Privacy Policy

Personal Information Processing Policy
The COSMOS site places great importance on the protection of users' personal information, and we do our best to ensure that users can always use the services provided by the site with confidence. The site informs you of the use and method of personal information provided by you through the Personal Information Processing Policy under Article 30 of the Personal Information Protection Act, and what measures are taken to protect your personal information.

Article 1 Items and Purpose of Collection of Personal Information 
The site collects the minimum amount of personal information needed to provide services.
(1) Personal information collection items: name, e-mail, phone (cell phone) number
(2) Purpose of collection and use of personal information: If necessary, additional verification of the contents of the report, guidance on receipt of the report, etc
(3) If you do not want to provide personal information, you can report it as "anonymous", but there may be restrictions on the handling of business such as confirming the receipt of a report and awarding a report.

Article 2 Processing and Retention of Personal Information
In principle, personal information collected through the site should be stored for two years after the completion of the report is completed, except for cases where separate storage is required, such as the report reward.

Article 3 Matters concerning entrustment of personal information and provision to third parties
The site uses personal information within the scope notified in "Collection Items and Purpose of Personal Information", and with the prior consent of the data subject, it may be provided to the relevant companies as follows for reporting.

(1) Provision of personal information to a third party
① Recipients: Shinko Pacation Holdings, D&O, Dream Nuri Co., Ltd
② Personal information provided: Name, e-mail, phone (cell phone) number
③ Retention and use period: Same as the processing of personal information and retention period

Article 4 Matters concerning the rights and obligations of the data subject and how to exercise them
(1) The data subject (user) may exercise the following privacy-related rights at any time for the site.
① Request for Personal Information Access
② Correction if there is an error, etc
③ Request for deletion
④ Request to stop processing

(2) The exercise of rights under paragraph 1 can be made to the company in writing, by telephone, e-mail, or by fax, and the company will take action without delay after confirming the applicant's identity.

(3) If the data subject requests correction or deletion of an error in personal information, the company will not use or provide the personal information until the correction or deletion is completed.

(4) The exercise of rights under paragraph (1) may be made through an agent, such as a legal representative of the data subject or a person who has been delegated. In such cases, a power of attorney under attached Form 11 of the Public Notice on How to Process Personal Information shall be submitted.

(5) The data subject shall not infringe on the personal information and privacy of the data subject or others that the company is processing in violation of related laws such as the Personal Information Protection Act.

Article 5 Measures to Protect the Stability of Personal Information
The site takes the following technical, administrative, and physical measures to ensure that personal information is not lost, stolen, leaked, tampered with, or damaged in processing personal information.

(1) technical measures
All personal information of the informant is encrypted and stored and managed, and we do our best to prevent leakage or damage of the informant's personal information, and we apply security devices (SSL, etc.) that safely transmit personal information on the network using secure encryption algorithms.

(2) a physical measure
It uses an intrusion prevention system to control unauthorized access from the outside and tries to equip other technical devices necessary to ensure safety.

(3) Minimization of operation and education of personal information controllers
The site's personal information controller is operated only by the person in charge of the business, and regular training is conducted to raise awareness of personal information protection.

Article 6 Procedures and methods for destroying personal information
When personal information becomes unnecessary, such as the expiration of the retention period of personal information and the achievement of the purpose of processing, the company will destroy the personal information without delay. If personal information must be preserved in accordance with other laws and regulations despite the expiration of the retention period agreed by the user or the achievement of the purpose of processing, the personal information shall be transferred to a separate database (DB) or stored in a different place.
(1) Reversal procedure
The company implements the destruction and checks the results under the responsibility of the personal information protection officer. The personal information protection officer records and manages the timing and procedure of destruction, and the contents of destruction as a separate ledger.
(2) How to destroy
The company destroys and destroys personal information recorded and stored in the form of electronic files so that records cannot be reproduced.
(3) Notice of separate management when preserving personal information due to exceptions
Regarding the personal information that is preserved separately according to the exception clue, we will clearly indicate the retention items, reasons for preservation, preservation method (or form), preservation period, and preservation place.

Article 7 Handling complaints related to personal information with the person in charge of personal information protection
The site is in charge of handling users' personal information, and designates a person in charge of personal information protection as follows to handle complaints and remedy damages related to personal information processing.





All personal information protection inquiries, applications for access claims, complaints, and damage relief that occur while using the site can be contacted to the person in charge of personal information protection and the department in charge. The company will respond to and process the information subject's inquiries without delay.

Article 8 Changes to the Personal Information Processing Policy
(1) The personal information processing policy will be implemented from November 1, 2023.