Samsung SDS (hereinafter referred to as “the Company”) is committed to protecting personal information of the users and to complying with applicable privacy laws and regulations.
This Privacy Policy describes ways the Company collects and uses personal information from its users (“users” or “you”). It also outlines additional measures that are taken to protect the personal information of the users. Any changes to the Privacy Policy will be informed via Notices on the Company’s website (or individual notices).
The Company Privacy Policy contains the following sections:
1. Categories of Personal Information Collection
2. Purpose(s) of Personal Information Collection and Usage
3. Entrustment of the processing of personal information
4. TRANSFER OF COLLECTED PERSONAL INFORMATION TO OTHER COUNTRIES
5. Retention Period of Collected Personal Information
6. Disposal Procedures and Measures of Personal Information
7. Measures to Ensure Security of Personal Information
8. Rights of Users and Their Legal Representatives and Measures to Exercise the Rights
9. Cookies or Similar Technologies
10. Chief Privacy Officer and Responsible Department
11. Duty to Notify
This policy will take effect on 4 August, 2024, as updated from time to time.
1. Categories of Personal Information Collection
In connection with the service, the Company collects and processes the following types of personal information.
(1) Membership management
- Required information: SVPN ID, company, division, name, password, e-mail address (Knox), e-mail address (Personal), and service initiation/termination date.
- Optional information: Phone number, mobile phone number, e-mail address (Personal 2nd), and Knox ID
(2) Provision of SVPN Services
- Required information: SVPN ID, password, e-mail address (Knox), e-mail address (Personal), and service initiation/termination date.
- Optional information: Mobile phone number, e-mail address (Personal 2nd), and Knox ID
(3) Information about your use of the services
The following information may be generated and collected in the process of using services or business processing:
- Service use history, access logs, cookies, access IP information, and suspension history
※ No Collection of Sensitive Information
- The Company will not collect “sensitive information”, including but not limited to, racial or ethnic origin opinions, political opinions, religious or philosophical beliefs, trade-union membership, precise geolocation, genetic and biometric data processed solely to identify a human being, a person’s sex life or sexual orientation.
※ No Collection of Personal Information from Children
The Company will not knowingly collect any personal information from children under the age of 16.
※ No Sale of Personal Information
The company does not sell any personal information of user.
※ No Collection of Behavioral Information
The Company will not collect, use, or provide behavioral information for online customized advertisements.
2. Purpose(s) of Personal Information Collection and Usage
The Company collects only minimum range of personal information upon the consent of customer and processes the personal information in accordance with the purpose of the collection and as necessary to provide the service.
The Company uses collected personal information for the following purposes:
(1) Membership management
Identify verification for using membership services; personal identification; prevention of delinquent members’ inappropriate/unauthorized usage; confirmation of intent to register; restriction of registration and number of registration; retention of records for conflict resolution; claim processing including complaints; and notification delivery
(2) Provision of SVPN Services
The Company processes personal information for the purpose of providing SVPN services, which provide a secure and reliable connection between remote users and the company's internal network.
[For European Economic Area (EEA) Residents Only]
The Company processes personal information for the purposes described above. The Company’s legal basis for processing personal information includes processing:
？ To provide the services, the Company needs to process personal information about you as necessary to enter into or perform a contract with you.
？ To further our business interests (legitimate interest) such as managing our relationship with you, improving your customer service experience.
？ To comply with applicable laws and regulations.
？ With your consent. When the Company asks for your consent, the Company will tell you how the personal information will be used, and how you can revoke your consent.
3. Entrustment of the processing of personal information
In principle, the Company does not disclose any of the personal information it collects.
However, the Company will share your personal information with the following entities, only to the extent that this will be necessary to provide the Company’s services..
- Recipients of personal information: Hyosung ITX Co., Ltd.
- Country: Republic of Korea
- Sharing date: When you using the service
- Sharing method: Grant system access rights only
- Purpose of sharing: Operation of customer center and customer consultation, providing service access information, receiving service requests/inquiries/complaints and taking action.
- Types of personal information we shared
？ Required information: SVPN ID, company, division, name, password, e-mail address (Knox), e-mail address (Personal), and service initiation/termination date.
？ Optional information: Mobile phone number, e-mail address(Personal 2nd), and Knox ID
- Period of possession and use: The date of termination of the consignment contract.
In accordance with Article 26 of the Korean Personal Information Protection Act when signing a consignment contract, the Company specifies responsibilities such as prohibition of personal information processing, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of trustees, and damages in documents such as contracts, and supervises whether trustees handle personal information safely.
If the contents of the consignment work or the trustee is changed, we will disclose it through this personal information processing policy without delay.
