Baron Consultant (“the Company”) has established this Privacy Policy to protect the personal information of customers (“Users”) who use the TOVA service (“Service”), and to fulfill its responsibilities and obligations under the Personal Information Protection Act. This policy explains how the personal information provided by users is collected, used, stored, and protected.

The company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those listed below; if the purpose is changed, the company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
- Identity verification: Verification for membership registration and management; contact via phone or email
- Service provision: Handling tasks for notifications and service delivery
- Product brochure download: Delivering explanatory materials
- Consultation and demo requests: Providing consultation and demos, collecting contract-related information
- Event participation: Guidance on attendance and providing seminars/explanations/educational sessions
- Provision of security cards: Delivering informational materials
- Technical support inquiries: Supporting service use
- Collecting service improvement feedback: Improving service quality
- Marketing activities: Sending newsletters and magazines to the same customer

① The company processes and retains personal information within the period prescribed by law or within the retention/use period agreed upon by the data subject at the time of collection.
② The retention periods for each category of personal information are as follows:
- Member information: From the date of registration until one year after membership withdrawal
- Personal information for marketing, consultation, and contract purposes: 2 years

① The company processes personal information only within the scope specified in Article 2, and provides personal information to third parties only with the data subject’s consent or when permitted under the Personal Information Protection Act Articles 17 and 18, such as in cases of legal requirements.
② The company provides personal information to third parties as follows:
- Recipients: Investigative agencies and related institutions, reported companies
- Purpose of use: Handling complaints related to personal information infringement
- Personal information provided: Name, contact information, email
- Retention and use period: Retained for the legally required period and destroyed once the purpose is fulfilled

① The company does not outsource personal information processing to external parties and handles it internally.
② If the company outsources specific tasks (e.g., recruitment), it will announce it on the company website before implementation and obtain consent from the data subject.

① Data subjects may request access, correction, deletion, or suspension of processing of their personal information at any time.
② Rights may be exercised in the following ways:
- Written submission
- Email request
- Fax request
③ Rights may also be exercised through a legal representative or delegated person. In such cases, a power of attorney must be submitted in the format prescribed in Annex 11 of the “Personal Information Processing Method Notice.
④ Requests for access or suspension may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act.
⑤ Requests for correction or deletion may be restricted if the information was collected under other laws.
⑥ The company verifies whether the requester is the data subject or a legitimate representative.

The company processes the following personal information:
- 수집 항목:
- Required items: Name, mobile phone number, email
- Optional items: Company phone number, inquiry details
- Collection methods:
- Website, phone, and email

① Personal information is erased without delay when the retention period expires or the processing purpose is achieved.
② If the information must be retained under other laws despite expiration, it will be stored in a separate database.
③ Destruction procedure and methods:
- Procedure: Select personal information to destroy and obtain approval from the protection officer.
- Method: Electronic files are deleted irreversibly; paper documents are shredded or incinerated.

The company does not use cookies.

The company appoints a Personal Information Protection Officer who is responsible for overseeing all activities related to personal information processing, handling complaints, and providing remedies for data subjects.
Personal Information Protection Officer:
- Name: Park Jin
- Position: Senior Researcher
- Phone: +82-2-2141-7485
- Fax: +82-2-2141-7599
- Email: jpark@baroncs.co.kr

Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The company will make every effort to ensure that access requests are processed promptly.
Department Responsible for Access Requests:
- Department: Management Planning Office
- Contact Person: Kwon Hyuk-jin
- Phone: +82-2-2141-7465
- Fax: +82-2-2141-7599
- Email: baroncs@baroncs.co.kr

In order to relieve personal information infringement, the data subject can apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee and the Korea Internet & Security Agency's Personal Information Infringement Reporting Center.
- Personal Information Dispute Mediation Committee: (without national code) 1833-6972 (www.kopico.go.kr )
- Personal Information Infringement Reporting Center: (without country code) 118 (privacy.kisa.or.kr )
- Supreme Prosecutors' Office: (without country code) 1301 (www.spo.go.kr )
- National Police Agency: 182 (www.police.go.kr )

This Privacy Policy shall be notified in advance on its website at least seven days prior to its revision when there is any addition, deletion or modification of the contents in accordance with changes in laws, policies or security technologies.

1. This privacy policy becomes take effect on October 1, 2024.

2. If the company updates its personal information processing policy, it will notify the change through the notice page in the service seven days before the effective date. However, if there is a significant change in the rights or obligations of the user, it will be notified 30 days before the effective date.

3. If some of the provisions of this Privacy Policy are invalidated or unenforceable due to legal or other reasons, the remaining provisions shall remain in force. The invalidated provisions shall be amended in such a manner as conforming to relevant laws and regulations to remain in effect.

4. In the event of a change in the personal information processing policy, the company will notify the user in the following ways:
- Service Initial Screen or Pop-up Announcement
- Send an e-mail
- Announcement on the company's website

5. The company also protects the personal information of non-members at the same level as members. If non-members refuse to provide personal information, there may be restrictions on the use of some services.

6. The company does not collect the personal information of children under the age of 14. If the personal information of children under the age of 14 is collected, it must be agreed upon by a legal representative, and if it is collected without the consent of the legal representative, it shall be destroyed without delay.

7. The company does not transfer the user's personal information abroad, and if necessary in the future, the user's consent is obtained in advance.

8. Any matters not specified in this policy are subject to the Company's internal policy and relevant laws and regulations.