Privacy Policy
Airbility Inc., a company incorporated in the Republic of Korea (hereinafter referred to as the “Company”), is committed to protecting the freedom and rights of data subjects and complies with the Personal Information Protection Act and related laws and regulations. The Company lawfully processes personal information and safely manages it. In accordance with Article 30 of the Personal Information Protection Act, this Privacy Policy has been established and disclosed to provide data subjects with information on the procedures and standards related to personal information processing and protection, and to handle related complaints promptly and smoothly.
1. Purpose of Processing, Categories of Personal Information, and Retention Period
The Company collects and uses personal information to the minimum extent necessary for providing its services in accordance with the Personal Information Protection Act.
1) Categories of Personal Information Processed With the Consent of the Data Subject
| Legal Basis | Category | Purpose of Collection | Items Collected | Retention Period |
|---|---|---|---|---|
| Personal Information Protection Act Article 15-1(1)(Consent) | Inquiries | Receiving and responding to inquiries; reviewing business cooperation | Last name, first name, email address, phone number, company name, industry, message | 3 years after completion of the inquiry |
| Personal Information Protection Act Article 15-1(1)(Consent) | Recruitment | Conducting the recruitment process and notifying results | Name, phone number, email address, career history, information contained in application documents | 6 months after the recruitment process ends (1 year where separate consent for a talent pool is given) |
All of the items listed above are required. Data subjects may refuse to give consent, in which case the Company may be unable to receive and respond to the inquiry.
The Company does not collect or use personal information for the transmission of advertising information such as newsletters.
2) Categories of Personal Information Processed Without the Consent of the Data Subject
The Company processes the following categories of personal information without the consent of the data subject, on the statutory grounds set out below.
| Legal Basis | Category | Purpose of Collection | Items Collected | Retention Period |
|---|---|---|---|---|
| Personal Information Protection Act Article 15-1(4)(Performance of a Contract) | Conclusion and performance of contracts | Concluding, performing, settling and administering supply and purchase contracts | Contact person’s name, organization, title, phone number, email address, contract and transaction records, supporting documents | 5 years after termination of the contract (per Article 85-3 of the Framework Act on National Taxes and Article 33 of the Commercial Act) |
| Personal Information Protection Act Article 15-1(2)(Special Provisions by Law) | Tax Affairs | Handling of ledgers and supporting documents for all transactions as required by law | Ledgers and supporting documents related to transactions | 5 years (per Article 85-3 of the Framework Act on National Taxes) |
| Personal Information Protection Act Article 15-1(2)(Special Provisions by Law) | Tax Invoices | Issuance of tax invoices to those who have received goods or services | Supply amount, VAT amount, recipient information (name, address, business name) | 5 years (per Article 71 of the VAT Act) |
| Personal Information Protection Act Article 15-1(2)(Special Provisions by Law) | Retention of access logs | Retention and review of access logs of the personal information processing system | Access date and time, access point (IP address), data subject information processed, tasks performed | 1 year or more (per Article 29 of the Personal Information Protection Act and Article 8 of the Standards for Measures to Secure the Safety of Personal Information) |
| Personal Information Protection Act Article 15-1(6)(Legitimate Interests) | Service usage records | Website operation statistics, prevention of misuse, and security | Access time, IP address, browser type, operating system, cookies, service usage logs and device information | 1 year from collection |
3) Categories of Personal Information Not Processed
① The Company does not collect or process sensitive information such as ideology or beliefs, health and medical history, or membership in trade unions or political parties, nor unique identifiers such as resident registration numbers. Applicants are advised not to include such information in their application documents.
② The Company does not provide services to children under the age of 14 and does not collect their personal information. If the Company becomes aware that personal information of a child under 14 has been collected, it will destroy such information without delay.
2. Procedures and Methods for the Destruction of Personal Information
① The Company shall destroy personal information within 5 days from the date on which the retention period expires, the processing purpose is achieved, or the information otherwise becomes unnecessary.
② Even if the retention period consented to by the data subject has expired or the processing purpose has been achieved, if there is a need to preserve the information according to other laws and regulations, the Company shall transfer the personal information to a separate database (DB) or store it in a different location for preservation. The specific items and legal grounds for the retention of personal information pursuant to other laws can be found in 1. Purpose of Processing, Categories of Personal Information, and Retention Period.
③ The procedures and methods for the destruction of personal information are as follows:
- Destruction Procedure — The Company selects the personal information to be destroyed and obtains approval from the Company’s personal information protection officer before proceeding with the destruction.
