Privacy Policy

1. General Provisions

The Seoul Design Foundation, the host organization of the World Design Congress, values the personal information of users in connection with the official World Design Congress website (hereinafter the “Site”) and the pre-registration and event participation application process, and complies with the Personal Information Protection Act and other relevant laws and regulations. This Privacy Policy has been prepared to explain what personal information the Congress processes, for what purposes, and how.

In the event the Congress transfers or is transferred all or part of its business, or undergoes a merger, and there is a party receiving the personal information, the Congress will notify this fact in advance through the Site and public notices, obtain the consent of data subjects, and carry out other necessary procedures.

• Effective date of this Privacy Policy: [2026.09.01]
• Date of most recent revision: [2026.09.01]

2. Purposes of Processing Personal Information

The Congress processes personal information for the following purposes, and where a purpose changes, will take necessary measures such as obtaining separate consent.

1. Pre-registration and notices for the World Design Congress 2027 Seoul Preview event (14 October 2026)

• Confirmation of application/receipt, sending event notices (venue, time, changes, etc.), management of the participant list, on-site check-in

2. Notices related to the 35th World Design Congress (where separate consent is given)

• Sending emails regarding key Congress news, notices of future registration openings, etc.

3. Responding to inquiries

• Confirming contact details in order to reply to inquiries received

4. Prevention of fraudulent use and Site security

• Detecting abnormal access, preventing fraudulent registration/abuse, and responding to security incidents

5. Improvement of service quality

• Improving content and features through analysis of Site usage statistics

6. Fulfilment of legal obligations

• Complying with retention and reporting obligations under relevant laws and regulations

3. Items of Personal Information Processed and Collection Methods

a. Items Collected (Preview Event Pre-Registration — via Naver Form or Catch Form)

Category	Item	Required/Optional
Required	Name	Required
Required	Email address	Required
Required	Mobile phone number	Required
Optional	Affiliation (organization/company name), position	Optional
Optional	Number of attendees, areas of interest	Optional
Automatically collected	Date/time of registration, IP address, browser/device information	–

b. Collection Methods

• Pre-registration: Data subjects enter information directly when applying online through the Naver Form/Catch Form accessed via the link posted on the Site
• Inquiries: Information entered through the inquiry channel on the Site (email, etc.)
• Automatic collection: Collected through automated means such as cookies when visiting the Site (see Article 12)

4. Period of Processing and Retention of Personal Information

• Pre-registration information: Retained until [3 months after the event ends] from the date of collection, then destroyed

(e.g., “Destroyed within 3 months of the end of the Preview event. However, where separate consent has been obtained for the purpose of managing participants in preparation for the official World Design Congress, information will be retained until [2027]”)

• Newsletter subscribers: Destroyed immediately upon request to unsubscribe
• Where retention is required under relevant laws and regulations, information will be separately stored for the applicable period before destruction (e.g., records of consumer complaint/dispute handling under the Act on Consumer Protection in Electronic Commerce — generally not applicable where there is no payment or transaction)

5. Outsourcing of Personal Information Processing ★ (Key clause when using Naver Form or Catch Form)

The Congress outsources personal information processing tasks as set out below to ensure the smooth handling of pre-registration, and specifies in the outsourcing agreement, in accordance with relevant laws and regulations, matters such as the prohibition on processing for purposes other than the outsourced task, technical and administrative protection measures, and supervision of the outsourced service provider.

Outsourced Party	Details of Outsourced Task	Period of Retention/Use of Personal Information
NAVER Corporation (Naver Form)	Receipt and storage of pre-registration form submissions	Until termination of the outsourcing agreement or until the purpose is achieved
ONEPEOPLE Co., Ltd. (Catchsecu/Catch Form)	Receipt and storage of pre-registration form submissions	Until termination of the outsourcing agreement or until the purpose is achieved

6. Provision of Personal Information to Third Parties

The Congress processes data subjects’ personal information only within the scope specified in Article 2 (Purposes of Processing), and does not provide personal information to third parties except where separate consent has been obtained from the data subject or where specifically required by law.

Personal information may exceptionally be provided where required by relevant laws and regulations, such as where a court, investigative agency, or similar body makes a request through lawful procedures based on applicable law.

7. Overseas Transfer of Personal Information

[This section was listed in the table of contents of the source draft but its content had not yet been drafted at the time of translation. Please supply the relevant details — e.g., whether personal information is transferred outside Korea (such as to overseas servers used by Naver Form/Catch Form or analytics providers), the recipient, items transferred, purpose, retention period, and method of transfer — so this section can be completed.]

8. Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise

Data subjects may exercise the following personal-information-related rights against the Congress at any time.

1. Request to access personal information

2. Request for correction in the event of errors

3. Request for deletion

4. Request to suspend processing

Rights may be exercised in writing, by email, or by other means, addressed to [Department Email/Contact Information], and the Congress will take action without delay.

• Requests for access: Access will be provided within 10 days of receipt of the request (Article 35 of the Personal Information Protection Act).
• Requests for correction/deletion: Except where other laws specifically designate the information as subject to separate collection requirements, the Congress will notify the result of processing within 10 days of receipt of the request (Article 36 of the Personal Information Protection Act).
• Requests to suspend processing: Processing will be suspended without delay (Article 37 of the Personal Information Protection Act).

The Congress may verify the identity of the data subject in order to process such requests. Where the data subject is a child under the age of 14, the child’s legal representative may exercise these rights on the child’s behalf.

9. Protection of Children’s Personal Information

As a general principle, the Congress operates pre-registration and event participation for adults (aged 14 and older).

Where it is necessary to process the personal information of a child under the age of 14, the Congress obtains the consent of the child’s legal representative in accordance with Article 22-2 of the Personal Information Protection Act, and may collect the minimum information necessary to confirm that such consent has been given.

A legal representative may request that the Congress provide access to, correct or delete, or suspend the processing of, a child’s personal information, and the Congress will take the necessary action without delay in such cases.

10. Procedures and Methods for Destruction of Personal Information

• Destruction procedure: Personal information for which grounds for destruction have arisen — such as the expiry of the retention period or achievement of the processing purpose — is transferred to a separate database (or, in the case of paper records, a separate filing cabinet) and is stored for a set period, or destroyed immediately, in accordance with internal policy and relevant laws and regulations.
• Destruction method: Personal information recorded and stored in electronic file form is deleted using technical methods that render the records unrecoverable; personal information recorded and stored on paper is destroyed by shredding or incineration.
• Upon request from a data subject, the Congress can confirm that destruction of their personal information has been completed.

11. Measures to Ensure the Security of Personal Information

The Congress takes the following measures to ensure the security of personal information.

1. Administrative measures: Establishment and implementation of an internal management plan; minimization of personnel with access and regular training

2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information during storage and transmission (where applicable), and installation and updating of security programs

3. Physical measures: Access control over the storage of materials

12. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices (Cookies, etc.)

The Site may use cookies and similar technologies to provide customized services to users and to analyze access statistics.

• Purpose of using cookies: Analysis of access frequency and time spent, etc. (e.g., where analytics tools such as Google Analytics are used)
• Third-party cookies: Third-party services embedded in the Site, such as social media share buttons or map embeds (Kakao/Google Maps), may independently install their own cookies, and the relevant third party’s privacy policy will apply in such cases.
• Refusing the installation and operation of cookies: Users may refuse to allow cookies to be stored through their web browser settings, in which case they may experience difficulty using the service.

13. Links to Other Sites

The Site may include links to other websites that are not owned or operated by the Congress, such as those of sponsors, partner organizations, or ticketing providers.

The Congress is not responsible for the personal information practices of such other sites, and users are advised to review the privacy policy of any site they access through such links. This Privacy Policy applies only to personal information collected on the World Design Congress Site.

14. Personal Information Protection Officer and Department in Charge

Category	Details
Personal Information Protection Officer	Name: [Jeonghoon Cho] / Title: [Senior Manager]
Department in Charge	[Universal Design Team, Seoul Design Foundation]
Contact	Email: [jhcho@seouldesign.or.kr] / Phone: [+82-2-2096-0123]

Data subjects may direct all inquiries, complaints, and requests for remedies related to personal information protection arising in connection with their use of the Congress’s services to the department in charge listed above. The World Design Congress will respond to and process such inquiries without delay.

15. Remedies for Infringement of Data Subjects’ Rights

Data subjects may report or seek consultation regarding infringements of their personal information rights with the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (no area code) (www.spo.go.kr)
• National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)

16. Changes to This Privacy Policy

This Privacy Policy applies from its effective date. Where any addition, deletion, or correction is made pursuant to relevant laws and regulations or internal policy, notice will be given through the notice board at least 7 days prior to the effective date of the change.