1. Purposes for personal information processing, items of personal information collected, and periods for retention and use of personal information

1. ① The NFMK processes personal information only to the minimum necessary for such purposes as providing services to the public, handling complaints, and performing relevant tasks.
2. ② The NFMK handles personal information and registers and discloses a list of personal information files as required by Article 32 of the Personal Information Protection Act as follows:

   Personal information file names	Operation basis & Purpose for processing	Personal information items	Period for retention and use
   IJIH(International Journal of Intangible Heritage) member	individual’s consent/ identification of the user for registration and membership services, Notification of IJIH activities	(mandatory) Name, Personal Postal Address, E-mail, User ID, Nationality, Affiliation, Phone Number, Personal Biography	Two Years from the time of the last login (However, Name, Nationality, Affiliation, Degree and Biography will be Semi-permanently stored with the publication of paper)
   	paper submission and reviews	(Optional) Additional Phone Number, Academic Activities, Final Degree, Publication
   Subscribers to mailing service	individual’s consent/ Managing service recipients	(mandatory) E-mail	Until subscription cancellation (Checking intention to cancel every year)
   List of people with reservations for Children’s Museum exhibition	individual’s consent/ Reservation confirmations, Sending information on reservations, Preventing overlapping applications	(mandatory) Name, Cellphone Number	1yrs
   Person in charge at agencies operating Culture Discovery Box program	individual’s consent/ Acceptance of Multicultural Culture Discovery Box rental application, Sending Guidelines, Dispatching Multicultural Culture Discovery Box and check the result	(mandatory) Name, E-mail, Affiliation, Phone Number, Personal Postal Address	1yrs (However, the information of those who have not yet completed box rental processing and result confirmation, will be stored until it’s completed.)
   List of individual applicants for educational programs at Children’s Museum	individual’s consent/ Applicant confirmations, Relevant information and educational materials sent, Preventing overlapping applications, Recipient confirmations	(mandatory) Name, Cellphone Number, E-mail, Names of each child, Each child’s age or grade	1yrs
   	Educational materials mailed	(Optional) Personal Postal Address
   List of group applicants for education at Children’s Museum	individual’s consent/ Confirming people in charge of groups, Preventing overlapping applications, Relevant information and educational materials sent	(mandatory) Name, Cellphone Number, E-mail, Affiliation, Affiliated Group Address	1yrs
   List of people with reservations for resting area	individual’s consent/ Reservation for the resting area, Sending information on reservations, Confirming the visiting group, etc.	(mandatory) Affiliation, Name of Person in Charge, Contact Information	1yrs
   List of questionnaires for Museum Reviews	individual’s consent/ Utilize to identify reviewers and reply to their inquiry	(mandatory) Name, Cellphone Number	Until post is deleted
   List of questionnaires for “What do you want to know?”	individual’s consent/ Utilize to identify questioners, specific questions, and reply to their inquiry	(mandatory) Name, Cellphone Number
   List of educational instructors	individual’s consent/ Confirm the information of educational instructors, Issue certificate of career	(mandatory) Name, E-mail, Cellphone Number, Date of Birth, Personal Postal Address	Semi-permanent
   	Issue certificate of career	(Optional) Career
   List of people applying for education via the NFMK website	individual’s consent/ Applicant confirmations, Relevant information and educational materials sent, Preventing overlapping applications	(mandatory) Name, Phone Number, E-mail	1yrs
   List of mailing recipients of The Folk News	individual’s consent/ Mailing of The Folk News (monthly magazine), Applicants confirmed	(mandatory) Name, Personal Postal Address, Phone Number	Until subscription cancellation
   Activity list of reporters	individual’s consent/ Supporting activities of reporters, Issue Activity Confirmation	(mandatory) Name, Phone Number, E-mail, Personal Postal Address	Semi-permanent
   List of donors	individual’s consent/ Confirming donors and operating benefits for them, Relevant information, etc. sent	(mandatory) Name, Personal Postal Address, Phone Number, E-mail	Semi-permanent

2. Providing personal information to third parties

1. ① The NFMK may provide personal information to third parties only as dictated under Articles 17 and 18 of the Personal Information Protection Act, includingwith consent from owners of personal information and under express provisions according to relevant statutes.
2. ② If provision to a third-party occurs, the NFMK will announce or notify owners of such within the scope allowed under applicable statutes.

