Privacy Policy

Human Consulting Group Co., Ltd. (hereinafter referred to as “HCG”) processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those stated below, and if there is any change in the intended use, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. 1. Consultation Requests and User Support
   • 1) HCG processes personal information with the consent of the data subject for the purpose of responding to inquiries about HCG's services and products and providing relevant information.
2. 2. Provision of Services
   • 1) HCG provides HR system maintenance services and payroll outsourcing services.

1. HCG processes the following categories of personal information with the consent of the data subject in accordance with Article 15(1)(1) and Article 22(1)(7) of the Personal Information Protection Act.

1. HCG processes and retains personal information within the period of retention and use stipulated by law, or within the period of retention and use to which the data subject consented at the time of collection.

2. The period of processing and retention for each category of personal information is as follows.

• 1) HR System Maintenance Service: Until the end of the service contract agreed with the client (if settlement or complaint handling remains, until it is completed)
• 2) Consultation Requests and User Support: 5 years from the completion of the inquiry response and support service (destroyed without delay upon the data subject's request for destruction)
• 3) Retention under Relevant Laws: Where retention is required under relevant laws such as the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, the company retains the information for the following periods.
  • - Records on contracts or withdrawal of offers: 5 years (Electronic Commerce Act)
  • - Records on payment and supply of goods: 5 years (Electronic Commerce Act)
  • - Records on consumer complaints or dispute handling: 3 years (Electronic Commerce Act)
  • - Records on labeling and advertising: 6 months (Electronic Commerce Act)
• 4) Retention under the Protection of Communications Secrets Act: Computer communication and internet log records and access location tracking data related to service use: 3 months

1. HCG destroys personal information without delay when it is no longer necessary, such as when the retention period has expired or the purpose of processing has been achieved.

2. If the retention period consented to by the data subject has expired or the purpose of processing has been achieved, but the personal information must continue to be preserved under other laws, the information is moved to a separate database (DB) or stored in a different location.

3. The procedures and methods for destroying personal information are as follows.

• 1) Destruction Procedure
• HCG selects the personal information for which a reason for destruction has arisen and destroys it with the approval of HCG's Personal Information Protection Officer.
• 2) Destruction Methods
• HCG destroys personal information recorded and stored in electronic files so that the records cannot be reproduced, and destroys personal information recorded and stored on paper by shredding or incineration.

1. The company does not use personal information collected from users for purposes other than those intended, nor does it provide such information to third parties.

2. In accordance with the “Guidelines for Personal Information Processing and Protection in Emergency Situations” jointly announced by government agencies, the company may provide personal information to relevant institutions without the data subject's consent in emergencies such as disasters, infectious disease outbreaks, incidents or accidents posing an imminent threat to life or physical safety, or imminent property loss.

1. The company provides and entrusts personal information collected from service users to overseas entities as follows.

2. Users may refuse the overseas transfer of personal information through the company's Personal Information Protection Officer and responsible department.

3. If a user refuses the overseas transfer of personal information, the company excludes that user's personal information from the transfer. However, in such cases, the use of services that necessarily involve overseas transfer of personal information may be restricted.

1. HCG entrusts personal information processing tasks as follows to ensure the smooth processing of personal information.

1. HCG takes the following measures to ensure the security of personal information.

• 1) Administrative Measures: Establishment and implementation of an internal management plan, operation of a dedicated organization, and regular employee training
• 2) Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, and installation and updating of security programs
• 3) Physical Measures: Access control to the computer room

1. The data subject may, at any time, exercise rights with respect to HCG (hereinafter referred to as “Exercise of Rights”), including requesting access to, correction of, deletion of, or suspension of processing of personal information, withdrawing consent, and refusing or requesting an explanation of automated decisions.

2. Rights may be exercised with respect to HCG in writing, by email, by fax, or by other means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and HCG will take action without delay.

3. Rights may also be exercised through a representative, such as the data subject's legal representative or a person authorized by the data subject. In such cases, a power of attorney in the form prescribed by Form No. 11 of the “Public Notice on Methods of Processing Personal Information” must be submitted.

4. The data subject's right to request access to personal information and suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.

5. Where other laws specify the personal information as subject to collection, the data subject cannot request its deletion.

6. Where the data subject has consented to automated decision-making, has been notified in advance through a contract or otherwise, or where it is clearly provided for by law, refusal of automated decisions is not permitted, and only requests for explanation and review are available.

• 1) In addition, a request to refuse or seek an explanation of an automated decision may be denied where there is a legitimate reason, such as a risk of unjustly infringing on another person's life, body, property, or other interests.

