Korea Fisheries Association and National Federation of Fisheries Cooperatives (hereinafter collectively “the institution”) shall establish and disclose the personal information processing policy as follows in order to protect the personal information of information subjects and process complaints promptly and smoothly pursuant to relevant laws such as 「Personal Information Protection Act」 (hereinafter “Personal Information Protection Act”) and 「Act on Promotion of Information and Communications Network Utilization And Information Protection」 (hereinafter “Information and Communications Act”).

Article 1 (Purpose of Personal Information Processing)

The institution shall process personal information for the following purposes. The processed personal information shall not be used for purposes other than the following purposes and if the purpose of use is changed, the institution shall take necessary measures including obtaining separate consent pursuant to Article 18 of Personal Information Protection Act and relevant laws.

1. Homepage Membership and Management
   The personal information shall be processed for purposes including checking if a user wants to apply for membership, identifying and authenticating a user according to the provision of membership services, maintaining and managing membership qualifications, preventing services from being used illegally, providing all kinds of notifications and handling complaints.
2. Provision of Goods and Services
   The personal information shall be processed to provide services, send contacts and bills, provide the content, verify the identity and verify the age.
   1) Provide a service for sending information related to projects for pioneering a fishery product overseas market and fishery policy projects
   2) Apply for a project online and reserve a K-seafood media studio
   3) Apply for downloading the K-seafood archive content
   4) Have a video consultation between an exporter and a buyer for import and export businesses
3. Preparation of Statistics and Reporting Materials
   The personal information shall be processed to compile consultation results with users (on-site visiting buyers), collect survey materials and prepare reporting materials.

Article 2 (Item of Personal Information Processed)

① The institution shall collect and use personal information according to the standards in the following each item to provide services.

1. Items of Personal Information Processed Without User’s Consent
   The institution shall process the following personal information items without the consent of users.

   Legal Ground	Division	Purpose of Collection	Collected Item	Retention and Use Period
   Article 15, Paragraph 1, Item 4 of Personal Information Protection Act (Contract Fulfillment)	Homepage Membership Registration and Management	Check if a user wants to apply for membership, identify and authenticate a user according to the provision of membership services, maintain and manage membership qualifications, prevent services from being used illegally, provide all kinds of notifications and handle complaints	[Domestic Corporate Member] ID, password, domestic/foreigner status, company information (business type, small and medium-sized enterprise, establishment date, company name, company and factory address, business registration number, homepage address, main (export) items, total assets, capital, sales and exports in the previous year, the number of regular employees, company introduction, main export country, certification status), representative information (name, contact information), information of a person in charge (name, department, position, company phone number and fax number, mobile phone number, email)	Until membership withdrawal
   			[Overseas Buyer Member] ID, password, domestic/foreigner status, country, company information (company name, DUNS number, corporate registration number, preferred item, main business partner), information of a person in charge (name, position, email, contact number)
   Article 15, Paragraph 1, Item 4 of Personal Information Protection Act (Contract Fulfillment)	Provision of Goods and Services	Provide services, send contacts and bills, provide the content, provide customized services, verify the identity and verify the age	[Domestic Corporate Member] ID, password, name, date of birth, address, telephone number, email, homepage address	Until the completion of supplying goods and services and the completion of payment/settlement (unpaid cancellation information: stored for 3 months from the date of reservation cancellation)
   			[Overseas Buyer Member] ID, password, country, company name, information of a person in charge (name, position, email, contact number, preferred item, main business partner, member log data, DUNS number, corporate registration number)

2. Items of Personal Information Processed With User’s Consent
   The institution shall process the following personal information items with the consent of users.

   Legal Ground	Division	Purpose of Collection	Collected Item	Retention and Use Period
   Article 15, Paragraph 1, Item 1 and Article 22, Paragraph 1, Item 1 of Personal Information Protection Act, Article 26-2 of Subsidy Management Act and Article 31, Paragraph 1 of National Subsidy Integrated Management Guidelines	Apply for a project online and reserve a K-seafood media studio * Including applying for approving the use of K·FISH	Apply for a project online and reserve a K-seafood media studio * Including applying for approving the use of K·FISH	business type, company name, address (Korean), business registration number, name, email, phone number, position, belonging, company information (business type, company name, address (Korean), business registration number, main export country), representative name, information of a person in charge (name, department, position, company phone number and fax number, mobile phone number, email)	Until membership withdrawal or consent withdrawal
   			participating project name, company name, benefit details, benefit amount	Stored for 5 years after the end of the business
   Article 15, Paragraph 1, Item 1 and Article 22, Paragraph 1, Item 1 of Personal Information Protection Act	Apply for downloading the K-seafood archive content	Apply for downloading the K-seafood archive content	business type, company name, address, business registration number, representative name, name of a person in charge, department and position, telephone number, fax number, mobile phone number, email, main export country, application details	Until membership withdrawal or consent withdrawal
   Article 15, Paragraph 1, Item 1 and Article 22, Paragraph 1, Item 1 of Personal Information Protection Act	Prepare statistics and reporting materials	Compile statistics for consultation results with users (on-site visiting buyers), collect survey materials and prepare reporting materials	company name, address, main (export) item, total assets, capital, sales in the previous year, exports in the previous year	Until membership withdrawal or consent withdrawal

Article 3 (Processing and Retention Period of Personal Information)

① The institution shall process and retain personal information within the retention and use period of personal information stipulated by the law or within the retention and use period of personal information agreed by information subjects when collecting personal information.

