Privacy Policy
Privacy Policy
PROID Co., Ltd. ("the Company") maintains this Privacy Policy under Korea's Personal Information Protection Act ("PIPA") to protect the personal data of data subjects and to handle related grievances promptly. This policy applies to the Company's website (www.proidlab.com), the employee portal, and the Android app "PROID Portal" (com.proidlab.portal).
1. Purposes of Processing
The Company processes personal data only for the following purposes. If a purpose changes, the Company takes the measures required under Article 18 of PIPA, including obtaining separate consent where needed.
- Using the employee portal and app: identity verification and login, account management, processing of purchasing, sales, inventory, and project (R&D) tasks, managing approvals, attendance, leave, and business trips, and sending work notifications
- HR management: HR records, issuing certificates, and onboarding/offboarding procedures
- Transaction management: quotes, purchase orders, payments, and contact with vendors and clients
- Service protection: preventing fraudulent use, investigating security incidents, and keeping access logs
The Company's website has no membership sign-up or inquiry form and does not collect personal data from visitors.
2. Personal Data Items Processed
| Subject | Items | Collection Method |
|---|---|---|
| Employee portal / app users | (Required) email, name, password, department and position (Optional) mobile phone number, signature image, two-factor authentication data | Sign-up request, admin registration, entered by the user |
| Employee HR data | date of birth, hire/termination date, address, emergency contact, family details, education/career/qualifications, military service record, supporting document copies | Entered by the employee or HR staff |
| Attendance and work records | clock-in/out times, work location type (office/field/remote), leave and business-trip requests, approval documents, photos and files uploaded during work | Entered by the employee while using the portal/app |
| Vendor and client contacts | name, title, phone number, email, business address, bank name/account number/account holder for payment | Provided by the vendor during transactions |
| Automatically generated data | access IP address, access/activity logs, login-session cookies, notification address of the device receiving alerts (if notifications are turned on in the app/browser) | Generated automatically while using the service |
The Company does not collect Korean resident registration numbers or location (GPS) data, and does not process personal data of children under 14.
3. Retention and Use Period
The Company destroys personal data without delay once the purpose of processing has been achieved, except for the following, which are kept for the periods below.
| Data | Retention Period |
|---|---|
| Portal/app account data | For the duration of employment. Login is automatically disabled on the termination date, and the data is destroyed when the account is deleted |
| HR and attendance records | The period set by relevant law after termination (3 years under the Labor Standards Act, 5 years under the Framework Act on National Taxes) |
| Vendor contact data and transaction documents | 5 years after the transaction ends (Framework Act on National Taxes, Commercial Act) |
| Login session data | 8 hours (30 days if "stay signed in" is enabled). Deleted immediately on logout or password change |
| Portal notification inbox | 90 days |
| Notification device data | Deleted when notifications are turned off, on logout, or when the device address expires |
| Access logs | At least 1 year (Standards for Ensuring the Safety of Personal Data) |
| Encrypted disaster-recovery backup | Kept encrypted for 7 days |
4. Destruction Procedure and Method
- Personal data whose retention period has passed, or whose processing purpose has been achieved, is destroyed after review by the Personal Data Protection Officer.
- Electronic files are deleted using methods that prevent recovery, and paper documents are shredded or incinerated.
- Data that must be kept under law is stored separately from other data.
5. Provision to Third Parties
The Company does not provide personal data to third parties, except where the data subject has consented or where a special provision of law applies, such as a lawful request from an investigative agency.
6. Outsourcing of Processing
The Company outsources the following personal data processing tasks to operate its services, and sets and supervises the measures required to keep the data safe under each outsourcing contract.
| Processor | Outsourced Task |
|---|---|
| Cloudtype | Operating the website/portal server and database |
| Cloudflare, Inc. | Storing attachments and photos uploaded to the portal (R2 storage) |
| GitHub, Inc. | Storing encrypted disaster-recovery backups |
| NAVER Cloud Corp. (NAVER WORKS) | Sending work notifications via the business messenger |
| Google LLC, Apple Inc., Microsoft Corporation, Mozilla Corporation | Delivering push notifications to phones/browsers (only when notifications are enabled, and only for the device/browser maker in use) |
7. Overseas Transfer
For some of the outsourced tasks above, the Company transfers personal data overseas as follows (Article 28-8 of PIPA).
