Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information processed by the Company will not be used for purposes other than those below. If the purpose of use changes, the Company will take necessary measures, including obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Membership registration, email login, email verification, account management, and identification of the user’s own account
2. Profile Photo upload, change and deletion, member profile display, operation of public profiles, and customer support
3. Social Sign-up and Social Login through Naver, Kakao, Google, or Facebook accounts, member account identification, existing account verification, prevention of duplicate registration, and login security verification
4. Exchange of OAuth authorization codes and tokens with Social Login Providers, member profile lookup, linked account status management, unlinking, and membership withdrawal processing
5. Direct input, additional verification, sign-up restriction, or customer support when required information from a Social Login Provider is missing or the validity of an email address cannot be confirmed
6. Verification of Contest eligibility, confirmation that participants are aged 18 or older, receipt of Contest participation applications, and notice of results
7. Artwork submission, file upload, issuance of Artwork identifiers, and management of Artwork history
8. Artist registration, artist profile management, upload, management and disclosure of Artist Registration Profile Photos, issuance and management of artist identifiers and Artwork unique numbers, and Artwork history management
9. Storage, thumbnail creation, file-format conversion, security verification, and deletion of member Profile Photos, Artist Registration Profile Photos, and Artwork files
10. Artwork review, voting, likes, support, evaluation, verification of review fairness, and winner management
11. Artwork exhibition, disclosure of award results, promotion, record retention, and copyright handling under the Contest Guidelines
12. Operation of artist profiles, management of artist identifiers, management of award and registration history, and protection of rights
13. Provision of community boards, culture and art content, and event notice services
14. Accrual, use, recovery, expiration, and prevention of misuse of Coins (service points)
15. Management of consent records for connecting to a separate site or Separate Service for Artwork purchase or use
16. Customer inquiries, complaint handling, and notice delivery
17. Notices regarding new services, programs, events, and marketing, where separate consent is obtained
18. Analysis of service usage records, security, incident response, and prevention of misuse
19. Protection of artist rights, Artwork identification, management of award and registration history, and future response to artwork resale royalty claims
20. Compliance with legal obligations and dispute response

Article 2 (Items of Personal Information Processed and Retention Period)

1. The Company processes the following personal information within the scope necessary to provide the Services.

The Company processes personal information necessary for membership registration, login, Social Sign-up, Social Login, Contest participation, Artwork submission, and other service provision within the scope necessary to enter into and perform the service use agreement. Marketing, optional items, and additional permissions beyond the login purpose are processed only where separate consent has been obtained, and records subject to statutory retention obligations are retained in accordance with the relevant laws.

1. Optional items may be omitted without restricting use of the basic Services. However, specific functions that require optional items may be restricted if the relevant information is not provided.
2. Receipt of marketing and advertising information is processed only where separate optional consent has been obtained, and users may withdraw such consent at any time.
3. For participation functions such as voting, likes, support, evaluation, and review, the processed items, disclosure scope, and retention period are provided on the participation screen or in the Contest Guidelines for each Contest.
4. The scope, purpose, period, or permanent retention of rights-identifying information, such as artist registration details, Artwork registration details, artist identifiers, Artwork unique numbers, and award or registration history, are determined in the Contest Guidelines for each Contest. The Company excludes from long-term retention, or separately stores, de-identifies, or anonymizes, personal information that is not directly necessary for rights identification, such as contact details, login information, and account information.
5. Member information, transaction information, settlement information, and similar information processed after moving to a separate site or Separate Service through an Artwork purchase or use connection are governed by the Privacy Policy and consent screen of that separate site or Separate Service.
6. The Company does not request additional permissions beyond the purpose of Social Sign-up and Social Login, such as Naver Cafe or Calendar, KakaoTalk messages, Google Drive/Gmail/Calendar, or Facebook friend lists, posts, pages, or ad accounts. If a function requiring additional permissions or additional personal information items is introduced in the future, the Company will clearly notify the processing purpose, items, retention period, and required/optional status on the provider consent screen and in the Artpiad Privacy Policy or a separate consent screen, and obtain necessary consent.
7. Consent on the Social Login Provider’s consent screen is consent for that provider to provide the selected information to Artpiad. Consent to the Artpiad Terms of Service and Privacy Policy, conclusion of the service use agreement, and consent to collection and use of personal information are separately conducted on the Artpiad sign-up screen or terms consent screen.
8. If an email address is not provided by a Social Login Provider, or if the validity or verification status of the email cannot be confirmed, the Company may require direct email input and verification, or restrict membership registration or login.

Article 3 (Minor Users and Personal Information of Children under 14)

1. Membership registration and basic use of the Site are intended for users aged 14 or older, and users under 14 may not register as members or use member services.
2. If the Company separately introduces a service that requires processing personal information of children under 14, the Company will obtain consent from a legal representative in accordance with applicable laws and establish procedures for the legal representative to exercise rights.
3. Contest participation and Artwork submission are provided only to users aged 18 or older.
4. If it is confirmed that a user under 18 participated in a Contest or submitted Artwork, the Company may, after age verification to the extent necessary, restrict or cancel the receipt, review, or award. Personal information already collected will be destroyed in accordance with applicable laws and the Contest Guidelines, or separately retained to the extent necessary for dispute response.
5. If it is confirmed that a user under 14 registered or used member services, the Company may, after identity or age verification to the extent necessary, restrict such use and destroy the personal information or retain it to the extent required by law.

