Privacy Policy

Rockplace Co., Ltd. (“Company”) establishes and discloses this Privacy Policy by the Personal Information Protection Act to protect the personal information of data subjects and to ensure the prompt and efficient handling of any related complaints
If the Company revises this Privacy Policy, such changes will be announced on the Company’s website.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information will not be used for any purpose other than those listed below. If the purpose of use changes, the Company will take the necessary steps, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Personal Information

Data Subject	Purpose of Use	Items Collected	Retention Period
Customers	• Provision of services, establishment, maintenance, execution, and management of business relationships, incident investigation, dispute resolution, handling of inquiries, and fulfillment of legal obligations. • Marketing and promotional purposes, such as seminar invitations, newsletters, and other informational content	• Name, contact information (address, phone number, email, etc.), workplace information (company name, position, title, etc.) • Personal information created or provided during the service or business relationship	3 years; for marketing purposes, until consent is withdrawn
Job Applicants	• Applicant identification and evaluation for recruitment processes (document screening, interviews, etc.) • To identify and evaluate applicants for all employment types (including full-time, contract, and internships); to review applications, make hiring decisions, provide notifications, and contact applicants for future opportunities.	[Required] • Name, date of birth, contact information (address, phone, email), photo, gender, academic background, military and veteran status, work experience, application motivation, and self-introduction [Optional] • Family details, awards, foreign language skills, certifications/licenses, additional documents and references, internship or probationary results	6 months after the end of the relevant recruitment process
Employees	• Execution and maintenance of employment contracts • HR tasks such as personnel appointment, evaluation, payroll, benefits, and training • Employee roster, internal groupware, internal messenger, email posting • Other internal systems	[Required] • Name, resident registration number (or national ID), nationality • Contact information (address, phone number, email), photo • HR management information related to employment, such as personnel card, resident registration transcript, etc., submitted upon joining • Employee ID, department, assignment history, job role, attendance, evaluation, reward/disciplinary records • Reason for resignation according to employment status [Optional] • Family information	5 years after resignation

Article 2 (Retention and Use Period of Personal Information)

The Company retains and processes personal information within the period stipulated by applicable laws and regulations, or within the period agreed upon by the data subject at the time of collection.

Unless otherwise specified in this Policy, personal information shall, in principle, be retained and used until the purpose of processing is achieved or until the data subject withdraws its consent. Once the objective is achieved, the information will be destroyed without delay.

However, if there is a need to retain the information for dispute resolution, handling of complaints, or fulfilling legal obligations after the original purpose has been fulfilled, the Company may retain the information for the period permitted by relevant laws and regulations.

Article 3 (Provision of Personal Information to Third Parties)

In principle, the Company processes personal information only within the scope specified in Article 1 (Purpose of Processing and Items Collected) and provides personal information to third parties only when it falls under Article 17 or 18 of the Personal Information Protection Act—such as with the data subject’s consent or under special provisions of the law.

As of now, the Company does not provide personal information to any third party.

Article 4 (Outsourcing of Personal Information Processing)

To enhance operational efficiency, the Company outsources certain personal information processing tasks to third-party service providers as follows:

① Domestic Outsourcing

The Company has engaged the following domestic vendors for the specified purposes:

