ActiveSystem Co., Ltd. (the “Company”) sets this Privacy Policy under the Personal Information Protection Act of the Republic of Korea to protect the personal information of data subjects and to handle related complaints promptly. This policy applies to both the website operated by the Company (https://www.activesys.io) and the Customer Support Portal (https://support.activesys.io). When this policy changes, the earlier version and a before-and-after comparison are recorded in the policy history.
1. Purposes of Processing Personal Information
The Company processes personal information only for the following purposes. If a purpose changes, the Company takes the necessary measures under Article 18 of the Personal Information Protection Act.
| Service | Purposes of processing |
|---|---|
| Website | Confirming and replying to inquiries made by email or phone; server security and incident response (access records) |
| Customer Support Portal | Issuing and managing accounts for users designated by customers and verifying their identity; receiving, handling and reporting on the progress of service requests (inquiries, incident reports, enhancement requests); issuing, delivering and announcing the expiry of license keys; sending notification emails; preventing security incidents and misuse; AI review of service requests (only where the customer has consented) |
2. Items Processed and How They Are Collected
| Service | Category | Items | Collection method |
|---|---|---|---|
| Website | Inquiry by email or phone | The sender's email address, information written in the inquiry such as a name, phone number (for phone inquiries) | Sent directly by the data subject |
| Website | Generated automatically | IP address, access time, requested address, browser type (User-Agent), referring address (Referer) | Recorded automatically by the server on access |
| Customer Support Portal | Account and contact information (required) | Name, business email address (used as the sign-in ID), customer organization, preferred language, account status | Registered by the Company or the customer's administrator at the customer's request |
| Customer Support Portal | Account and contact information (optional) | Phone number (when Company staff register a contact), job title and other notes | Registered by Company staff at the customer's request |
| Customer Support Portal | Authentication information | Password (only an encrypted value is stored in the authentication system), one-time password registration, sign-in session | Set directly by the data subject |
| Customer Support Portal | Service requests | Everything the data subject writes in the title, body, comments and attachments (including file names), and the author | Entered directly by the data subject |
| Customer Support Portal | Generated automatically | IP address, sign-in time, usage records (audit records), email delivery records (recipient email address, subject, body) | Recorded automatically by the system during use |
| Customer Support Portal | Licenses | Name and email address of the contact who receives a license key, delivery records | Registered at the customer's request |
The body and attachments of a service request are free-form content written by the data subject, so personal information beyond the items above may be included. The Company asks users not to upload personal information that is not needed for processing, and asks that unique identifiers such as national identification numbers and sensitive information not be uploaded.
3. Processing and Retention Periods
The Company processes and retains personal information within the period required by law or the period for which the data subject has consented, and destroys it without delay when the period ends.
| Service | Target | Retention period | Basis |
|---|---|---|---|
| Website | Content of email and phone inquiries | 1 year from the date the reply is completed | Responding to inquiries and handling disputes |
| Website | Server access records | 90 days from the date recorded | Security incident and fault response |
| Customer Support Portal | Account and contact information | 1 year after the Primary Agreement ends or the account is revoked | Performing the agreement and answering inquiries |
| Customer Support Portal | Service requests and attachments | 1 year after the Primary Agreement ends | Performing the agreement, follow-up support and handling disputes |
| Customer Support Portal | Email delivery records | 1 year from the date of sending | Confirming delivery and handling disputes |
| Customer Support Portal | Usage records (audit records) and access IP | 1 year from the date recorded | Retention of access records under the safety measures standard for personal information |
| Customer Support Portal | Server access records | 90 days from the date recorded | Security incident and fault response |
| Customer Support Portal | Sign-in session | Until the session ends (at most 8 hours) | Keeping the signed-in state |
Personal information for which another law sets a longer retention period is kept separately for that period.
4. Procedures and Methods for Destroying Personal Information
- When: Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay (within 5 days) from the date the reason arises.
- Procedure: The items to be destroyed are selected and destroyed after confirmation by the Chief Privacy Officer.
- Method: Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
- Backups: Personal information remaining in the regular backups of server storage (disk snapshots) is destroyed together when those backups are cycled out after their retention period.