| Recipient (Country) | Items Transferred | Purpose / Retention Period |
|---|---|---|
| Cloudflare, Inc. (United States and other locations of the provider's data centers) privacy@cloudflare.com | Attachments and photos uploaded to the portal (work documents, supporting document copies, etc.) | File storage / until the backup retention period ends after the original file is deleted, or until the outsourcing contract ends |
| GitHub, Inc. (United States) github.com/contact/privacy | Encrypted backup of the entire database | Disaster recovery / 7 days |
| Google LLC, Apple Inc., Microsoft Corporation, Mozilla Corporation (United States) | Device address to receive notifications, notification title | Push notification delivery / immediately upon delivery (per each company's policy) |
- Timing and method of transfer: transmitted over encrypted communication (https) at the time the service is used
- How to refuse and the effect of refusing: attachment storage and backups are necessary to operate the portal and cannot be refused. Push notifications are not transferred if notifications are not enabled, or if they are turned off, in the portal/app; in that case you simply will not receive phone/browser push notifications.
8. App Access Permissions
The Android app "PROID Portal" uses only the following permissions.
| Permission | Type | Purpose of Use |
|---|---|---|
| Internet | Required | Connecting to the portal screens |
| Camera | Optional | Taking a work photo to attach it immediately. Even without granting this, you can still choose a photo from the gallery or use other features. |
You can change the optional permission at any time under [Settings → Apps → PROID Portal → Permissions] on your phone. The app does not access contacts, location, call logs, or the device's entire storage.
9. Automatic Collection Devices (Cookies, etc.)
- The portal and app use cookies to keep you signed in. If cookies are blocked, you cannot log in.
- Screen settings (such as table display preferences) are stored only in your device's browser storage.
- The Company does not use cookies for advertising or visitor analytics.
- The Kakao Map embedded in the "Directions" page on the website is provided by Kakao Corp., and its use is governed by Kakao's own privacy policy.
10. Rights of Data Subjects and How to Exercise Them
Data subjects may at any time request the Company to allow access to, correct or delete, suspend processing of, or withdraw consent for their personal data.
- Clicking your name at the top right of the portal opens the [My Info] panel, where you can immediately check your name, email, and permission summary, and the [My Settings (Password / Signature / Notifications)] screen lets you directly change your name, phone number, password, and signature. Department and position are managed as HR data and can only be changed by an administrator.
- For any other request, please contact the Personal Data Protection contact below by email or phone, and the Company will process it and inform you of the result without delay.
- Requests may also be made through a legal representative or an authorized agent, in which case a power of attorney must be submitted.
- Data that other laws require to be retained may continue to be kept for that period even if deletion is requested.
11. Account and Data Deletion Requests
You may request deletion of your portal/app account and related data as follows.
- Email info@proidlab.com with the subject "Account Deletion Request," including the email address you use to log in to the portal and your name.
- After verifying your identity, the Company will delete your account and personal data within 10 days and reply with the result.
- Data deleted: account data, signature, notification device data, screen settings, HR card, and other personal data
- Data retained: HR, attendance, and transaction records, and access logs that must be kept under law, are kept for the period stated in Section 3 before being destroyed.
A retired employee's account is automatically locked out of login on the termination date.
12. Measures to Ensure Safety
- Administrative measures: minimizing the number of staff who handle personal data, permission management by menu, and regular security checks
- Technical measures: encryption of all communications (https), one-way encrypted storage of passwords, two-factor authentication for administrators, blocking repeated login attempts, encrypted backups, and keeping logs of personal data access and management actions
- Physical measures: servers and storage are operated in security-certified cloud data centers
13. Personal Data Protection Officer
The Company designates the department below to oversee personal data processing and to handle related complaints and remedies.
| Role | Personal Data Protection Contact |
|---|---|
| info@proidlab.com | |
| Phone | 031-546-1471 |
| Address | Units B107 and 413, Geumjeong Station SK V1 Tower II, 136 LS-ro, Dongan-gu, Anyang-si, Gyeonggi-do, Republic of Korea |
14. Remedies for Infringement of Rights
If your rights have been infringed due to a personal data breach, you may apply for dispute resolution or consultation with the following organizations.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118, no area code (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301, no area code (www.spo.go.kr)
- National Police Agency: 182, no area code (ecrm.police.go.kr)
15. Changes to This Policy
This policy takes effect on November 10, 2026. If its content changes, the Company will post a notice on the website and the portal at least 7 days before the change takes effect.