- Destruction Method — Personal information recorded or stored in electronic file formats shall be destroyed so that it cannot be restored. Personal information recorded or stored in paper documents shall be destroyed by shredding or incineration.
3. Provision of Personal Information to Third Parties
① The Company processes personal information only within the scope explicitly stated for its processing purposes, and does not provide personal information to third parties unless the data subject consents or it is permitted under Articles 17 and 18 of the Personal Information Protection Act, such as under special provisions of the law.
② The Company does not provide personal information to third parties as of the effective date of this Policy. Should such provision become necessary, the Company will obtain the data subject’s prior consent and disclose the details through this Policy.
③ In accordance with the “Guidelines for Handling and Protection of Personal Information in Emergency Situations” jointly announced by government authorities, the Company may provide personal information to relevant agencies without the data subject’s consent in urgent situations such as disasters, infectious diseases, events or accidents that pose imminent threats to life or physical safety, or property damage. In such cases, the Company will provide only the minimum necessary personal information required by law and will not use the information for any purpose other than that specified.
4. Entrustment of Personal Information Processing
① For the smooth provision of its services, the Company entrusts personal information processing tasks as follows.
| Trustee | Entrusted Tasks | Retention Period |
|---|---|---|
| Cafe24 Corp. | Website hosting and server operation; operation of mail servers for inquiry correspondence | Until termination of the entrustment agreement or achievement of the purpose |
| Google LLC | Website usage statistics and analysis (Google Analytics 4) | Until termination of the entrustment agreement or achievement of the purpose |
② When entering into an entrustment agreement, the Company specifies, in documents such as contracts, the prohibition of personal information processing beyond the entrusted tasks, technical and managerial protection measures, restrictions on re-entrustment, oversight of the trustee, liability for damages, and other responsibilities, in accordance with Article 26 of the Personal Information Protection Act. The Company also supervises whether the trustee handles personal information securely.
③ In accordance with Article 26, Paragraph 6 of the Personal Information Protection Act, the trustee must obtain the Company’s consent before re-entrusting the personal information processing tasks.
④ If the details of the entrusted tasks or the trustee change, the Company will disclose such changes without delay through this Privacy Policy.
5. Transfer of Personal Information Overseas
① In accordance with Article 28-8 of the Personal Information Protection Act, the Company transfers personal information overseas as follows.
| Recipient | Country | Basis for Transfer | Date and Method of Transfer | Items Transferred | Purpose | Retention Period | Contact |
|---|---|---|---|---|---|---|---|
| Google LLC | United States | Entrustment of processing (Article 28-8(1)(3)) | Transmitted over the network when the website is visited or map and video content is loaded | IP address, cookies, service usage logs, device information | Website usage analytics (Google Analytics 4); provision of map and video content | As configured in Google Analytics data retention settings (up to 14 months) | https://support.google.com/policies |
② When transferring personal information overseas, the Company takes measures necessary to ensure security, including encryption, in accordance with Article 28-8(4) of the Personal Information Protection Act.
③ Data subjects may request the suspension of processing of their personal information under Article 37 of the Personal Information Protection Act. If you do not wish your personal information to be transferred overseas, please contact the office listed in 10. Contact Information of the Personal Information Protection Officer or Department Handling Complaints. In that case, certain features that require overseas transfer, such as the display of map and video content and usage analytics, may be restricted.
6. Measures to Ensure the Security of Personal Information
① The Company takes the following measures to ensure the security of personal information:
- Administrative Measures: Establishment and implementation of an internal management plan, operation of a dedicated organization, regular employee training
- Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, installation and updating of security software, retention of access logs and prevention of forgery or alteration
- Physical Measures: Access control for computer rooms and data storage rooms
7. Use of Automatic Personal Information Collection Devices
Personal Information Collection Devices in Use
① The Company uses ‘cookies’ that store and retrieve user information from time to time to provide personalized services and user convenience.
② Cookies are small pieces of data sent by the server (http) operating the website to the user’s browser and are stored on the user’s PC or mobile device.
③ Users may choose to allow or block cookies through browser settings. However, refusal to store cookies may result in limitations on the use of customized services.