7. HCG verifies whether the person exercising the rights is the data subject or a legitimate representative.

8. The data subject may exercise these rights through the department below.

9. HCG will make efforts to ensure that the data subject's exercise of rights is processed promptly.

• 1) Personal Information Protection Department
• ・ Department Name: Information Security Team
• ・ Person in Charge: Head of Information Security Team
• ・ Contact: 02-2194-5000
• ・ Email: privacy@e-hcg.com

1. To analyze website usage and provide personalized advertising, HCG allows the advertising providers below to collect and process users' behavioral information through tags (automated collection devices such as cookies) installed on the HCG website.

2. HCG does not identify individual users with the above information and receives only aggregated statistical information from the advertising providers.

3. Users may refuse the collection of behavioral information and personalized advertising in the following ways.

• 1) Web browser settings
  • - Chrome: Settings > Privacy and security > Third-party cookies > Block third-party cookies
  • - Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data > Block third-party cookies
  • - Safari: Settings > Privacy > Prevent cross-site tracking
• 2) Meta: In Accounts Center > Ad preferences, turn off 'Activity information from ad partners', and disconnect past activity in 'Your activity off Meta technologies'
• 3) LinkedIn: Members can turn off personalized advertising in Advertising data settings, and non-members in Guest controls

4. Refusing to store cookies does not restrict the use of the HCG website.

5. Inquiries and requests for remedies regarding the processing of behavioral information may be submitted to the Personal Information Protection Officer and responsible department described in Article 10.

1. HCG has designated a Personal Information Protection Officer as follows, who is responsible for overseeing the processing of personal information and for handling complaints and remedies related to personal information processing.

• 1) Personal Information Protection Officer
  • ・ Name and Position: Executive Vice President Uk Hur
  • ・ Contact: 02-2194-5000
  • ・ Email: privacy@e-hcg.com
• 2) Personal Information Protection Department
  • ・ Department Name: Information Security Team
  • ・ Person in Charge: Head of Information Security Team
  • ・ Contact: 02-2194-5000
  • ・ Email: privacy@e-hcg.com

2. The data subject may direct all inquiries, complaints, and requests for remedies related to personal information protection arising from the use of HCG's services (or business) to the Personal Information Protection Officer and the responsible department. HCG will respond to and handle the data subject's inquiries without delay.

1. To seek remedies for personal information infringement, the data subject may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), and similar organizations. For other reports or consultations regarding personal information infringement, please contact the organizations below.

• 1) Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)
• 2) Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)
• 3) Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
• 4) Korean National Police Agency: (no area code) 182 (ecrm.police.go.kr)

2. HCG guarantees the data subject's right to self-determination over personal information and strives to provide consultation and remedies for personal information infringement. If you need to report or seek consultation, please contact the department below.

• 1) Customer Consultation and Reporting Related to Personal Information Protection
• ・ Department Name: Information Security Team
• ・ Person in Charge: Head of Information Security Team
• ・ Contact: 02-2194-5000
• ・ Email: privacy@e-hcg.com

1. Human Consulting Group Co., Ltd. (hereinafter referred to as “HCG”) informs you, through its 'Physical Security Guidelines', of the purposes and methods by which personal video information processed by HCG is used and managed.

• 1) Legal Basis and Purpose of Installing Fixed Video Surveillance Devices
  • HCG installs and operates fixed video surveillance devices for the following purposes in accordance with Article 25(1) of the Personal Information Protection Act.
  • Facility safety and management, fire prevention
• 2) Number of Installations, Installation Locations, and Recording Range

  Number of Installations	Installation Locations and Recording Range
  2 units	Office entrances (Yangjae Center, Pangyo Center)

• 3) Person in Charge of Management and Authorized Personnel with Access

  Category	Name	Position	Department	Contact
  Person in Charge of Management	Sohee Sung	Manager	Management Support Team	02-2194-5000

• 4) Recording Time, Retention Period, Storage Location, and Processing Method of Personal Video Information

  Recording Time	Retention Period	Storage Location
  24 hours	30 days	Computer room (Yangjae Center, Pangyo Center)

  • Processing Method: HCG records and manages matters regarding use beyond the intended purpose, provision to third parties, destruction, and requests for access to personal video information. Upon expiration of the retention period, the information is permanently deleted in a way that makes restoration impossible (printed materials are shredded or incinerated).
• 5) Matters Regarding the Delegation of Installation and Management of Fixed Video Surveillance Devices

  Service Provider	Contact Person	Contact
  S-1 (Secom)	Customer Service Center	1588-3112

• 6) Methods and Location for Checking Personal Video Information
  • Method: You may check the information by contacting the person in charge of personal video information in advance and visiting.
  • Location: Management Support Team
• 7) Measures Regarding the Data Subject's Requests for Access to Personal Video Information
  • If you wish to access, verify the existence of, or delete personal video information, you may request it at any time from the operator of the fixed video surveillance devices. This applies only to personal video information in which you were recorded.
  • HCG will take the necessary measures without delay upon a request to access, verify the existence of, or delete personal video information.
• 8) Measures to Ensure the Security of Personal Video Information
• Personal video information processed by HCG is securely managed through measures such as encryption. As administrative safeguards, HCG grants differentiated access rights to personal information and, to prevent forgery or alteration, records and manages the creation time of personal video information and, upon access, the purpose of access, the person accessing, and the time of access. In addition, locking devices are installed for the safe physical storage of personal video information.