Service Provider (Domestic)	Personal Information Provided	Purpose of Use
Metanet SaaS Co., Ltd.	• Name, Resident Registration Number, Address, Phone Number, Bank Account Info	• Payroll processing and four major social insurances	Until the purpose is fulfilled or consent is withdrawn
Hanaro Medical Foundation	Name, Position, Department, Date of Birth, Gender	Health check-up services
KMI Medical Research Institute
WooriOne Healthcare
Hyundai Marine & Fire Insurance	Name, Resident Registration Number, Job Group Info, Gender	Enrollment, maintenance, and claim processing for corporate group accident insurance and long-term overseas stay insurance
DB Insurance
Kyobo Life Insurance
Korea Software Industry Association	Name, Resident Registration Number, Copy of Bankbook, Contact Info	Training for new employees
Korea Software Technology Promotion Association
Korea Radio Promotion Association
Kyobo Book Centre	Name, Email	Access to the digital library
Inflearn Co., Ltd.	Name, Affiliation, Mobile Number, Email	Online training service operation
EZ & Wellness Co., Ltd.	Name, Email	Operation of EAP (Employee Assistance Program)
Hana Card Co., Ltd.	Name, Resident Registration Number, Job Title, Phone Number, Email, Bank Account Info	Issuance and renewal of corporate credit cards
Lotte Card Co., Ltd.	Name, Resident Registration Number, Address, Phone Number, Bank Account Info	Issuance and renewal of corporate credit cards
Hyundai EZwel Co., Ltd.	Name, Department, Date of Birth	Provision of holiday gifts
PINPOINT Inc.	Name, Department, Mobile Phone Number, Email Address	For granting and managing office entry access
Monami Imaging Solutions Co., Ltd.	Name, Affiliation, Mobile Number, Email	Use of secure multifunction printer solution
Bridge M Co., Ltd.	Name, Affiliation, Mobile Number, Email	Use of corporate dinner reservation app
TARA TPS	Name, Job Title, Affiliation, Mobile Number, Email	Business card application and production
Enjoy Co., Ltd.	Mobile Number	Distribution of gift vouchers for employees
Metanet Digital Co., Ltd.	Name, Job Title, Affiliation, Mobile Number, Email	MS O365 account setup
Benepia	Name, Date of Birth, Job Title, Department, Phone Number, Email	Registration in welfare system
IBK (Industrial Bank of Korea)	Name, Resident Registration Number, Phone Number, Email, Address	Retirement pension enrollment
Mirae Asset Securities	Name, Resident Registration Number, Phone Number, Email	Retirement pension enrollment
Kyobo Life Insurance	Name, Resident Registration Number, Phone Number, Email	Retirement pension enrollment
Daishin Securities	Name, Resident Registration Number, Address, Phone Number, Email	Retirement pension enrollment
Stibee Co., Ltd.	Name, Company Name, Department, Job Title, Email, Phone Number	Distribution of newsletters and informational emails
Performars Co., Ltd.	Name, Affiliation, Mobile Number, Email	Office access control

② Overseas Outsourcing

Overseas Service Provider	Personal Information Transferred	Purpose of Transfer	Destination Country	Transfer Timing & Method	Retention Period
Oracle	Name, Contact Information, Account Information, HR Data (e.g., job assignments)	For HR master data and assignment management through Oracle HCM	United States	Transferred via a secure network upon initiation of the service	Until the purpose is achieved or consent is withdrawn
Microsoft	User’s full name, email, phone number, password, password hints, authentication info, demographic data (e.g., date of birth, gender, country/region, preferred language)	MS O365 account management and use of the data center under the backup policy	United States, Singapore	Transferred via network	Same as above
HubSpot, Inc.	Name, Email Address, Company Name, Department, Job Title, Phone Number	CRM service operation, storage of personal data for marketing, and activity log tracking	United States	Transferred continuously via the network	Same as above

When entering into outsourcing agreements, the Company includes necessary clauses as stipulated in Article 26 of the Personal Information Protection Act. These clauses specify that the outsourced party shall not process personal information for purposes other than those entrusted, shall implement appropriate technical and administrative protection measures, restrict further outsourcing, be subject to supervision, and bear liability for damages. The Company also supervises whether the outsourced parties are processing personal information safely.
If there are any changes to the contents of the outsourced tasks or the outsourced service providers, the Company will promptly disclose such changes through this Privacy Policy.

Article 5 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise the following rights regarding personal information protection at any time with respect to the Company:
① Request access to personal information
② Request correction in case of errors
③ Request deletion
④ Request suspension of processing
These rights may be exercised by submitting a request in writing, or via telephone, email, or fax. The Company will respond without delay.
① If a data subject requests correction or deletion due to an error in their personal information, the Company will not use or provide the relevant information until the correction or deletion is completed.
② The rights specified in Paragraph 1 may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney must be submitted using the form prescribed in Appendix Form No. 11 of the “Notice on Personal Information Processing Methods (No. 2025-05).”
③ Data subjects must not violate applicable laws, including the Personal Information Protection Act, by unlawfully accessing or infringing upon the personal information or privacy of themselves or others processed by the Company.

Article 6 (Methods of Collecting Personal Information)

The Company collects and processes personal information using the following methods:

Customer Information
The Company collects customer information through the 'Contact Us' form on its website and from contact details provided within service contract agreements.
Job Applicants
Recruitment website, email, third-party recruitment agencies, or platforms
Employees
Personal information forms, job application documents, HCM (Human Capital Management) system, etc.

