Privacy Policy

Effective October 25, 2026 · Version 1.2 · Previous version 1.0 (Korean)

This Policy covers the website (ksair.org), the member service (members.ksair.org · ksair-members.pages.dev) and the membership administration screen used by officers (ksair-admin.pages.dev). KSAIR processes only the minimum personal information it needs and does not collect resident registration numbers, dates of birth, addresses, telephone numbers, or license numbers. Dues are accepted only by transfer to the Society’s bank account, so no card or simple-payment information is processed.

1. Purposes of Processing

Personal information is processed to receive and check membership applications and notify the outcome; to manage the member register, membership categories and eligibility, run General Meetings and Board of Directors meetings and contact members; to bill and confirm dues, issue certificates of dues payment, and settle and audit the accounts; to let members view their own information and dues history and to handle requests to exercise their rights; to send news of academic events and the Society to those who opted in; to answer inquiries; and to provide the website and member service, control and log access to the administration screen, and block security threats.

2. Personal Information Processed and Retention Periods

(a) Information Processed with Consent — Member Service

Membership applications are accepted only online, using a Google account. The application screen asks for each consent separately (Article 15 (1) 1 of the Personal Information Protection Act): collection and use of personal information, cross-border transfer, confirmation that you are 14 or older, agreement with KSAIR’s purposes and undertakings, and confirmation that you have no record of expulsion or suspension of membership are required, and receiving Society news is optional.

(b) Information Processed without Consent, and Its Legal Basis

As Article 22 (3) of the Personal Information Protection Act requires, this information is listed separately with its legal basis.

Officers designated as administrators are notified of this processing separately in writing.

(c) Website Visits and Email Inquiries

3. Children under 14

KSAIR does not accept applications from children under 14; if an applicant is found to be under 14, the application is canceled and the information is destroyed without delay.

4. Destruction

Information is destroyed without delay when its retention period ends or its purpose is achieved (Article 21 of the Personal Information Protection Act), as a rule within 5 days from the date the reason for destruction arises (Article 10 (1) of the Standard Personal Information Protection Guidelines (표준 개인정보 보호지침), a PIPC notice). In the member database a member’s name, affiliation, position and email address are overwritten and the login, consent and session data deleted, leaving only the membership number so that it is never reused; the records in Section 2 (b) remain for the periods stated there. The database (Cloudflare D1) has a restore function that is always on and cannot be turned off, and KSAIR can restore it for up to 7 days; KSAIR does not restore it to a point before a destruction, and if a restore is unavoidable, the destruction is applied again and recorded. The member register is not separately backed up or downloaded, paper documents are shredded, and destruction is recorded and checked by the privacy officer.

5. Provision to Third Parties

KSAIR does not provide personal information to third parties and does not disclose or provide the member register to others, except where a law specifically provides otherwise or an investigative agency requests it under the procedures and methods prescribed by law.

6. Entrustment of Processing

If a person entrusted or a task changes, this table is updated without delay.

7. Cross-Border Transfer

Basis — members’ and applicants’ information: separate consent to cross-border transfer on the application screen (Article 28-8 (1) 1 of the Personal Information Protection Act) · website access logs and email inquiries: Article 28-8 (1) 3 (a) (disclosure in this Policy) · administrators’ information: Article 28-8 (1) 3 (b) (written notice to the administrators).

8. Rights of Data Subjects and How to Exercise Them

• On My Page (마이페이지) members can at any time view their information, dues history and consents, update their affiliation and position, withdraw consent to Society news, and withdraw from membership (withdrawing a required consent counts as withdrawal and takes effect immediately).
• By request — correction of your name, or access, correction, erasure or suspension of processing — through the member pages, privacy@ksair.org or post to the Society’s office: KSAIR acts and tells you the result within 10 days of receipt, and handles withdrawal of consent without delay. Identity is confirmed by logging in with the Google account you joined with or by a reply from the email address on file, and no documents beyond those required at joining are requested; requests may also be made through a representative (with a power of attorney), and no fee is charged. The information in Section 2 (b) rests on legal obligations or legitimate interests, so a request to erase it or suspend its processing may not be granted; you will then be told why.
• Objections can be sent to privacy@ksair.org without a time limit and are reviewed again by the privacy officer. Anyone who paid dues on a member’s behalf will, on request, be told immediately the source of the information, the purpose of processing, and their right to request suspension of processing or withdraw consent (Article 20 (1) of the Personal Information Protection Act).

