롯데미래전략연구소

1. Purpose of Processing Personal Information
The Institute processes personal information for the following purposes. Processed personal information will not be used for purposes other than those stated below, and any changes in the purpose of use will be subject to prior consent.
- Providing email services, delivering various content, announcing events and seminars, and conducting surveys, operation of access control system

2. Items of Personal Information Processed
① Information subject's consent not required for processing personal information items The research institute provides a publication email notification service without obtaining the consent of the information subjects for the following personal information items:

1) Legal basis: Personal Information Protection Act Article 15 Clause 1 Item 4 (performance of contract)
2) Mandatory items: name, affiliated company, rank, email address, subscription authority (executive/staff), phone number
3) During the service use process, access logs, IP addresses, cookie items may be automatically generated and collected.

② Information subject's consent required for processing personal information items The research institute operates an access control system to regulate the entry of external personnel (cleaning, fire safety, etc.) and processes the following personal information items with the consent of the information subjects: The institute processes the following personal information to operate an access control system to control access by external personnel(cleaning, fire fighting)

1) Legal basis: Personal Information Protection Act Article 15 Clause 1 Item 1
2) Mandatory items: name of the relevant party, employee ID or system ID, rank, department, authority (manager/general user), affiliated company name, entry group (employees/temporary entrants), card number

3. Period of Processing and Retaining Personal Information
The research institute processes and retains personal information in accordance with legal regulations or with the consent of the data subject. The processing and retention periods for each type of personal information are as follows.

1. Purpose of Processing Personal Information
The Institute processes personal information for the following purposes. Processed personal information will not be used for purposes other than those stated below, and any changes in the purpose of use will be subject to prior consent.
- Providing email services, delivering various content, announcing events and seminars, and conducting surveys, operation of access control system

2. Items of Personal Information Processed
① The Institute processes the following personal information for providing email services:
1) Required items: name, company, position, Email address, subscription authorization, phone number
2) Access logs, IP addresses, and cookies may be automatically generated and collected during the service usage.

② The institute processes the following personal information to operate an access control system to control access by external personnel(cleaning, fire fighting)
1) Required items: name, company number or system ID, position, department, authority (manager/general user), company, access group (employee/temporary visitor), card number

3. Period of Processing and Retaining Personal Information
The research institute processes and retains personal information in accordance with legal regulations or with the consent of the data subject. The processing and retention periods for each type of personal information are as follows.

1. Purpose of Processing Personal Information
The Institute processes personal information for the following purposes. Processed personal information will not be used for purposes other than those stated below, and any changes in the purpose of use will be subject to prior consent.
- Providing email services, delivering various content, announcing events and seminars, and conducting surveys.

2. Items of Personal Information Processed
The Institute processes the following personal information for providing email services:
1) Required items: Email address, subscription authorization
2) Access logs, IP addresses, and cookies may be automatically generated and collected during the service usage.

3. Period of Processing and Retaining Personal Information
The Institute processes and retains personal information per the law or with the data subject's consent. The period of processing and retention for each category of personal information is as follows:
1) Information retained according to the Institute’s internal policy
- Record of fraudulent use (abnormal service usage)
- Retention reason: Prevention of fraudulent use
- Retention period: 1 month
2) Information retained according to relevant laws
- Website visit records
- Retention reason: Protection of Communications Secrets Act
- Retention period: 3 months
3) Other reasons
- If the retention period has been pre-notified to the member and has not expired, or if individual consent has been obtained from the member, the information will be retained for the agreed-upon period.
- If required by other laws to retain personal information.

4. Entrustment of Personal Information Processing
1) The Institute entrusts personal information processing tasks to ensure smooth service provision and system operation as follows:
Entrusted Party (Trustee) / Entrusted Company / Industry / Description of Entrusted Tasks / Retention and Usage Period
Lotte Data Communication Co., Ltd. / IT Services / System operation and management / Until contract termination
Delastic Communication Co., Ltd. / IT Services / System development and maintenance / Until contract termination
2) When signing an entrustment contract, the Institute specifies in the contract x-x-documents the responsibilities for prohibiting personal information processing for purposes other than the performance of the entrusted tasks, implementing technical and managerial protection measures, restricting re-entrustment, managing and supervising the trustee, and handling damages by Article 26 of the Personal Information Protection Act, and oversees the trustee to ensure safe handling of personal information.
3) If the content of the entrusted tasks or the trustees changes, the Institute will disclose them promptly through this Privacy Policy."

5. Destruction of Personal Information
1) The Institute promptly destroys personal information when the retention period expires, or the processing purpose is achieved.
2) If other laws require the retention of personal information despite the expiration of the agreed retention period or the achievement of the processing purpose, the information will be moved to a separate database (DB) or stored in a different location.
3) The procedures and methods for destroying personal information are as follows:
a) Destruction procedures
The information entered by the user is destroyed according to internal policy and relevant laws after the retention period expires or the processing purpose is achieved.
b) Destruction methods
- Electronic files: Permanently deleted irreversibly.
- Printed materials, written x-x-documents, and other recordable media: Shredded or incinerated.

