Privacy Policy (2024)

NAVER Privacy Policy Ver.11.9

NAVER ranks the protection of personal information as top priority value among several managerialcomponents.

NAVER Corporation (“NAVER” or “Company”) strictly complies with all domesticlaws and regulations, including the Personal Information Protection Act, in all stages from serviceplanning to termination. Furthermore, NAVER provides services in compliance with internationalstandards, including the OECD Privacy Guidelines.

1. What Privacy Policy Means for Our Users

NAVER has made efforts to describe the current status of processing personal informationwithin NAVER as detailed and easy as possible, while creating this Privacy Policy based on thePersonal information protection Act.
This is because NAVER has adopted the“Plain Language Privacy Policy,” as its principle in writing Privacy Policy with conciseand easy-to-understand terms.

Privacy Policy has the following important implications.

• Privacy Policy provides transparent information in relation to the “life cycle ofpersonal information,” such as the information collected by NAVER, how the collectedinformation is used, with whom the information is shared when necessary, and when and how theinformation is destroyed once it fully serves its purpose.
• Privacy Policy informs users, the information subjects, their rights regarding theirpersonal information as well as the methods and procedures to exercise such rights. Guidelinesare also provided for the rights that legal representatives (including parents, etc.) mayexercise to protect the personal information of minors under the age of 14.
• Where the privacy infringement takes place, Privacy Policy guides you who to contact andwhat kind of help you should expect in order to prevent further damage and restore the damageyou have already sustained.
• Above all, it defines the rights and duties of NAVER and users in relation to personalinformation and a means to guarantee the Right to Informational Self-determination among users.

2. Personal Information Collected

Users may access the majority of NAVER services in a manner equivalent tomembers, such as information searches and viewing news articles without any need to subscribe asmembers.
When a user subscribes to use personalized or membership services such as e-mail,calendar, cafe, blog, and more, NAVER collects the minimum amount of personal information neededfor him/her to use such services.

The personal information that NAVER collects fromusers at the time they sign up for membership is as follows.

• • When signing up for membership, both the required items (including ID, password,name, date of birth, gender, and mobile phone number) and the optional item (an e-mailaddress for the identification process), are collected. When signing up for membershipwith a real-name-authenticated ID, encrypted connecting information (CI), duplicationinformation (DI), and domestic and foreign resident information are collected together.For children under the age of 14, we obtain the consent of a legal guardian and verifythis consent through a mobile phone number or i-PIN authentication. During this process,the legal guardian's information (legal guardian's name, duplicate registrationconfirmation information (DI), mobile phone number (i-PIN number in the case of i-PINauthentication)) is additionally collected.
  • When multiple users belonging to a group sign up for membership, both therequired items (including the group ID, password, group name, e-mail address, and mobilephone number) and the optional item (the name of the group's representative) arecollected.
  • When signing up for membership without a password, both the required items(including ID, name, date of birth, and mobile phone number) and the optional item(password) are collected.
  • In countries other than Korea, users may join using their Facebook, LINE, orApple ID. Personal information stated above will not be collected when users join usingtheir social media ID. The following personal information will be collected when usersjoin using social media ID:
    Facebook : (Required) Name, profile picture,(Optional) Email address
    LINE : (Required) Name, profile picture, mobile phonenumber, list of friends, (Optional) Email address
    Apple : (Required) Name,(Optional) Email address

• Personal information collected from users during their service use is asfollows.

  • Your profile information (nickname, profile picture) can be set in your memberinformation or individual services. When a nickname is not entered, the masked ID willbe automatically entered as the nickname.
  • Additional personal information may be collected only from users who accessindividual services within NAVER, participate in an event, or register for a giveawayevent. In addition, when collecting additional personal information, the users areprovided with further guidance regarding the ‘collected items of personalinformation, purposes of collecting and using personal information, and the retentionperiod of personal information’ at the time of collecting such personalinformation and are asked to provide their consent.

  Caseswhere additional personal information is collected upon user consent Check Status on the Useof Personal Information (My Info)

• The IP address, cookies, service usage records, device information, and locationinformation may be generated and collected during service use.
  Inaddition, images or voice data may also be collected from search services using imagesand voice data.

  To be specific, 1) information about users is generated in an automated manner or informationthat users entered is stored (collected) during their service use or 2) the unique deviceinformation of users is safely converted to prevent the original values from beingidentified and such converted information is then collected. Location information may becollected during the service use, and the location-based service provided by NAVER isregulated in details in the “Terms of Location-Based Service”
  The collectedinformation may correspond to personal information or not, depending on whether it is linkedto personal information.

