The HOBAN Cultural Foundation (hereinafter referred to as the “Foundation”) lawfully processes and securely manages personal information in compliance with the Personal Information Protection Act and other applicable laws and regulations in order to protect the freedoms and rights of data subjects.
Pursuant to Article 30 of the Personal Information Protection Act, the Foundation hereby establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for the processing and protection of personal information and to ensure that grievances related to personal information are handled promptly and effectively.
Key Information on Personal Information Processing (Privacy Labeling)
The Foundation provides the following summary to help data subjects easily understand how their personal information is processed.
| Category | Details | |
|---|---|---|
 | Personal Information Processed | Membership information, identity verification information, competition application information, awardee information, prize payment and tax-processing information, etc. |
 | Purposes of Processing | Membership management, identity verification, competition application and judging, awardee management, prize payment and tax processing, etc. |
 | Retention Period | Until membership withdrawal, fulfillment of the processing purpose, or the end of the period prescribed by applicable laws and regulations |
 | Provision to Third Parties | No regular provision to third parties |
 | Outsourcing of Personal Information Processing | Dream Security Co., Ltd.; HEYHICOMPANY; Amazon Web Services; judges appointed by the Foundation |
 | Overseas Transfer | Storage in the United States of AWS WAF security logs (access IP addresses) |
 | Privacy Inquiries and Grievances | Department responsible for personal information protection / 02-6337-7306 |
The key privacy information above is a summary of the detailed provisions of this Privacy Policy. Please refer to the relevant sections below for specific details
1. Purposes and Items of Personal Information Processing, Retention Periods, and Legal Bases
The Foundation processes only the minimum personal information necessary to provide its services and operate the competition.
Personal information is processed on lawful bases provided under the Personal Information Protection Act and other applicable laws and regulations. The Foundation distinguishes between personal information that may be processed without the data subject’s consent and personal information processed based on the data subject’s consent, as set out below.
① Personal Information Processed Without the Data Subject’s Consent
The Foundation may process the following personal information without the data subject’s consent in accordance with applicable laws and regulations.
| Legal Basis | Category | Purpose of Processing | Items of Personal Information | Retention Period |
|---|---|---|---|---|
| Article 15(1)4 of the Personal Information Protection Act | Membership Registration and Management | Provision of member-only services; member identification and management; notices and notifications | Email address, password, name, date of birth, gender, nationality, contact information | Until approval of membership withdrawal |
| Identity Verification | Identity verification; identification of the same individual; prevention of duplicate registration | Mobile identity verification result (CI) | Until approval of membership withdrawal | |
| Competition Application and Administration | Receipt of applications; participant verification; prevention of duplicate applications; receipt and management of submitted works | Name, gender, date of birth, email address, mobile phone number, nationality, artist name or team name, biography, team member names, submitted works and work-related information, etc. | Until approval of membership withdrawal | |
| Prize Payment | Payment of prize money to competition awardees | Name, account holder name, bank name, account number | Until prize payment and related procedures are completed; however, where retention is required under applicable laws and regulations, for the period prescribed therein | |
| Article 15(1)4 or 6 of the Personal Information Protection Act | Service Operation | Prevention of misuse and ensuring service stability | Access IP address (hashed) | 2 years from the date of collection |
For Korean nationals and foreign nationals residing in Korea, among the information that users provide directly to Dream Security Co., Ltd. during mobile identity verification—including name, date of birth, mobile phone number, and mobile carrier—information that the Foundation does not receive or store is not included among the items of personal information processed by the Foundation.
Personal information required for prize payment is not collected in advance from all members or competition applicants. The minimum personal information necessary for prize payment is collected separately only from individuals selected as awardees.
② Personal Information Processed with the Data Subject’s Consent
Where the Foundation processes personal information based on the data subject’s consent, it informs the data subject of the purposes of collection and use, the items of personal information processed, and the retention and use period, and obtains consent.
| Legal Basis | Category | Purpose of Processing | Items of Personal Information | Required / Optional | Retention Period |
|---|---|---|---|---|---|
| Article 15(1)1 of the Personal Information Protection Act | Awardee Archive | Exhibition and promotion of award-winning works and operation of the competition archive | Name or artist name, team member names or team name, biography, social media account, submitted works and work-related information, award details | Optional | Until the purposes specified in the “Notice on Copyright and Consent to Use of Works” are fulfilled |
Whether personal information processed with separate consent is required or optional in the actual service is governed by the same terms as the consent to the collection and use of personal information presented on the membership registration and service screens.