1. Membership Registration and Management : Until membership withdrawal. However, for any of the following reasons, the institution shall retain personal information until a relevant reason is ended.
   1) If an investigation or a survey is ongoing due to the violation of relevant laws, until the end of a relevant investigation or survey
   2) If a claim-obligation relationship according to the use of the homepage remains, until the settlement of a relevant claim-obligation relationship
   3) Retain the support history for 5 years from the support time pursuant to Article 26-2 of Subsidy Management Act and Article 21 of National Subsidy Integrated Management Guidelines (the retention period may vary depending on relevant laws)
2. Provision of Goods or Services : Until the completion of supplying goods and services and the completion of payment/settlement. However, for any of the following reasons, the institution shall retain personal information until a relevant period is ended.
   1) Records of transactions including display and advertisement, contract details, fulfillment, etc. pursuant to Article 6 of 「Act On The Consumer Protection In Electronic Commerce」
   - Records of Display and Advertisement : 6 months
   - Records of contract or subscription withdrawal, payment, supply of goods, etc. : 5 years
   - Records of handling consumer complaints or disputes : 3 years

   Contents	Retention Period	Personal Information Item
   Records of Display and Advertisement	6 months	company name, information of a person in charge (name, department, position, company phone number and fax number, mobile phone number, email)
   Records of contract or subscription withdrawal, supply of goods, etc.	5 years	company name, information of a person in charge (name, department, position, company phone number and fax number, mobile phone number, email), transaction ledger and supporting document
   Records of handling consumer complaints or disputes	3 years	company name, information of a person in charge (name, department, position, company phone number and fax number, mobile phone number, email), log data

   2) Retain communication confirmation data pursuant to Article 15-2 of 「Protection of Communications Secrets Act」
   - the date of telecommunications by subscribers, start and end time, the subscriber number of the other party, the frequency of use, location tracking data from an originating base station: 1 year
   - computer communication, Internet log records, access location tracking data : 3 months

Article 4 (Processing of Pseudonymous Information)

The institution shall pseudonymize some of the collected personal information to avoid identifying a specific individual for preparing statistics and reporting materials and utilize the same as follows.

1. Matters on Processing of Pseudonymous Information

   Division	Processing Purpose	Processed Item	Processing Period
   Statistics of Actual Exports by Company	Prepare statistics and reporting materials	trade statistics information (year and month, business type, business name, business registration number, HS code, destination country, port of loading, weight (kg), amount ($))	Until the completion of data analysis

2. Matters on Provision of Pseudonymous Information to Third Party

   Receiver	Receiver’s Purpose of Use	Provided Item	Receiver’s Retention and Use Period
   Ministry of Oceans and Fisheries, Local Government, Korea Agro-Fisheries & Food Trade Corporation, Korea Maritime Institute, Korea Fishery Trade Association	Provide information for reporting and preparing materials related to projects for pioneering a fishery product overseas market and fishery policy projects	trade statistics information (year and month, destination country, weight, amount)	Until the completion of data analysis

Article 5 (Provision of Personal Information to Third Party)

① The institution shall process the collected personal information only within a scope specified in Article 1 (Purpose of Personal Information Processing) and provide personal information to the third party only for cases falling under Article 17 and Article 18 of Personal Information Protection Act such as the consent of information subjects or the special provision of laws, etc..

② The institution shall provide personal information to the third party by obtaining the consent of information subjects as follows.

Article 6 (Entrustment of Personal Information Processing)

① The institution shall entrust the personal information processing business as follows for the smooth personal information processing.

② The institution shall specify matters on responsibilities such as prohibition of personal information processing for purposes other than the performance of entrusted works, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of a trustee, compensation for damages, etc. in a document such as a contract, etc. pursuant to Article 26 of Personal Information Protection Act when concluding an entrustment contract, and supervise whether a trustee safely processes personal information.

③ If the contents of entrusted works or a trustee is changed, the institution shall disclose it through this personal information processing policy without delay.

Article 7 (Reading of Personal Information, Refusal and Withdrawal of Consent, etc.)

① The information subject may exercise his/her right to request the reading, correction, deletion, suspension of processing, etc. of personal information against the institution at any time.

② The right pursuant to Paragraph 1 may be exercised via phone, email, etc. and the institution shall take measures without delay.

• ▶ Department For Receiving and Processing Requests for Personal Information Reading
  Department Name : Export Support Team
  Person in Charge : Manager SUBIN JIN
  Contact Number : 02-898-0567, korfish@kfish.kr

③ The right pursuant to Paragraph 1 may be exercised through the legal representative or agent of information subjects. In this case, the power of attorney shall be submitted.

