Privacy Policy of Exporum Co., Ltd. for Korea Expo Osaka 2025
Exporum Co., Ltd. (hereinafter referred to as the "Company") establishes and discloses this privacy policy to protect the personal information of data subjects in accordance with the General Data Protection Regulation (GDPR), and the Act on the Protection of Personal Information (APP. The Company takes necessary measures to protect your personal information and handle related complaints promptly and smoothly.
Article 1 (Purpose of Processing Personal Information)
The Company processes personal information for the following purposes. The processed personal information will not be used for purposes other than those specified below, and in the event of a change in the purpose of use, necessary measures will be taken, including obtaining separate consent.
1. Website membership registration and management
o Purpose: Confirmation of membership registration intent, self-identification/authentication for providing membership services, maintenance/management of member qualifications, prevention of service misuse, confirmation of consent from legal representatives for processing personal information of children under 14, complaint handling, etc.
2. Provision of goods or services
o Purpose: Delivery of goods, provision of services, sending of contracts and invoices, content provision, personalized service provision, self-authentication, fee payment and settlement, debt collection, etc.
3. Complaint handling
o Purpose: Confirmation of complainant's identity, confirmation of complaint details, contact/notification for fact-finding investigations, notification of processing results, etc.
4. Compliance with GDPR and APPI
o Ensuring compliance with GDPR for users based in the European Economic Area (EEA) and APPI for Japanese users.
o Providing clear opt-in and opt-out options for data processing, email communications, and marketing.
o Guaranteeing data portability, the right to erasure, and the right to restrict processing as outlined in both GDPR and APPI.
Article 2 (Processing and Retention Period of Personal Information)
1. The Company processes and retains personal information only for as long as necessary to fulfill the purpose for which it was collected, unless a longer retention period is required by law or for legal compliance purposes.
2. The processing and retention periods for each category of personal information are as follows:
o Website membership registration and management: Until the user withdraws from the website, with the following exceptions:
(1) In the event of an ongoing investigation or inquiry due to a violation of relevant laws, until the end of the investigation or inquiry.
(2) If there are remaining rights and obligations related to website usage, until their resolution.
o Marketing and promotional data retention: For marketing purposes, user consent will be obtained separately, and data will be retained for up to one year unless the user withdraws consent earlier.
Article 3 (Processed Personal Information Items)
1. What Personal Data Do We Collect? The Company processes the following personal information:
o Identity data: Name, surname, nationality, job title.
o Contact information: Email, phone number, company address.
o Professional details: Company name, industry.
o Technical data: IP address, cookies, browser type.
o Event-related information: Registration details, booth preferences, participation in networking activities.
2. How Do We Collect Your Data?
o When users register for the event.
o When they subscribe to newsletters.
o When they browse the website (cookies, analytics).
o When they contact the Company via email or forms.
3. Purpose of Data Processing
o Event registration and participation management.
o Sending event-related updates and promotional offers.
o Website improvement (analytics, cookies).
o Legal and security compliance.
4. Automatic Data Collection
o The following personal information items may be automatically generated and collected during internet service usage: IP address, cookies, MAC address, service usage records, visit records, faulty usage records, etc.
Article 4 (Destruction of Personal Information)
1. The Company promptly destroys personal information when it becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose.
2. User Request for Data Deletion (Right to Be Forgotten):
o Users can request the deletion of their personal data under GDPR’s Right to Be Forgotten and APPI’s related provisions.
o Requests will be processed within one month (30 days). If an extension is required due to complexity or volume of requests, the user will be informed within the initial 30-day period, as per GDPR Article 12(3) and APPI guidelines.
Article 5 (Ensuring the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information:
1. Administrative measures: Internal management plans, regular employee training, etc.
2. Technical measures: Access control systems, encryption, security software, etc.
3. Physical measures: Restricted access to data storage rooms, monitoring systems, etc.
Article 6 (GDPR Representative Exemption and APPI Compliance)
The Company has determined that the appointment of a GDPR Representative is not required under Article 27 of GDPR for the following reasons:
1. Occasional Processing: The Company does not engage in continuous or repeated processing of EU residents' data. Data collection is strictly related to the organization of Korea Expo Osaka 2025, the final edition of this event.
2. Limited Scope of Data Processing: Personal data collected is minimal and used solely for event registration, participation management, and communication regarding this specific event. No large-scale processing or high-risk activities (e.g., automated decision-making) are involved.
3. No Long-Term Data Retention: All collected personal data will be deleted within 12 months after the event’s conclusion in compliance with GDPR and APPI principles.
4. No Systematic Monitoring: The Company does not track, profile, or conduct targeted behavioral advertising.
5. Primary Establishment Outside Japan: The Company does not have a physical presence, subsidiary, or permanent establishment in Japan.
Should the Company engage in systematic data processing activities beyond the scope defined in this policy, a GDPR Representative will be appointed as required under GDPR Article 27. Additionally, the Company complies with APPI requirements for users located in Japan, ensuring their personal information is processed in line with the relevant provisions of this law.
Article 7 (Effective Date and Changes to the Privacy Policy)
• This privacy policy is effective as of February 17, 2025.
• Future updates will be communicated via the website and email notifications.