Privacy Policy
Effective Date: September 15, 2026 (first effective September 1, 2026)
Article 1 (Purpose and Data Controller)
The Innopolis Venture Association (Operating Secretariat of the Quantum Transformation Industry-Council, QTI-C; hereinafter the "Association") is the data controller operating the Council website (qti-c.kr, the "Q-Platform"). The Association complies with the Personal Information Protection Act and other relevant laws, and establishes and discloses this Privacy Policy to protect the personal information of data subjects and to promptly handle related grievances.
The Association processes personal information only for the purposes below and does not use it for any other purpose. If a purpose changes, the Association obtains separate consent or takes other measures required under Article 18 of the Personal Information Protection Act.
- Membership registration and management: confirming intent to register, identity verification, maintaining membership (administrator approval), notices
- Council participation applications: receiving and reviewing applications, registering participating organizations, guiding MOU execution
- Program and event operation: providing program announcements and event notices, receiving event registrations and managing participants
- Inquiries and proposals: identity confirmation, replies and result notices for Q&A, proposals and technology cooperation submissions
- Service improvement: analyzing usage statistics and improving service quality
Article 2 (Items Collected and Collection Methods)
| Category | Items | Method |
|---|---|---|
| Membership (ID registration) | (Required) ID, password, name, email | Website registration form |
| Social login | (Required) social account identifier, email, name — no password is collected or stored | External social login (Google, Kakao) |
| Council participation application | (Required) organization name, type, representative, address, phone, email, website, industry and technology fields, contact person name, title, mobile phone, email, applicant (Optional) organization brochure | Participation application form |
| Q&A, proposal, technology cooperation | (Required) name, email (Optional) affiliation, contact number | Submission form |
| Event registration | (Required) name, email (Optional) contact number, affiliation | Registration form |
| Automatically collected | Login records (IP address, timestamp, browser information), service usage records | Generated automatically during service use |
Social login signs the member in with an external account selected by the member; only the minimum identifiers provided by that service are collected and no password is stored.
Every form that collects personal information states the items, purpose and retention period and obtains consent. The service is intended for organization and company representatives and does not collect personal information from children under 14. Where processing of a child under 14 is necessary, consent of a legal guardian is obtained under Article 22-2 of the Act.
Article 3 (Processing and Retention Period)
The Association processes and retains personal information within the retention period required by law or agreed at the time of collection.
| Category | Retention period | Basis / Note |
|---|---|---|
| Member information (ID registration, social login) | Until membership withdrawal | Destroyed without delay upon withdrawal |
| Council participation application | Until participation in the Council ends | Management of participating organizations and MOU performance. Applications that do not lead to participation are destroyed after review |
| Q&A, proposal, technology cooperation, event registration | 1 year after completion (reply sent or event ended) | Additional retention to handle follow-up inquiries and confirm results or attendance; destroyed after the period |
| User login records (IP address, etc.) | 1 year | Prevention of misuse and security incident response |
| Access and processing records of administrators of the personal information processing system | At least 1 year | Standards for Ensuring the Safety of Personal Information; at least 2 years where 50,000 or more data subjects, sensitive or unique identification information are processed |
Personal information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Where an investigation into a violation of law is ongoing or retention is required by law, it is retained until that reason ends or for the period prescribed by law.
Article 4 (Provision to Third Parties)
The Association does not provide personal information to third parties except in cases under Articles 17 and 18 of the Act, such as with the consent of the data subject or where required by law.
Google and Kakao social login links the authentication result from the provider selected by the user. It does not constitute the Association selling or independently providing member information to those providers. Personal information processed directly by each provider is governed by that provider’s privacy policy.
