1. Purposes of processing
EPOCHA (business operator: EPOCHA; representatives: Ofranc Maeva Aurelie and Juwon Bak; “EPOCHA”) processes personal information to respond to enquiries; provide information; accept, assess and administer programme registrations; communicate with participants and guardians; manage safety; process contracts, payments and refunds; and comply with legal obligations. Processing is based on consent, steps requested before or needed to perform a contract, legal obligations, or EPOCHA’s legitimate interests within the reasonable limits of Article 15(1) of Korea’s Personal Information Protection Act. We obtain separate consent or confirm another lawful basis before using information for an unrelated purpose.
2. Information we process
- General enquiries: name, email address, message and information voluntarily provided
- Programme applications: participant name, year of birth or age range, contact details, email, school or organisation, programme interests and application responses
- Minor participants: guardian name, relationship, contact details, email and evidence of legal guardian consent
- Contracts, payments and refunds: registration and transaction information. Payment providers may process card details directly.
- Safety: emergency contact, allergies, dietary needs and relevant health considerations, subject to separate consent where sensitive information is required
- Automatically generated data: IP address, access time, browser and device details, cookies and similar identifiers
3. Retention
Except for transaction records retained under Article 6 of the Enforcement Decree of the Korean E-Commerce Act, personal information is deleted without delay when its purpose or retention period ends under Article 21 of the Personal Information Protection Act. Only records required by another law or an active dispute are stored separately for the applicable period.
- General enquiries: one year after the response is completed; three years where the matter is a consumer complaint or dispute
- Unsuccessful programme applications: six months after selection ends
- Participant application, attendance and administration records: three years after the programme
- Emergency contacts, allergies and health considerations: deleted within 30 days after the programme, or when a related safety incident is resolved
- Images, video and participant work used with optional consent: three years from consent or until consent is withdrawn
- Contract, payment and supply records: five years under Korean e-commerce law
- Consumer complaints and dispute records: three years under Korean e-commerce law
- Advertising records: six months under Korean e-commerce law
- Guardian consent records: three years after the programme
4. Children under 14
Where consent is required to process information about a child under 14, we obtain and verify consent from the child’s legal guardian. We may first collect the minimum guardian details needed for verification. A guardian may exercise access, correction, deletion, suspension and withdrawal rights on the child’s behalf.
5. Third parties and processors
We do not provide personal information to an independent third party without consent unless permitted by law. If information must be shared with a school, coach, mentor or programme partner, we give a separate notice describing the recipient, purpose, items, retention period and right to refuse.
We may use service providers for hosting, forms, email, document management and payments. Material changes to processors or outsourced tasks will be disclosed in this policy or at the relevant collection point.
6. Overseas transfers
When Google Forms, Drive or Workspace, overseas hosting, or communications services are used, information may be transferred to or accessed from servers outside Korea. At the relevant collection point, we disclose the recipient, country, timing and method, purpose, items, retention period and how to refuse, and confirm the lawful basis. Refusal may prevent use of an application or communication channel that depends on that provider.
7. Deletion
We delete information without undue delay when its purpose or retention period ends. Electronic records are deleted using methods designed to prevent recovery, and paper records are shredded or incinerated. Records retained by law are stored separately.
8. Your rights
Data subjects and legal guardians may request access, correction, deletion, suspension, withdrawal of consent and an objection where provided by law. We verify the requester or authorised representative and respond under applicable procedures and deadlines.
9. Security and cookies
We use proportionate safeguards including limited access, protection of passwords and data in transit, access logging, staff training and processor oversight.
The site may use cookies for essential functions and service improvement. Browser settings can block or delete cookies, though some functions may be limited. We will provide a separate choice before introducing optional analytics or advertising cookies.
10. Contact and changes
Controller: EPOCHA Representatives: Ofranc Maeva Aurelie and Juwon Bak Business registration number: 708-53-00997 Privacy officers: Ofranc Maeva Aurelie and Juwon Bak (Founders) Email: hello@epocha.world Address: R214, 10 Yeonmujang 11-gil, Seongdong-gu, Seoul, Republic of Korea
In Korea, privacy concerns may also be directed to the Privacy Infringement Report Center (118), Personal Information Dispute Mediation Committee (1833-6972), or Korean National Police Agency (182). We publish material changes and their effective date before they take effect.
This English translation is provided for convenience. If the Korean and English versions differ, the Korean version prevails to the extent permitted by applicable law.