5. Provision of Personal Information to Third Parties
The Company does not provide the personal information of data subjects to third parties. It provides personal information only to the minimum extent necessary where the law so permits or the data subject has consented, and in that case this policy states the recipient, purpose, items and retention period. The Company does not sell or provide information that a data subject enters in a service request to outside parties for training AI models.
6. Entrustment of Personal Information Processing
For smooth service delivery, the Company entrusts the processing of personal information as follows.
| Processor | Entrusted work | Services concerned | Country and retention or use period |
|---|---|---|---|
| Amazon Web Services Korea LLC | Server and storage operation (server infrastructure hosting), sending notification and account guidance emails | Website, Customer Support Portal | Republic of Korea (Seoul region). Until the entrustment agreement ends |
| Anthropic PBC | AI review of service request content. Used only where the customer has consented to AI review | Customer Support Portal | United States. See section 7 below |
In the entrustment agreements the Company sets out the safe handling of personal information, limits on sub-entrustment, management and supervision, and liability for damages, and supervises whether processors handle personal information safely. If a processor or the entrusted work changes, this policy is revised and announced.
7. Overseas Transfer of Personal Information
| Recipient | Country | Items transferred | Time and method | Purpose of use and retention or use period | How to refuse and effect of refusing |
|---|---|---|---|---|---|
| Anthropic PBC (privacy contact: the contact point that company publishes) | United States | The title, body and text attachments of a service request, after names, email addresses, phone numbers and IP addresses are masked. Masking is done on a best-effort basis, so personal information inside free-form text may remain | Sent over a network (API) when AI review is performed after a service request is received | Producing the AI review result for the service request. Retention and use period follow the agreement with the processor | If the customer chooses not to use AI review, nothing is transferred and Company staff handle the request directly. Not using it does not disadvantage the receipt or handling of service requests |
- The Company makes this transfer under Article 28-8(1)3(a) of the Personal Information Protection Act, as entrustment and storage of personal information for the conclusion and performance of a contract, by disclosing the overseas transfer in this policy.
- AI review operates only where the customer has consented in the Primary Agreement or in a separate writing and the Company has enabled the feature. Otherwise the transfer above does not take place.
- The servers and the email delivery service operate in the Seoul region, so they are not overseas transfers. If another region is used, it is added to the table above.
8. Personal Information Processing Using Generative AI Features
This section describes AI review of service requests on the Customer Support Portal.
- Purpose of use: it assists with summarizing and classifying service requests, finding similar cases and drafting replies.
- How it works: names, email addresses, phone numbers and IP addresses in the input are masked first, and then the content is sent to an external AI service. Company staff confirm the result before using it, and the AI does not by itself make decisions that significantly affect the rights or obligations of a data subject.
- Keeping inputs and results: the AI review result attached to a service request is kept for the same period as the service request. The call log keeps only a hash of the masked input and call information, and the original input is not stored.
- Use for training: the Company does not use information entered by data subjects to train AI models. The processor’s retention and training policies follow the agreement.
- Refusal: consent to AI review is given per customer, and a customer can ask the Company to stop using it at any time.
9. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
- A data subject may at any time ask the Company to access, correct or delete personal information, to stop its processing, or to withdraw consent. However, personal information that another law specifies as a collection target cannot be deleted on request.
- To exercise these rights, make a request to the Chief Privacy Officer or the department that receives access requests, by email, phone or in writing. For account information on the Customer Support Portal, requests can also be made through the administrator of the customer organization.
- A request made through an agent requires a power of attorney.
- On receiving a request, the Company takes action and notifies the result within 10 days for access and within 10 days for correction, deletion or suspension of processing, and if it cannot take action it states the reason.
- On the Portal, a signed-in user can view their own information and change the language on the profile screen, and can change the password and one-time password directly on the account screen.
- The Company does not treat a data subject unfavorably for exercising these rights, and may ask for the minimum information needed to verify identity.
10. Measures to Ensure the Safety of Personal Information
The Company takes the following measures to keep personal information safe.