Article 5 (Outsourcing of Processing)
The Association outsources personal information processing as follows. The outsourcing contract specifies the prohibition of processing beyond the outsourced purpose, technical and organizational safeguards, restrictions on sub-outsourcing, supervision and liability, and the Association supervises the processor.
| Processor | Outsourced services | Sub-processors and services | Period |
|---|---|---|---|
| First R&D Co., Ltd. | Q-Platform development, operation and maintenance; management of member data and personal information systems | Supabase, Inc.: authentication and data storage/management Vercel Inc.: web hosting, access data and usage analytics Plus Five Five, Inc. (Resend): email delivery | Until the outsourcing contract ends |
Any change to the outsourced services or processors is disclosed without delay through this Privacy Policy.
Article 6 (Overseas Transfer)
The Association transfers personal information overseas for email delivery as follows. Data subjects may object by contacting the Privacy Officer; however, email-based verification, notices and password reset may then be limited.
| Recipient / Country | Data transferred | Timing / Method | Purpose | Retention |
|---|---|---|---|---|
| Plus Five Five, Inc. (Resend) / United States | Email address, email metadata and message content (including name where necessary) | Transferred over an encrypted network when an email is sent | Delivery of service-related emails | Email and log data: 30 days (customer data deleted within 90 days after account termination) |
Article 7 (Destruction)
The Association destroys personal information without delay when it is no longer needed due to expiry of the retention period or achievement of the purpose.
- Procedure: personal information subject to destruction is destroyed under the responsibility of the Privacy Officer.
- Method: electronic files are deleted so they cannot be restored; printed materials are shredded or incinerated.
Article 8 (Security Measures)
The Association takes the following measures to ensure the safety of personal information.
- Organizational: internal management plan, minimizing and training staff who handle personal information
- Technical: access control and least privilege, encryption in transit (SSL), non-reversible storage of passwords for ID-registered members (no password is stored for social login members), retention and review of access logs for at least 1 year, change history (audit log), security software and vulnerability management
- Physical: data center access control by infrastructure providers
Article 9 (Cookies and Automatic Collection)
The Association may use cookies and browser storage for user convenience, only to keep the login session and screen settings such as whether a popup has been dismissed. Users may refuse cookies in their browser settings, in which case some services such as login may be inconvenient.
Usage statistics are produced with a cookie-free web analytics tool (Vercel Web Analytics) that processes only aggregated, non-identifying data; the Association does not collect behavioral data or use it for targeted advertising. If an analytics tool that collects behavioral data, such as Google Analytics, is introduced in the future, the items, purpose, retention and opt-out method will be announced in this policy beforehand.
Article 10 (Rights of Data Subjects and Legal Representatives)
Data subjects may at any time exercise their rights to access, correct, delete or suspend processing of personal information and to withdraw consent (Articles 35 to 37 of the Act), through My Page or by writing or emailing the Privacy Officer in Article 11. The Association acts without delay. Where correction or deletion is requested, the information is not used or provided until completed.
These rights may also be exercised through a legal representative or an authorized agent. The Association may verify the identity and authority of the requester and will take the necessary action without delay unless otherwise permitted by law.
Article 11 (Privacy Officer)
The Association designates the department below to oversee personal information processing and to handle complaints and remedies. Data subjects may contact this department regarding privacy inquiries, complaints and remedies, and the Association responds without delay.
- Department in charge of privacy and grievances: QTI-C Operating Secretariat (Innopolis Venture Association)
- Phone: +82-42-368-9713
- Email: contact@qti-c.kr
Article 12 (Remedies)
Data subjects may apply for dispute resolution or counseling with the following organizations.
Article 13 (Changes to the Privacy Policy)
This Privacy Policy applies from its effective date. Changes that materially affect the rights of data subjects, such as collected items, purposes, retention periods or third-party provision, are announced through the website notice board and this page from 7 days before they take effect. Minor changes such as updates to the processor list are reflected on this page immediately and may be announced together over a period.
Revision history: first effective September 1, 2026 / September 15, 2026: data controller stated, Council participation application items, retention table, right to withdraw consent, automatic collection, remedy organizations.
