Privacy Policy

Article 1 (Purpose and Scope)

Korvia Consulting Co., Ltd. (“Korvia”, “we”) establishes and publishes this Privacy Policy under Article 30 of PIPA to protect the personal information of data subjects and to handle related complaints promptly.

Scope of this policy

• Our website https://www.korvia.com (the “Website”) and the online forms offered on it (applications, inquiries, hiring requests, course sign-ups and similar forms, including forms served from form.korvia.com, forms.korvia.com and forms.zohopublic.com)
• The whole recruitment and placement service we provide based on information submitted through those forms — reviewing applications, recommending candidates to employers, arranging interviews, guiding visa and entry paperwork, support after placement, and alumni management
• The employer portal (portal.korvia.com), the Alumni site (alumni.korvia.com), sign-ups for Korvia events, the Website chatbot and live chat, and information collected automatically while you use the Website

Note: the previous policy (v2.5) excluded job applicants and referred them to a separate policy. That separate policy was never published, so from v2.6 applicants' personal information is covered by this policy.

Article 2 (Purposes of Processing)

We process personal information for the purposes below and do not use it for any other purpose. If a purpose changes, we take the steps required by Article 18 of PIPA, such as obtaining separate consent.

Article 3 (Personal Information We Process and How We Collect It)

① Information you give us

② Information collected automatically

• IP address, cookies and advertising identifiers, browser, device and operating-system information, date and time of visit, pages visited, referral source, and on-page behavior such as clicks and scrolling
• Collection for analytics and advertising happens only if you allow it in the cookie settings. Articles 11 and 12 describe the tools and how to consent or refuse.

③ Sensitive information and unique identifiers

• Racial or ethnic origin: the “Ethnic Background” item in the online application and the Korean-heritage item in the EPIK registration form are sensitive information under subparagraph 4 of Article 18 of the PIPA Enforcement Decree. For “Ethnic Background” you can choose “Prefer not to disclose”. This information is used in assessing applicants and matching them with employers.
• Health and criminal-record information: health-related answers in the screening questionnaire and health documents submitted as recruitment proceeds are sensitive information (Article 23(1) of PIPA) and are used in assessing applicants and in the hiring processes of employers and public programs. Criminal-record answers and criminal-record certificates may also be sensitive information.
• Alien registration and passport numbers: alien registration numbers contained in submitted documents are unique identifiers (subparagraph 4 of Article 19 of the PIPA Enforcement Decree), and passport numbers may also be unique identifiers.
• We process sensitive information and unique identifiers only to the minimum extent needed for the purposes above, and protect them with the safeguards in Article 10.
• We do not collect Korean resident registration numbers.

Article 4 (Processing and Retention Periods)

We keep personal information for the period required by law or the period you consented to, and destroy it under Article 9 when that period ends.

• Even within the retention period, if you ask us to delete your information we destroy it promptly, unless a law requires us to keep it (Article 8).
• Articles 11 and 12 explain how long information collected by cookies is kept.
• The retention period for applicant information changes from 3 years (previous policy v2.5) to match the application consent terms. Under paragraph 2 of the Addendum the change applies from 22 October 2026; until then the previous period (3 years) applies.

Article 5 (Provision to Third Parties)

We provide personal information to third parties only within the purposes in Article 2 and only where Article 17 of PIPA allows it, for example where you have consented.

• Method: email, KakaoTalk AlimTalk messages, file-sharing links issued by Korvia, and similar means
• Provision to employers outside Korea and to the TEFL course operators (United Kingdom and elsewhere) is an overseas transfer and is also described in Article 7.
• In addition, information may be provided where Article 18(2) of PIPA applies — for example with your separate consent, where another law specifically provides for it, or where it is clearly necessary to protect the life, body or property of you or a third party in an emergency.

Article 6 (Outsourcing of Processing)

To run our services we outsource the processing of personal information as follows (Article 26 of PIPA). Article 7 lists the items transferred, countries and other details for processors outside Korea.

Work that a processor outsources further (sub-processing) can be checked in the sub-processor lists each processor publishes (where published). If the outsourced work or a processor changes, we will announce it through this policy.