Article 7 (Destruction of Personal Information)

The Company shall destroy personal information without delay when the retention period has expired, or the processing purpose has been achieved, and the information is no longer necessary.
If personal information must be retained even after the agreed retention period has expired or the processing purpose has been fulfilled—due to obligations under other laws—it will be transferred to a separate database (DB) or otherwise stored in a segregated location.
The procedures and methods for destroying personal information are as follows:
- Personal information recorded and stored in electronic file format will be destroyed using a method that makes data recovery impossible, such as low-level formatting.
- Personal information in paper documents will be shredded or incinerated.

① Destruction Procedure
Personal information subject to destruction will be selected by the Company and will be destroyed with the approval of the Company's Chief Privacy Officer.

② Destruction Method

Article 8 (Measures to Ensure the Security of Personal Information)

To ensure the security of personal information, the Company takes the following measures:

Administrative Measures: Establishment and implementation of an internal management plan, regular employee training, etc.
Technical Measures: Access control for personal information processing systems, installation of access control systems, encryption of unique identifiers, installation of security software
Physical Measures: Access restrictions to computer rooms, data storage rooms, etc.

Article 9 (Use and Rejection of Automatic Data Collection Devices)

The Company does not use cookies that store and retrieve user information regularly. However, IP addresses or usage records may be collected in order to respond to customer inquiries or ensure smooth service provision. In such cases, the Company will obtain the data subject's consent or refusal for the collection and use of personal information.

In addition, if a decision based on automated systems, including those applying artificial intelligence technologies, has a significant impact on the data subject’s rights or obligations, the data subject may refuse such a decision or request an explanation from the Company.

Article 10 (Chief Privacy Officer)

The Company has appointed the following Chief Privacy Officer (CPO), who is responsible for overseeing personal information processing and handling complaints and remedies related to the protection of personal information.
▶ Chief Privacy Officer: CEO Hyun-Deok Ahn (rp_cpo@metanet.co.kr)
▶ Responsible Departments:
• Administrative Protection Measures – HR Team (rp_cpo@metanet.co.kr)
• Physical Protection Measures – General Affairs Team
• Technical Protection Measures – ISS Group
Data subjects may contact the Chief Privacy Officer or the departments responsible for any inquiries, complaints, or remedies related to the protection of their personal information while using the Company's services. The Company will respond to and handle such inquiries without delay.

Article 11 (Request for Access to Personal Information)

Data subjects may request access to their personal information according to Article 35 of the Personal Information Protection Act by contacting the department below. The Company will endeavor to process such requests promptly.

▶ Responsible Department for Personal Information Access
HR Team (rp_cpo@metanet.co.kr)

Article 12 (Remedies for Violation of Rights)

Data subjects may contact the following institutions to seek consultation or remedies for violations related to personal information. These institutions are independent of the Company, and you may contact them if you are not satisfied with the Company’s complaint handling or remedy procedures, or if you require further assistance.

Personal Information Infringement Report Center
☎ 118 / https://privacy.kisa.or.kr
Personal Information Dispute Mediation Committee
☎ 1833-6972 / https://www.kopico.go.kr
Supreme Prosecutors’ Office Cyber Crime Investigation Division
☎ 1301 / https://www.spo.go.kr
Cyber Bureau, Korean National Police Agency
☎ 182 / https://cyberbureau.police.go.kr

Article 13 (Installation and Operation of Video Surveillance Equipment)

The Company installs and operates video surveillance equipment as follows:
① Legal Basis and Purpose: Facility safety and fire prevention
② Number, Location, and Coverage: A total of four cameras installed inside the entrance doors of each floor in the headquarters building, covering the hallway in front of the elevator and office entrances
③ Manager and Authorized Personnel: General Affairs Team, Metanet Digital
④ Recording Time, Retention Period, Storage Location, and Handling Method:
- Recording Time: 24 hours
- Retention Period: 30 days from the time of recording
- Storage Location and Handling: Stored and managed in the headquarters' machine room
⑤ How to Access Video Information: Contact the person in charge (General Affairs Team)
⑥ Requests to Access Footage: Data subjects may request access by submitting a Personal Video Information Access Request Form. Access is granted only when the footage pertains to the data subject or is necessary to protect their life, body, or property.
⑦ Technical, Administrative, and Physical Measures for Protection: Establishment of internal control plans, access control and permission restrictions, secure storage facilities, and installation of locking systems

Article 14 (Changes to the Privacy Policy)

This Privacy Policy shall take effect as of May 1, 2025.
Any additions, deletions, or modifications to this Policy due to changes in laws or internal policies will be announced via the Company’s website.

Agree to Terms