@extends('layouts.default')

@section('content')

<div class="container policy">
    <!-- 페이지 상단 : 제목 및 현재위치 표시 -->
    <div class="area-pages-top">
        <div class="area-page-location">
            <h1 class="page-title">PrivacyPolicy: edm Education</h1>
        </div>
    </div>

    <div class="area-pages-content">
        <div class="policy-wrap">
            <div class="area-terms">
                <article>
                    <h2>Introduction</h2>
                    <p>edm Education is committed to keeping your data safe and respecting your privacy. In this policy you will find information that show what we process about you, why we process that data and what the legal bases are for processing that data.</p>
                    <p>edm Education (the company) complies with the following principles of processing personal information, the principles of:</p>
                    <ul>
                        <li>a) lawfulness, fairness and transparency, (having a lawful reason to process your data and being clear with you what that is)</li>
                        <li>b) purpose limitation (processing your data for a specific reason)</li>
                        <li>c) data minimisation (only processing data that is relevant for the purpose explained and agreed with you)</li>
                        <li>d) accuracy (making sure the data we process is accurate)</li>
                        <li>e) storage limitation (only keeping data for as long as necessary for the purpose explained and agreed with you)</li>
                        <li>f) confidentiality (keeping your data safe and not sharing it with anyone you do not give us permission to share with)</li>
                    </ul>
                    <p>These principles are prescribed in privacy protection laws in the Republic of Korea and in the GDPR (General Data Protection Regulation) laws in the EU. The company has established privacy policies, explained in this document</p>

                    <h3>Your rights</h3>
                    <p>Under certain circumstances you have certain rights regarding how your personal data is used and kept safe, including the rights to:</p>
                    <ul>
                        <li>a) Right of Access (you have the right to a copy of the information we hold about you)</li>
                        <li>b) Right to Object (you may object to the use of personal data if it would cause or is causing damage or distress. You have the right to object to any decisions taken using automated processes, you also have the right to object to certain types of processing such as direct marketing</li>
                        <li>c) Right of Rectification (if the data we hold about you is inaccurate or incomplete you have the right to correct or complete that data)</li>
                        <li>d) Right to be Forgotten (under certain circumstances you can ask for the data we hold about you to be deleted form our systems)</li>
                        <li>e) Right to Restriction of Processing (where certain conditions apply you have the right to restrict the processing of data)</li>
                        <li>f) Right of portability (you have the right to have the data we hold about you transferred to another organisation)</li>
                    </ul>
                    <p>Where we have collected your data and are processing it with your consent you have the right to withdraw your consent at any time.</p>
                    <p>Some of these rights may not apply where we are legally obliged to keep or share your personal data. If you wish to exercise any of these rights please contact our Data Protection Officer.</p>

                    <h3>Complaints</h3>
                    <p>We take any complaints about our collection and use of personal information very seriously. If you think our collection or use of personal information is unfair, misleading or inappropriate please raise this with us in the first instance. To make a complaint please email our data Protection Officer</p>
                    <p>Alternatively, in the EU you can make a complaint to the Information Commissioner’s Office in the UK through the options listed in Article 11:</p>
                </article>
                <article>
                    <h2>Article 1: Personal Data to be collected and processed</h2>
                </article>

