Privacy Policy

SAMYOUNG ENG ("the Company") establishes and discloses this Privacy Policy under Article 30 of the Korean Personal Information Protection Act to protect the personal information of data subjects and to handle related complaints promptly and smoothly. This English version is a translation provided for reference; if it differs from the Korean version, the Korean version prevails. This does not limit your rights under applicable law.

1. Purposes of processing

The Company processes personal information only for the purposes below. If a purpose changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of the Act.

• Quotation and construction inquiries, after-sales service requests and customer feedback: reviewing the inquiry, consultation, and replying with a quotation or answer
• Job applications: identifying applicants, reviewing documents, running the selection process and notifying results
• Talent pool registration: identifying registrants and informing them of later job openings
• Website operation and security: providing the service, responding to failures and misuse, and keeping your language setting
• Visit statistics and advertising measurement: counting how visitors arrive and use the website, improving the website, and checking search advertising results (inquiry conversions)

2. Personal information processed and legal basis

1) Inquiries (quotation and construction consultation, after-sales service, customer feedback) — the data subject's consent (Article 15(1)(1))

• Required: name, email, message, inquiry type
• Optional (separate consent): company, phone number, type of work, site region, industry, area, target class, desired schedule, budget range, equipment and model, symptoms, attachments (including personal information contained in the files)
• You can send an inquiry without the optional items and attachments.

2) Job applications and talent pool registration — the data subject's consent (Article 15(1)(1))

• Job application, required: name, phone number, email, the job posting applied for, application form, résumé and other attachments (including personal information contained in the files)
• Required fields in the standalone talent pool form: name, phone number, email, desired field, years of experience, résumé and other attachments
• When applying for a job, additional talent pool registration occurs only with optional consent, and the submitted application information and attachments are stored separately. This route does not ask you to enter a desired field or years of experience separately.
• Optional (separate consent): a message such as a self-introduction
• Please do not include your resident registration number, health information or other sensitive information in attachments.

3) Information recorded with a submission

• Inquiries: time of receipt, inquiry channel, processing status, and the times of required and optional consent
• Inquiry source information: the first page you entered before the inquiry, the referring site (domain), the traffic channel (search, advertising, direct visit, etc.), advertising and campaign information (utm values, search keyword, ad click identifier), the time of your first visit and its source information, a hashed visitor identifier derived from the syeng_vid cookie and the session identifier from the syeng_ses cookie. This is not recorded if you have opted out of visit statistics.
• Job applications and talent pool: time of receipt, the times of required and optional consent, and the consent wording you agreed to and its version

4) Information processed without consent — Article 15(1)(6) of the Act

• Access records (IP address, date and time of access, requested address, browser information and referring page): processed for reliable website operation and responding to failures and misuse.
• Language cookie (i18next): processed to retain the language you selected. Its retention period and refusal options are described in Sections 3 and 9.
• Visit statistics: the address of pages visited, the referring site (domain), advertising and campaign information (utm values, search keyword, ad click identifier), device type derived from screen width, operating system and browser type, language, time spent, actions such as tapping a phone number, downloading the company profile or submitting an inquiry (not the content of the inquiry), and the identifiers in the visit statistics cookies (syeng_vid, syeng_ses). The visit statistics database stores a hashed identifier derived from syeng_vid; without that cookie, it uses a hashed identifier derived from the date, IP address and browser information that changes every day. The session identifier (syeng_ses) is stored as it is, and raw IP addresses are not stored. The collection time, website host, event identifier, presence of a visitor cookie and whether the event starts a session are also recorded. This is processed without consent to count how visitors arrive and use the website, improve it and check advertising results, and you can opt out at any time as described in Section 9.
• This processing is limited to cases substantially related to those operational interests, not exceeding a reasonable scope, and where those interests clearly outweigh the data subject's rights.

3. Processing and retention periods

The Company processes and retains personal information for the period consented to by the data subject or required by law.

• Inquiries: retained for 3 years from the date of receipt and then destroyed without delay (quotation and construction consultations involve long review and follow-up periods, and the consultation history is needed to handle disputes). If you ask for deletion, the information is destroyed without delay even before then.
• Job applications: the application and its attachments are destroyed automatically 365 days (1 year) after receipt.
• Talent pool registrations: the registration and its attachments are destroyed automatically 365 days (1 year) after registration.
• Access records: the website's web server access records are kept in rotation, up to 3 files of 10 MB each; beyond that, the oldest records are deleted automatically.
• Language cookie: 1 year
• Inquiry source information: kept with the inquiry it belongs to and destroyed together with that inquiry.
• Visit statistics (the Company's own records): deleted automatically 14 months after collection.
• Google Analytics user-level and event-level data: 14 months (see Section 5)
• Visit statistics and advertising measurement cookies: the periods in the cookie list in Section 9

Information that another law requires to be kept is stored separately from other personal information for the period that law sets.

