Purpose of Processing Personal Data

IBS processes personal data for the following purposes. Personal information processed will not be used for any purpose other than the following purposes, and in the event the purpose of use is changed, IBS will perform all necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

Purpose of Processing Personal Data

Name of personal data file	Legal basis	Purpose
User information on the IBS Science Culture Center website	Data subject’sconsent	Verify identity of registered users
Visitor information	Data subject’sconsent	Register visitors
Personal information registered on the IBS Talent Pool	Data subject’sconsent	Recruit talent and provide job opportunities
User information on the IBS Laboratory Animal Resource Facility website	Data subject’sconsent	Check user information
User information on the IBS Research Equipment Information System website	Data subject’sconsent	Verify identity of registered users
Guesthouse user information	Data subject’sconsent	Verify identity of guests
Visitor information from the IBS Headquarters tour requests	Data subject’sconsent	Check visitor information
Inquirer information on the IBS website Q&A	Data subject’sconsent	Improve quality of answers
Quiz participant information	Data subject’sconsent	Check participants’ information

Collected Items and Retention Period

① IBS processes and retains personal data in accordance with the laws or within the period consented to by data subjects at the time of personal data collection

② The types of information IBS collects and the retention period of data is as follows:

Collected Items and Retention Period - 개인정보 파일명, 수집·보유 근거, 수집·보유 목적, 주요항목, 보유기간 정보제공

Name of personal data file	Collected items	Retention period
User information on the IBS Science Culture Center website	· Required: Name, cell phone number and address · Optional: Email address	Immediately disposed of after fulfillment of its purpose
Visitor information	· Required: Name, email address and work address · Optional: Office phone number	Two years
Personal information registered on the IBS Talent Pool	· Required: Name, date of birth, cell phone number, email address, work address and other information (gender, major field of study, department, degree program) · Optional: Additional information (period of study, research areas, publication list and CV)	Five years
User information on the IBS Laboratory Animal Resource Facility website	· Required: Name, cell phone number, email address and other information (ID, password, affiliation and PI) · Optional: Additional information (job level)	Immediately disposed of after fulfillment of its purpose
User information on the IBS Research Equipment Information System website	· Required: Name, cell phone number, email address and other information (Romanized name, ID, password, whether the user is internal/external member and affiliation) · Optional: Whether the user is citizen or foreign national	One year
Guesthouse user information	· Required: Name, cell phone number, email address, work address and other information (gender) · Optional: Employee number (for IBS employees)	Three years
Visitor information from the IBS Headquarters tour requests	· Required: Name, date of birth, home address, cell phone number, email address, office phone number and work address	Immediately disposed of after fulfillment of its purpose
Inquirer information on the IBS website Q&A	· Required: Name and email address	Immediately disposed of when the post is deleted
Quiz participant information	· Required: Name and cell phone number	Immediately disposed of when the event ends

Registered Personal Data Files

The purpose, retention period and collected items of personal data files that IBS registers and discloses in accordance with Article 32 of the Personal Information Protection Act are as follows.

Registered Personal Data Files - 개인정보 파일명, 처리목적, 개인정보 항목, 보유기간 정보제공

Name of personal data file	Purpose	Collected items	Retention period
User information on the IBS Science Culture Center website	Verify identity of registered users	Name, cell phone number, address and email address	Immediately disposed of after fulfillment of its purpose
Visitor information	Register visitors	Name, email address, work address and office phone number	Two years
Personal information registered on the IBS Talent Pool	Recruit talent and provide job opportunities	Name, date of birth, cell phone number, email address, work address and other information (gender, major field of study, department, degree program, period of study, research areas, publication list and CV)	Five years
User information on the IBS Laboratory Animal Resource Facility website	Check user information	Name, cell phone number, email address and other information (ID, password, affiliation, PI and job level)	Immediately disposed of after fulfillment of its purpose
User information on the IBS Research Equipment Information System website	Verify identity of registered users	Name, cell phone number, email address and other information (name in English, ID, password, whether the user is internal/external member and affiliation, whether the user is citizen or foreign national)	One year
Guesthouse user information	Verify identity of guests	Name, cell phone number, email address, work address, employee number and other information (gender)	Three years
Visitor information from the IBS Headquarters tour requests	Check visitor information	Name, date of birth, home address, cell phone number, email address, office phone number and work address	Immediately disposed of after fulfillment of its purpose
Inquirer information on the IBS website Q&A	Improve quality of answers	Name and email address	Immediately disposed of when the post is deleted
Quiz participant information	Check participants’ information	Name and cell phone number	Immediately disposed of when the event ends

Sharing Personal Data with Third Parties

IBS shares personal data outside of IBS only where permitted by and in accordance with Articles 17 and 18 of the Personal Information Protection Act as below.

