This English version is provided for reference only. The Korean version is the legally binding text and prevails if the two differ.
Effective date: 5 Nov 2026 (amended)
Nanum Consulting (the “Company”) complies with the Personal Information Protection Act and other applicable laws. We publish this Privacy Policy to protect your personal information and to resolve related complaints promptly.
Article 1 (Purposes of Processing Personal Information)
The company processes personal information for the following purposes only. If the purpose of use changes, the company will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.
① Website member registration and management
Confirming intent to sign up; identifying and authenticating users; maintaining and managing membership; preventing misuse of the service; confirming legal guardian consent for children under age 14; sending notices and announcements; handling complaints; and similar purposes
② Providing goods or services
Providing courses and content, sending contracts and invoices, providing customized services, identity and age verification, payment and settlement, debt collection, etc.
③ Handling complaints
Verifying the complainant’s identity, confirming and investigating the complaint, and notifying the result
④ Use in marketing and advertising (with consent to receive)
Announcements of new services and courses, events, and promotional information. Receiving marketing information is optional, and declining does not limit your use of the services. You may withdraw your consent at any time.
⑤ Improving training quality (surveys)
We survey participants about the training and courses they attended, and analyze the responses to improve training content and operations. Surveys are completed after member login, and responses are stored together with member information to prevent duplicate submissions. Responses are used only to improve training quality.
⑥ Responding to training consultations and quote inquiries
We process your information to respond to your inquiry and follow up, including preparing training quotes, advising on training programs, and sending AI readiness diagnosis result reports. Non-members may also submit inquiries, quote requests, and diagnosis requests.
⑦ Linking visit records with inquiries and emails (for consultation preparation and measuring email effectiveness)
If you visit the website by logging in as a member, submitting an inquiry, quote, or diagnosis request, or clicking a link in an email sent by the Company (newsletter, announcement, or proposal email), the visit records from the same browser (this page, conditions chosen in the quote calculator, names of downloaded materials) are linked to that data subject and used to prepare consultations, measure email effectiveness, and propose customized training. Links in emails sent by the Company carry a value that identifies the recipient, which is encrypted, so your email address is never shown as-is in the address bar. If an email is forwarded to someone else, that visit may be recorded as the original recipient’s.
To serve corporate clients, we analyze visit activity (company name, main topic of interest, and number of visits) at the level of the company or organization estimated from network connection information, and we combine it with the same information from Gangsanews (gangsanews.co.kr) and Gangsaro (gangsaro.com), which the Company also operates. We do not use network information alone to identify any individual.
Article 2 (Processing and Retention Period of Personal Information)
The Company processes and retains personal information within the retention and use period required by law or the period for which the data subject has given consent.
| Category | Retention period |
|---|---|
| Website member registration and management | Until 5 days after membership withdrawal (if an investigation is ongoing or claims and obligations remain outstanding, until closure or settlement is completed) |
| Posts, comments, and course questions written by members | Upon account closure, the author name is changed to “Withdrawn member” and member-identifying information is deleted, while the post itself is kept (to preserve context for other users; the retained content cannot identify an individual) |
| Providing goods or services | Until the service is delivered and payment is settled |
| Receiving marketing information (with consent) | Until consent is withdrawn or the member account is closed (upon closure, the member is removed from mailing lists and added to the opt-out list) |