• NAVER collects personal information under the following methods.

  • If the user agrees to the collection of personal information and enters his/herpersonal information while signing up for membership during service use, such personalinformation will be collected.
  • Personal information of the user may be collected through websites, email, fax,phone, etc. during the consultation through the customer center.
  • Personal information may be collected in writing from offline events, seminars,and the like.
  • Personal information may be provided from outside companies or organizationspartnered with NAVER, and in such cases, the partner is required to obtain consent fromusers to provide personal information under the Personal Information Protection Actbefore such information is provided to NAVER.
  • Generated information such as device information may be automatically generatedand collected during the use of PC web or mobile web/app.

3. Use of Collected Personal Information

Personal information is used only to manage members of NAVER and all other related services(including mobile web/app), develop, provide, and improve services, and establish a safeInternet environment.

• • Personal information is used for member management, such as confirmingmembers’ intention to subscribe, confirming the age, proceeding with obtainingconsent from legal representatives, verifying the identity of users and their legalrepresentatives, identifying users, and confirming their intention to unsubscribe.
  • In addition to the purpose of providing existing services (includingadvertisem*nts) such as contents, personal information is used to discover new serviceelements and improve existing services such as demographic analysis, analysis of visitsto services and usage records, building user-to-user relationships based on personalinformation and interests, and providing tailor-made services based on acquaintances andinterests.Cultivating new service elements and enhancing existing servicesinvolves the utilization of artificial intelligence (AI) technology for tasks such asinformation searching, user communication, the creation, provision, and recommendationof content, and product shopping.
  • Personal information is used to protect users and operate services by means suchas preventing and imposing sanctions against acts that interfere with the smoothoperation of services, including measures restricting the use by members who breach thestatutes and NAVER Terms of Service, preventing account theft and fraudulenttransactions, sending out notices regarding a revision to the terms and conditions,preserving records for dispute mediation, and handling civil complaints.
  • Personal information is used for personal authentication, purchases and paymentsfor charges, and deliveries of products and services for the provision of paid services.
  • Personal information is used for marketing and promotion purposes such asproviding event information, opportunities for participation, and advertisinginformation.
  • Personal information is used for service usage records and access frequencyanalysis, statistics on service use, service analysis, and providing tailor-madeservices and advertising according to statistics.
  • Personal information is used to establish a service environment that users feelsafe to use in terms of security, privacy, and safety.

  After pseudonymizing the collected personal information to make it impossible toidentify a particular individual, NAVER can process the information for purposes such asstatistical, scientific research, and archiving for the public interest. At this time,the pseudonymized information shall be stored and managed separately from additionalinformation to prevent re-identification, and necessary technical and managerialsafeguards shall be taken.

  Status of pseudonym informationprocessing

  See Also

  Children's Privacy PolicyTerms of Use | WEBTOON

4. Provision & Entrustment of Personal Information

• In principle, NAVER does not provide personal information to the outside without theconsent of users.

  NAVER does not provide personal information to the outside without prior consent from users.However, personal information is provided in limited circ*mstances if a user personallyagrees to provide his/her personal information in order to use the service of an outsidepartner, if NAVER becomes obliged to submit personal information under the relevant laws andregulations, or if an urgent risk to life or safety of users is identified.

  Caseswhere personal information is provided following user consent Check Status of PersonalInformation Use (My Info) Cases where personal information is provided under the law (NAVERPrivacy Center)

• NAVER entrusts part of its work to the outside to provide convenient and betterservices.

  NAVER entrusts part of its work necessary to provide services to outside companies,stipulates the matters necessary for the entrusted party to safely process personalinformation, and carries out management or supervision to ensure such safe processing, inaccordance with the Personal Information Protection Act. If a user does not use the servicerelated to the work entrusted to the entrusted party, his/her personal information will notbe provided to the said entrusted party.

  Information regarding the consignment of the company's consignment

  Entrusted Company	Entrusted Operations	Retention and Usage Period of Personal Information

• NAVER Cloud Corp., the entrusted company, stores personal information outside ofKorea in the following way.

  The following are cases where the outsourcing of personal information processing is necessaryfor the conclusion and performance of a contract with the data subject (Article 28-8,Paragraph 1, Item 3 of the Personal Information Protection Act):
  NAVER safely storesdata within and outside of Korea to continue providing the company's services even in theevent of natural disasters and catastrophes. "NAVER Cloud Corp." is an affiliate of NAVERand is subject to the same data protection policy as NAVER. Furthermore, the companyperforms data management tasks under NAVER's strict control, which includes blocking dataaccess from abroad. In the event of a loss due to natural disasters or catastrophes, a fulldata backup is conducted to recover data. Refusal to comply may result in inability to usethe service. If you don't want to relocate, you can either proceed with membershipwithdrawal or request assistance through our customer service center.