Sharing Personal Data with Third Parties - 구분, 내용 정보제공

Category	Content
Article 17	∘Where the consent is obtained from the data subject; or ∘Where the personal information is provided within the scope of purposes for which it is collected pursuant to Articles 15 (1) 2, 3 and 5 and 39-3 (2) 2 and 3.
Article 18	∘Where additional consent is obtained from the data subject; ∘Where special provisions exist in other laws ◦Where it is deemed manifestly necessary for the protection of life, health or property of the data subject or third party from imminent danger where the data subject or his or her legal representative is not in a position to express intention, or prior consent cannot be obtained owing to unknown addresses ∘Where it is impossible to perform the duties under its jurisdiction as provided for in any Act, unless the personal information controller uses personal information for other purpose than the intended one, or provides it to a third party, and it is subject to the deliberation and resolution by the Commission ∘Where it is necessary to provide personal information to a foreign government or international organization to perform a treaty or other international convention ∘Where it is necessary for the investigation of a crime, indictment and prosecution ∘Where it is necessary for a court to proceed with trial-related duties or ∘Where it is necessary for custody, probation or punishment.

External Processing of Personal Data

① IBS entrusts the processing of personal data as shown in the table below for the smooth processing of personal data.

External Processing of Personal Data - 위탁부서명, 수탁자명, 이용·제공 목적 정보제공

Responsible unit	Service provider	Service provided
Public Relations Team	Gonet	Website maintenance
Safety and Health Team	Guard	Video surveillance equipment maintenance
		Visitor management
Information Technology Team	CRESPEED	Internal business system maintenance
Information Technology Team	Innovation Solution Technology	Information system maintenance
Public Relations Team	IT Together	Science Culture Center management system maintenance
Core Facilities and Service Team	ITstandard	IBS Laboratory Animal Resource Facility website maintenance
Research Facilities and Equipment Management Team	Collabi	Research Equipment Information System website maintenance
Facilities and Security Team at Heavy-Ion Accelerator Research Institute	Mirae	Visitor management
	AZWELL	Internal information system maintenance
	Neoforce	Internal business system maintenance

② When concluding a contract with a service provider, in accordance with Article 26 of the Personal Information Protection Act, IBS specifies in the contract matters concerning the prohibition on personal data processing for purposes other than performing the contracted services, measures to ensure safety, restriction on subcontracting, management and supervision of the service provider and liabilities for damages, and supervises whether the service provider processes personal data in a safe and secure way.

③ If there are changes to the contracted service or the service provider, IBS will disclose such changes through this Privacy Policy in a prompt manner.

Disposal of Personal Data

① IBS will dispose of personal data without delay at the expiration of the retention period, the fulfillment of the purpose or other reasons for which such personal data is no longer necessary.

② Notwithstanding the expiration of the retention period consented by the data subject or the achievement of the purpose, in cases where such personal data must be continued to be retained in accordance with other laws, such personal data (or personal data files) will be transferred to a separate database or retained at a different location.
After the retention period has expired, the law may require IBS to continue to store personal data. In this case, the personal data (or personal data files) will be stored in a separate database or location.

③ Personal data will be disposed of in the following procedure and methods:

Disposal of Personal Data - 구분, 내용 정보제공

Category	Description
Procedure	IBS selects personal data (or personal data files) to be disposed of and discards them with approval of the chief privacy officer.
Method	IBS disposes of electronic personal data by performing a low-level format in order to ensure the data cannot be recovered. Paper-based personal information will be disposed of by shredding or incineration.

