Apply for a Course

Draft for the Standard Privacy Policy of the National Disaster Management Training Institute

The National Disaster Management Training Institute (the “NDTI”) lawfully processes and safely manages personal information by complying with the Personal Information Protection Act and related laws and regulations to protect the freedom and rights of data subjects. Accordingly, the National Civil Defense Disaster and Safety Training Institute has established and disclosed the privacy policy as follows in order to guide the procedures and standards for processing personal information to data subjects under Article 30 of the Personal Information Protection Act, and to promptly and smoothly handle complaints related thereto:

Key information Personal information processing indication (labeling)

Collection of General Personal Information
Purpose of Processing
Retention Period
Commissioned Processing of Personal Information
Provision of Personal Information
Request to View Personal Information

The privacy policy consists of the following contents:

Article 1. Purpose of Processing Personal Information
Article 2. Items of Processed Personal Information
Article 3. Results of Impact Assessment of Personal Information
Article 4. Matters Concerning Provision of Personal Information to Third Parties
Article 5. Matters Concerning Commissioned Processing of Personal Information
Article 6. Procedures and Methods for Destroying Personal Information
Article 7. Matters Concerning Rights, Obligations, and Exercise Methods of Data Subjects and Legal Representatives
Article 8. Matters Concerning Measures to Ensure Safety of Personal Information
Article 9. Matters Concerning Installation, Operation, and Refusal of Devices Automatically Collecting Personal Information
Article 10. Standards for Determination Regarding Additional Use and Provision
Article 11. Matters Related to Processing of Pseudonymized Data
Article 12. Matters Concerning Managers Responsible for Protection of Personal Information (by Field)
Article 13. Division Receiving and Processing Request for Viewing Personal Information
Article 14. Remedies for Infringement of Rights and Interests of Data Subjects
Article 15. Results of Inspection of Status of Protecting Personal Information
Article 16. Matters Concerning Changes in Privacy Policy

The NDTI complies with the regulations on the protection of personal information under the related laws such as the Personal Information Protection Act, specifies and operates the privacy policy as follows to protect personal information of data subjects under Article 30 of the Personal Information Protection Act, and smoothly handles complaints related thereto:

Article 1. Purpose of Processing Personal Information

① The purpose of processing personal information files registered and disclosed by the NDTI in accordance with Article 32 of the Personal Information Protection Act is as follows:
1. 1. Personal information file name: (Member information in the training management system)
2. 1. a. Purpose of processing personal information: To provide a high-quality educational environment by applying the latest ICT convergence to trainees in the era of the 4th Industrial Revolution and provide a one-stop online service for the existing method of making them enter and complete courses offline
  2. b. Collection method: Website
  3. c. Ground for retention: Article 29-2 of the Framework Act on Disaster and Safety Management (Training of workers in the disaster and safety field)
  4. d. Retention period: Semi-permanent
3. 2. Personal information file name: (Current status of trainees in the cyber education field)
4. 1. a. Purpose of processing personal information: To use statistical data by course, target, and training status, confirm targets and issue certificates of completion at the request for confirming whether trainees have completed training courses or not, and survey the training effects and satisfaction
  2. b. Collection method: Website
  3. c. Ground for retention: Article 29-2 of the Framework Act on Disaster and Safety Management (Training of workers in the disaster and safety field)
  4. d. Retention period: Semi-permanent
5. 3. Personal information file name: (Status of trainees and instructors in the field of disaster safety and civil defense)
6. 1. a. Purpose of processing personal information: To use statistical data by course, target, and training status, confirm targets and issue certificates of completion at the request for confirming whether trainees have completed training courses or not, survey the training effects and satisfaction, send emails to deliver the news about the NDTI and notices, promote the training results, request lectures, pay lecture fees, implement, and utilize database on excellent instructors, etc.
  2. b. Collection method: Website
  3. c. Ground for retention: Article 29-2 of the Framework Act on Disaster and Safety Management (Training of workers in the disaster and safety field)
  4. d. Retention period: Semi-permanent
7. 4. Personal information file name: (Member information on disaster and safety training portal)
8. 1. a. Purpose of processing personal information: To give disaster safety training courses and issue certificates
  2. b. Collection method: Website
  3. c. Ground for retention: Article 29-2 of the Framework Act on Disaster and Safety Management (Training of workers in the disaster and safety field)
  4. d. Retention period: Semi-permanent