Overseas outsourcing of personal information is described in "4. TRANSFER OF COLLECTED PERSONAL INFORMATION TO OTHER COUNTRIES ".
4. TRANSFER OF COLLECTED PERSONAL INFORMATION TO OTHER COUNTRIES
(1) Data Center
This service is primarily hosted and operated in the Republic of Korea
- Data Center: Samsung SDS Suwon IT Center
- Address: 410-1 Maetan-dong, Youngtong-gu, Suwon, Gyeonggi-do, Republic of Korea
(2) Samsung SDS Vietnam
The Company will transfer your personal information to third parties outside the country as follows: and can process personal information of employees located outside of the country where users reside.
- Legal basis for transfer: Your consent, performance of a contract, and Article 28 (8) (1) (3) of the Korean Personal Information Protection Act (offshore processing and storage for contract fulfillment)
- Recipients of personal information: Samsung SDS Vietnam CO., LTD (84-243-279-7123, ct.anh1@samsung.com)
- Transferred country: Vietnam
- Date of transfer: When you are using the service
- Transfer method: Network transmission to remote locations, and transfer via email
- Purpose of transfer: System operation and maintenance
- Types of personal information we transfer
？ Required items: SVPN ID, company, division, name, password, e-mail address (Knox), e-mail address (Personal), and service initiation/termination date.
？ Optional items: Mobile phone number, e-mail address(Personal 2nd), and Knox ID
- Period of retention and use of personal information: Until the end of the data processing agreement
- How to refuse the transfer of personal information, procedures and effects of refusal: If you object to the sharing, please contact us. (+82-1661-3311) If you choose to opt-out (Menu-Personal Information) you will not be able to use the service.
[For European Economic Area (EEA) Residents Only]
The Company will take appropriate measures, in accordance with applicable law, to ensure that your personal information remains protected. Such measures include the use of Standard Contractual Clauses to protect the transfer of data outside of the EEA or the UK. To request more information or to obtain a copy of the agreements in place, please contact us (see “10. Chief Privacy Officer and Responsible Department”).
5. Retention Period of Collected Personal Information
The Company disposes of personal information after fulfilling the original purposes of collecting and using the information without delay.
The processing and retention periods for each category of personal information is as follows.
1) Membership management: One (1) year after termination of service
2) Provision of SVPN services: Until the completion of the services, payment and billing of fees
6. Disposal Procedures and Measures of Personal Information
Personal information is disposed without delay after the original purposes of collecting and using the information are fulfilled.
However, the following information will be retained for the specified period for the following reason
(1) Disposal procedures
The information that the members provide for membership registration and other reasons will be retained for a certain period of time after the original purposes are fulfilled and disposed in accordance with the internal guidelines and other related legislation for information protection purposes (see #5. Retention Period of Collected Personal Information).
The above-mentioned personal information will not be used for any purposes other than the purpose of retention except as required by law.
(2) Disposal methods
Personal information printed on paper will be disposed by a paper shredder or an incinerator. Personal information in electronic files are deleted by a technical method that prohibits regeneration of the record.
7. Measures to Ensure Security of Personal Information
The Company pursues the following technical/managerial measures in order to ensure security in processing personal information of the users to prevent any loss, theft, leakage, tampering or damage of personal information
(1) Establishment and execution of internal management plan
The Company establishes and executes an internal management plan for personal information protection.
(2) Minimizing number of persons who handle personal information and training
The Company appoints the minimum number of persons who handle personal information and implements measures to manage personal information more efficiently.
(3) Restrictions on access to personal information
The Company takes the necessary steps to monitor access to personal information by granting, changing and removing access to the database systems in which personal information is processed. The Company also deploys and uses an intrusion prevention system to control unauthorized external access.
(4) Access record storage and tempering prevention
The Company retains access records of the personal information processing system (e.g. web logs, summary data, etc.) for at least six (6) months, and enables security functions to prevent tampering, theft and loss of the access records.
(5) Personal information encryption
Personal information of the users is encrypted to be saved and managed. Additional security functions are used for important data, including encryption when saving/sending.
(7) Technical measures against hacking
In order to prevent any leakage of or damage to personal information caused by hacking or computer viruses, the Company has installed security software with regular updates and monitoring, as well as a system in access-controlled areas for technical/physical monitoring and blocking. The Company also provides network traffic monitoring and detection of any attempts to illegally change the information.
(8) Entrance control for unauthorized persons
The Company has established and is in operation of entrance control procedures for the physical retention place of the personal information system.
8. Rights of Users and Their Legal Representatives and Measures to Exercise the Rights
Users are, subject to the applicable laws, entitled to the following:
The rights to access rectification/correction - Users and their legal representatives are entitled to viewing or revising their personal information and requesting unsubscription at any time.