 Rights and Obligations of Data Subjects and Legal Representatives and Method to Exercise Such Rights

① The data subject may exercise the right to access, correct, delete or restrict the processing of personal data at any time
※ For data subjects under the age of 14, their legal representative may exercise such rights on behalf of them. For a minor aged 14 or above, they may exercise their rights either directly or through their legal representative.

② The rights may be exercised in writing or by email, fax or other means in accordance with Article 41 Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and IBS will take action accordingly without delay.

③ The rights may be exercised through the data subject’s legal representative or a delegated individual. In such cases, Form 11 Power of Attorney of the Notice on Personal Data Processing Method (2020–7) must be submitted.

④ The rights to access or restrict the processing of personal data may be restricted in accordance with Articles 35 (4) and 37 (2) of the Personal Information Protection Act

⑤ Requests to correct or delete personal data cannot be granted when IBS is legally obligated to collect such data in accordance with relevant laws.

⑥ When IBS receives a request to access, correct, delete or limit the processing of personal data, IBS will verify whether the person who has made the request is the data subject or their legal representative.

Measures to Ensure Security of Personal Data

IBS takes the following measures to ensure security of personal data.

개인정보의 안전성 확보조치를 관리적, 물리적, 기술적 조치로 구분하여 안내

Category	Description
Managerial measures	Establishing and implementing an internal management plan and conducting periodic employee training
Technical measures	Managing access rights to personal data processing systems, installing access control system, encrypting personal data and installing security programs
Physical measures	Controlling unauthorized access and locking away documents

Installation, Operation and Rejection of Automatic Personal Data Collection Tool

① IBS uses cookies to store and retrieve user information, thereby providing personalized and customized service to users.

② Cookies are small packets of data that are transferred from a website’s server to a user's hard disk via their browser.

Installation, Operation and Rejection of Automatic Personal Data Collection Tool - 구분, 개인정보 책임자, 개인정보보호 담당자 정보제공

Category	Description
Purpose of cookies	To provide users with optimized information by identifying user behavior including which services and websites they have visited including websites with secure connections.
Installation, operation and rejection of cookies	1) Internet Explorer : Tools in the browser toolbar > Internet Options > Privacy > Settings 2) Chrome : At the top right, click More > Settings > Privacy and security > Cookies and other site data

※ If you refuse to accept cookies, you may experience some inconvenience in your use of services provided by IBS.

Chief Privacy Officer

① In order to protect personal data and handle complaints or remedies in relation to the processing of personal data, IBS has designated the chief privacy officer and point of contact as below.

개인정보 열람청구 담당자의 부서명 , 담당자 , 전화번호 , 이메일의 정보를 제공합니다.

Category	Name	Job title/unit	Contact
Chief privacy officer	HA Sungdo	Vice president	Tel. +82–042–878–8250 ※ Incoming calls will be directed to the Information Security Team
Point of contact	LEE Yu Gyeong	Information Security Team	Tel. +82–042–878–8250 Email: ukyung@ibs.re.kr

② Data subjects may contact the chief privacy officer and the Information Security Team for inquiries relating to personal data protection, complaints, remedies or other concerns that they have while using IBS’s services (or programs). We will answer and process all inquiries as quick as possible.

Request for Access to Personal Data

Data subjects may make a request for access to personal data to the IBS Information Security Team as below in accordance with Article 35 of the Personal Information Protection Act. We will do our best to handle such request in a prompt manner

Request for Access to Personal Data 담당자의 부서명 , 담당자 , 전화번호 , 이메일의 정보를 제공합니다.

Unit	Name	Office Phone	Email address
Information Security Team	LEE Yu Gyeong	+82–042–878–8250	ukyung@ibs.re.kr

Remedies for Infringement of Data Subject’s Rights and Interests

① Data subjects may contact the Personal Information Dispute Mediation Committee, Korea Internet and Security Agency, Personal Information Infringement Report Center and other relevant organizations for issues relating to remedies for breach of privacy. For reporting and other privacy matters, please contact the following

영상정보처리기기 담당부서, 관리책임자 - 구분, 담당부서, 성명, 전화번호, 이메일 정보제공

Category	Contact number	Website
Personal Information Dispute Mediation Committee	+82–1833-6972	www.kopico.go.kr
Personal Information Infringement Report Center	+82–118	privacy.kisa.or.kr
Supreme Prosecutors' Office of the Republic of Korea	+82–1301	www.spo.go.kr
National Police Agency	+82–182	ecrm.police.go.kr

② IBS is committed to safeguarding data subjects’ right to self-determination of personal data and responding to requests/inquiries for privacy matters and pursuing remedies. If you need to report or consult on privacy infringement, please contact the Information Security Team as below.