9. Automated Decisions

KSAIR does not make decisions that affect data subjects’ rights, such as approving admission, by a system alone without human review.

10. Cookies and Other Automatic Collection Tools

• The website (ksair.org) does not use cookies. The website and member service use no analytics tools, ad trackers, or external scripts.
• Member service, only for people who log in: __Host-ksair_tx (login in progress, 10 minutes) · __Host-ksair_pre (filling in the application, 30 minutes) · __Host-ksair_sid (staying logged in; ends after 2 hours without use · 12 hours at most).
• Administration screen, only for administrators: __Host-ksair_atx (login in progress, 10 minutes) · __Host-ksair_oidc (step before passkey verification, 5 minutes) · __Host-ksair_adm (staying logged in; ends after 30 minutes without use · 8 hours at most).
• Cookie contents are encrypted or random and can be read only at that address; browser storage (such as local storage) is not used, and the cookies are deleted when you log out or withdraw. You can refuse cookies in your browser settings, but then you cannot use screens that require logging in.

11. Security Measures

KSAIR applies eight security measures, including an internal management plan checked every year by the privacy officer; trained administrators designated from among the Directors, with minimum privileges and one account each; two-step authentication (Google login and a passkey) for the administration screen, which disconnects after 30 minutes without use or after 8 hours; no stored passwords and HTTPS for all transmission; access logs kept for 2 years and privilege records for 3 years, checked every month; no download or export of the member register; and separate databases for member information and administration records.

12. Notification of Divulgence, etc.

If KSAIR learns that personal information has been lost, stolen or leaked (“divulgence, etc.”), it notifies the people concerned within 72 hours, in writing, by email or by similar means, of the items involved, when and how it happened, how to reduce harm, KSAIR’s response and remedy procedures, whom to contact, and their rights, such as compensation and dispute mediation, and how to exercise them. It also notifies within 72 hours when a divulgence, etc. may have occurred, and tells them if it is confirmed that nothing was actually divulged. If contact details are unknown, a notice is posted on the website for at least 30 days, and where the law requires, KSAIR reports to the Personal Information Protection Commission or the Korea Internet & Security Agency.

13. Privacy Officer

KSAIR designates a privacy officer under Article 31 of the Personal Information Protection Act. Privacy matters, related complaints, and requests for access are handled by the department below (Article 30 (1) 6 of the Act).

14. Remedies for Infringement

For advice on an infringement of personal information, you may contact the following bodies.

• Personal Information Infringement Report Center — 118 (no area code) · privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee — 1833-6972 · kopico.go.kr
• Supreme Prosecutors’ Office Cyber Investigation Division — 1301
• Korean National Police Agency Cyber Investigation Bureau — 182

15. Changes to This Policy

Changes and their effective date are posted on the Privacy Policy page and in Notices from 7 days before they take effect (from 30 days before if they are unfavorable to users), and the previous version stays available on the Privacy Policy page (in Korean). Version 1.1, however, takes effect on the date it is posted, because it adds the processing for the newly opened member service without changing the items or retention periods that version 1.0 set for website visits and email inquiries; a table comparing the two versions is in the Privacy Policy (Korean). Version 1.2 likewise takes effect on the date it is posted: it only replaces the privacy officer's name with the department in charge and its contact details and removes the representative's name from the controller line, without changing any purpose, item or retention period, so the text of version 1.1 is not kept separately.

The full text of the previous version (version 1.0, effective September 29, 2026) is available in Korean only: Privacy Policy version 1.0 (Korean).