- Administrative measures: designating a Chief Privacy Officer, establishing and carrying out an internal management plan, minimizing and training the staff who handle personal information
- Access control: granting access rights by role and recording their changes and removal, limiting the viewing scope by customer organization (a customer’s users can see only their own organization’s information), separate authentication for administrator screens
- Authentication security: a password policy (length and history limits), mandatory registration of a one-time password, temporary account lockout and request rate limiting after repeated sign-in failures, and limits on session duration
- Encryption: passwords are stored in a way that cannot be reversed, names, email addresses and phone numbers stored in the Customer Support system’s business database are encrypted with a dedicated key, transmission is encrypted with HTTPS, and server storage is encrypted
- Keeping and reviewing access records: usage records and access IP addresses are kept, and changes and deletions are restricted so that they cannot be altered
- Security checks: regular review of security trends and remediation of vulnerabilities, and automated security checks
- Physical measures: servers are placed in the cloud provider’s data centers, and the Company relies on the cloud provider’s assurances for physical access control
11. Installation, Operation and Refusal of Automatic Collection Devices
The Company does not use tools for personalized advertising or analysis of user behavior, and does not allow third parties to collect behavioral information. The following are the minimum devices needed to provide the services.
| Target | Name | Type | Purpose | Retention | How to refuse and effect |
|---|---|---|---|---|---|
| Website | lang | Cookie | Remembering the language last viewed so the first visit is directed to the same language | 1 year | You can block cookies in your browser settings. If blocked, the first visit is directed by your browser language |
| Website | Server access records | Server log | Security and fault response | 90 days | Cannot be refused (the server records them automatically) |
| Customer Support Portal | AUTH_SESSION_ID, KC_AUTH_SESSION_HASH, KC_RESTART, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION and other authentication cookies of the sign-in service | Cookie | Sign-in progress and keeping the signed-in state | During the sign-in process or session | If blocked, you cannot sign in |
| Customer Support Portal | Sign-in token and user information | Browser session storage | Keeping and renewing the signed-in state | Until the browser tab is closed | If blocked, you cannot sign in |
| Customer Support Portal | Display language | Browser local storage | Remembering the selected display language | Until the data subject clears it | If blocked, the default language is shown |
| Customer Support Portal | Server access records | Server log | Security and fault response | 90 days | Cannot be refused |
You can choose whether to allow cookies and storage, or clear them, in your browser settings.
12. Chief Privacy Officer and the Department Receiving Access Requests
The Company designates the following Chief Privacy Officer and department to oversee the handling of personal information and to deal with data subjects’ complaints and remedies.
| Item | Details |
|---|---|
| Chief Privacy Officer | Kim JongSeob (Chief Executive Officer) |
| privacy@activesys.io | |
| Phone | 02-851-7616 |
| Department for access requests and complaints | Management Support |
| Department contact | privacy@activesys.io, 02-851-7616 |
Data subjects may direct any privacy-related inquiry, complaint or remedy request that arises while using the services to the contact details above, and the Company will answer and act without delay.
13. Remedies for Infringement of Rights
Data subjects may apply to the following bodies for dispute resolution or consultation to obtain a remedy for an infringement of personal information.
| Body | Phone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Personal Information Infringement Report Center (Korea Internet and Security Agency) | 118 | privacy.kisa.or.kr |
| Supreme Prosecutors' Office, Cyber Investigation Division | 1301 | www.spo.go.kr |
| Korean National Police Agency, Cyber Bureau | 182 | ecrm.police.go.kr |
14. Matters That Do Not Apply
- Children under 14: the Company’s services are for businesses and do not process the personal information of children under 14.
- Sensitive and unique identification information: the Company does not collect it as a processing purpose. Even if a data subject wrote it in a free-form field of a service request, they can ask for its deletion if it is not needed for processing.
- Additional use or provision: the Company does not use or provide personal information for a purpose different from the collection purpose without the data subject’s consent.
- Pseudonymized information: not processed.
- Collection of behavioral information by third parties: not allowed.
- Domestic representative: not applicable because the Company is a domestic corporation.
- Video information processing devices: the Company does not operate fixed or mobile video information processing devices.
- Automated decisions: the Company does not make decisions that significantly affect the rights or obligations of a data subject solely through automated processing of personal information. AI review of service requests assists staff, and a person makes the final judgment (see section 8).
15. Changes to This Privacy Policy
- This policy applies from the effective date shown above.
- When content is added, deleted or amended, the Company announces it on the website from 7 days before it takes effect, and from 30 days before for changes that materially affect data subjects’ rights.
- Earlier versions and before-and-after comparisons can be viewed in the Privacy Policy history.
- If this policy differs from the Primary Agreement, whichever is more favorable to the data subject applies.