  Information regarding the consignment of the company's consignment

  Entrusted Company	NAVER Cloud Corp.
  Storage Location	Singapore(#24-01, Vision Exchange, 2 Venture Drive, Singapore608526)
  Date of Entrustment & methods	July 13, 2020 Remote transmission using dedicated privatenetworks
  Chief Privacy Officer Contact Information	dl_ncloud_privacy@navercorp.com
  Personal Information List for Entrustment	Only a minimal amount of user data required for recovery
  Entrusted Operations	Data backup (store) between countries for safe user data protectionfrom disasters and accidents
  Personal Information Retention & Usage Period	Corresponds to the storage period described in this privacy policy

  In the process of using certain services, if meetings or voice calls are conducted,there may be cases where personal information is outsourced for processing overseas to providethe service. If you do not use the meeting or voice call services, no personal informationtransfer will occur. If you refuse the transfer, you will not be able to use these services.Therefore, if you do not wish for your personal information to be transferred overseas, you canrefuse by not using these services.

  Information regarding the consignment of the company's consignment

  Entrusted Company	LINE Plus Corporation
  Storage Location	Japan
  Date of Entrustment & methods	Remote transmission over the network at the time the user utilizesthe service
  Contact Information	privacy_kr@linecorp.com
  Personal Information List for Entrustment	User identifiers and video/audio information generated internally
  Entrusted Operations	Provision of video/audio call and video conferencing services
  Personal Information Retention & Usage Period	Video/audio information is destroyed immediately upon the end of themeeting or call, and user identifiers are stored for one year

5. Destruction of Personal Information

• In principle, the company destroys users' personal information without any delayeither when they withdraw from membership or the company achieves its purpose ofuse.

  However, if the Company has obtained separate consent from users regarding the retentionperiod of personal information or if the laws and regulations impose duties to retaininformation for a certain period, personal information may be stored safely during thedesignated period.

• NAVER will obtain consent from users for the retention period of personalinformation at the time of their member or service subscription for the followingpurposes.

  To prevent any fraudulent subscription and use
  DI of fraudulent users(legal representative’s DI for users aged 14 or under) : Stored for 6 monthsfrom the date of withdrawal
  Mobile phone number of users withdrawn frommembership (In the case of mobile phone verification, the information is storedusing irreversible one-way encryption (hashing), and for DI (when using i-PINverification) : Stored for 6 months from the date of withdrawal

  Identification for the provision of NAVER's services
  Information on thetelecommunication company, mobile phone number : The aforementioned informationshall be kept for one year from the time of its collection

  Ifseparate consent has been obtained for the retention period in individualservices

• Relevant statutes, including the Act on the Consumer Protection, in ElectronicCommerce, Etc., the Framework Act on Electronic Documents and Transactions, and theProtection of Communications Secrets Act, require NAVER to store the information fora certain period of time under the following circ*mstances. NAVER stores personalinformation during the set period under the provisions of the statutes and in nocase will it ever store this information for any other purposes.

  Act on the Consumer Protection, in Electronic Commerce, Etc.
  Records onthe contract or subscription withdrawal, etc. : Stored for 5 years
  Records onthe payment and supply of goods, etc. : Stored for 5 years
  Records on theconsumer complaints or dispute settlement : Stored for 3 years

  Framework Act on Electronic Documents and Transactions
  Records on thedistribution of electronic documents through authorized electronic addresses :Stored for 10 years

  Protection of Communications Secrets Act
  Login information : 3 months

• Personal information that fully serve its purpose of collection and use, by meanssuch as membership cancellation, service termination, and/or expiration of theretention period of personal information approved by the user, is destroyed to anirreversible state.
  Information required to be retained underthe statutes is also destroyed to an irreversible state without delay after theexpiration of the relevant period.

  Personal information storedin electronic form is securely deleted by technical means to prevent its recovery orrestoration, while written information is shredded or incinerated.