4. Provision to third parties

The Company processes personal information only within the purposes in Section 1 and provides it to a third party only where Articles 17 and 18 of the Act allow, such as with the data subject's consent or under a specific provision of law.

5. Entrustment of processing and overseas transfer

To deliver the website reliably and securely and to measure visit statistics and advertising results, the Company entrusts processing as follows; personal information is transferred overseas in the course of the entrustment to Cloudflare and Google.

1) Cloudflare (website delivery and security)

• Entrusted party (recipient): Cloudflare, Inc. and its subsidiaries
• Contact: 101 Townsend St., San Francisco, CA 94107, USA / dpo@cloudflare.com
• Entrusted work and purpose: website delivery (content delivery network) and access protection (security)
• Items transferred: information transmitted when you use the website (IP address, date and time of access, requested address, browser information, and the content and attachments you submit with an inquiry or application)
• Recipient countries published by Cloudflare in Section 3 of its South Korea addendum: United States, United Kingdom, Singapore, Australia, Germany, Portugal, France, Japan, Canada, the Netherlands, the United Arab Emirates, India, Mexico, Malaysia and Sweden. This is Cloudflare's general published list, not a separately verified list of all transit and storage countries applicable to this website.
• Timing and method: transferred over the network when you visit the website or submit information
• Cloudflare's published retention criteria: Section 11 of its privacy policy considers the processing purpose and legal obligations, the volume, nature and sensitivity of the information, risks from misuse or disclosure, and whether the purpose can be achieved with less data. These published criteria do not specify confirmed retention periods for this website's relayed content and access or security records individually.
• Legal basis: Article 28-8(1)(3) of the Act (entrustment of processing necessary to conclude and perform a contract with the data subject, disclosed in this Privacy Policy)
• If you do not want the transfer: not using the website and not submitting online avoids further transfers, but you then cannot use the website's online inquiry and application features. You can also make an inquiry by phone (+82-31-355-3315). To exercise your rights over information already transferred, contact the privacy officer in Section 10.
• Related policies: https://www.cloudflare.com/privacypolicy/ , https://www.cloudflare.com/privacypolicy/southkorea-addendum/

2) Google (visit statistics analysis, advertising conversion measurement)

• Entrusted party (recipient): Google LLC
• Contact: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / https://support.google.com/policies/contact/general_privacy_form
• Entrusted work and purpose: visit statistics and inquiry-conversion analysis using GA4, and measurement of the one-minute conversion using Google Ads. The Company does not use Google's ad-personalization or remarketing features.
• Items transferred: the identifiers in the Google cookies listed in Section 9, the address and title of pages visited, the referring site, device, operating system and browser information, screen size, language, the IP address and the approximate location (country and city) estimated from it, ad click identifiers, and action information. Action information includes the inquiry type, type of work, whether attachments are present, job-application or talent-pool submission, the location of phone, company-profile and inquiry-button clicks, the identifier of the 3D project opened, and whether one minute has elapsed. Event parameters configured directly by the Company do not include the inquiry message, name, personal contact details, email address or attachment contents.
• IP address: your IP address is transmitted to Google. According to Google's published explanation, IP addresses of users in the EU, Switzerland and the UK are discarded immediately after coarse-location derivation. Outside those regions, raw IP addresses are discarded after use for location derivation and basic functions such as spam detection. For Google Ads-linked properties, encrypted IP addresses may be transferred to Google Ads and stored and used there, depending on the settings.
• Recipient countries: the United States and any other country where Google or its subprocessors maintain facilities. Section 10.1 of the Google Ads Data Processing Terms provides that Google may process the data in any country in which Google or its subprocessors maintain facilities. Google data center locations are listed at https://www.google.com/about/datacenters/locations/ , and subprocessors and their locations at https://business.safety.google/adssubprocessors/ .
• Timing and method: data is sent from your browser to Google over the network when pages load or change, when the actions described above occur, or when time spent is measured.
• Retention period: GA4 user-level and event-level data is retained for 14 months, with retention reset on new activity disabled. Expired data is deleted through Google's monthly deletion process. This setting does not apply to standard aggregated reports or data processed separately by Google Ads. Under Google's data retention policy (https://policies.google.com/technologies/retention), advertising data such as Google Ads data is anonymized in server logs by removing part of the IP address after 9 months and cookie information after 18 months. Cookie storage periods are listed in Section 9.
• Legal basis: Article 28-8(1)(3) of the Act (entrusted processing and storage, with the items, countries, timing and method, recipient, purpose and retention period, and how to refuse disclosed in this Privacy Policy)
• If you do not want the transfer: to refuse analytics and advertising measurement, use the visit statistics opt-out button in Section 9 and reload the website, or load the website in a browser sending a DNT or GPC signal. Blocking cookies alone does not stop all analytics transmissions. The Google Analytics opt-out add-on blocks Google Analytics measurement only; it does not block Google Ads, NAVER or the Company's own collection. Refusal does not prevent use of the website or its online inquiry and application features.
• Related policies: https://policies.google.com/privacy , https://business.safety.google/privacy/