3. Outsourcing personal information processing

1. ① For efficiency of personal information processing, the NFMK outsources the following relevant tasks:

   개인정보처리의 위탁 표 - 위탁받는자(수탁자), 위탁부서, 위탁업무, 전화번호로 구성됨

   Outsourced company	Outsourcing NFMK division	Work outsourced	contact
   Tune System	Planning & Management Division	Operating servers & networks of NFMK	+82-70-4231-4400
   Tune System	Planning & Management Division	Maintaining and operating the main website of NFMK	+82-70-4231-4400
   Landsoft	Planning & Management Division	Improving of the main website of NFMK	+82-70-4231-4400
   I-commtechnology	Children’s Museum Division	Operating the website of Children’s Museum of NFMK	+82-2-851-8438
   Designintro	Cultural Exchange & Education Division	Sending The Folk News on behalf of the NFMK	+82-2-2285-0789
   Stoneintegrity	Research Division	Operating the IJIH website	+82-2-516-9230

2. ② In accordance with Article 26 of the Personal Information Protection Act, when concluding an outsourcing contract, the NFMK specifies in the contract and other relevant documents such matters as preventing personal information processing beyond the purpose for outsourcing; technical and managerial safeguards; restriction of re-outsourcing; management and supervision of outsourced companies; compensation for damages and other responsibilities; and superviseswhether the outsourced company is processing personal information in a secure manner.
3. ③ When the content of the outsourced task or outsourced company changes, it will be made public in accordance with the appropriate privacy policy without delay.

4. Procedures and methods for destroying personal information

1. ① The NFMK destroys personal information without delay when such information becomes unnecessary owing to expiry of the retention period, completion ofthe purpose for processing the information, etc.
2. ② Provided that the retention of such personal information is mandatory by other statutes even when the retention period, agreed upon by the owner ofpersonal information, has expired or the processing purpose has been completed, the relevant personal information (personal information file) will be stored in adifferent place from before.
3. ③ Procedures and methods for destroying personal information.
   1. 1. Destruction procedures
      The NFMK creates plans to destroy personal information (or personal information files) up for destruction and destroys it accordingly. The NFMK designates personal information (or personal information files) for which reason for destruction arises, and destroys personal information (or personal information files)under the supervision of a privacy officer in charge of protecting personal information.
   2. 2. Destruction methods
      The NFMK destroys personal information recorded and stored as electronic files in ways that they cannot be reproduced, and destroys paper records by shredding or incinerating.

5. Rights and obligations of owners of personal information and legal representatives and how to exercise them

1. ① Owners of personal information can always exercise against the NFMK their rights to request access to, correction, erasure, and suspension of processing ofpersonal information.
   ※ Requests for access to and other requests regarding the personal information of a child under 14 years of age should be made directly by the child’s legal representative. Owners of personal information who are minors but are 14 years of age and older can exercise their rights about their personal information themselves or through their legal representative.
2. ② Rights can be exercised by filling out an access to personal information request and submitting it in person, by email or by fax. Upon receipt, the NFMK will promptly act on the request.
3. ③ Paragraph 2 should apply to the procedures for requests to correct, erase, and suspend processing of personal information , and in this case, “access” shouldbe regarded as including requests for “correction, erasure, and suspension of processing.”
   ☞ Download the form
4. ④ Rights can be exercised by legal representatives of owners of personal information, or those with power of attorney. In this case, a notification of power ofattorney should be submitted using the attached Form No. 11 of the Public Notice on Processing Methods of Personal Information (No. 2020-7).
   ☞ Download the form
5. ⑤ Regarding requests for access to and suspension of processing of personal information, the rights of the owners of personal information may be restricted according to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.
6. ⑥ Requests to correct and erase personal information cannot be honored if the relevant personal information is specified as a target for collection under other statutes.
7. ⑦ The NFMK confirms whether the party requesting to access, correct, erase, or suspend processing pursuant to the rights of the owner of the relevantinformation is the owner of that information himself/herself or a lawful agent.

6. Measures taken to protect the security of personal information

1. ① Managerial measures
   1. 1. Only the absolutely necessary staff are designated to handle personal information, and are supervised when they do so. They also undergo training on secure management.
   2. 2. Internal management plans have been established and are in practice on secure processing of personal information.
2. ② Technical measures
   1. 1. Additional security measures include important personal information (like members’ passwords) being saved, managed and transmitted in an encrypted state.
   2. 2. To prevent leakage of and damage to personal information due to hacking, computer viruses, and other such reasons, security programs are installed and regularly updated and inspected.
   3. 3. Necessary measures to control access to personal information are taken by granting, changing, and cancelling access to the personal information processing system. Unauthorized access from outside is also controlled through a firewall system.
3. ③ Physical measures
   1. 1. An IT room and document storage facilities are in place to safekeep personal information, and physical access control procedures are in use.