Article 4 (Provision of Personal Information to Third Parties)

1. In principle, the Company does not provide users’ personal information to third parties. However, the Company may provide personal information to the extent necessary in the following cases.

• Where the user has given prior consent
• Where there is a special provision in law or a request from an investigative agency, supervisory authority, or other institution with lawful authority
• Where necessary under applicable laws in an emergency, such as disasters, infectious diseases, imminent danger to life or body, or imminent property loss

2. Identity verification, SMS or email delivery, customer center operation, operation of review and evaluation systems, and management of separate consent records necessary for Artwork purchase or use connections are, in principle, managed as entrustment of personal information processing. If regular third-party provision occurs, the Company will disclose the recipient, purpose of provision, items provided, and retention and use period in this Policy and obtain necessary consent.

During Social Sign-up and Social Login, the Company performs OAuth authentication procedures with the Social Login Provider selected by the user. In this process, the Company may transmit to and receive from the provider authentication server authentication processing information necessary for authorization code exchange, profile lookup, unlinking, or token revocation, such as redirect URI, client_id, authorization code, and access token. The Company does not provide Artpiad member personal information to Social Login Providers for advertising, marketing, posting, or sharing within provider services.

Social Login Providers are external authentication service providers selected by users and are not recipients of third-party provision that receive Artpiad member information held by the Company for advertising, marketing, posting, or sharing within provider services.

Article 5 (Entrustment of Personal Information Processing)

1. The Company may entrust personal information processing tasks to external parties for smooth service provision. When entrusting such tasks, the Company specifies in written documents, such as contracts, matters including prohibition of personal information processing beyond the purpose of the entrusted task, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of processors, and liability for damages, and manages and supervises processors so that they safely process personal information.

2. If the details of entrusted work or processors change, the Company will disclose such changes through this Policy without delay.

• Social Login Providers are not processors to whom the Company comprehensively entrusts personal information processing. They are external authentication service providers selected by users. The Company transmits to and receives from provider authentication servers information necessary for OAuth authorization code exchange, profile lookup, unlinking, or token revocation so that users can log in with their selected provider accounts. Such processing is disclosed in Articles 2, 4, and 6 of this Policy.
• If the Company entrusts storage of Social Login linkage information, account database operation, email delivery, security verification, log retention, incident response, or similar tasks to external cloud, email delivery, security, or operation services, the Company will reflect the actual processor name, entrusted work, processed items, and retention and use period in the entrustment table.

Article 6 (Overseas Transfer of Personal Information)

In principle, the Company does not transfer personal information overseas. If an overseas transfer occurs through cloud services, email delivery, analytics tools, customer center tools, or similar tools, the Company will provide prior notice of the recipient, country of transfer, date/time and method of transfer, transferred items, purpose of use, retention period, and method for refusing the transfer, and will take necessary measures.

Article 7 (Destruction of Personal Information)

1. When the retention period expires or the processing purpose is achieved and the personal information becomes unnecessary, the Company destroys the relevant personal information without delay.
2. Where personal information must continue to be retained under other laws, the Company moves such personal information to a separate database or separates access rights for retention.
3. Personal information in electronic file form is deleted by a secure method so that it cannot be recovered or reproduced.
4. Personal information recorded on paper documents is destroyed by shredding or incineration.
5. The Company may retain for the long term the minimum review results, Artwork unique numbers, artist identifiers, receipt numbers, scores, rankings, award details, and consent records for Contest Guidelines that are necessary to verify review fairness, manage award and registration history, protect artist rights, identify Artworks, and respond to future artwork resale royalty claims.
6. Even where long-term retention is necessary under paragraph (5), personal information not directly necessary for rights identification is destroyed, separated, de-identified, or anonymized after expiration of the retention period or achievement of the processing purpose.
7. Rights-identifying information among artist registration details and Artwork registration details that is specified in the Contest Guidelines as subject to permanent retention may be retained permanently within the purpose stated in the Contest Guidelines.
8. If Social Login linkage is disconnected or a Member withdraws, the Company destroys or separately stores, without delay, Social Login linkage information such as Social Login Provider, provider member identifier, and linked status. However, minimum records necessary to prevent fraudulent sign-up, respond to account theft, handle disputes, or comply with statutory retention obligations may be separately retained for the period stated in this Policy.
9. OAuth authorization codes, provider access tokens, refresh tokens, and ID tokens are destroyed without delay after the purpose of authentication processing, profile lookup, unlinking, or error response is achieved, or are no longer used after expiration. If the Company introduces a function for long-term storage of provider tokens, it will separately notify the storage purpose, items, retention period, encryption method, and withdrawal method, and obtain necessary consent.