Article 2. Items of Processed Personal Information

① The NDTI processes the following personal information items:
1. <Member Information for the Training and Management System>
a. Required items: Name, date of birth, mobile phone number (contact information), email address, workplace contact number, and others (name of organization, name of division, name of position, gender, account number)
2. <Status of Trainees in the Cyber Education Field>
a. Required items: Name, date of birth, mobile phone number (contact information), email address, and others (name, mobile phone number, organization name, position, date of birth)
3. <Status of Trainees and Instructors in the Field of Disaster Safety and Civil Defense>
1. a. Required items: Name, date of birth, mobile phone number (contact information), email address, and others (Instructor: ID, password, date of birth, gender, account number, address, company/division, title/position, academic information, career information; trainee: ID, password, gender, workplace phone number, company/division, title/position; administrator: ID, password, gender, workplace phone number, company/division, title/position)
2. b. Optional items: Instructor: phone number, fax, major books, photos, videos; trainee: account number, fax
4. <Member Information on the Disaster and Safety Training Portal>
a. Required items: Name, mobile phone number (contact information), email address, and others: (name, gender, year of birth), Other (mobile phone number, email address)

ㅣ

Article 3. Results of Impact Assessment of Personal Information

① The NDTI undergoes an “impact assessment of personal information” in accordance with Article 33 of the Personal Information Protection Act in order to investigate, analyze, and evaluate the impact of the personal information processing system it operates on the personal information files of data subjects.
② The NDTI conducts impact assessment on the following personal information files:

Article 3 Results of personal information impact assessment
Name on Personal Information Files	Items of Personal Information Recorded in Personal Information Files	Year of Impact Assessment
Member information for the training management system	Name, date of birth, mobile phone number (contact information), email address, workplace contact number, and others (name of organization, name of division, name of position, gender, account number)	2023
Current status of trainees in cyber education field	Name, date of birth, mobile phone (contact information), E-MAIL, other (name, mobile phone, organization name, rank, date of birth)	2023
Current status of trainees and instructors in disaster safety and civil defense fields	Name, date of birth, cell phone (contact information), E-MAIL, etc. (Instructor: ID, password, date of birth, gender, account number, address, affiliation/department, rank/position, education information, career information, trainee: ID, password, Gender, work phone, affiliation/department, rank/position, manager: ID, password, gender, work phone, affiliation/department, rank/position)	2023
Disaster and Safety Education Portal Member Information	Name, cell phone (contact information). E-MAIL, Other: (name, gender, year of birth), Other (cell phone, E-MAIL)	2023

Article 4. Matters Concerning Provision of Personal Information to Third Parties

① The NDTI processes the personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides personal information only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, including the consent of the data subjects and special provisions of the law.
① The NDTI provides personal information to third parties as follows:
1. < Recipient of Personal Information >
- Recipient of personal information: National Information Resources Service
- Purpose of use of personal information of the recipient: To send text messages, give notices, etc.
- Provided personal information items: Name, address, phone number, email address
- Period of retention and use by the recipient: Until completion of the training management system-related tasks

Article 5. Matters Concerning Commissioned Processing of Personal Information

① In order to smoothly process personal information, the NDTI commissions the processing of personal information as follows: 가. Commissioned Companies

Article 5 Matters concerning entrustment of personal information processing
Name of Commissioned Company	Address	Phone Number	Working Hours	Commissioned Tasks
Sangsang Story Co., Ltd.	-	02-6677-3082	09:00~18:00	Maintenance of the training management system
Sangsang Story Co., Ltd.	-	02-6677-3082	09:00~18:00	2nd upgrade of the next-generation training management system

② Upon concluding a commission contract, the NDTI specifies matters regarding responsibilities, including prohibition of processing personal information for purposes other than performing commissioned tasks, technical and managerial protection measures, restrictions on recommissioning, management, and supervision to the commissioned company, and compensation for damages in the documentation such as the contract. etc., and supervises whether the commissioned company handles personal information safely under Article 26 of the Personal Information Protection Act.
② If the details of the commissioned tasks or the commissioned company are changed, the NDTI will disclose such changes through this privacy policy without delay.