                <article>
                    <h2>Article 2: The Purpose of the Collection of Personal Data</h2>
                    <p>The Company collects and processes the following Personal Data for the purposes of entering and fulfilling a legal contract with you.</p>
                    <table class="tbl-basic text-center">
                        <colgroup>
                            <col width="40%">
                            <col width="30%">
                            <col width="30%">
                        </colgroup>
                        <thead>
                        <tr>
                            <th>The data or type of data we process	</th>
                            <th>The purpose of processing that data	</th>
                            <th>The lawful basis for processing that data</th>
                        </tr>
                        </thead>
                        <tbody>
                        <tr>
                            <td>Name, address, mobile phone no	</td>
                            <td>To accept your application for consultation, collected through our Web Form,	</td>
                            <td>To be able to offer a contract to you</td>
                        </tr>
                        <tr>
                            <td>ID, password, type of membership, name, address, mobile phone no	</td>
                            <td>To accept your application for membership, collected through our Web Form	</td>
                            <td>To be able to offer a contract to you</td>
                        </tr>
                        <tr>
                            <td>Desired country of study, area of interest, estimated departure date, level of preparation for overseas study	</td>
                            <td>To accept your application for membership, collected through our Web Form	</td>
                            <td>To be able to offer a contract to you</td>
                        </tr>
                        <tr>
                            <td>Name, address, mobile phone no, estimated departure date, intended period of overseas study	</td>
                            <td>To be able to invite you to a seminar</td>
                            <td>To be able to offer a contract to you</td>
                        </tr>
                        <tr>
                            <td>Name, address, mobile phone no	</td>
                            <td>To be able to send you a guide book	</td>
                            <td>To be able to offer a contract to you</td>
                        </tr>
                        <tr>
                            <td>Name, sex, date of birth, passport number, address, level of English, type of visa, school information (school name, course, start date of classes, registration period, estimated end date of classes, vacations) accommodation information if requested (period, type of accommodation required)	</td>
                            <td>To make a booking with an overseas school</td>
                            <td>For the fulfilment of a contract with you</td>
                        </tr>
                        <tr>
                            <td>Name, sex, date of birth, passport number, address, level of English, type of visa, school information (school name, course, start date of classes, registration period, estimated end date of classes, vacations) accommodation information if requested (period, type of accommodation required), Year of entry, UCAS number	</td>
                            <td>To confirm enrolment at an overseas school	</td>
                            <td>For the fulfilment of a contract with you</td>
                        </tr>
                        <tr>
                            <td>Name, sex, date of birth, passport number, address, level of English, type of visa, school information (school name, course, start date of classes, registration period, estimated end date of classes, vacations) accommodation information if requested (period, type of accommodation required), parents Information (name of father and mother, English name, contact details, occupation)	</td>
                            <td>To process an application for a young student (under 14 years old. To be able to check the legal representative of a child under 14 years of age consents to information being used	</td>
                            <td>For the fulfilment of a contract with you To protect your vital interests</td>
                        </tr>
                        <tr>
                            <td>Name, images</td>
                            <td>for marketing our services for confirming your identity to maintain our security</td>
                            <td>Where you have given consent Compliance with a legal obligation</td>
                        </tr>
                        </tbody>
                    </table>
                </article>

                <article>
                    <h2>Article 3: Concerning the Period of Retention</h2>
                    <p>The Company retains and uses the Personal Information during the period of retention and during this period may use the Personal Information in line with the principles of processing data explained in the introduction of this policy.</p>
                    <p>The Company will normally use any personal Data obtained for the following periods:</p>
                    <ul>
                        <li>1. Where Personal Data is retained under the Internal Policy of the Company, where the Personal Data is kept as a record of wrongful use, the Personal Data will be kept for a period of one year.</li>
                        <li>2. Where the Personal Data is retained as required by applicable laws and regulations including the Commercial Act and the Act on Consumer Protection in E-commerce the Company will retain the Personal Data as required by the appropriate Acts for the following periods:</li>
                    </ul>
                    <table class="tbl-basic text-center">
                        <thead>
                        <tr>
                            <th>Description of Data	</th>
                            <th>Period of retention	</th>
                            <th>Basis for retention</th>
                        </tr>
                        </thead>
                        <tbody>
                        <tr>
                            <td>Record of withdrawal of contract or subscription	</td>
                            <td>5 years	</td>
                            <td>Act on Consumer Protection in E-commerce</td>
                        </tr>
                        <tr>
                            <td>Record of payment and supply of goods</td>
                            <td>5 years</td>
                            <td>Act on Consumer Protection in E-commerce</td>
                        </tr>
                        <tr>
                            <td>Record of consumer complaint or dispute treatment	</td>
                            <td>3 years</td>
                            <td>Act on Consumer Protection in E-commerce</td>
                        </tr>
                        <tr>
                            <td>Record of identification</td>
                            <td>6 months</td>
                            <td>Act on Promotion of Information and Communication Network Use and Protection of Information</td>
                        </tr>
                        <tr>
                            <td>Record of visit	</td>
                            <td>3 months</td>
                            <td>Protection of Communications Secrets Act</td>
                        </tr>
                        </tbody>
                    </table>
                </article>

                <article>
                    <h2>Article 4: Dormant Accounts</h2>
                    <p>In principle, any Personal Data that has not been used for a period of one calendar year will be transferred into a dormant account and the Personal Data will be retained in a separate database. Personal Data held in a dormant account will be deleted after a period of (….. years).</p>
                    <p>Any person whose Personal Data is held in this way is restricted in how they can use the Company’s services. If that person wishes to use the Company’s Services again, the data will be moved from the Dormant account to the Company’s live system.</p>
                </article>