How to Allow or Block Cookies
On Web Browsers
- Chrome: Settings > Privacy and Security > Third-party cookies
- Edge: Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data
- Safari: Settings > Privacy > Block all cookies
On Mobile Browsers
- Chrome (Mobile): Settings > Privacy and Security > Third-party cookies
- Safari: Device Settings > Safari > Advanced > Block All Cookies
- Samsung Internet: Settings > Sites and downloads > Allow cookies
Third-Party Content and External Links
The website may embed content provided by third parties, such as maps (Google Maps) and videos (YouTube). When such content is displayed, the user’s IP address and cookie information may be transmitted to the relevant third party and processed in accordance with that third party’s privacy policy.
Personal information processing on external sites reached through links on this website (LinkedIn, YouTube, Instagram, and others) is governed by the policies of those sites.
Collection, Use, Provision, and Refusal of Behavioral Information
The Company does not collect or use behavioral information for online targeted advertising, and does not provide such information to third parties. The Company uses Google Analytics 4, provided by Google LLC, for website usage statistics, through which usage records that cannot identify an individual are collected. Data subjects may refuse this by changing their browser’s cookie settings, and may direct related inquiries or exercise their right to refuse to the department listed in 10. Contact Information of the Personal Information Protection Officer or Department Handling Complaints.
8. Rights of the Data Subject and Their Legal Representative, and How to Exercise Them
① Data subjects may at any time exercise their rights to access, correct, delete, suspend the processing of their personal information, or withdraw their consent.
② The Company does not make automated decisions that produce legal effects concerning data subjects.
③ These rights may be exercised by submitting a written request, email, or fax in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. The Company will respond promptly.
- To inquire, correct, delete, or access your personal information: contact@airbility.co.kr
- To withdraw consent for the collection or use of personal information: contact@airbility.co.kr
④ Rights may also be exercised by a legal representative or delegated person. In such cases, a power of attorney following Form No. 11 of the “Notice on the Methods of Processing Personal Information (No. 2023-12)” must be submitted.
⑤ The right to access or suspend processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act.
⑥ Personal information specified by other laws as mandatory to collect cannot be deleted upon request.
⑦ The Company verifies whether the requester is the data subject or an authorized representative.
⑧ Data subjects may exercise their rights by contacting the office listed in 10. Contact Information of the Personal Information Protection Officer or Department Handling Complaints. The Company will strive to process such requests promptly.
9. Criteria for Additional Use or Provision of Personal Information
Where the Company additionally uses or provides personal information without the consent of the data subject pursuant to Article 15(3) and Article 17(4) of the Personal Information Protection Act, it considers the following:
- Whether the additional use or provision is related to the original purpose of collection
- Whether the additional use or provision was foreseeable in light of the circumstances of collection or processing practices
- Whether the interests of the data subject would be unfairly infringed
- Whether measures necessary to ensure security, such as pseudonymization or encryption, have been taken
10. Contact Information of the Personal Information Protection Officer or Department Handling Complaints
① The Company designates the following Personal Information Protection Officer who is responsible for overseeing all tasks related to the processing of personal information, handling of complaints, and providing remedies to data subjects:
| Category | Name & Role | Contact |
|---|---|---|
| Personal Information Protection Officer | · Title: Team Lead · Name: Hyein Cha | Email: contact@airbility.co.kr |
| Department Handling Access Requests | · Department: Brand Team, Product Division · Contact Person: Hyein Cha | Email: contact@airbility.co.kr |
② Data subjects may contact the Personal Information Protection Officer or the responsible department regarding any inquiries, complaints, or remedies related to personal information protection that arise while using the Company’s services. The Company will respond and take appropriate action without delay.
11. Remedies for Infringement of Data Subject Rights
① If a data subject suffers damages due to the infringement of their personal information rights, they may request dispute resolution or consultation from the following organizations:
- Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
- KISA Personal Information Infringement Report Center: 118 / privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301 / www.spo.go.kr
- Cyber Bureau of the Korean National Police Agency: 182 / ecrm.cyber.go.kr
② The Company makes every effort to safeguard data subjects’ right to self-determination regarding personal information and to support consultations and remedies for any personal information-related issues. For such inquiries, please contact the department listed in 10. Contact Information of the Personal Information Protection Officer or Department Handling Complaints.
12. Changes to the Privacy Policy
① This Privacy Policy shall take effect as of August 31, 2026.
② Where the Company amends this Privacy Policy, it will announce the reasons for and details of the amendment on its website at least 7 days before the amendment takes effect, or at least 30 days in advance where the amendment materially affects the rights of data subjects. Where an amendment is unavoidable, such as due to a change in applicable law, the Company will announce the amendment without delay after it takes effect.