Article 7 (Overseas Transfers)

We transfer personal information overseas (by provision, outsourcing or storage) as follows. (1) Outsourcing and storage necessary to conclude or perform a contract with you are disclosed in this policy under Article 28-8(1)(3)(a) of PIPA. (2) Provision to employers and others abroad follows the consent terms in the application. (3) Transfers through Website analytics tools and advertising tags happen only if you allow them in the cookie settings (Articles 11 and 12), and you can withdraw at any time.

• Refusing overseas transfers: if you do not want your information transferred overseas, tell us using the contact details in Article 14. The processors above are systems we need to run our services, so if you refuse we may be unable to provide recruitment and related services. You can refuse information collected by cookies using the methods in Article 11.
• We apply the safeguards in Article 10 to personal information transferred overseas as well.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives)

You may exercise the following rights against Korvia at any time (Articles 35 to 37 and 37-2 of PIPA).

1. Request access to your personal information
2. Request correction or deletion if it is inaccurate (deletion cannot be requested for information that another law specifically requires to be collected)
3. Request suspension of processing, or withdraw consent
4. Refuse, or request an explanation of, an automated decision (Article 16)

• How: in writing, by phone or by email (support@korvia.com; admin@korvia.com, given in the application and elsewhere, also works). We make this no harder than the way we collected the information, and we check that the request comes from you or an authorized representative.
• Time limits: for access requests we make the information available within 10 days of receiving the request (Article 41 of the PIPA Enforcement Decree); for correction, deletion and suspension requests we tell you the result within 10 days (Articles 43 and 44 of the Decree); and we act on requests about automated decisions within 30 days (Article 44-3 of the Decree).
• Representatives: you may exercise your rights through a legal representative or a person you authorize; a power of attorney is required.
• Limits: access or suspension may be restricted where a law specifically provides for it, where it is unavoidable to comply with a legal obligation, or where it may unfairly harm another person's life, body, property or other interests. We will tell you the reason.
• Objections: if you disagree with how we handled a request, you may object to the Chief Privacy Officer in Article 14, and we will review it and tell you the outcome.
• Withdrawing consent during recruitment: if an applicant withdraws consent, we stop recommending and supporting them using that information. You may ask employers who already received your information to delete it, and we will help.

Article 9 (Destruction of Personal Information)

When personal information is no longer needed — for example because the retention period has ended or the purpose has been achieved — we destroy it without delay (Article 21 of PIPA).

Procedure and timing

• We identify the information to be destroyed and destroy it.
• We destroy it without delay once the retention period ends or the purpose is achieved.

Method

• Electronic files: deleted by technical means so they cannot be restored
• Paper documents: shredded or incinerated

Information kept under other laws

Personal information that another law requires us to keep is stored and managed separately from other personal information (Article 21(3) of PIPA).

Article 10 (Safeguards)

We take the following measures under Article 29 of PIPA and Article 30 of its Enforcement Decree.

• Access management: access rights to personal-information systems are granted to the staff who need them and managed per account
• Encryption: encryption in transit (HTTPS) for the Website and online forms, and encrypted storage of portal passwords
• System security: use of cloud services that provide security features such as access control and access logs, and applying security updates
• Physical: locked storage for documents containing personal information

Article 11 (Automatic Collection Tools such as Cookies)

We use cookies and similar technologies for Website analytics, connecting you to live chat, and measuring ad performance. A cookie is a small text file that a website stores in your browser.

How consent works: on your first visit a cookie settings panel appears. The analytics and advertising tools below run only if you allow that category, and live chat (Channel Talk) loads only when you press the chat button. Information needed to deliver pages, keep the site secure and remember your cookie choice is used without consent. You can change your choice at any time under «Cookie settings» at the bottom of the page.

Lifetimes are how long the cookie or stored data stays in your browser. Information each company collects may be kept separately under that company's own policy.

Withdrawing consent and refusing cookies

• Cookie settings: under «Cookie settings» at the bottom of the page you can change or withdraw analytics and advertising consent at any time.
• Browser settings: in the privacy (cookie) settings of Chrome, Safari, Edge, Firefox or other browsers you can block cookies or delete stored cookies.
• Ad settings: you can turn off personalized ads in Google My Ad Center and Microsoft ad settings.
• If you do not allow analytics or advertising, or block cookies, you can still use the Website's basic features.