③ Personal Information Processed to Verify Consent of a Legal Representative
Where the consent of a legal representative is required for the processing of personal information of a child under 14, or for an applicant under 19 to enter the competition and for use of the submitted work, etc., the Foundation processes personal information as follows.
| Category | Purpose of Processing | Items of Personal Information | Method of Collection | Retention Period |
|---|---|---|---|---|
| Legal representatives of Korean nationals under 14 and foreign nationals under 14 residing in Korea | Verification of the legal representative’s consent to the processing of the child’s personal information | Identity verification result (CI) | Dream Security mobile identity verification | Until approval of membership withdrawal |
| Legal representatives of foreign nationals under 14 and Korean nationals under 14 residing overseas | Verification of the legal representative’s consent to the processing of the child’s personal information | Name, mobile phone number, relationship to the child | Written submission | |
| Legal representatives of applicants under 19 | Verification of consent to competition entry and use of submitted works, etc. | Name, date of birth, contact information, relationship to the participant | Written submission |
Consent of a legal representative to the processing of personal information of a child under 14 and consent regarding competition entry and use of submitted works by an applicant under 19 are processed separately according to their respective purposes.
④ Processing of Resident Registration Numbers and Other Personally Identifiable Information
The Foundation processes resident registration numbers and other personally identifiable information only where such processing is specifically required or permitted under an Act, Presidential Decree, or other applicable laws and regulations.
Where necessary to perform tax-related procedures under applicable laws and regulations, including withholding and submission of statements of payment in connection with prize payments to competition awardees, the Foundation processes personally identifiable information as follows.
| Legal Basis | Purpose of Processing | Items of Personal Information | Retention Period |
|---|---|---|---|
| Article 164 of the Income Tax Act, its Enforcement Decree, and other applicable tax laws and regulations | Tax-related procedures, including withholding and submission of statements of payment, in connection with prize payments to awardees | Resident registration number or, where required under applicable laws and regulations, passport number, alien registration number, etc. | 5 years from the day following the statutory filing deadline for the relevant national tax |
Resident registration numbers are processed only where an Act, Presidential Decree, or other applicable regulation specifically requires or permits such processing, pursuant to Article 24-2 of the Personal Information Protection Act.
Passport numbers, alien registration numbers, and other personally identifiable information are processed only where there is a lawful basis for processing under Article 24 of the Personal Information Protection Act.
Personal information necessary for tax processing, including resident registration numbers, is not collected in advance from all members or competition applicants. It is collected separately only from awardees for whom tax processing is required.
Retention periods for tax-related books and supporting documents are governed by Article 85-3 of the Framework Act on National Taxes and other applicable laws and regulations.
2. Provision of Personal Information to Third Parties
The Foundation processes personal information within the scope specified in the purposes of personal information processing and does not provide personal information to third parties except with the data subject’s consent or where permitted by applicable laws and regulations.
If the Foundation provides personal information to a third party in the future, it will disclose, through this Privacy Policy or other appropriate means, the matters required by applicable laws and regulations, including the recipient, purpose of provision, items of personal information provided, and retention and use period.
3. Outsourcing of Personal Information Processing
The Foundation outsources certain personal information processing tasks to external service providers and other parties to ensure smooth service delivery and competition administration.
| Entrusted Party | Entrusted Tasks |
|---|---|
| Dream Security Co., Ltd. | Identity verification services for membership registration, etc. |
| HEYHICOMPANY | Website development, operation, and maintenance |
| Amazon Web Services | Operation of servers, databases, and file storage |
| Judges appointed by the Foundation | Judging of submitted works |
Judges appointed by the Foundation access and review information concerning applicants and submitted works on-site solely for the purpose of performing the Foundation’s competition judging. They do not separately store or copy such personal information or transmit it outside the judging environment.
When outsourcing personal information processing, the Foundation specifies in contracts, appointment documents, or other written instruments the matters necessary to ensure the secure management of personal information in accordance with applicable laws and regulations, and manages and supervises the entrusted parties.
If the details of outsourced tasks or the entrusted parties change, the Foundation will disclose the changes through this Privacy Policy.
4. Overseas Transfer of Personal Information
In the course of operating website security services, the Foundation processes and stores personal information outside Korea as follows.
| Recipient | Country | Personal Information Transferred | Purpose of Transfer | Timing and Method of Transfer | Retention and Use Period |
|---|---|---|---|---|---|
| Amazon Web Services | United States | Access IP address of requests blocked by WAF | Detection and blocking of security threats; management of security logs | Transmitted over the network when a blocked request occurs | 30 days |
Major system resources where personal information is stored, including databases, Redis, and S3, use the AWS Seoul Region.
Access IP addresses contained in security logs for requests blocked by WAF are stored in a U.S. region, and authentication headers, cookies, and similar information are masked before processing.
Overseas transfers of personal information are handled in accordance with Article 28-8 of the Personal Information Protection Act and other applicable laws and regulations.
5. Use of External Video Services
The Foundation uses external video services, including YouTube and Vimeo, to play video works submitted to the competition. If a user accesses a page containing a YouTube or Vimeo video or plays such a video, the user’s access and usage information may be transmitted directly to or collected by the relevant service provider.