Article 6. Procedures and Methods for Destroying Personal Information

① The NDTI destroys personal information without delay when personal information becomes unnecessary, such as when the personal information retention period has elapsed or when the purpose of processing has been achieved.
② The procedures and methods for destroying personal information are as follows:
1. Destruction procedure: The NDTI selects personal information for which reasons for destruction have arisen, and destroys the personal information with the approval of the manager in charge of each personal information field of the NDTI.
2. Destruction method: The NDTI destroys personal information recorded and stored in the form of electronic files so that the records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding or incineration.

Article 7. Matters Concerning Rights, Obligations, and Exercise Methods of Data Subjects and Legal Representatives

① Data subjects can exercise their rights, such as requesting viewing, correction, deletion, and suspension of processing of personal information, at any time, against the NDTI.

② Data subjects may exercise rights under Paragraph 1 in writing or by e-mail, fax, etc. to the NDTI in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the NDTI shall take action without delay.

③ Data subjects may exercise the rights under Paragraph 1 through an agent, such as the data subject's legal representative or a person authorized to do so. In this case, the data subject must submit a power of attorney in the form of Appendix No. 11 of the “Notification on Method of Processing Personal Information.”

※ A request to view personal information regarding a child under the age of 14 must be made directly by the legal representative, and a data subject who is a minor over the age of 14 may exercise their rights regarding their personal information or through their legal representative.

④ At a request to view and suspend processing personal information, the data subject's rights pursuant to Article 35(4) & Article 37(2) of the Personal Information Protection Act may be restricted.

⑤ In the case of a request for correction or deletion of personal information, if the personal information is specified as the subject of collection in other laws and regulations, the deletion shall not be allowed to be requested.

⑥ Upon a request for viewing, correction, deletion, or suspension of processing according to the rights of the data subject, the NDTI verifies whether the requesting person is the data subject themselves or a legitimate agent.

⑦ If the data subject is dissatisfied with the measures taken by the NDTI, such as refusal of a request to exercise rights, the NDTI may raise an objection through the contact information listed in the “division of receiving and handling the request for viewing personal information” in Article 13(1) of this privacy policy.

Article 8. Matters Concerning Measures to Ensure Safety of Personal Information

The NDTI takes the following measures to ensure the safety of personal information:
1. Establishment and implementation of an internal management plan: The NDTI is establishing and implementing an internal management plan to ensure safe processing of personal information.
2. Minimization and training of staff handling personal information: The NDTI designates and manages only the absolutely necessary number of staff to handle personal information, and provides training programs for safe management to staff handling personal information.
3. Conduction of regular self-guidance: To ensure stability in handling personal information, the NDTI conducts a self-diagnosis of personal information protection management level every year.
4. Restriction of access to personal information: The NDTI takes necessary measures to control access to personal information by granting, changing, and deleting access rights to the personal information processing system that processes personal information, and controls unauthorized access from the outside by using the intrusion prevention system.
5. Storage of access records: The records of access to the personal information processing system are stored and managed for at least one year. However, in the case of a personal information processing system that processes personal information of more than 50,000 data subjects or unique identification information or sensitive information, the records are stored and managed for at least two years.
6. Encryption of personal information: Personal information is safely stored and managed through encryption, etc. In addition, the NDTI uses separate security features such as encrypting important data when storing and transmitting it.
7. Technical measures against hacking, etc.: The NDTI (the “Training Management System“) installs and periodically updates and inspects security programs to prevent personal information from being disclosed and damaged due to hacking or computer viruses.
8. Access control for unauthorized persons: The NDTI has a separate physical storage location for the personal information processing system where personal information is stored, and establishes and operates access control procedures for this.