7. Installation and operation of an automatic personal information collection tool, and refusal thereof

1. ① The NFMK uses cookies that save and frequently retrieve usage information to customize services for individual users.
2. ② Cookies are limited information sent by the server running a website (http) to a user’s computer browser. They are often saved on user hard disks.
3. ③ Users can block cookie storage through their web browser’s security settings.
   1. 1. Cookies can be turned off by setting the options on Personal Information under Internet Options under the Tools menu.
   2. 2. You may experience difficulties using content if you turn these cookies off.
4. ④ The purpose for cookies and information collected are as follows:
   1. 1. Purpose for use of cookies: Cookies are meant to gather information on user visits to and use of different services and websites, content they use, etc. forstatistical analysis and optimizing the information provided to users.
   2. 2. Information collected by cookies: information about service use including access IP, content used, and visit history.

8. Privacy officer and request to access personal information

1. ① The NFMK designates a privacy officer to oversee and take responsibility for all tasks with regard to personal information processing and handle complaintsfrom and remedy any damages suffered by owners of personal information during such processing.
2. ② Owners of personal information may file a request with the following division to access personal information pursuant to Article 35 of the Personal Information Protection Act. The NFMK will endeavor to promptly handle such requests.

   개인정보 보호책임자 및 개인정보 열람청구 표 - 구분, 부서, 이름, 연락처로 구성됨

   Position	Division	Name	Contact
   Privacy officer in charge of protecting personal information	Planning & Management Division	Manager Moon-soo Park	ㅇPhone Number +82-2-3704-3027 ㅇE-mail : folkweb@korea.kr ㅇFax : +82-2-3704-3049
   Staff in charge of protecting personal information	Planning & Management Division	Seung-yeon Park

3. ④ Owners of personal information may communicate with the privacy officer and the responsible division regarding questions, complaints or remedies regarding personal information arising from using the NFMK’s services (or businesses). The NFMK will answer and process such inquiries from owners of personal information without delay.

9. Criteria for determining additional use and provision of personal information

1. ① The NFMK may additionally use and provide personal information without consent from the owners of personal information in consideration of matter sunder Article 14-2 of the Enforcement Decree of the Personal Information Protection Act pursuant to Article 15, Paragraph 3 and Article 17, Paragraph 4 of said Act.
2. ② The criteria for the NFMK to determine to do so without such consent are as follows:
   1. 1. It is relevant to the purpose for initial collection;
   2. 2. It could have been predicted considering the circumstances where personal information was collected or as a part of customary processing;
   3. 3. Whether it unduly damages the interests of the owners of personal information;
   4. 4. Whether necessary measures for security are taken such as use of aliases or encryption.

10. Remedy for infringement of rights and interests

1. ① If damages occur to an individual owner of personal information from a breach of personal information, that individual can request consultation, disputeresolution, etc. with such parties as the Personal Information Dispute Mediation Committee, and the Korea Internet & Security Agency’s Personal Information Infringement Report Center. The following agencies can also be contacted to report or seek consultation on personal information infringement:
   ☞ Personal Information Dispute Mediation Committee : (hotline) 1833-6972 (www.kopico.go.kr)
   ☞ Personal Information Infringement Report Center : (hotline) 118 (privacy.kisa.or.kr)
   ☞ Supreme Prosecutor's office : (hotline) 1301 (www.spo.go.kr)
   ☞ Korean National Police Agency : (hotline) 182 (ecrm.cyber.go.kr)
   ※ The above agencies are independent of the NFMK. If you are not satisfied with the outcomes of personal information complaints and damages handled by the NFMK or need more specific assistance, please direct your inquiries to them.
2. ② Regarding requirements under the regulations of Article 35 (Access to Personal Information), Article 36 (Rectification or Erasure of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, an administrative appeal may be filed against adisposition or omission by the head of a public institution when such disposition or omission infringes on the rights or interests of an entity as dictated by the Administrative Appeals Act.
   ☞ Central Administrative Appeals Commission Corporation. : (hotline) 110 (www.simpan.go.kr)

11. Revision of the privacy policy