6. Rights of Users & Legal Representatives and Exercising Those Rights

• Users can go to ‘NAVER My Info> Member Info’ to view or update their personal information and request accessto their personal information at any time.
• Users are entitled to request a suspension of processing their personal information atany time, and NAVER may refuse the request for suspension of processing if special provisions inthe statute provide otherwise.
• Users can go to ‘MembershipWithdrawal’ to revoke their consent to the collection and use of their personalinformation at any time.
• If the user is under the age of 14, the child’s legal representative has the rightto view and update the child’s personal information, and to revoke his/her consent to thecollection and use of the child’s personal information.
• If a user requests the correction of errors in his/her personal information, the relevantpersonal information will not be used or provided until the correction is made. In addition, inthe event where the incorrect personal information has already been provided to a third party,NAVER will notify the third party of the corrected information without delay to ensure that thenecessary correction is made.
• Users and their legal representatives can go to ‘MemberInfo’ to personally handle their rights or go to ‘Inquire’ to send a request. The details provided to third partiesaccording to the user's service use activities and consent details are available on the‘Personal Information UsageStatus’ where they may withdraw their consent.
• NAVER provides the page to ensure users' rights in accordance with the 'Online customizedadvertising privacy protection guideline'

7.Actions Taken to Protect Personal Information

• NAVER makes every effort to securely manage users' personal information(includingpseudonymous information) and protects personal information beyond the degree requiredby the Personal Information protection Act.

• NAVER has established and implemented an internal privacy management plan.

  NAVER has established an internal personal information management plan, containing matters inrelation to the composition and operation of the privacy organization, such as thedesignation of privacy personnel, and inspect whether the internal management plan isimplemented effectively each year.

• Actions are undertaken to control access to and restrict the right to access personalinformation.

  In order to prevent illegal access to personal information, NAVER has established thestandards for granting, modifying, and canceling access rights to the personal informationprocessing system, and runs an intrusion prevention system and intrusion detection system.Employees that handle personal information are kept to a minimum and Intranet is completelycut off from external Internet for the work computers of employees that are permitted todownload personal information from the personal information processing system, therebyreducing the risk of personal information leakage.

• Personal information is being encrypted for safe storage and transmission.

  In addition to the passwords, unique identifiable information, account numbers, and creditcard numbers that are encrypted for storage as required by law, email addresses and mobilephone numbers are also encrypted and stored. NAVER also safely sends and receives personalinformation over the network via encrypted communication.

• Actions are taken to store personal information access records and prevent anyforgery and tampering.

  The personal information handler stores and manages access records for the personalinformation processing system, periodically inspects access records to prevent any misuse,abuse, loss, forgery, and tampering of personal information, and safely stores the relevantaccess records so that they are not forged, stolen, or lost.

• NAVER installs and renews security programs for personal information.

  NAVER frequently backs up data to offset risk of any damage to personal information, and usesthe latest antivirus software to prevent leakage or damage of users' personal information.

• NAVER enforces physical actions to keep personal information safe.

  In order to prevent leakage or damage of members' personal information caused by hacking orcomputer viruses, NAVER installs systems in areas with restricted access from the outside,and establishes and operates access control procedures.

• NAVER establishes and operates detailed plans that must be executed in crisis dueto disasters and calamities.
  
  Detailed plans, including crisisresponse guidelines, are prepared, and response systems are in place to minimizeinconvenience to users during such situations.
  

• NAVER securely manages printed and copied materials containing personal information.
  Printed materials containing personal information are destroyed afterviewing, and files copied to external storage media are detected and deletedaccordingly.
  
• Personal information that has fulfilled its intended use is destroyed in a manner thatmakes recovery and restoration impossible.
  For electronic files, technicalmethods are used to ensure safe deletion, preventing recovery and restoration, while printedmaterials are destroyed by shredding or incineration.

• NAVER operates a separate organization that only deals with the protection ofpersonal information.

  In 2007, NAVER became the first company in Korea to create the Privacy Team. Even to thisday, the Privacy Department continues to enforce technical/administrative protectivemeasures at all times to ensure that all executive and employees of NAVER fully comply withtheir duties to protect the personal information of users.

• NAVER is the first company in Korea to run a blog and website entirely dedicated tothe protection of personal information.

  NAVER has launched Korea's first blog entirely dedicated to the protection of personalinformation to communicate with users. NAVER also provides Privacy as a Service to protectthe privacy of users through its NAVER Privacy Center.

  Go to NAVER Privacy Center > Protection Activities Go to NAVER blog for personalinformation protection

• NAVER audited by domestic and international certification authorities for its privacyactivities.

  NAVER is regularly audited by external authorities for its information protection activitiesthrough the international information security standard ISO/IEC 27001 and the Koreaninformation security standard ISMS-P·ISMS. NAVER is audited for the level of itsinternal service control under the auditing standards of the American Institute of CertifiedPublic Accountants (AICPA) and the results are published in SOC reports.