Examples of statutory retention:

Article 8 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

1. The Company may use cookies necessary for Site operation, such as maintaining login, security management, and access statistics.
2. If the Company collects or uses behavioral information for customized advertising, it will provide separate notice and obtain necessary consent.
3. Users may refuse cookie storage through web browser settings. However, if essential cookies are refused, use of some Services, such as login, shopping cart, order, and payment, may be restricted.
4. During Social Sign-up and Social Login, the Company may process the state value, redirect URI, OAuth state value in localStorage or session storage, access IP, User-Agent, access date/time, error code, and login success/failure records for CSRF prevention and login security. Such information is used for login security verification, blocking abnormal access, incident analysis, and dispute response.
5. In procedures that require security verification, such as membership registration, login, and password reset, Cloudflare Turnstile verification tokens, verification results, error information, access IP, and User-Agent may be processed.

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

1. Users may at any time request access to, correction of, deletion of, suspension of processing of, withdrawal of consent to, or membership withdrawal with respect to their personal information.
2. Users may exercise their rights through the member information modification function on the Site or through the customer center.
3. Upon receiving a rights request, the Company will take action without delay in accordance with applicable laws and notify the user of the result.
4. If a user requests correction of personal information, the Company will not use or provide the relevant personal information until correction is completed.
5. Requests for deletion or suspension of processing may be restricted where there is a statutory retention obligation, where there is a risk of infringing on another person’s life, body, or property interests, or where other grounds prescribed by applicable laws exist.
6. Where an agent exercises rights, the Company may request documents confirming legitimate authority, such as a power of attorney.

Members may request Social Login unlinking, access to, correction of, deletion of, suspension of processing of personal information, withdrawal of consent, and membership withdrawal through the customer center or member information management screen. Social Login unlinking is a procedure to disconnect the provider linkage for the Artpiad account. Withdrawal from a Naver, Kakao, Google, or Facebook account itself, or deletion of information remaining in such provider account, must be separately handled through the account settings of each provider.

If Social Login linkage is disconnected, the Member cannot log in to Artpiad with that provider account. However, if another login method such as email login is set up, or if identity verification is completed through customer support, the Company may support recovery of account access.

Rights requests and inquiries:

• Department: Artlian Co., Ltd. Secretariat
• Email: artlianmaster@gmail.com
• Telephone: 1544-9811

Article 10 (Measures to Ensure the Safety of Personal Information)

The Company takes the following measures to ensure the safety of personal information.

1. Managerial measures: minimizing personal information handlers, establishing internal management standards, personal information protection training, and management and supervision of entrusted companies
2. Technical measures: encrypted storage of passwords, access authority management, storage of access records, malware prevention, encryption during transmission, and two-factor authentication for administrator access
3. Physical measures: access restrictions for places or systems where personal information is stored
4. Operational measures: separation of access rights for member Profile Photos, Artist Registration Profile Photos, Contest Artwork files, artist identifiers, Artwork unique numbers, review materials, and Coin records
5. Development and deployment measures: minimizing CI/CD access rights, restricting direct access to production databases, managing deployment logs, managing secrets in production environments, and masking or de-identifying personal information in test environments
6. Long-term retention measures: separating rights-identifying information from contact information, account information, and profile photos and destroying or de-identifying unnecessary direct identifiers

Article 11 (Chief Privacy Officer and Grievance Handling Department)

The Company designates the following Chief Privacy Officer or grievance handling department to oversee personal information processing and to handle inquiries, complaints, and damage relief related to personal information.

Article 12 (Remedies for Infringement of Rights)

Users may contact the following institutions for consultation or damage relief regarding personal information infringement.

1. Privacy Infringement Report Center: 118 without area code, https://privacy.kisa.or.kr
2. Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
3. Supreme Prosecutors’ Office: 1301 without area code, https://www.spo.go.kr
4. Korean National Police Agency: 182 without area code, https://ecrm.police.go.kr

Article 13 (Changes to this Privacy Policy and Renewed Consent)

1. If the Company changes this Privacy Policy, it will post the changed details, reason for change, and effective date on the Site notice board.
2. If there is a change that materially affects user rights, such as the purpose of personal information processing, items, retention period, third-party provision, entrustment, or overseas transfer, the Company will post notice at least 30 days before the effective date and, where possible, provide individual notice by email or other means.
3. If the scope of personal information processing is substantially expanded due to introduction of a new function such as Coins, the Company may obtain renewed consent at login or upon entry into the relevant function.
4. If there is a substantial change to Social Login Providers, requested scopes, collected items, required/optional status, retention period, third-party provision, or overseas transfer, the Company will provide prior notice of the change and obtain renewed or additional consent for changes that materially affect user rights in accordance with applicable laws and provider policies.
5. Minor changes, such as wording corrections or contact information changes, will be updated without delay.

Renewed consent records:

• Terms/Policy version
• Consent item
• Consent date/time
• IP address
• User-Agent
• Consent screen wording version