EF Technology Co., Ltd. (the “Company”) processes personal information lawfully and securely and protects the rights and interests of data subjects in accordance with the Personal Information Protection Act. This Policy applies to quote requests and online inquiries on the website; recruitment, human resources, payroll and tax; business partner communications; grievance handling; and the operation of CCTV at the workplace.
Article 1 (Basic Principles of Personal Information Processing)
The Company processes only the minimum personal information necessary for its business. It confirms the purpose, items and retention period of collection and the legal basis, and follows the procedures required by law when the purpose changes or separate consent is required. Resident registration numbers are processed only where specifically permitted by law.
This Policy is posted on the Company website (ef-tech.kr), kept at the workplace, and provided upon request by telephone or email. Disclosure of this Policy does not in itself constitute consent to the collection and use of personal information.
Chief Privacy Officer and contact for exercising rights
| Category | Details |
|---|---|
| Chief Privacy Officer | Chaeyoung Park, Assistant Manager, Administration Department |
| Department in charge | Administration Department |
| Company phone | 031-354-1345 |
| Company email | info@ef-tech.kr |
Article 2 (Purposes, Items and Retention Periods of Processing)
The Company processes information to the extent necessary to perform the tasks below, and collects optional information only with separate consent. In recruitment, it does not request unnecessary information unrelated to the job, such as family relations, assets or physical characteristics.
| Task and purpose | Personal information required | Retention period |
|---|---|---|
| Recruitment screening and contact | Name, contact details, position applied for, job-related education, experience and qualifications, and information entered in the application | Until the statutory return and retention period after the recruitment process ends. For talent pool retention, the period separately consented to |
| Employment contracts and HR management | Name, date of birth, contact details, address, department and position, experience and qualifications, and attendance, leave, training and HR records | Period of employment. After separation, only items subject to statutory retention under Article 3 are retained for the applicable period |
| Payroll, tax and social insurance | Name, salary, allowance and deduction details, bank account information, and resident registration number and dependent documentation as required by law | Statutory retention period under Article 3 after the task ends |
| Customer and partner communications | Contact person’s name, affiliation and title, business contact details, email, and records of communications related to contracts and transactions | Until the transaction and related tasks end. Statutory transaction records are retained under Article 3 |
| Receipt of and responses to website quote requests and online inquiries | (Required) Contact person’s name, phone number or email / (Optional) Company name, region, and request details concerning parts and treatment | 1 year after the inquiry is resolved. If the inquiry leads to a quotation or contract, the transaction-related retention period applies |
| Occupational safety and health management | Name, department and duties, training and qualifications, and information required by law for health examinations and work | Retention period for statutory safety and health records. Unnecessary detailed medical information is not collected |
| Handling of grievances and exercise of rights | Name and contact details (except for anonymous submissions), details of the request or report, and evidence necessary for investigation and handling | Until handling and objection procedures end. Where there is a legal reason for retention, the information is retained with its items and period distinguished |
| Workplace safety and facility protection | Personal video information recorded by CCTV | Retention period from the recording date set out in Article 10 |
Legal basis and sources of collection
Information necessary for concluding and performing employment contracts is processed under Article 15(1)4 of the Personal Information Protection Act, and information for fulfilling legal obligations such as tax, social insurance and safety and health is processed under subparagraph 2 of the same paragraph. Business partner communications are processed after reviewing the requirements for contract performance or legitimate interests, and consent is obtained under subparagraph 1 of the same paragraph for information that requires separate consent.
Information is collected through applications, contracts and request forms submitted by the data subject; written, telephone and email communications in the course of business; statutory tasks; and CCTV. Sensitive information such as health information is processed only where permitted by law or with separate consent, and when information is collected from sources other than the data subject, the source, purpose and other matters are notified as required by law.