| Survey responses (to improve training quality) | Until the member withdraws (destroyed together with survey responses upon withdrawal) |
| Training consultations and quote inquiries | Until consent is withdrawn or deletion is requested (destroyed without delay upon request) |
| Partner instructor schedule reporting and settlement (/coop) | Until settlement and tax processing are complete |
| Labeling and advertising records (E-Commerce Act) | 6 months |
| Records of contracts, payments, and supply of goods (Act on the Consumer Protection in Electronic Commerce) | 5 years |
| Records of consumer complaints and dispute resolution (Act on Consumer Protection in Electronic Commerce) | 3 years |
| Communication confirmation data (Protection of Communications Secrets Act) | 1 year |
| Internet log records and access location tracking data (Protection of Communications Secrets Act) | 3 months |
| Visit and usage records (our own web logs — access date and time, addresses and order of pages visited, referral source, device and browser information, per-browser visitor identifier, access region and network and the company or organization name inferred from them, options selected in tools such as the quote calculator (selected items only — free-text fields are not collected), names of downloaded materials. When logged in: member account and name) | Retained for visit and usage statistics analysis and service improvement. Monthly summary statistics are generated, and after 12 months the original records are moved to separate storage with restricted access. When a member withdraws, the link to the member account and name is severed so that the individual can no longer be identified. (Raw IP addresses are not stored.) |
| Visit records and the link between those records and you (when you log in, submit an inquiry, quote, or diagnosis request, or visit through a link in an email or proposal sent by the Company: your name, email, and company name matched to your visitor identifier) | Until the end of the retention period of the linked member and inquiry information. If you request suspension of processing or deletion, the link is destroyed without delay, and it is also destroyed when you withdraw your membership. |
| Security alert logs (IP address, member identifier, and detection details recorded when misuse is suspected) | 1 year |
Article 3 (Outsourced Processing of Personal Information)
To provide our services smoothly, the company outsources the processing of personal information as follows. When concluding outsourcing contracts, the company specifies safeguards under Article 26 of the Personal Information Protection Act and supervises whether processors handle personal information securely.
| Processor | Outsourced tasks |
|---|---|
| Google (Firebase) | Member authentication and data storage (cloud infrastructure); blocking automated access (App Check, reCAPTCHA) |
| Toss Payments Co., Ltd. | Payment processing and prevention of payment fraud |
| Cloudflare | Lecture video streaming |
| Google (Google Analytics) | Analysis of website visits and usage statistics |
| NAVER Corp. | Measuring ad performance (conversions) |
| Channel Corporation Inc. (Channel Talk) | Operating the live customer support (chat) service |
| Brevo (Sendinblue SAS) | Sending informational and marketing emails |
| Solapi | Sending notification texts (SMS) and KakaoTalk notifications |
| Google LLC (Gemini API) | Generating AI tool responses (processing user-entered prompts and attached files) |
| Anthropic PBC (Claude API) | Operational data analysis and report generation (admin feature) |
| Functional Software, Inc. (Sentry) | Collecting and diagnosing website errors (outages) |
| Google LLC (Google Contacts and Calendar) | Storing contact details for training consultations and inquiries; managing training schedules |
| IPinfo(IPinfo Inc.) · ipapi.co | Estimating visitor region and affiliated organization from connecting IP address (for visit statistics analysis and responding to corporate clients) |
If the outsourced tasks or the processors change, we will disclose the change through this policy.
Article 3-2 (Transfer of Personal Information Abroad)
To provide the service smoothly, the Company transfers personal information abroad (outsourced processing and storage) as described below. Under Article 28-8 of the Personal Information Protection Act, data subjects may refuse the transfer abroad; if you refuse, some services may be restricted.