Article 9. Matters Concerning Installation, Operation, and Refusal of Devices Automatically Collecting Personal Information

① The NDTI uses cookies to store use information and periodically retrieves it in order to provide individualized services to users.
② A cookie refers to a piece of data that the server (http) used to run the website sends to the user's computer browser, and is sometimes stored on a user’s computer hard disk.
a. Purpose of use of cookies: Used to provide optimized information to a user by identifying visits and usage patterns, popular search terms, secure access, etc. for each service and website visited.
b. Installation, operation, and rejection of cookies: The user may set their browser options to allow or block cookies.
- Internet Explorer: Tools menu at the top right of the web browser > Internet Options > Privacy > Settings > Advanced
- Microsoft Edge: Settings Menu at the top right of the web browser > Cookies and Site Privileges > Manage and Delete Cookies and Site Data
- Google Chrome: Settings Menu at the top right of the web browser > Privacy and Security > Cookies and Other Site Data
c. If the user refuses to store cookies, they may have difficulty using customized services.

Article 10. Standards for Determination Regarding Additional Use and Provision

① The NDTI can additionally use and provide personal information without the consent of the data subject in consideration of matters pursuant to Article 14-2 of the Enforcement Decree of the Personal Information Protection Act in accordance with Articles 15(3) and 17(4) of the Personal Information Protection Act.

Article 10 Criteria for judgment regarding additional use and provision
Item	Purpose of Use and Provision	Retention and Use Period
Name, contact information, address	Sending additional notices related to the Service of the NDTI provided on a regular basis	Destroying immediately upon achievement of purpose

② Accordingly, the NDTI considers the following matters in order to make additional use and provision without the consent of the data subjects:

‣Whether the purpose of additional use and provision of personal information is related to the original purpose of collection
‣ Whether there is a possibility of additional use and provision of personal information in light of the circumstances in which it was collected, or processing practices
‣ Whether the additional use and provision of personal information unfairly infringes on the interests of data subjects
‣ Whether necessary measures were taken to ensure safety, such as pseudonymization or encryption

Article 11. Matters Related to Processing of Pseudonymized Data

The Ministry of the Interior and Safety processes personal information collected for statistical purposes, scientific research, and public record preservation as follows:
1. Matters Pertaining to the Processing of Pseudonymized Data

Article 11 Matters related to processing of pseudonym information
Classification	Purpose of Processing	Processing Items	Retention and Use Period
Creating statistics	Preparation of statistics such as training status	Name	Until statistics are completed

2. Matters Concerning Measures to Ensure the Safety of Pseudonymized Data Pursuant to Article 28-4 of the Act (Obligation to Take Safety Measures for Pseudonymized Data, etc.)
- Administrative measures: Establishment and implementation of internal management plan, regular employee training, etc.
- Technical measures: Management of access rights to the personal information processing system, installation of an access control system, encryption of unique identification information, installation of a security program
- Physical measures: Access control to computer rooms, data storage rooms, etc.

Article 12. Matters Concerning Managers Responsible for Protection of Personal Information (by Field)

① The NDTI is responsible for the overall management for processing personal information, and designates managers in charge of protection of personal information (by field) as follows to handle complaints and damage relief, etc. of data subjects related to processing personal information.

Article 12 Matters concerning the person responsible for personal information protection (by field)
Classification	Division	Name	Contact Information
Privacy Officer	Planning and Cooperation Division	Yong-doo Kim	※ To be connected to the division in charge. Tel 041-840-6435 Email sielcrow88@korea.kr
Manager in charge of protection of personal information by field	Planning and Cooperation Division	Sang-yeon Park

② Data subjects may inquire to the division in charge of personal information by field for all inquiries related to protecting personal information, handling complaints, relieving damage, etc. that arise while using the Service of the NDTI. The NDTI shall respond and process inquiries from data subjects without delay.

