Privacy Policy
Effective date September 6, 2026
NANRO Foundation values your personal information and complies with the Personal Information Protection Act and other applicable laws. This policy applies to the Foundation’s website and its support/payment services.
Article 1 (Purpose of Processing)
NANRO Foundation ("the Foundation") processes personal information for the purposes below and does not use it for any other purpose. Where the purpose changes, the Foundation takes the necessary steps, including obtaining separate consent as required by law.
- Responding to inquiries about the Foundation’s activities, support, and partnerships.
- Processing one-off payments (entry fees, donations, auction settlements), confirming payment records, handling cancellation and refund requests, and receiving requests for donation receipts.
- Auction participation — accepting bids and notifying winners at Foundation auction events.
- RSVP — confirming attendance and providing information for events hosted or invited by the Foundation.
- Member management — registration and identity verification, viewing payment/donation history, use of My Page, and delivering notices.
- Service usage analytics — understanding how the website is used and improving the service (via Google Analytics).
Article 2 (Items Collected and Retention Period)
The Foundation collects the following personal information by service. Where retention is required by law, the information is kept for the required period.
| Service | Items collected | Retention period |
|---|---|---|
| Inquiries | Name, affiliation/role, email, (optional) attachment | 3 years after the inquiry is resolved |
| Support / payment | Name, email, (optional) phone, payment record (order no., item, amount, approval data), reason where a cancellation/refund is requested | 5 years for records of payment and supply of goods and 3 years for records of consumer complaints or dispute handling, under the Act on Consumer Protection in Electronic Commerce |
| Auction participation (bid) | Name, phone, email, bid amount and history, record of consent to personal-information collection | 3 years after the auction closes (for handling related disputes) |
| RSVP | Name, phone, email, (optional) affiliation, attendance, record of notice acknowledgement | 1 year after the event |
| Donation receipt request | Payment identifiers, (optional) phone, (optional) notes | 5 years after issuance (supporting documents retained under the Income Tax Act and the Inheritance and Gift Tax Act) |
| Membership | Email, password (stored encrypted), name, (optional) Instagram handle | Until the member withdraws (statutory-retention items for their required period) |
| Service usage analytics (Google Analytics) | IP address, browser/device information, access timestamp, page-view records, session/user identifier cookies | Up to 14 months (Google Analytics default retention period) |
Payment-instrument details such as card or account numbers are collected and processed directly by the payment gateway (PG) and are not stored by the Foundation, which retains only the payment result (e.g. approval number). Donation receipts are issued in the Foundation’s name (not linked to the National Tax Service year-end system); resident/business registration numbers, addresses, and other information needed for issuance are not collected on the website and are received by the Foundation directly from the requester at the time of issuance.
Article 3 (Provision to Third Parties)
As a rule the Foundation does not provide personal information to third parties beyond the scope stated in Article 1, except in the following cases:
- The data subject has consented in advance.
- Information necessary for payment is provided to the payment gateway to process a payment (see Article 4 for the specific consignee).
- Provision is required by law, or an investigative authority requests it under the procedures set by law.
Article 4 (Consignment of Processing)
The Foundation consigns personal-information processing tasks as below, and stipulates the matters necessary for the safe management of personal information in each consignment contract.
| Consignee | Consigned task |
|---|---|
| iropke Co., Ltd. | Website system operation and maintenance |
| KakaoPay Corp. | Payment processing (electronic payment agency) |
| Amazon Web Services, Inc. | Infrastructure (hosting) and notification email delivery |
In connection with the tasks above, personal information is processed within Korea (AWS Seoul region) and is not transferred abroad.
Article 5 (Destruction of Personal Information)
When personal information becomes unnecessary — the retention period has elapsed or the purpose has been achieved — the Foundation destroys it without delay.
- Electronic files are permanently deleted by a method that prevents recovery.
- Printed personal information is shredded or incinerated.
Article 6 (Rights of Data Subjects and How to Exercise Them)
Data subjects may at any time request access to, correction, deletion, or suspension of processing of their personal information, in writing or by email, and the Foundation acts without delay.
Requests and inquiries: nanro@nanrogroup.com
Article 7 (Security Measures)
The Foundation takes the following measures to ensure the security of personal information:
- Administrative: minimizing staff who handle personal information; establishing and operating an internal management plan.
- Technical: encryption of important data such as passwords, access-rights management, and secure transmission (HTTPS).
- Physical: access control to systems storing personal information.
Article 8 (Cookies and Automatic Collection)
The Foundation may use cookies and similar automatic-collection technologies to provide tailored services and to analyze how the website is used.
- For usage analytics, the Foundation uses Google Analytics operated by Google LLC. That service collects usage information — IP address, browser/device information, pages viewed, access timestamps, and session/user identifiers — via cookies and similar technologies. The Foundation uses this information only to improve the website and not to identify individual users.
- You may refuse cookies through your browser settings; doing so may limit the use of some services.
- If you do not want Google Analytics to collect your usage information, you may install the opt-out browser add-on provided by Google (https://tools.google.com/dlpage/gaoptout) to block it.
Article 9 (Personal Information Protection Officer)
The Foundation designates the following officer to take overall responsibility for personal-information processing and to handle complaints and remedies from data subjects.
- Protection Officer: 최정윤
- Contact: nanro@nanrogroup.com
Article 10 (Remedies for Rights Infringement)
Data subjects may apply to the following bodies for dispute resolution or consultation regarding personal-information infringement (Korean authorities):
- Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
- Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office Cybercrime Division: 1301 (spo.go.kr)
- National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)
Article 11 (Changes and Governing Language)
This policy applies from its effective date. When there are additions, deletions, or amendments due to changes in law, policy, or security technology, the Foundation will give notice on the website from 7 days before the change takes effect.
This English text is a translation provided for convenience. In the event of any discrepancy, the Korean version prevails.
Effective date: September 6, 2026