Cross Inc. complies with the 「Personal Information Protection Act」 and related laws to protect the freedom and rights of data subjects, processing personal information lawfully and managing it securely. In accordance with Article 30 of the 「Personal Information Protection Act」, we establish and disclose this Privacy Policy to inform data subjects about the procedures and standards for personal information processing and to ensure prompt and smooth resolution of related grievances.
Purpose, Items, and Retention Period of Personal Information Processing
The company processes personal information within the minimum scope necessary to provide services in accordance with the 「Personal Information Protection Act」. The processed information is retained for the period required by relevant laws or with the consent of the data subject.
The information retained by the company under applicable laws and their retention periods are as follows:
- Under the 「Act on Consumer Protection in Electronic Commerce, Etc.」:
- Records related to contracts or subscription cancellations (service subscription and termination information): 5 years
- Records related to payments and supply of goods (service payment information): 5 years
- Records related to consumer complaints or dispute resolution (customer consultation information): 3 years
- Records related to advertising: 6 months
- Under the 「Framework Act on National Taxes」, all transaction-related documents are retained for 5 years.
- For electronic financial transactions, records are retained for 5 years under the 「Electronic Financial Transactions Act」.
- Under the 「Protection of Communications Secrets Act」, records of computer communications, internet logs, and access tracking data related to service usage are retained for 3 months.
The information processed and retained by the company for service provision purposes and their retention periods are as follows:
The collected personal information may be pseudonymized to provide insights through statistical analysis, ensuring that individuals cannot be identified. Pseudonymized information is stored and managed separately from additional information to prevent re-identification and is subject to the same technical and administrative safeguards as personal information.
[Membership Registration and Management]
- Purpose: Confirming membership intent, identification and authentication for membership services, maintaining and managing membership status, preventing fraudulent use of services, providing notices, and handling grievances.
- Collected Items: Name, email address
- Retention and Usage Period: Until membership withdrawal
※ However, if an investigation or inquiry related to a violation of applicable laws is ongoing, retention extends until the conclusion of such investigation or inquiry.
[Dispute Resolution]
- Purpose: Record retention for dispute resolution
- Collected Items: Service usage records (access time, type and frequency of transactions), device information
- Retention and Usage Period: Up to 1 year after membership withdrawal
※ However, if an investigation or inquiry related to a violation of applicable laws is ongoing, retention extends until the conclusion of such investigation or inquiry.
[Events]
- Purpose: Event participation, winner selection, prize delivery
- Collected Items: Name, address, mobile phone number, email address
- Retention and Usage Period: Until consent is withdrawn or 6 months after the event ends
※ Subject to retention periods required by applicable laws.
[Error and Complaint Handling]
- Purpose: Identifying the complainant, analyzing and resolving issues based on the complaint, and responding to the complaint
- Collected Items: Name, email address, details of errors or complaints
- Retention and Usage Period: Until membership withdrawal
※ Subject to retention periods required by applicable laws.
[Customer Inquiries]
- Purpose: Identifying the inquirer and responding to inquiries
- Collected Items: Name, email address, mobile phone number, order number, inquiry details
- Retention and Usage Period: Until membership withdrawal
※ Subject to retention periods required by applicable laws.
[Promotion and Marketing]
- Purpose: Providing services and advertisements based on statistical characteristics, delivering personalized promotional information
- Collected Items: Age, service usage records (access time, type and frequency of transactions), IP address
- Retention and Usage Period: Until membership withdrawal
※ Subject to retention periods required by applicable laws.
Provision of Personal Information to Third Parties
The company processes personal information only within the scope specified for the purpose of processing and does not provide personal information to third parties except with the data subject’s consent or as permitted under Articles 17 and 18 of the 「Personal Information Protection Act」 or other special legal provisions.
Currently, the company does not provide personal information to third parties.
Entrustment of Personal Information Processing
The company does not entrust personal information processing to third parties for the smooth handling of personal information-related tasks.
Overseas Transfer of Personal Information
For the smooth handling of personal information processing, the company entrusts personal information processing as follows:
[Amplitude]
- Purpose: Analyzing service usage patterns to provide recommended services (including advertisements) and using behavioral data as a measure for new services or service improvements
- Transferred Personal Information Items: Device model, manufacturer, device unique identifier, OS version, user log information
- Country of Transfer: United States
- Transfer Method: Periodic transfer via information and communication networks during service provision
- Retention Period: Until membership withdrawal or termination of the entrustment contract
- Privacy Policy: https://amplitude.com/privacy
[Webflow]
- Purpose: Collection and storage of customer inquiry records
- Transferred Personal Information Items: Device unique identifier, name, email address
- Country of Transfer: United States
- Transfer Method: Periodic transfer via information and communication networks during service provision
- Retention Period: Until membership withdrawal or termination of the entrustment contract
- Privacy Policy: https://webflow.com/legal/privacy
Personal Information Protection Officer
Personal Information Access Request Contact
Data subjects may contact the Personal Information Protection Officer or the relevant department with any inquiries, complaints, or requests for remedies related to personal information protection arising from the use of the company’s services. The company will respond and handle such inquiries promptly.
Remedies for Rights Infringement
1. The company strives to ensure the data subject’s right to self-determination regarding personal information and to provide consultation and remedies for personal information infringements. For reports or consultations, please contact the department below:
- Grievance Handling DepartmentDepartment: CX
- Contact Person: Jaepil Choi
- Email: privacy@cros.team
2. Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency’s Personal Information Infringement Report Center. For other reports or consultations regarding personal information infringements, please contact the following organizations:
- Personal Information Dispute Mediation Committee: 1833-6972 (without area code) (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (without area code) (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (without area code) (www.spo.go.kr)
- National Police Agency: 182 (without area code) (ecrm.cyber.go.kr)
3. Under Articles 35 (Access to Personal Information), 36 (Correction or Deletion of Personal Information), and 37 (Suspension of Personal Information Processing) of the 「Personal Information Protection Act」, any person whose rights or interests have been infringed due to a disposition or omission by a public institution may request an administrative appeal as prescribed by the Administrative Appeals Act.
- Central Administrative Appeals Commission: 110 (without area code) (www.simpan.go.kr)
Changes to the Privacy Policy
This policy is effective from November 1, 2025.