④ For a request for the reading and suspension of processing of personal information, the right of information subjects may be restricted pursuant to Article 35, Paragraph 5 and Article 37, Paragraph 2 of Personal Information Protection Act. may be subject to restrictions on the rights of the data subject pursuant to Article 35, Paragraph 5 and Article 37, Paragraph 2 of the Personal Information Protection Act.

⑤ The correction and deletion of personal information may not be requested when personal information is specified as a collection target in other laws.

⑥ For a request for reading, correction and deletion and suspension of processing according to the right of information subjects, the institution shall check if a person who makes a request such as reading, etc. is an information subject or a legitimate agent.

Article 8 (Destruction of Personal Information)

① If personal information becomes unnecessary due to the expiration of the retention period of personal information, the achievement of a processing purpose, etc., the institution may destroy relevant personal information without delay.

② If personal information must be retained continuously pursuant to other laws although the retention period of personal information agreed by information subjects is expired or the purpose of processing is achieved, relevant personal information shall be transferred to a separate database (DB) or stored in a different storage location.

③ The procedures and method for destroying personal information shall be as follows.

1. Destruction Procedures
   The institution shall select personal information for which a reason for destruction occurred and destroy personal information by obtaining the approval of the institution’s personal information protection manager.
2. Destruction Method
   The institution shall destroy personal information recorded and stored in an electronic file format to prevent records from being recovered and destroy personal information recorded and stored in a paper document by shredding or incineration.

Article 9 (Measure For Ensuring Safety of Personal Information)

The institution shall take the following measures to ensure the safety of personal information.

① Establishment and Implementation of Internal Management Plan
The institution shall establish and implement its internal management plan pursuant to the standards for measures for ensuring the safety of personal information protection.

② Minimizing and Securing Personal Information Handler
The institution shall minimize the number of personal information handlers and give a separate password to access personal information.

③ Restriction on Access to Personal Information
The institution shall control the access to personal information through procedures for granting, changing and canceling the authority to access the database system that processes personal information.

④ Personal Information Encryption
Since a password for a member ID is encrypted, stored and managed, only the member shall know it and an administrator may not confirm it.

⑤ Prevention of Malicious Program, etc.
In order to prevent the personal information of members from being leaked or damaged by hacking or a computer virus, etc., the institution shall install the access control system to control unauthorized access from the outside and make efforts to have all possible technical devices for ensuring security in other systemic ways.

⑥ Prevention of Physical Access
The institution shall have a computer room, a data storage room, etc. separately and control access to them.

⑦ Other Management

Article 10 (Matters on Installation, Operation and Refusal of Personal Information Automatic Collecting Device)

① The institution may use ‘cookies’ for storing and frequently retrieving usage information to provide users with separate customized services. In this process, the following personal information items may be automatically created and collected.
- IP address, cookie, MAC address, service usage history, visit history, poor usage history, etc.

②The cookies shall refer to a small amount of information sent by a server (http) used to operate the website to a user's computer browser and may also be stored on a user's PC hard disk.

• a. Purpose of Using Cookies: The cookies shall be used to provide information optimized to users by identifying visit and usage patterns, popular search words, secure connection, etc. related to each service and website visited by users.
• b. Installation, Operation and Refusal of Cookies : The user may refuse to store cookies via option settings in the menu of Tools>Internet Option>Personal Information at the top of the web browser.
• c. If the user refuses to store cookies, he/she may have difficulty in using customized services.

Article 11 (Personal Information Protection Manager)

① The institution shall generally take charge of works related to personal information processing and designate a personal information protection manager as follows to provide remedies against damage and handle complaints from information subjects regarding personal information processing.

② The information subject may make an inquiry about matters related to all personal information protection-related questions, handling of complaints, remedies against damage, etc. arising while using the institution’s services (or projects) to the personal information protection manager and the department in charge. The institution shall answer and process inquiries from information subjects without delay.

Article 12 (Remedies Against Infringement of Rights)

The information subject may inquire about consulting, remedies against damage, etc. for the infringement of personal information to the following institution.

(As the following institution is separate from Korea Fisheries Association and National Federation of Fisheries Cooperatives, please contact us if you are not satisfied with the result of remedies against damage and personal information complaint handling by the operating institution itself.)

• ▶ Personal Information Infringement Report Center (operated by Korea Internet & Security Agency)
  - Business : report on the infringement of personal information, consultation application
  - Homepage : privacy.kisa.or.kr
  - Telephone : (without a telephone exchange number) 118
• ▶ Personal Information Dispute Mediation Committee
  - Business : personal information dispute mediation application, collective dispute mediation
  - Homepage : www.kopico.go.kr
  - Telephone : (without a telephone exchange number) 1833-6972
• ▶ Supreme Prosecutors' Office, Cyber Investigation Bureau : 1301 (www.spo.go.kr)
• ▶ National Police Agency, Cyber Bureau : 182 (ecrm.cyber.go.kr/minwon/main)

Article 13 (Change in Personal Information Processing Policy)

If the contents of this personal information processing policy are added, deleted and modified due to any change in laws, policies or security technologies, they shall be notified via the homepage home screen or notification [7] days before the enforcement date of changes.

(Enforcement Date) This personal information processing policy shall take effect from 2025. 3. 10.