6. Rights and Obligations of Data Subjects and Methods of Exercise
1) Data subjects can view or delete their registered personal information at any time. If they do not agree with the Institute’s processing of personal information, they can refuse consent or request service termination. However, this may restrict the use of some or all services.
2) For inquiries about viewing or terminating personal information, contact the Personal Information Protection Officer (Manager) by written mail, telephone, or email. We will take action after verifying the identity.
3) When a data subject requests correction of personal information errors, the Institute will not use or provide the information until the correction is completed. If incorrect personal information has already been provided to a third party, the Institute will notify the third party of the correction result immediately.
4) The Institute processes personal information that has been terminated or deleted at the request of the data subject as described in the retention and use period of personal information and ensures that it cannot be viewed or used for other purposes.

7. Measures to Ensure the Security of Personal Information
By Article 29 of the Personal Information Protection Act, the Lotte Institute of Economy and Business Strategy implements the following technical, managerial, and physical measures necessary to ensure the security of personal information:
1) Technical Measures for Personal Information Protection
The Institute takes the following technical measures to ensure the safety of personal information and prevent it from being lost, stolen, leaked, altered, or damaged during processing:
a. To ensure security, we use intrusion prevention systems and vulnerability analysis systems to prevent external intrusions, such as hacking.
b. We use antivirus software to prevent damage from computer viruses.
c. Separation of the database server.
2) Managerial Measures for Personal Information Protection
The Institute has established procedures for accessing and managing personal information to ensure stability. We designate PC users, assign passwords, and regularly update them to prevent unauthorized use of operators' PCs. We also restrict access to PCs that can connect to PCs containing personal information.
3) Physical Measures for Personal Information Protection
The Institute has established and operates access control procedures to prevent unauthorized access to physical locations where vital information, including personal information, is stored, such as computer and data storage rooms."

8. Installation, Operation, and Rejection of Automated Personal Information Collection Devices
The Institute uses cookies to store and retrieve information about data subjects. Cookies are small pieces of information sent to the web browser of the data subject's computer from the Institute's website.
1) Purpose of Using Cookies
Cookies are used to read the contents of the data subject's web browser, recognize the data subject's visits to the Institute's website, and provide optimal services, including secure access.
2) Installation, Operation, and Rejection of Cookies
a. Cookies identify the data subject's computer but do not personally identify the data subject. Data subjects have the option to accept or reject cookies. However, some services may be difficult to use if cookies are rejected.
b. To reject the installation and operation of cookies, data subjects can adjust the settings in their web browser under Tools > Internet Options > Privacy.

9. Department in Charge of Personal Information Protection and Contact Information
The Institute designates the following person in charge and contact person to protect personal information and handle complaints about personal information. Please contact the Personal Information Protection Officer or the Personal Information Protection Manager below for any inquiries related to personal information protection, complaints, damage relief, or requests to view that arise while using the Institute’s services (or business).
1) Personal Information Protection Officer
- Department: Management Planning Team
- Name: Cho Hyun-joon 
- Contact: HYUNJOON.CHO@LOTTE.NET
2) Personal Information Protection Manager
- Department: Management Planning Team
- Name: Lee Hyun-jin 
Contact: HYUNJIN_LEE@LOTTE.NET

10. Remedies for Rights Infringement
Data subjects can seek dispute resolution or consultation for remedies related to personal information infringement from the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency Personal Information Infringement Report Center, etc. For reports or consultations regarding other personal information infringements, please contact the following organizations:
1) Personal Information Dispute Mediation Committee: (No area code) 1833-6972 (www.kopico.go.kr)
2) Personal Information Infringement Report Center: (No area code) 118 (privacy.kisa.or.kr)
3) Supreme Prosecutors' Office: (No area code) 1301 (www.spo.go.kr)
4) National Police Agency: (No area code) 182 (ecrm.cyber.go.kr)"

11. Changes to the Privacy Policy
This policy will be applied from the effective date. Any additions, deletions, or corrections to this policy according to laws and guidelines will be notified separately before they take effect.
a. Revision History
1) Version 1.0 Effective Date: January 1, 2019
2) Version 1.1 Effective Date: October 23, 2023
b. Viewing Previous Documents
Previous versions of the Privacy Policy can be accessed below.

 

1. Purpose of Processing Personal Information
The Institute processes personal information for the following purposes. Processed personal information will not be used for purposes other than those stated below. If the purposes change, we will seek prior consent.
- Providing email services
Delivering various content, event, and seminar notifications and conducting surveys.

2. Items of Personal Information Processed
The Institute processes the following personal information to provide email services:
1) Required items: Email address, subscription authorization
2) Access logs, IP addresses, and cookies may be automatically generated and collected during the service usage.