Users may view or revise their personal information or unsubscribe membership after identity verification procedures under ‘Revise Personal Information’ (or ‘Revise Member Information’) to view/revise personal information or ‘Unsubscribe’ to unsubscribe membership (withdrawal of consent).
Users may also contact the Chief Privacy Officer via written document, phone or e-mail for the process.
If users request for a correction on the error of their personal information, that personal information will not be used or provided until the correction is completed.
The right to erasure/delete - Personal information that have been cancelled or deleted upon the request of the users or their legal representatives will be processed pursuant to the “Retention Period of Collected Personal Information.
” This information may not be accessed or used for any other purposes."
The right to restrict/object to processing - right to request that the Company restricts the processing of user’s personal data, under certain conditions.
The right to data portability - the right to request that the Company transfers the data that we have collected to another organization, or directly to the user, under certain conditions
[For California Residents Only]
In addition to the user rights above, California residents may exercise the following additional rights:
The right to “Opt-out” of “Sale”. - The Company does not sell user’s personal information, so we do not offer an opt-out.
The right to limit use and disclosure of sensitive personal information. - The Company does not collect user’s sensitive personal information.
The right to non-discrimination - the Company will not hold it against user for exercising any of the rights above.
How to Submit a Request: You can download the request form here.
When you exercise these rights and submit a request to the Company, the Company will verify your identity by asking you to authenticate your identity via standard authentication procedures. For example, the Company may ask for your email address, your name or zip code. The Company also may use a third-party verification provider to verify your identity.
The Company generally does not use automated decision-making technology, as that term is defined by applicable privacy laws. If the Company makes use of automated decision-making technology, you will be informed through a separate privacy notice.
The Company considers the World Wide Web Consortium’s Web Content Accessibility Guidelines (WCAG) 2.1 to uphold WCAG’s recommended level of conformance. With this guidance in mind, the Company will:
？ Design site templates with an emphasis on color contrast, logical heading order, and configurable repeated elements.
？ Code the templates to ensure pages are usable with keyboard commands;
？ Ensure that all non-textual elements have a text equivalent (such as “alt text” for images)
9. Cookies or Similar Technologies
The Company will install and operate a device that automatically collects personal information, including cookies that constantly find and save user information. Cookies are text files that the Company’s website servers send to users’ browsers and are saved on users’ hard drive.
The Company uses cookies for the following purposes to provide SVPN service :
(1) Strictly necessary
- Session ID, Secondary Authentication, Security program installation status, Service connection status
(2) Performance cookies
- Usage language (Korean, English), Access area selection, Login ID storage, Service Desk information
You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser except the strictly necessary cookie. However, in a few cases, part of the Company’s website features cannot function as a result.
[How to accept/block cookies]
？ Accepting/blocking cookies in your web browser
- Chrome: Web browser settings > Privacy and security > Clear browsing data
- Edge: Web browser settings > Cookies and site permissions > Manage and delete cookies and site data
？ Allow/block cookies on mobile browsers
- Chrome: Mobile browser settings > Privacy and security > Clear Browsing data
Choose the items you want to clear
- Safari: Mobile device settings > Safari > Privacy & Security > Block all cookies
- Samsung Internet: Mobile browser settings > Browsing data > Clear browsing data
10. Chief Privacy Officer and Responsible Department
The Company has designated a Chief Privacy Officer and a responsible department to protect personal information and handle related complaints as follows:
(1) Chief Privacy Officer
Chief Privacy Officer: Legal service team leader
Phone number: +82-2-6155-1118
E-mail address: privacy.sds@samsung.com
※ Connect to the personal information protection department.
(2) Responsible Department
Department : Cloud Network SRE Group
Phone number : +82-70-7010-3000
E-mail address: svpn@samsung.com
※ Connect to the SVPN Service desk.
Users may report all personal information related claims that may arise in the process of using the Company’s services to Chief Privacy Officer or the responsible department. The Company will promptly provide proper responses to the claims.
For reporting or consultation on other personal information violations, please contact the following institutions:
- Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: +82-118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: +82-1301 (www.spo.go.kr)
- National Police Agency: +82-182 (ecrm.cyber.go.kr)
- Contact details for all EU and EEA supervisory authorities can be found at https://edpb.europa.eu/about-edpb/board/members_en.
11. Duty to Notify
If the Company makes any additions, deletions, or changes to this Privacy Policy, it will notify via Notices on the website and least seven (7) days prior to such changes.
Previous Privacy Policy can be found at the top of the screen.
Date of public announcement: August 4, 2024
Date of implementation: August 4, 2024
Notify Date : 4 August, 2024.
Effective Date : 4 August, 2024.