Such information is not directly collected or stored by the Foundation and is processed in accordance with each service provider’s privacy policy.
| Service Provider | Purpose | Information That May Be Collected |
|---|---|---|
| Google LLC(YouTube) | Provision of video content | IP address, URL of page visited, browser information, cookies, etc. |
| Vimeo | Provision of video content | IP address, URL of page visited, browser information, cookies, etc. |
6. Procedures and Methods for Destruction of Personal Information
The Foundation destroys personal information without delay when the retention period has expired or the purpose of processing has been fulfilled and the personal information is no longer necessary.
However, where continued retention is required under applicable laws and regulations, such personal information is stored separately from other personal information.
① Destruction Procedure
When a reason for destruction arises for particular personal information—such as approval of membership withdrawal, completion of competition-related operations, expiration of the retention period for applicant personal information, or completion of prize payment and tax processing—the Foundation identifies and destroys the relevant personal information.
Personal information that must be retained separately under applicable laws and regulations is stored separately for the required period and destroyed after that period expires.
When membership withdrawal is approved, the member’s personal information is deleted from the operational database without delay. Personal information contained in backup data is deleted after the applicable retention period under the backup policy has expired.
② Methods of Destruction
Personal information in electronic file format is permanently deleted using methods that prevent recovery or restoration.
Paper documents are destroyed by shredding, incineration, or other secure methods.
7. Installation and Operation of Automatic Personal Information Collection Devices and Refusal Thereof
The Foundation uses cookies to provide website services and analyze usage patterns.
The Foundation may use cookies for the following purposes:
Login and service provision
Statistics and analysis of usage patterns, including visit times
Service improvement and stable operation
Data subjects may allow or block the storage of cookies through their web browser settings.
8. Processing of Personal Information of Children Under 14
The Foundation permits children under 14 to register as members and obtains consent from the child’s legal representative where consent is required for the processing of the child’s personal information.
The Foundation processes only the minimum personal information necessary to verify the legal representative’s consent.
For Korean nationals and foreign nationals residing in Korea, the Foundation verifies consent through mobile identity verification of the legal representative. For foreign nationals and Korean nationals residing overseas, the Foundation verifies consent through written documentation containing the legal representative’s name, mobile phone number, relationship to the child, and other necessary information.
A legal representative may exercise rights regarding the child’s personal information, including rights to access, correction or deletion, and suspension of processing.
9. Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them
Data subjects may exercise their rights against the Foundation in accordance with applicable laws and regulations, including rights to access, correct or delete personal information, suspend processing, and withdraw consent.
These rights may be exercised using the member information editing and membership withdrawal functions provided on the website, or in writing, by telephone, by email, or by other appropriate means.
A data subject may exercise these rights through a legal representative or an authorized agent. Rights concerning the personal information of a child under 14 may be exercised by the child’s legal representative.
The department responsible for receiving and processing requests to exercise privacy rights is as follows.
| Category | Department Responsible for Receiving and Processing Requests to Access Personal Information | Business Hours |
|---|---|---|
| Department | Department Responsible for Personal Information Protection | Weekdays 09:00–17:00Closed on Saturdays, Sundays, and public holidays |
| Telephone | 02-6337-7306 | |
| contact@next-art-ai.com |
10. Measures to Ensure the Security of Personal Information
The Foundation implements the following measures to ensure the security of personal information.
A. Administrative Measures
Establishment and implementation of an internal management plan
Training, management, and supervision of personnel handling personal information
B. Technical Measures
Management of access privileges to personal information processing systems
Access control
Encryption of important personal information
Retention and inspection of access logs
Installation and operation of security programs
C. Physical Measures
Access control to locations where personal information is stored, such as computer rooms
11. Chief Privacy Officer
The Foundation has designated a Chief Privacy Officer and a department responsible for privacy matters to oversee personal information processing and to handle complaints and provide remedies to data subjects in connection with personal information processing.
| Category | Details |
|---|---|
| Chief Privacy Officer | Jinoh Song |
| Title | Director |
| Department | HOBAN Cultural Foundation |
| Telephone | 02-6337-7306 |
| Email Address | contact@next-art-ai.com |
12. Remedies for Infringement of Rights
Data subjects may contact the following institutions for remedies and consultation regarding personal information infringements.
Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Supreme Prosecutors’ Office, Cyber Investigation Division: 1301 (no area code), cid@spo.go.kr (spo.go.kr)
National Police Agency Cybercrime Reporting System: 182 (no area code) (https://ecrm.police.go.kr)
The institutions above are separate from the Foundation and may be contacted where a matter is not resolved through the Foundation’s own privacy complaint handling or remedies, or where more detailed assistance is required.
13. Changes to This Privacy Policy
This Privacy Policy takes effect on September 1, 2026.
Announcement Date: August 31, 2026
Effective Date: September 1, 2026
If this Privacy Policy is amended, the Foundation will announce the effective date and material changes through the website.