Article 13. Division Receiving and Processing Request for Viewing Personal Information

① A data subject may make a request to view personal information pursuant to Article 35 of the Personal Information Protection Act to the division below, and the NDTI shall endeavor to promptly process the request to view personal information. ‣ Division for receiving and processing the request for viewing personal information by field

Article 13 Department that receives and processes requests to view personal information
Division in Charge by Field	Manager	Phone Number	Email Address	Fax
Planning and Cooperation Division	Sang-yeon Park	041-840-6435	sielcrow88@korea.kr	-

② Subjects may make a request for viewing personal information through the website “Personal Information Portal” (www.privacy.go.kr) in addition to the division receiving and processing the request for viewing as seen in Paragraph 1 above.
※ Portal for Personal Information → Civil Service → Exercise of Rights of Data Subject → Request to View Personal Information, etc. (Identity authentication required)

Article 14. Remedies for Infringement of Rights and Interests of Data Subjects

① In order to receive relief due to the infringement of personal information, a data subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center under the Korea Internet & Security Agency, etc. For other reports and consultation on infringement of personal information, please contact the organizations below.

1. Personal Information Dispute Mediation Committee: (Without area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: (Without area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: (Without area code) 1301 (www.spo.go.kr)
4. Korea National Police Agency: (Without area code) 182 (ecrm.cyber.go.kr)

② If a subject‘s rights or interests have been infringed upon due to disposition or omission carried out by the head of a public institution regarding a request under Article 35 (View of Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing Personal Information, etc.) of the Personal Information Protection Act, they may request an administrative trial as specified by the Administrative Appeals Act.
▸ Central Administrative Appeals Commission: (Without area code) 110 (www.simpan.go.kr)

Article 15. Results of Inspection of Status of Protecting Personal Information

① In order to safely manage the personal information of data subjects, the NDTI receives the “inspection of the actual status of protecting personal information” conducted annually by the Ministry of the Interior and Safety in accordance with Articles 11 and 13 of the Privacy Guideline of the Ministry of the Interior and Safety.
② The NDTI received a “good” rating as a result of inspecting the status of protecting personal information in 2022.
③ The NDTI took the following improvement measures according to the result of inspecting the status of protecting personal information in 2022:
• Preparing a crisis response manual for the personal information processing system

Article 16. Matters Concerning Changes in Privacy Policy

View Privacy Policy before January 4, 2024 (Click)

pop up close button

Article 1 (Purpose)

The purpose of the Terms of Use (hereinafter referred to as the “Terms”) is to prescribe the rights, obligations, and responsibilities of the National Disaster Management Training Institute (“NDTI”) and users in relation to the use of all Internet services (the "Service") of the training management system operated by the NDTI.

Article 2 (Definition)

① The term “Training Management System” refers to a computer system for managing group training/online training programs for the purpose of operating training programs.
② The term “user(s)” refers to a member or a non-member who accesses the training management system and receives services provided by the Training Management System in accordance with the Terms.
③ The term “member” refers to a person who has been registered as a member by providing personal information to the Training Management System, can continuously receive information of the training management system, and use the Service provided by the training management system.
④ The term “non-member” refers to a person who uses the Service provided by the Training Management System without joining a membership.

Article 3 (Statement, Explanation, and Revision of the Terms, etc.)

① The NDTI shall post the content of the Terms, the name of the institute, phone number, privacy officer, etc. on the initial service screen (front) of the training management system so that users can easily understand them, provided, however, that the content of the Terms can be viewed by users through the connection screen.
② The NDTI may revise the Terms so that they do not violate relevant laws and regulations and the organization's instructions and regulations.
③ Matters not stipulated in the Terms and interpretation of the Terms shall be subject to relevant laws and regulations, directives, established rules, etc.

Article 4 (Provision and Change of the Service)

① The NDTI shall provide disaster and safety training services.
② The service of the Training Management System shall be operated, in principle, without interruption unless there is a special reason.

Article 5 (Suspension of the Service)

① If any reason occurs, including but not limited to inspection for maintenance, replacement, failure of electrical and information and communication equipment such as PC, communications interruption, etc., if there is any event of force majeure such as natural disaster, or if it is difficult to provide normal services due to any event such as national emergency, service user congestion, etc., the NDTI may temporarily suspend all or part of the Services.
② If there is any change in relevant laws and regulations, directives, established rules, etc., the NDTI may suspend the Service.