Article 3 (Retention and Destruction Under Law)
| Records retained | Period and starting point | Legal basis |
|---|---|---|
| Employee register, employment contracts, wage records and other key documents | 3 years. The statutory starting point for each document applies, such as the date of separation, the date the employment relationship ends or the date of the last entry | Labor Standards Act, Article 42 Enforcement Decree of the same Act, Article 22 |
| Books and supporting documents under tax laws | In principle, 5 years from the date on which the statutory filing deadline expires. Where individual laws provide extended or exceptional periods, those periods apply | Framework Act on National Taxes, Article 85-3, etc. |
| Commercial books, important business documents and slips | 10 years for books and important documents; 5 years for slips and similar records. Books are counted from the date of closing | Commercial Act, Article 33 |
| Records of employee health examination results | In principle, 5 years. 30 years for records related to hazardous factors specified by law | Occupational Safety and Health Act and related subordinate statutes |
Personal information that is not subject to statutory retention is destroyed without delay once the purpose of processing is achieved or the retention period ends. Where retention is required by law or for dispute handling, the Company confirms the basis, items and period, separates the information from general business data and restricts its use for any other purpose.
The person in charge confirms the information to be destroyed and the method of destruction, and destruction is carried out under the supervision of the Chief Privacy Officer. Electronic files are deleted by methods that make recovery difficult, and paper documents are shredded or incinerated. Destruction results are recorded without unnecessarily copying the original personal information into the record.
Article 4 (Provision of Personal Information to Third Parties)
The Company provides personal information to third parties only with the consent of the data subject or where there is a lawful basis such as a law. The Company does not provide employees’ resident registration numbers, payroll or health information, or individual filing records solely on the basis of a customer’s ESG assessment or audit request; where necessary, it anonymizes the information or first confirms a lawful basis.
| Task and recipient | Purpose and information provided | Legal basis |
|---|---|---|
| National Tax Service and competent tax offices | Statutory tax filings such as withholding tax and year-end tax settlement / Name, statutory identification information, and income, deduction and payment statement information | Income Tax Act and other tax laws |
| National Pension Service, National Health Insurance Service, Korea Workers’ Compensation & Welfare Service, etc. | Statutory social insurance reports such as acquisition, loss of coverage and remuneration / Name, statutory identification information, and information on hiring, separation and remuneration | National Pension Act, National Health Insurance Act, and laws on employment insurance and industrial accident compensation insurance |
Recipient organizations retain the information for the period required by the applicable laws. If any other provision occurs, the Company confirms the recipient, purpose, items, retention period and legal basis and carries out the required consent and disclosure procedures.
Article 5 (Outsourcing of Personal Information Processing)
| Contractor | Outsourced task | Scope and period of processing |
|---|---|---|
| Deoreum Tax & Accounting | Tax bookkeeping, tax filing and other tax services under contract | HR, payroll and tax records necessary for the task. Until the outsourcing contract ends or the purpose is achieved; where legal retention is required, for the applicable period |
| S-1 | Management of CCTV and related security equipment | Personal video information as required under the contract. Video is retained for 30 days from the recording date in principle and processed within the scope of management under the contract |
The Company specifies in outsourcing contracts the prohibition of processing for other purposes, security measures, management of sub-outsourcing, and the supervision and responsibility of contractors, and verifies compliance. When a contractor sub-outsources, lawful approval and management and the necessary disclosure are carried out. Changes in outsourced tasks or contractors are reflected in this Policy.
The status of outsourcing such as payroll calculation, labor affairs, ERP and video management, and information on sub-contractors, are reflected in this Policy according to actual processing. If an overseas transfer occurs, such as storage, access or processing abroad, the Company confirms the legal basis and the country, timing, method, recipient, purpose, items and period, and carries out the related notification and protective measures.
Article 6 (Rights of Data Subjects and How to Exercise Them)
Data subjects may request access to, correction or deletion of, and suspension of processing of their personal information processed by the Company, and may withdraw their consent. When a request is made to the Chief Privacy Officer or the Administration Department in person, by telephone, by email or in writing, the Company verifies whether the requester is the data subject or a legitimate representative, processes the request within the statutory deadline and notifies the requester of the result.
The Company requests only the minimum information necessary to verify the exercise of rights. Where a request for deletion or suspension of processing cannot be fully accepted due to statutory retention obligations or similar reasons, the Company explains the basis and reason, the extent of processing possible, and how to file an objection. The Company does not impose any unfair disadvantage on the grounds that rights have been exercised.