3. Period of Processing and Retaining Personal Information
The Institute processes and retains personal information by the law or with the data subject's consent. The processing and retention periods for each category of personal information are as follows:
1) Information retained according to the Institute’s internal policy
- Record of fraudulent use (abnormal service usage)
- Retention reason: Prevention of fraudulent use
- Retention period: 1 month
2) Information retained according to relevant laws
- Website visit records
- Retention reason: Protection of Communications Secrets Act
- Retention period: 3 months
3) Other reasons
- If the retention period has been pre-notified to the member and has not expired, or if individual consent has been obtained from the member, the information will be retained for the agreed-upon period.
- If required by other laws to retain personal information.

4. Entrustment of Personal Information Processing
1) The Institute entrusts personal information processing tasks to ensure smooth service provision and system operation as follows:
Entrusted Party (Trustee) / Entrusted Company / Industry / Description of Entrusted Tasks / Retention and Usage Period
Delastic Communication Co., Ltd. / IT Services / System development and maintenance / Until contract termination
2) When signing an entrustment contract, the Institute specifies in the contract x-x-documents the responsibilities for prohibiting personal information processing for purposes other than the performance of the entrusted tasks, implementing technical and managerial protection measures, restricting re-entrustment, managing and supervising the trustee, and handling damages by Article 26 of the Personal Information Protection Act, and oversees the trustee to ensure safe handling of personal information.
3) If the content of the entrusted tasks or the trustees changes, the Institute will disclose them promptly through this Privacy Policy."

5. Destruction of Personal Information
1) The Institute promptly destroys personal information when the retention period expires, or the processing purpose is achieved.
2) If other laws require the retention of personal information despite the expiration of the agreed retention period or the achievement of the processing purpose, the information will be moved to a separate database (DB) or stored in a different location.
3) The procedures and methods for destroying personal information are as follows:
a. Destruction procedures
The information entered by the user is destroyed according to internal policy and relevant laws after the retention period expires or the processing purpose is achieved.
b. Destruction methods
- Electronic files: Permanently deleted irreversibly.
- Printed materials, written x-x-documents, and other recordable media: Shredded or incinerated.

6. Rights and Obligations of Data Subjects and Methods of Exercise
1) Data subjects can view or delete their registered personal information at any time. If they do not agree with the Institute’s processing of personal information, they can refuse consent or request service termination. However, this may restrict the use of some or all services.
2) To inquire about viewing or terminating personal information, contact the Personal Information Protection Officer (Manager) by written mail, telephone, or email. We will take action after verifying the identity.
3) When a data subject requests correction of personal information errors, the Institute will not use or provide the information until the correction is completed. If incorrect personal information has already been provided to a third party, the Institute will notify the third party of the correction result immediately.
4) The Institute processes personal information that has been terminated or deleted at the request of the data subject as described in the retention and use period of personal information and ensures that it cannot be viewed or used for other purposes.

7. Measures to Ensure the Security of Personal Information
By Article 29 of the Personal Information Protection Act, the Lotte Institute of Economy and Business Strategy implements the following technical, managerial, and physical measures necessary to ensure the security of personal information:
1) Technical Measures for Personal Information Protection
The Institute takes the following technical measures to ensure the safety of personal information and prevent it from being lost, stolen, leaked, altered, or damaged during processing:
a. We use intrusion prevention and vulnerability analysis systems to guard against hacking and external intrusions.
b. We use antivirus software to prevent damage from computer viruses.
2) Managerial Measures for Personal Information Protection
The Institute has established procedures for accessing and managing personal information to ensure stability. We designate PC users, assign passwords, and regularly update them to prevent unauthorized use of operators' PCs. We also restrict access to PCs that can connect to PCs containing personal information."

8. Installation, Operation, and Rejection of Automated Personal Information Collection Devices
The Institute uses cookies to store and retrieve information about data subjects. Cookies are small pieces of information sent to the web browser of the data subject's computer from the Institute's website.
1) Purpose of Using Cookies
Cookies are used to read the contents of the data subject's web browser, recognize the data subject's visits to the Institute's website, and provide optimal services, including secure access.
2) Installation, Operation, and Rejection of Cookies
a. Cookies identify the data subject's computer but do not personally identify the data subject. Data subjects have the option to accept or reject cookies. However, refusing cookies may make it difficult to use some services.
b. To specify whether to allow the installation of cookies (for Internet Explorer):
Ⓐ Select ""Internet Options"" from the Tools menu.
Ⓑ Click the ""Privacy"" tab.
Ⓒ Choose the level of privacy settings.

9. Personal Information Protection Department and Contact Information
The Institute designates the following department and contact person to protect personal information and handle complaints about personal information.
1) Personal Information Protection Manager
- Name: Kwak Roh-myoung 
- Contact: ROHMYOUNG.KWAK@LOTTE.NET

10. Changes to the Privacy Policy
This policy will be applied from the effective date. Any additions, deletions, or corrections to this policy according to laws and guidelines will be notified separately before they take effect.
a. Revision History
Version 1.0 Effective Date: January 1, 2019