                <article>
                    <h2>Article 5: Procedure for Disposal of Personal Data</h2>
                    <p>1. If it is no longer necessary to keep any Personal Data (either because of the ending of a Retention Period or the original purpose for collecting data being achieved) the Company will delete such Personal Data without delay.</p>
                    <p>2. If there is a request for deletion of data by the Data Subject (the Right to be Forgotten) and this is a lawful request the Company will delete Personal Data without delay and within any time limits defined under the GDPR.</p>
                    <p>3. Personal Data that has become inaccurate or out of date will also be disposed of securely, where it cannot or does not need to be rectified or updated.</p>
                    <p>4. If it is necessary, in order to comply with a legal obligation, to keep Personal Data for a period which is longer than the initial purpose of retention, the Personal Data will be moved to a separate database or other place of storage not in the live system.</p>
                    <p>5. Personal Data that is no longer required will be disposed of securely. Electronic files will be deleted or overwritten and paper-based records will be shredded or incinerated.</p>
                    <p>The Company will identify the Personal Data to be deleted and will delete the data only with the approval of the Data Protection Officer.</p>
                </article>

                <article>
                    <h2>Article 6: Sharing Data with a 3rd party.</h2>
                    <p>Personal Data will not be shared with any 3rd party without the prior consent of the user. Any intention to share Personal Data will be made clear when obtaining any consent to collect Personal Data.</p>
                    <p>If this situation changes and the Company wishes to share Personal Data with a 3rd party at a later time the Company will obtain consent from the user.</p>
                    <p>Any consent obtained can be withdrawn by the Data Subject at any time by contacting the Company. Details of who to contact can be found in Article 11.</p>
                    <p>The only exceptions to this are where there is a legal requirement to share the Personal Data with a 3rd party.</p>
                </article>

                <article>
                    <h2>Article 7: Transfer of Personal Information</h2>
                    <p>Where the Company has an agreement with another Company to provide specific services it may share the Personal Data obtained. In such cases there will be a Transfer Agreement clearly specifying how the other Company can use the Personal Data. This agreement will make clear the Company is the Data Controller (who specifies how the Data may be used) and the other company will be The Processor (who follows the instructions of the Data Controller. If there is any change to the Controller/Processor agreement the Company will make any such changes without delay.</p>

                    <table class="tbl-basic text-center">
                        <thead>
                        <tr>
                            <th>Processors of Data in Contract with the Company	</th>
                            <th>Description of Responsibilities	</th>
                            <th>Period of retention</th>
                        </tr>
                        </thead>
                        <tbody>
                        <tr>
                            <td>Panbusiness Travel Agency</td>
                            <td>Booking and ticketing of Plane ticket	</td>
                            <td>
                                Until membership is withdrawn of the termination of the agreement.
                            </td>
                        </tr>
                        <tr>
                            <td>Seven Holidays-In Space Co Ltd	</td>
                            <td>Booking and ticketing of Plane ticket	</td>
                            <td>Until membership is withdrawn of the termination of the agreement.</td>
                        </tr>
                        <tr>
                            <td>Inschingu Co Ltd</td>
                            <td>Arranging Insurance for students studying abroad</td>
                            <td>Until membership is withdrawn of the termination of the agreement.</td>
                        </tr>
                        <tr>
                            <td>Planetti (Yousimstore) Co Ltd</td>
                            <td>Subscription and service for mobile phone for students studying abroad</td>
                            <td>Until membership is withdrawn of the termination of the agreement.</td>
                        </tr>
                        <tr>
                            <td>Universities and Schools in countries where the Customer is going to study</td>
                            <td>Provision of Education</td>
                            <td>Until membership is withdrawn of the termination of the agreement. In cases where there is a legal requirement on the provider of education to retain Personal Data for a certain period this will be disclosed to the Company at the beginning of the agreement.</td>
                        </tr>
                        </tbody>
                    </table>
                </article>

                <article>
                    <h2>Article 8: Your rights</h2>
                    <p>
                        Under certain circumstances you have certain rights regarding how your personal data is used and kept safe, including the rights to:
                    </p>
                    <ul>
                        <li>a) Right of Access (you have the right to a copy of the information we hold about you)</li>
                        <li>b) Right to Object (you may object to the use of personal data if it would cause or is causing damage or distress. You have the right to object to any decisions taken using automated processes, you also have the right to object to certain types of processing such as direct marketing</li>
                        <li>c) Right of Rectification (if the data we hold about you is inaccurate or incomplete you have the right to correct or complete that data)</li>
                        <li>d) Right to be Forgotten (under certain circumstances you can ask for the data we hold about you to be deleted form our systems)</li>
                        <li>e) Right to Restriction of Processing (where certain conditions apply you have the right to restrict the processing of data)</li>
                        <li>f) Right of portability (you have the right to have the data we hold about you transferred to another organisation)</li>
                    </ul>
                    <p>Where we have collected your data and are processing it with your consent you have the right to withdraw your consent at any time.</p>
                    <p>Some of these rights may not apply where we are legally obliged to keep or share your personal data. If you wish to exercise any of these rights please contact our Data Protection Officer.</p>
                </article>