If the Company introduces a task in which decisions made by a fully automated system significantly affect rights or obligations, it will disclose the criteria and procedures for such decisions and how personal information is processed, and will establish procedures for exercising rights under law, such as refusal and requests for explanation.
Article 7 (Measures to Ensure Security)
The Company implements protective measures appropriate to the nature and risks of the personal information, including an internal management system and staff training; granting, changing and revoking the minimum access rights required for work; access control and authentication; encryption required by law; retention and review of access logs; malware prevention; and locking devices and entry control.
Access to shared email accounts and shared folders is restricted, and resident registration numbers, health information and filing records are not included in general distribution materials. Upon becoming aware of an incident such as a leak, the Company acts to prevent the spread of damage and confirm the facts, and notifies data subjects and reports to the relevant authorities in accordance with the scope and deadlines required by law.
Article 8 (Grievance Handling and Remedies)
Inquiries about personal information and requests to exercise rights may be directed to Kiseok Lee, CEO, or Chaeyoung Park, Assistant Manager, Administration Department (031-354-1345, info@ef-tech.kr). External remedy bodies include the Personal Information Infringement Report Center (118 without area code, privacy.kisa.or.kr) and the Personal Information Dispute Mediation Committee (kopico.go.kr).
Article 9 (Effective Date and Amendments)
This Policy was established on January 2, 2026. The Company has completed verification of the purposes, items and retention periods of processing and the status of outsourcing and video information, and implements and discloses this Policy. When this Policy is amended, the Company will announce the changes and the effective date by the same means, such as the copy kept at the workplace, and will keep previous versions available for review. The effective date of the revision for posting on the website (Rev.1) is the date of posting.
Article 10 (Operation of Fixed Video Information Processing Devices)
The Company operates CCTV at its workplace. The purpose of installation and the recording range are limited to what is necessary for lawful purposes such as facility safety, fire prevention and crime prevention, and arbitrary use for other purposes, such as monitoring employees, is prohibited. Depending on whether the location is open to the public, the Company confirms Article 25 of the Personal Information Protection Act or the relevant basis for collection and use.
| Item | Company operation |
|---|---|
| Purpose of installation | Facility safety, fire prevention and crime prevention |
| Number and locations of cameras | 16 / 2nd and 3rd floors of the Company’s workplace |
| Recording hours | 24 hours |
| Retention period and location | 30 days from the recording date / Company office |
| Manager and persons with access rights | Kiseok Lee, CEO / 031-354-1345 |
| How and where to view footage | Request viewing from the Administration Department after identity verification / Company office |
| External management contractor | S-1 / Management of CCTV and related security equipment Contact with the contractor is arranged through the Administration Department (031-354-1345) |
Signs display the statutory information, including the purpose and location of installation, the recording range and hours, and the manager and contact details. Cameras are not installed in places with a high risk of privacy invasion, such as restrooms and changing rooms, and audio is not recorded.
Footage is viewed only by authorized personnel, and records of viewing, provision and removal are kept. When the retention period ends, footage is deleted so that it is difficult to recover. Where there is a reason for separate retention, such as an accident investigation, the Company confirms the basis, items and period, retains the footage separately, and destroys it when the reason no longer applies.
Data subjects may request to view footage in which they appear or to confirm its existence. The Company verifies identity and the statutory requirements and takes necessary measures, such as masking, to protect the rights of others. If a request is refused or restricted, the Company provides the reason and explains how to file an objection.
Article 11 (Information Automatically Collected When Using the Website)
The Company website does not use advertising or analytics cookies that collect users’ behavioral information. When an inquiry is received, browser information (User-Agent) is stored with the inquiry record to prevent misuse, and administrator logins by employees use only session cookies to keep users logged in.
Document control and references
This Policy is linked with Management Process EF-QP-06 Rev.2, Safety and Health Management Process EF-QP-08 Rev.0 and Control of Documented Information EF-QI-08. The criteria for applying this Privacy Policy follow the Personal Information Protection Act and related subordinate statutes.