retain the data more than the period which requires the data. The Company monitors the compliance regarding the data retention on a regular basis and deletes the data, if no longer necessary, in a safe manner (Recital Article 39);
· The company schedules regular review of stored data to determine whether the data is still required;
· The company immediately destroys especially sensitive data including sexual orientation, race, beliefs, health information, etc. and does not retain the data for no longer than is necessary;
· The company is in compliance with relevant regulations such as GDPR, etc. in relation to the retention of users’ personal data;
The Company educates and monitors employees including the HR department that handle personal data of the Company’s employees not only to handle users’ personal data but also employees’ personal data in compliance with the GDPR (Article 39). The Company documents the records that manage all training-related contents for employees (date, time, list of subjects, list of attendees, contents of training, subject of training, role of DPO).
The latest update date: (2022. 03. 01.)