  Go to Information ProtectionCertification Go to SOC Certification

8. Chief Privacy Officer & Responsible Personnel

NAVER has designated the following persons as the Chief Privacy Officer and Personal InformationManager to remain responsible for responding to user inquiries regarding personal information andresolving any related complaints.

If you need to report or consult on other privacy infringements, please contact the followinginstitutions.

• Personal Information Dispute Mediation Committee (www.kopico.go.kr /Phone no. 1833-6972)
• Privacy Infringement Report Center (privacy.kisa.or.kr / Phone no.118)
• Cyber Crime Investigation Unit, Supreme Prosecutor’s Office (www.spo.go.kr / Phone no.1301)
• Cyber Bureau of Investigation, National Police Agency (police.go.kr / Phone no.182)

9. Processing personal location information

• NAVER safely manages users' personal location information in accordancewith the Act on the Protection and Use of Location Information.

• Purpose of processing and period of use of personal locationinformation

  NAVER destroys personal location information without delay after one-time or temporary usefrom most location-based services. However, when a user posts or stores personal locationinformation along with posts and content on NAVER’s service, such as in the‘GeoTagging’ service, the personal location information is stored togetherduring the retention period of the posts and content.

• The purpose of processing personal location information to provide NAVER'slocation-based services is as follows.

• Grounds for and period of retaining data verifying the collection, usageand provision of location information

  In accordance with Article 16 (2) of the Act on the Protection and Use of LocationInformation, NAVER automatically records data verifying the collection, use, and provisionof location information in a location information system, and preserves the data for 6months or longer.

• Procedure and method for the destruction of personal locationinformation

  When the purpose of processing personal location information has been attained, NAVER safelydestroys personal location information in an unrecoverable way. Electronic files aredestroyed using a technical method that cannot be recovered or regenerated, and documentsare shredded or incinerated.

• Matters on providing personal location information to third parties andnotification of such provision

  NAVER does not provide personal location information to a third party without prior consentfrom the user. In case NAVER provides personal location information to a third partydesignated by the user, NAVER immediately notifies the subject of personal locationinformation of the designated recipient of such information, the date and time, and thepurpose of such provision on each occasion.

  NAVER only provides personal location information to a third party when a user directlyconsents to the provision of personal location information in order to use the services ofan outside partner, when NAVER is obligated to provide personal location information inaccordance with relevant laws, and when an imminent risk to the life or safety of a user isconfirmed and such risk needs to be addressed.

  Location information 3rd party provision status

• Rights and responsibilities held by the legal guardian of children of eightyears old or younger, etc., and how to exercise them

  Where the legal guardian of any of the following users (hereinafter referred to as "child ofeight years old or younger, etc.") gives consent to the use or provision of personallocation information regarding the child of eight years old or younger, etc. for theprotection of their health or safety, NAVER deems that the user him/herself has givenhis/her consent.

  • A child of eight years old or younger
  • A person under adult guardianship
  • A person with a mental disorder defined in Article 2 (2) 2 of the Act on Welfareof Persons with Disabilities, classified as a person with a severe disability defined insubparagraph 2 of Article 2 of the Act on the Employment Promotion and VocationalRehabilitation of Persons with Disabilities (limited to those registered as disabledpersons under Article 32 of the Act on Welfare of Persons with Disabilities).

  For the protection of the health or safety of a child of eight years old or younger, etc.,the legal guardian who intends to consent to the use or provision of personal locationinformation must submit a written consent to NAVER along with a document proving that he/sheis the legal guardian.

  The legal guardian can exercise all of the rights of the subject of personal locationinformation if he/she agrees to the use or provision of personal location information for achild of eight years old or younger, etc.

• Person responsible for managing location information

  The above person responsible for protecting personal information at NAVER is also in chargeof managing location information.

10. Application of this Privacy Policy

• This Privacy Policy is applied to the ‘NAVER(www.naver.com)’ website, a brand of NAVER, and otherrelated services (including mobile web/app), whereas a separate privacy policy may be applicableto services provided under a different brand name.
• This Privacy Policy will not be applied to personal information collected from websitesthat are run by other companies through links to NAVER after such formation is provided underthe consent of users.

11. Obligation to Notify Prior to Amendment

Users will be notified of any addition, deletion, and/or modification in this Privacy Policy through‘Notice’ at least 7 days prior to the scheduled amendment.
However, if an importantmodification is made to the rights of users, such as the modification to the collected items ofpersonal information and the purposes of their use, the notification will be sent at least 30 daysprior to any such modification, and if necessary, NAVER may obtain users’ consent again.

• Notification date : June 20, 2024
• Effective date : June 27, 2024