1. Purpose and Retention Period of Personal Location Information Processing

• 1) The company provides the following location-based services using users' location information received from location information providers. The purpose and retention period of personal location information for providing the services are as follows.

  Service Name	Purpose of Personal Location Information Processing	Retention Period of Personal Location Information
  JaDE	Provides clock-in/clock-out verification using location information when employees of a contracted corporation record their attendance	Until clock-in/clock-out verification by the contracted corporation's attendance manager
  talenx	Provides clock-in/clock-out verification using location information when employees of a contracted corporation record their attendance	Until clock-in/clock-out verification by the contracted corporation's attendance manager

2. Basis and Retention Period for Records Confirming the Collection, Use, and Provision of Personal Location Information

• 1) In accordance with Article 16(2) of the Act on the Protection and Use of Location Information, the company automatically records data confirming the collection, use, and provision of customers' location information in the location information system. The company keeps a handling log at a level that allows the collection, use, and provision to be confirmed, and retains the log for at least six months.

3. Procedures and Methods for Destroying Personal Location Information

• 1) In principle, users' personal location information is destroyed without delay once the purpose of its collection and use has been achieved. The company's procedures and methods for destroying personal location information follow Article 4 (Procedures and Methods for Destroying Personal Information).

4. Provision of Personal Location Information to Third Parties

• 1) The company does not provide personal location information to third parties without the consent of the personal location information subject. When providing a service that involves third-party provision, the company notifies the subject of the recipient and the purpose of provision in advance and obtains consent.

5. Notification of Third-Party Provision of Personal Location Information

• 1) When the company provides personal location information to a third party designated by the user, it immediately notifies the user of the recipient, date and time, and purpose of provision each time, via the communication terminal from which the location information was collected. However, in the following cases, the notification is sent to a communication terminal or email address designated in advance by the user.
  • ① When the communication terminal from which the personal location information was collected cannot receive text, voice, or video
  • ② When the user has requested in advance to be notified by online posting or similar means

6. Rights and Obligations of Guardians of Children Aged Eight or Under, Persons under Adult Guardianship, and Persons Registered with Severe Mental Disabilities, and Methods of Exercise

• 1) Where the guardian of any of the following persons (hereinafter “children aged eight or under, etc.”) consents to the collection, use, or provision of personal location information to protect their life or body, the consent is deemed to be given by the person.
  • ① Children aged eight or under
  • ② Persons under adult guardianship
  • ③ Persons with mental disabilities under Article 2(2)(2) of the Act on Welfare of Persons with Disabilities who fall under severely disabled persons under subparagraph 2 of Article 2 of the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities (limited to persons registered under Article 32 of the Act on Welfare of Persons with Disabilities)
• 2) The guardian of children aged eight or under, etc. under the preceding paragraph means a person who actually protects them and falls under any of the following.
  • ① The legal representative of a child aged eight or under, or a guardian under Article 3 of the Act on Guardianship of Minors in Protective Facilities
  • ② The legal representative of a person under adult guardianship
  • ③ The legal representative of a person under item 3 of paragraph 1, the head of a residential facility for persons with disabilities under Article 58(1)(1) of the Act on Welfare of Persons with Disabilities, the head of a social rehabilitation facility for persons with mental illness under subparagraph 4 of Article 3 of the Mental Health Act, or the head of a mental care facility under subparagraph 5 of the same Article
• 3) A guardian who wishes to consent to the collection, use, or provision of personal location information to protect the life or body of children aged eight or under, etc. must submit a written consent to the company together with a document proving guardianship.
• 4) When a guardian consents to the collection, use, or provision of personal location information of children aged eight or under, etc., the guardian may exercise all rights of the personal location information subject.

7. Name of the Location Information Management Officer, or Name and Contact of the Department Handling Personal Location Information Protection and Related Grievances

• 1) The company designates a person in a position to take substantial responsibility as the Location Information Management Officer, to properly manage and protect location information and to smoothly handle complaints from personal location information subjects.
  • Location Information Management Officer
  • ・ Person in Charge: Executive Vice President Uk Hur
  • ・ Contact: 02-2194-5000
  • ・ Email: privacy@e-hcg.com

1. We would like to inform you that the contents of the Privacy Policy are scheduled to be changed as follows. The revised Privacy Policy will take effect on October 13, 2026.