                <article>
                    <h2>Article 9: Installation, Operation and rejection of Automatic Collection of Personal Data</h2>
                    <p>The Company installs and operates ‘Cookies’ which store information about the customer’s use of the Company website. Cookies are small text files which are sent by the Company server to the Customer’s browser and which are stored in the hard disk of the Customer’s Computer.</p>
                    <p>The Company uses cookies to target marketing and for the provision of customised services through an analysis of the Customer’s use of the Website (including frequency and visit time of members and non members to the Home Page, identification and trace tracking of taste and the interests of customers, the degree of participation in various events and the numbers of visits).</p>
                    <p>Customers have options regarding the installation of Cookies through the settings in their web browser. Customers may allow all cookies, force a check of cookies when using a web browser or not accept any cookies.</p>
                </article>

                <article>
                    <h2>Article 10: Measures to secure the stability of Personal Information</h2>
                    <section>
                        <h3>1. Operational measures:</h3>
                        <ul class="square-list">
                            <li>Designing internal processes (Privacy by Design) to minimise the likelihood of Data breaches</li>
                            <li>Training for all staff involved in handling Personal Data</li>
                            <li>Carrying out internal audits on a regular basis (once each year)</li>
                            <li>Penetration testing (pen testing / mock hacking) carried out once each year</li>
                            <li>The establishment and execution of an internal management plan to ensure the security of Data</li>
                            <li>Having the following policies in place: Privacy Policy, Privacy by Design, Data Protection Impact Assessments, The Right to Erasure, Procedure for Dealing with Requests for the Erasure of Personal Data, Working Remotely, Using Personal devices, User Managament of Company systems, Responding to Objections, reporting a Data Breach, Data Retention Policy and Schedule,</li>
                            <li>Regular evaluation of the effects of Company policies and procedures for ensuring the security of Personal Data</li>
                            <li>Having agreements in place with any 3rd party who will be involved in handling Personal Data collected by the Company</li>
                        </ul>
                    </section>
                    <section>
                        <h3>2. Technical measures</h3>
                        <ul class="square-list">
                            <li>Web firewall (365 x 24 security operation service)</li>
                            <li>Firewall security operation service</li>
                            <li>IPS (invasion detection)</li>
                            <li>SSL installation</li>
                            <li>User access through management of IP /authority</li>
                            <li>Encryption of sensitive information (SHA2)</li>
                            <li>Office firewall</li>
                            <li>Office PC vaccine (tablet)</li>
                            <li>Separate wired and wireless networks</li>
                        </ul>
                    </section>
                    <section>
                        <h3>Physical measures</h3>
                        <ul class="square-list">
                            <li>Consignment of physical security of server (IDC) access control</li>
                        </ul>
                    </section>
                </article>

                <article>
                    <h2>Article 11: Contact details of the person responsible for Data Protection</h2>
                    <p>How to contact the ICO in the UK</p>
                    <p>Report a concern online at https://ico.org.uk/concerns</p>
                    <p>Call +443031231113</p>
                    <p>Write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF</p>
                    <p>Contact us:</p>
                    <p>If you have any questions, concerns or would like more information about anything in this privacy policy, please contact our Data Protection Officer:</p>
                    <section>
                        <h3>1. Staff responsible for privacy protection – Main office in Republic of Korea</h3>
                        <ul class="square-list">
                            <li>Staff responsible for privacy protection: Dongwan Noh</li>
                            <li>Position : director</li>
                            <li>Tel. : +82-2-562-5091, E-mail : admin@edmedu.com</li>
                        </ul>
                    </section>
                    <section>
                        <h3>2. Staff responsible for privacy protection – London branch</h3>
                        <ul class="square-list">
                            <li>Staff responsible for privacy protection: David Wilkins</li>
                            <li>Position : Data Protection Officer</li>
                            <li>Tel. : +44-20-7580-1521, E-mail : dataprotection@edmedu.com</li>
                        </ul>
                    </section>
                    <section>
                        <h3>3. Department in charge of Personal Information</h3>
                        <ul class="square-list">
                            <li>Department in charge of Personal Information</li>
                            <li>Dept. : development team</li>
                            <li>Tel. : +82-2--562-2790, E-mail : admin@edmedu.com</li>
                        </ul>
                    </section>
                </article>
            </div>
        </div>
    </div>
</div>

@endsection