Article 6 (Membership)

① After filling out member information according to the membership form as set forth by the NDTI and expressing the consent to the Terms, the user shall apply to join a membership.
② The NDTI shall register as members the users who have applied to become members as described in Paragraph (1) hereof, unless they fall under any of the following cases: If there is any false information, omission, or misentry in the registration information; if membership has been revoked pursuant to Article 7(2) and the user falls under Article 7(4); and if registration as a member is considered to be significantly impeded in the technology of the NDTI.
③ If there is any change in registration information, the NDTI shall immediately change member information, and shall not be liable for any problems that arise from failing to change member information.

Article 7 (Withdrawal, Disqualification, etc. of Membership)

① A member may request withdrawal from the NDTI at any time, and the NDTI shall immediately process withdrawal from membership.
② If a member falls under any of the following cases, the NDTI may restrict, suspend, or revoke membership, and shall not be responsible for any legal action such as detention, etc. depending on the result therefrom: - If false information is registered upon application for membership; - If the user interferes with someone else’s use of the Training Management System, or steals their information; - If business activities are conducted using the service of the Training Management System; - If the user engages in illegal or obscene acts using the service of the Training Management System; or - If the user has committed any act prohibited by laws or regulations, the Terms, or any act that is against public order and morals using other Service of the Training Management System.
③ In the event of withdrawal from or revoke of membership, the NDTI shall cancel membership registration, provided, however, that if there is a history of training completion, the training completion history shall be stored separately in accordance with relevant laws and regulations, directives, established rules, etc.
④ To prevent a disqualified user from joining a membership again, member information shall be stored separately.

Article 8 (Notice to Members)

① The NDTI may give notice to members via the mobile phone number and the email address designated in advance through the agreement with the NDTI by members.
② Upon giving notice to a large number of unspecified members, the NDTI may replace such individual notice by posting the notice on a notice board.

Article 9 (Obligations of the NDTI)

① The NDTI shall not engage in any act prohibited by the law or the Terms or against public order and morals, and shall do its best to provide continuous and stable services in accordance with the provisions of the Terms.
② The NDTI shall have a security system to protect users’ personal information (including credit information) so that users can use the Internet service safely.
③ The NDTI shall not send advertising emails for commercial purposes that users do not want.

Article 10 (Obligations Regarding Member IDs and Passwords)

① Members shall be responsible for managing their IDs and passwords.
② No member shall allow a third party to use their ID and password.
③ If a member becomes aware that their ID and password have been stolen or are being used by a third party, the member shall immediately notify the NDTI of the fact and follow any instructions provided by the NDTI.

Article 11 (User Obligations) Users shall be prohibited from performing any of the following acts:

①Registration of false information upon application or change;
②Stealing some else’s information;
③Unauthorized use of part or all of the information obtained through the service of the Training Management System;
④Infringement of intellectual property rights of the NDTI or other third parties such as copyrights;
⑤Any act that defames the reputation of the NDTI or other third parties, or interferes with their work;
⑥Disclosing or posting obscene or violent messages, images, voices, or other information that is against public order and morals on the Training Management System; or
⑦Abusing program errors in the Training Management System.

Article 12 (Ownership and Restrictions on Use of Copyrights)

① Copyrights and other intellectual property rights for works created and serviced by the NDTI shall belong to the NDTI.
② No users shall use information for which intellectual property rights belong to the NDTI from the data obtained by using the Training Management System for commercial purposes by reproducing, transmitting, publishing, distributing, broadcasting, or using other methods without the prior consent of the NDTI, or allow a third party to use the information.

Article 13 (Dispute Resolution)

The NDTI shall not be responsible for any disputes while the Service provided to users are free.

Addenda (Enforcement Date) The Terms shall be effective on and from February 4, 2021.

Draft for the Standard Privacy Policy of the National Disaster Management Training Institute

Key information Personal information processing indication (labeling)

Table of Contents