3) NAVER (search advertising conversion measurement)

• Entrusted party: NAVER Corporation
• Contact: 95 Jeongjail-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Korea (NAVER 1784) / customer center +82-1588-3820
• Entrusted work and purpose: NAVER search advertising conversion measurement (checking visits from NAVER ads and whether those visits led to an inquiry) and NAVER log analytics for that purpose
• Items processed: the identifiers in NAVER log analytics cookies, the address of pages visited, the referring site, NAVER ad click information, device and browser information, IP address, and whether an inquiry was submitted (the content of the inquiry and entered information are not sent)
• Timing and method: sent from your browser to NAVER over the network when you visit the website, move between pages or submit a quotation or after-sales service inquiry
• Retention period: under NAVER's privacy policy, the information is destroyed without delay once its retention period ends or its purpose is fulfilled. NAVER does not publish a separate server-side retention period for this conversion measurement data. The storage periods of NAVER cookies in your browser are listed in Section 9.
• How to refuse: use the visit statistics opt-out button in Section 9 and reload the website, or load the website in a browser sending a DNT or GPC signal. Blocking cookies alone does not stop all transmissions to NAVER.
• Related policy: https://policy.naver.com/policy/privacy_en.html

If the entrusted work or the entrusted party changes, the Company will announce it through this Privacy Policy.

6. Destruction procedure and method

1) Procedure: personal information whose retention period has ended or whose purpose has been fulfilled is destroyed without delay. Original job application and talent pool records and their attachments are deleted through the system's automatic cleanup after their retention period ends. The processing records described in Section 8, such as access and destruction records, are not included in this automatic deletion. Where another law requires continued retention, the information is kept separately from other personal information for the period that law sets.

2) Method: the system deletes original job application and talent pool records from the database and attachments from storage. Destruction of personal information must include the measures necessary to prevent recovery or reproduction. Where paper documents are destroyed, appropriate methods such as shredding or incineration must be used.

7. Rights and obligations of data subjects and legal representatives, and how to exercise them

1) You may at any time ask the Company for access to, correction or deletion of, or suspension of processing of your personal information, or withdraw your consent.

2) You can exercise these rights in writing, by phone or by email to the privacy officer below, and the Company will act without delay.

3) You can also exercise these rights through a legal representative or an authorized agent. An authorized agent must submit a power of attorney, and a legal representative must submit documents confirming the legal representation.

4) Your rights may be restricted under Articles 35(4), 36(1) and 37(2) of the Act and other provisions.

5) You cannot ask for deletion of personal information that another law specifies must be collected.

6) The Company checks that the person making a request is the data subject or a legitimate representative.

7) Do not enter another person's personal information without authorization.

8. Safeguards

The Company takes the following measures to keep personal information secure.

• Access rights: inquiry and recruitment information can be viewed only through authenticated administrator accounts.
• Access control: the administration pages require ID and password authentication, and the login renewal information is kept in a secure cookie that scripts cannot read (HttpOnly).
• Attachment protection: attachments are stored separately from public paths, can be downloaded only after administrator authentication, and their file types are checked on upload.
• Encryption in transit: information exchanged between your browser and the website is sent over encrypted connections (HTTPS).
• Processing records: the Company keeps records of processing such as viewing and destroying recruitment information.
• Misuse prevention: repeated submissions in a short time are limited.

9. Installation, operation and refusal of automatic collection devices

1) The Company uses the cookies below. Visit statistics and advertising measurement cookies are set only when the administrator has turned on visit analytics, and are not set on pages loaded after you saved an opt-out or while your browser sends a Do Not Track (DNT) or GPC signal.