개인정보 열람청구 담당자의 부서명 , 담당자 , 전화번호 , 이메일의 정보를 제공합니다.

Unit	Name	Office phone	Email address
Information Security Team	LEE Yu Gyeong	+82–042–878–8250	ukyung@ibs.re.kr

③ Any individual whose rights or interests are violated by an action or omission of the head of a public agency with regard to a request made under the provisions of Article 35 (Access to Personal Information), Article 36 (Rectification or Erasure of Personal Information) and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, may file an administrative appeal in accordance with the Administrative Appeals Act.
※ Central Administrative Appeals Commission : +82–110 (www.simpan.go.kr)

Results of Personal Data Management Assessment

① As an effort to safely manage personal data of data subjects, IBS receives a public sector personal data management assessment conducted by the Personal Information Protection Commission every year in accordance with Article 11 of the Personal Information Protection Act.

② IBS obtained an average rating from the 2021 personal data management assessment.

③ By improving personal data processing procedures and strengthening system security (automatic filtering of personal data) and other necessary measures, IBS has made efforts to prevent personal data leaks.

Installation and Operation of Video Surveillance Equipment

IBS installs and operates video surveillance equipment as below.

1. Purpose: Safety of facilities, fire prevention, crime prevention, and prevention of vehicle theft and damage

2. Installed equipment, location and coverage: 333 cameras have been installed throughout the IBS Headquarters covering nearby areas of the lobby, hallways, parking lots and outside facilities.

3. Responsible unit and authorized personnel permitted to access information:

개인정보 열람청구 담당자의 부서명 , 담당자 , 전화번호 , 이메일의 정보를 제공합니다.

Category	Unit	Name	Office phone	Email address
Chief manager	Safety and Health Team	KIM Bong Jae	+82–042–878–8286	bjkim@ibs.re.kr
Point of contact	Safety and Health Team	KIM Wonbin	+82–042–878–8158	bin2139@ibs.re.kr

4. Recording, storage and retention of recorded material and processing method

영상정보 촬영시간, 보관기간, 보관장소, 처리방법의 정보를 제공합니다.

Category	Description
Recording	24 hours
Retention period	30 days from the date of recording
Storage and processing method	Stored and processed at the Disaster Prevention Center of the Safety and Health Team

5. How to request viewing access: Please contact the chief manager of the Safety and Health Team.

6. Measures to respond to data subject’s requests: Appropriate request form must be submitted. Viewing access is granted only when the recorded footage shows the data subject or when it is clearly necessary for the data subject’s interests related to their life, health and property.

7. Technical, administrative and physical measures to protect video recordings: Internal management planning, access control and limiting the number of authorized personnel, applying safe storage/transfer technologies, recordkeeping the data process, keeping the data safe from forgery and alterations, securing storage facilities, and installing additional safekeeping systems.

8. Outsourcing Video Surveillance Installation and Management
IBS outsources its video surveillance equipment installation and management services as below by specifying necessary matters for safe management of personal data in accordance with relevant laws.

영상정보처리기기 설치 및 관리 등의 위탁에 관한 사항으로 부서명, 수탁업체, 담당자, 연락처의 정보를 제공합니다.

Unit	Service provider	Point of contact	Office number
Safety and Health Team	Guard	PARK Jaesu	042-878-8119

9. Changes to video surveillance equipment operation and management policy
The above video surveillance equipment operation and management policy was established on 3 May 2021. In case of any addition, deletion or revision of the above policy due to changes in relevant laws, policies or security technology, IBS will notify thereof and reasons on its website in a prompt manner.

Revisions to Privacy Policy

① This Privacy Policy is effective from 2 March 2023.

② Previous versions of Privacy Policy are stated below.