| Recipient | Destination country | Items transferred | Purpose of transfer | Retention and use period |
|---|---|---|---|---|
| Google LLC (Firebase) | United States | Email, authentication information, service usage records, device and browser signals (App Check, reCAPTCHA) | Member authentication and data storage (cloud infrastructure) | Until the member withdraws or the outsourcing contract ends |
| Cloudflare, Inc. | United States | IP address, access and usage records | Lecture video streaming (CDN) | Until the outsourcing contract ends |
| Google LLC (Google Analytics) | United States | Cookies and device identifiers, visit and usage records | Website visit statistics analysis | Up to 14 months from the date of collection |
| Brevo (Sendinblue SAS) | France | Email address, name | Sending informational and marketing emails | Until the outsourcing contract ends |
| IPinfo(IPinfo Inc.) · ipapi.co | United States | IP address (sent only at the time of viewing) | Estimating visitor region and organization (for visit analytics) | Not retained: discarded immediately after lookup. The original IP address is not stored (only the estimated region and organization name are kept) |
| Google LLC (Gemini API) | United States | Prompts and attached images or documents that users enter into AI tools | Generating responses from AI tools | Not stored — we do not retain it and discard it as soon as the response is generated; under Google's paid API policy, inputs are not used to train models |
| Anthropic PBC (Claude API) | United States | Operational data subject to analysis, such as visit and usage records | Operations analytics and report generation | Not stored — discarded immediately after analysis; not used for model training |
| Functional Software, Inc. (Sentry) | United States | IP address, accessed URL, browser and device information, error messages and where they occurred, and a record of actions just before the error (clicks, page navigation) | Website error diagnosis | 90 days from the date of occurrence |
| Google LLC (Google Contacts and Calendar) | United States | Name, email, phone number, company name, inquiry details | Storing contact details for training consultations and inquiries; managing training schedules | Until consent is withdrawn or deletion is requested |
Date and method of transfer: sent over the network as needed whenever you use the service.
Article 4 (Rights and Obligations of Data Subjects and How to Exercise Them)
- Data subjects may exercise their rights to access, correct, delete, or suspend the processing of their personal information at any time.
- You may exercise these rights in writing, by phone, or by email, and the Company will act on them without delay.
- If a data subject requests correction or deletion, the personal information concerned will not be used or provided until the request is completed.
- Rights may also be exercised through a representative, in which case a power of attorney must be submitted.
- The rights of children under 14 are exercised through their legal guardians.
Article 5 (Personal Information We Process)
| Category | Feature |
|---|---|
| Member registration and management (required) | Name, user ID, password, email |
| Member sign-up and management (optional) | Mobile phone number |
| Member profile (optional, when entered on My page) | Affiliation (company or organization), job title, responsibilities |
| When signing up via social login (items received) | Email, profile information (nickname, etc.), social service identifier |
| Providing goods or services (required) | Name, email, payment information |
| Receiving marketing information (with consent) | Email, mobile phone number, consent to receive messages |
| Survey responses (members) | Name, email, survey responses |
| Training consultation and quote inquiries (including non-members) | Name, phone number, email, company name, inquiry details, quote conditions, diagnosis responses |
| Partner instructor schedule reporting and settlement (/coop) | Instructor name, identity verification code (4 digits), affiliation, email, training information (training date, client, intermediary, topic, hours, lecture fee, commission, notes), and client contact’s name, title, phone number, and email (optional) |
| Automatically collected items | IP address, cookies, per-browser visitor identifier, service usage records (pages visited, options selected in tools such as the quote calculator, names of downloaded materials), access logs, encrypted recipient identifier in links of emails we send, records of abusive use, etc. |
※ When you use social login (Naver, Kakao, Google, Facebook, GitHub), we receive the items above from the respective provider. The items provided are limited to the scope you consented to on each social service.
※ Personal information collected from sources other than the data subject: When a partner instructor reports a training schedule, the name, title, phone number and email of the client contact are collected from a third party (the partner instructor who delivered the training), not from the person concerned. The source of collection is that partner instructor, and the information is used only for confirming the training schedule, delivering course materials and notices, and settlement. It is not used for marketing or advertising and is not provided to any outside party. Under Article 20 of the Personal Information Protection Act, the data subject may request notice of the source of collection, the purpose of processing and the right to demand suspension of processing, and under Articles 35 to 37 may request access, correction, deletion or suspension of processing. Upon receiving a request, the Company will inform the data subject of the result within 24 hours.
Article 6 (Destruction of Personal Information)
- Destruction procedure: Personal information that is no longer needed is destroyed after approval by the Chief Privacy Officer.
- Destruction method: Electronic files are deleted using technical methods that prevent recovery; paper documents are shredded or incinerated.
