Privacy Policy
Orca IT Co., Ltd. ("Orcait" or "the Company") has established and publishes this Privacy Policy under the Personal Information Protection Act of Korea (PIPA) to protect the personal information of data subjects and to handle related complaints promptly. This English version is provided for reference. If it differs from the Korean version, the Korean version prevails.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes.
- Receiving, confirming and answering inquiries made through the website, by e-mail or by phone
- Receiving job applications and running the selection process
- Receiving seminar and training registrations and providing information about them
The Company does not use the personal information it processes for any purpose other than those above. If a purpose changes, the Company takes the necessary steps, such as obtaining separate consent, under Article 18 of PIPA.
2. Personal Information Processed and Collection Methods
| Category | Items |
|---|---|
| Inquiries | Company name, name, job title, e-mail, phone number, content of the inquiry |
| Job applications | Items in the documents the applicant submits, such as a résumé and a cover letter |
| Seminar and training registrations | Company name, name, job title, e-mail, phone number |
| Automatically generated information | IP address, date and time of access and browser information when a visitor accesses the website |
The Company collects personal information that data subjects provide directly by e-mail, by phone or through the website. The Company does not collect personal information of children under 14 years of age.
3. Processing and Retention Periods
- Inquiry information: 1 year after the reply is completed
- Job application information: 180 days after the hiring process ends
- Seminar and training registration information: 1 year after the event ends
Information that must be kept under applicable laws is kept for the period those laws set.
4. Provision of Personal Information to Third Parties
The Company does not provide the personal information of data subjects to third parties. The exceptions are cases where the data subject gives separate consent or a law makes a special provision.
5. Outsourcing of Personal Information Processing
The Company outsources the following work to provide its services smoothly.
| Processor | Outsourced work |
|---|---|
| Cloudflare, Inc. | Website hosting and security (including processing of access logs), and receiving and transmitting the inquiry form |
| Microsoft Corporation | Operating e-mail (Microsoft 365), and sending and storing inquiry e-mails |
The outsourcing contracts set out the matters needed to manage personal information safely, and the Company supervises whether the processors handle personal information safely. If a processor or the outsourced work changes, the Company announces it in this policy.
6. Transfer of Personal Information Abroad
Personal information may be processed on servers outside Korea when the Company hosts the website and handles inquiry e-mails.
Cloudflare, Inc.
| Recipient | Cloudflare, Inc. (privacy@cloudflare.com) |
|---|---|
| Country | The United States and other countries where Cloudflare data centers are located |
| Items transferred | IP address, date and time of access, browser information and the items entered in the inquiry form (company name, name, job title, e-mail, phone number, content of the inquiry) |
| Time and method | Transferred over the network when a visitor accesses the website and when the inquiry form is submitted |
| Purpose | Providing the website, security, incident response and receiving the inquiry form |
| Retention period | The period set by Cloudflare's processing policy |
Microsoft Corporation
| Recipient | Microsoft Corporation (aka.ms/privacyresponse) |
|---|---|
| Country | Countries in the Asia-Pacific region where Microsoft data centers are located |
| Items transferred | Items entered in the inquiry form (company name, name, job title, e-mail, phone number, content of the inquiry) |
| Time and method | Transferred over the network when the inquiry form is submitted |
| Purpose | Sending and storing inquiry e-mails |
| Retention period | 1 year after the e-mail is received |
Data subjects may refuse the transfer abroad. If a data subject refuses the transfer to Cloudflare, however, the data subject cannot use the website. If a data subject refuses the transfer to Microsoft, the data subject can contact the Company by phone instead of using the inquiry form.
7. Destruction Procedure and Method
The Company destroys personal information without delay once its retention period has passed or its processing purpose has been achieved. Electronic files are deleted by a method that cannot be recovered, and paper documents are shredded or incinerated.
8. Rights of Data Subjects and How to Exercise Them
Data subjects may ask the Company for access to, correction or deletion of, suspension of processing of, or withdrawal of consent for their personal information. If a data subject makes a request to the department below in writing, by e-mail or by phone, the Company acts without delay. Data subjects may also exercise these rights through a legal representative or an authorized agent.
9. Security Measures
- Administrative measures: limiting the number of staff who handle personal information, and regular training
- Technical measures: access permission management, encryption in transit (HTTPS) and retention of access logs
- Physical measures: access control for the places where records are kept
10. Automatic Collection Devices and How to Refuse Them
The Company website does not use cookies or visitor analytics tools. The choice of screen theme (light or dark) is stored only in the user's browser and is not sent to the Company. Users can clear the stored information in their browser settings.
11. Chief Privacy Officer
| Chief Privacy Officer | CEO |
|---|---|
| Department | Management Support |
| Phone | +82-2-572-4720 |
| contact@orcait.net | |
| Address | 1F Grace Building, 26 Dwitgol-ro, Gwacheon-si, Gyeonggi-do 13814, Republic of Korea |
12. Remedies for Infringement of Rights
For reports or consultations about an infringement of personal information, you can contact the following agencies.
- Personal Information Infringement Report Center: privacy.kisa.or.kr, 118 within Korea
- Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
- Supreme Prosecutors' Office: spo.go.kr, 1301 within Korea
- Korean National Police Agency: ecrm.police.go.kr, 182 within Korea
13. Changes to This Privacy Policy
This Privacy Policy takes effect on November 1, 2026.