• i18next (the Company): remembers the language you chose (Korean or English) / 1 year
• syeng_vid (the Company): a random identifier that recognizes the same visitor in visit statistics / 1 year
• syeng_ses (the Company): a random identifier that recognizes the same visit (session) in visit statistics / 30 minutes after last use
• syeng_analytics (the Company): remembers that you opted out of visit statistics (stored only if you opt out) / 1 year
• _ga (Google Analytics): distinguishes visitors / 2 years
• _ga_<ID> (Google Analytics, where <ID> is the measurement ID): keeps the visit (session) state / 2 years
• _gcl_ cookies, including _gcl_au, _gcl_aw and _gcl_gs (Google Ads): Google ad-click information and conversion measurement / 90 days by default
• NAVER ad visit cookies (NA_SA, NA_DA, NVADID; NAVER): remember visits that arrived by clicking a NAVER search or display ad and measure inquiry conversions / NA_SA 20 days, NA_DA and NVADID 30 days
• NAVER log analytics cookies (NA_CO, NA_SAC, NA_SAS, NA_MI; NAVER): temporarily pass ad visit and conversion information / until you close the browser
• NA_TRIDTP (NAVER): prevents the same conversion from being sent twice / 1 day
• wcs_bt, _fwb (NAVER): record visit times and distinguish browsers / about 200 years (73,000 days, effectively no expiry; can be deleted in your browser)
• The periods of NAVER cookies are the values set in NAVER's conversion script (wcslog.js 0.8.32) and may change if NAVER changes the script.

In addition to cookies, the Company uses browser session storage and local storage. The values below are stored only on pages where visit statistics and advertising measurement run.

• syeng_touch (the Company, session storage and local storage): this visit's landing page, referring domain, and advertising and campaign information. So that a new tab opened during the same visit can keep using it, local storage holds this information together with the visit (session) identifier from syeng_ses. It is sent with an inquiry as inquiry source information / in session storage, until the tab is closed or a new visit replaces it; in local storage, until the next visit (session) starts and replaces it, or until you delete this website's site data in your browser
• syeng_first_touch (the Company, local storage): the first-visit time and source information, never overwritten once stored and sent with an inquiry as inquiry source information / no automatic expiry; retained until you clear this website's data in your browser
• time_remain (Google Tag Manager, session storage): the remaining time used to measure Google Ads' one-minute conversion / until the tab is closed
• _gcl_ls (Google Ads, local storage): ad-click information stored by Google's conversion linker. Cookie expiry and the Company's server retention periods do not specify the expiry of this local storage.

2) You can refuse these cookies as follows. You can still use the website and its online inquiry and application features if you refuse.

• Opt out of visit statistics: pressing the "Opt out of visit statistics" button on this Privacy Policy page saves your choice in the browser and reloads this page. After that, the Company's visit statistics and the Google and NAVER tags do not run on pages loaded with the choice saved. If this website is open in other tabs, reload those tabs for the choice to apply there. You can allow them again with the "Allow visit statistics" button in the same place, which also reloads the page. The choice is stored in the browser you use, so you need to choose again if you change browser or device or delete cookies.
• Tracking refusal signals: when a page loads while Do Not Track or GPC (Global Privacy Control) is turned on in your browser, the visit statistics and the Google and NAVER tags do not run on that page.
• Google Analytics opt-out browser add-on: available at https://tools.google.com/dlpage/gaoptout. The add-on blocks Google Analytics measurement only; it does not block Google Ads, NAVER or the Company's own collection.
• Browser settings: you can refuse or delete cookies (for example, Chrome Settings > Privacy and security > Third-party cookies, Safari Settings > Privacy, Edge Settings > Cookies and site permissions). Blocking cookies alone does not stop all analytics transmissions. Without the language cookie you can still use the website through the language path (/ko, /en) and your browser's language setting.

3) The company location page loads Google Maps. When the map is shown, your browser connects to Google directly, so your IP address, browser information and similar data are sent to Google, and Google may use its own cookies. Google's privacy policy (https://policies.google.com/privacy) applies to this, and you can block third-party cookies in your browser settings.

10. Privacy officer

The Company has designated the following privacy officer to oversee the processing of personal information and to handle data subjects' complaints and remedies.

• Name: Kim Yu-na
• Phone: +82-31-355-3315
• Email: mskim@syeng.net

You can contact the privacy officer with any inquiry, complaint or request for remedy about personal information, and the Company will answer and act without delay.

11. Remedies for infringement of rights

To seek a remedy for an infringement of personal information, you can apply for dispute resolution or consultation to the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Prosecution Service: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

12. Changes to this Privacy Policy

1) This Privacy Policy applies from October 24, 2026. This revision adds the items processed and retention periods for visit statistics (the Company's own records) and inquiry source information, entrusted processing and overseas transfer to Google LLC for Google Analytics 4 and Google Ads conversion measurement, entrustment to NAVER for search advertising conversion measurement, the list of cookies used, and how to opt out of visit statistics (the opt-out button, Do Not Track and GPC signals, and the Google Analytics opt-out add-on), and changes the privacy officer. The previous text is available through the version list and comparison below.

2) If this Privacy Policy changes, the Company will announce it on the website at least 7 days before the change takes effect (at least 30 days before for changes that materially affect your rights).

3) Previous versions are available in the list of versions on this page.