- When you close your account: We destroy the account, course records, certificates, survey responses, 1:1 messages and activity records, and remove you from marketing mailing lists. Posts, comments and course questions you wrote are kept, with the author changed to “Withdrawn member” and all member-identifying information deleted. Visit and usage records are kept as statistics after we sever their link to the member account and name. Payment and contract records are kept for 5 years under the Act on Consumer Protection in Electronic Commerce.
Article 7 (Installation, Operation and Refusal of Automatic Data Collection Devices)
The Company uses cookies and similar automatic collection tools to provide personalized services and analyze visit and usage statistics. Cookies are small pieces of information stored in your web browser. As described below, you can review what they are used for and refuse to have them stored.
① Purpose of use: keeping you logged in, analyzing visit and usage statistics, measuring ad referrals and effectiveness, supporting live customer chat, etc.
② Automatic collection and analytics tools used by the Company
| Tool | Provider | Purpose | How to opt out |
|---|---|---|---|
| Google Analytics (GA4) | Google LLC | Analyzing visit and usage statistics | Block cookies in your browser or install the GA opt-out add-on |
| Naver conversion tracking (wcs) | NAVER Corp. | Measuring ad traffic and conversions | Block cookies in your browser / opt out of personalized ads in Naver ad settings |
| Channel Talk | Channel Corporation Inc. | Maintaining live customer support (chat) sessions | Block browser cookies (consultation features are limited if blocked) |
| In-house visit analytics (web logs) | Nanum Consulting | Analysis of visit and usage statistics, and responding to corporate clients — a visitor identifier is stored in your browser. If you log in as a member, submit an inquiry, quote, or diagnosis request, or visit through a link in an email or proposal sent by the company, the record is linked to that data subject (raw IP addresses are not stored). | Block browser cookies and site data, type the address directly instead of using links in emails, or request suspension of processing under Article 4 |
| reCAPTCHA (Firebase App Check) | Google LLC | Blocking automated access (bots): determining whether a visitor is human from device and browser signals | Block cookies in your browser (some features, such as login and inquiries, will be limited) |
| YouTube embedded player | Google LLC | Video playback on the home page and course list (loaded when the video appears on screen) | Block browser cookies (video playback will be limited if blocked) |
③ How to refuse cookie storage: You can choose whether to allow cookies in your web browser settings.
- Chrome: Settings > Privacy and security > Cookies and other site data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari: Settings > Privacy > Cookies and website data
- Firefox: Settings > Privacy & Security > Cookies and Site Data
※ If you refuse cookies, some services, such as staying logged in, may be limited.
Article 8 (Measures to Ensure the Security of Personal Information)
- Administrative measures: establishing and implementing an internal management plan; regular employee training
- Technical measures: access rights management, encryption of personal information, installation of security programs
- Physical measures: access control for server rooms and records storage rooms
Article 9 (Chief Privacy Officer)
Name: John Kim / Title: CEO
Contact: +82 10-2414-3329 · jazzmania74@gmail.com
▶ Privacy Department
Department: Operations Support Team / Contact person: John Kim
Contact: +82 10-2414-3329 · jazzmania74@gmail.com
Article 10 (Requests to Access Personal Information)
Data subjects may request access to their personal information under Article 35 of the Personal Information Protection Act from the Operations Support Team above (contact: John Kim). The company will make efforts to process access requests promptly.
Article 11 (Remedies for Infringement of Rights)
If you believe your personal information has been misused, you may contact the following organizations for remedies and counseling.
- Personal Information Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / kopico.go.kr
- Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (no area code) / spo.go.kr
- National Police Agency Cyber Bureau: 182 (no area code) / police.go.kr
Article 12 (Changes to This Privacy Policy)
This Privacy Policy takes effect on 5 Nov 2026. If we add, remove or revise anything because of changes in law, policy or security technology, we will announce the changes in the service at least 7 days before they take effect.
▷ Previous versions effective: 24 Oct 2026 · 5 Aug 2026 · 2 Jul 2026 · 18 Jun 2026