Article 12 (Behavioral Information)

Only if you allow advertising in the cookie settings, we collect and use behavioral information for ad performance measurement and interest-based advertising as follows.

• Companies we allow to collect and process behavioral information: Google (Google Ads) and Microsoft (Microsoft Advertising). They process the information under their own privacy policies.
• We do not collect sensitive behavioral information such as health information, and we do not target interest-based ads at children under 14.
• How to refuse: do not allow advertising, or withdraw it, under «Cookie settings»; you can also use the browser and ad settings in Article 11.
• Questions or complaints about behavioral information can be sent to the Chief Privacy Officer in Article 14.

Article 13 (Children under 14)

Our services are for adults, and we do not collect personal information directly from children under 14. Where an applicant gives us the name and relationship of an accompanying dependent (such as a child), we process it only for applying to public programs such as EPIK, the visa application and settling-in support.

Article 14 (Chief Privacy Officer and Complaints Department)

We have appointed a Chief Privacy Officer who is responsible for our personal information processing and for handling complaints and remedies relating to it (Article 31 of PIPA).

Controller: Korvia Consulting Co., Ltd. (주식회사 코비아컨설팅) · #2517 Hyundai Rexion, 305 Gangnam-daero, Seocho-gu, Seoul 06628, Republic of Korea

Data subjects outside Korea: people living in the European Union, the United Kingdom or elsewhere can exercise the rights in this policy using the contact details above. We have not currently appointed a representative under Article 27 of the EU General Data Protection Regulation (GDPR) or Article 27 of the UK GDPR.

Article 15 (Remedies)

To seek a remedy for an infringement of your personal information, you can apply for dispute resolution or advice to the following bodies.

Article 16 (Automated Decisions)

For applicants who apply through the Website's forms, we may make automated decisions in the application process based on applications, questionnaire responses and similar materials (Article 37-2 of PIPA).

• You may refuse an automated decision or ask for an explanation of it, and you may ask a staff member to review it again. Send your request to support@korvia.com; unless there is a legitimate reason not to, we will act on it and tell you the outcome within 30 days of receiving the request.

Article 17 (CCTV)

We do not operate CCTV in connection with running the Website.

Article 18 (Changes to this Policy)

If this policy is added to, deleted from or corrected, we announce the change on the Website 7 days before it takes effect (30 days before, for a significant change to data subjects' rights).

Revision history

• v1: effective 1 January 2015
• 15 March 2024: revised and effective
• v2.5: effective 30 June 2026 — retention periods revised, recipient contact details added to overseas transfers, overseas-transfer notice for the hiring-request form added · Read (Korean)
• v2.6: announced 22 September 2026, effective 29 September 2026 (retention change 22 October 2026) — (1) applicants' and the employer portal's personal information brought into scope, and items and sensitive information aligned with the actual forms (2) processors and overseas transfers corrected to the services actually in use (Google Analytics, which is not used, removed; chatbot, AI work assistance, advertising, visitor-analytics and chat tools added; legal names and contacts corrected) (3) cookie section corrected to how the Website actually works, and a behavioral-information article added (4) statutory retention bases under the Employment Security Act stated (5) governing law updated to PIPA as amended on 10 March 2026 (6) retention for applicant information changed from 3 years to 10 years (20 years for alumni management information) to match the application consent terms (applies from 22 October 2026) (7) automated-decisions article revised (8) cookie settings panel introduced — analytics and advertising tools run only with consent, live chat only on request

Addendum

• ① (Effective date) This policy takes effect on 29 September 2026.
• ② (Retention change) The retention periods in Article 4 for applicant information (10 years) and alumni management information (20 years) apply from 22 October 2026; until then the previous policy's period (3 years) applies.
• ③ (Transition) The periods in paragraph 2 also apply to applicant and alumni information Korvia holds on 22 October 2026.
• ④ (Previous policy) The previous policy (v2.5) ceases to apply when this policy takes effect.