Skip to main content
KO
Donate KO

Privacy Policy

Ronald McDonald House Korea (the “Foundation”) recognizes the importance of protecting personal data and processes personal data in accordance with applicable laws and regulations. This Privacy Policy explains how the Foundation collects, uses, retains, and protects personal data. Any amendments to this Policy will be announced through the Foundation website or, where appropriate, through individual notice.

1. Personal Data Collected

The Foundation collects the following personal information for membership registration, consultations, service applications and use, donations, donation receipt issuance, volunteer applications, newsletters, and updates on the Foundation's activities.

1) Categories of Personal Data Collected

① Individual Donors

· Name, date of birth, gender, mobile phone number, user ID, password, email address, and address.

· Individuals under the age of 14 may not register for an account.

② Corporate Donors

· Company name, contact person's name, contact number, contact person's email address, user ID, password, address, and business registration number. The business registration number is collected for the purpose of issuing donation receipts.

③ Social Login Users

· When a user registers or logs in through Kakao or Naver, the Foundation receives the user's social account identifier and email address.

· Where the relevant social platform does not provide certain information, the Foundation separately collects the user's name, date of birth, gender, mobile phone number, and email address.

· Individuals under the age of 14 may not register for an account through social login.

④ Non-Registered Donors

· For individual donors, the Foundation collects the donor's name, date of birth, gender, and email address. The donor's mobile phone number is processed for identity verification.

· For corporate donors, the Foundation collects the company name, contact person's name, contact number, and contact person's email address. A business registration number may also be collected where available.

⑤ Payment Data

· For credit card payments, the Foundation collects the card issuer, card number, expiration date, cardholder name, and cardholder's date of birth.

· For CMS direct debit payments, the Foundation collects the bank name, account number, account holder's name, account holder's date of birth, and withdrawal authorization signature.

· For certain credit card payments, additional data required to process the payment, including the card number, expiration date, and card security code (CVC/CVV), may be collected.

⑥ Other Donation-Related Data

· In connection with donations, the Foundation processes data including donor type, donation type, donation amount, payment method, and whether a donation receipt has been requested.

· For certain donations, additional data including first name, last name, email address, country, and address may be collected.

⑦ Donation Receipts

· For individual donors, a resident registration number is collected once for the purpose of issuing a donation receipt.

· For corporate donors, the business registration number is used for the purpose of issuing a donation receipt.

⑧ Volunteer Applications

· For individual applicants, the Foundation collects the applicant's name, date of birth, gender, contact number, email address, address, and application-related information.

· For corporate applicants, the Foundation collects the company name, contact person's name, contact number, contact person's email address, address, and application-related information.

⑨ Newsletters and Activity Updates

· When a user subscribes to the newsletter, the Foundation collects the user's email address.

· During account registration and the donation process, users may also choose whether to consent to receiving newsletters and activity updates.

2) Methods of Collection

Website, social login integration, and identity verification.

2. Purposes for Processing Personal Data

The Foundation processes personal data for the following purposes:

  1. Account registration, identity verification, login, and account management
  2. Processing donations and managing donors
  3. Processing donation payments and managing payment data
  4. Reviewing donation history and processing the application and issuance of donation receipts
  5. Providing service-related notices, including account registration and donation processing updates
  6. Receiving and processing volunteer applications, verifying applicants, and providing participation information
  7. Providing newsletters and activity updates to users who have consented to receive such communications

3. Retention Period of Personal Data

The Foundation retains personal data only for as long as necessary to fulfill the purposes for which the data were collected and processed. Unless otherwise required by applicable laws or for another legitimate retention purpose, personal data will be destroyed without delay once the relevant purpose has been fulfilled.

Personal data of users with no donation history will be retained for one week following account deletion for account recovery purposes and will then be destroyed.
Donation history, payment records, and donation receipt data will be retained separately for the period required under applicable laws and regulations and as necessary for the issuance of relevant documentation.
Personal data collected through volunteer applications will be retained for one year and will be destroyed thereafter unless there is a separate basis for continued retention.
All other personal information is destroyed when its purpose has been fulfilled, unless there are separate grounds for retention.

4. Procedures and Methods for Destruction of Personal Data

The Foundation destroys personal data without delay once the purpose for which the data were collected and processed has been fulfilled, unless continued retention is required. The procedures and methods for destruction are as follows:

1) Destruction Procedures

Personal data provided by users for account registration, service applications, or use of services will, once the relevant purpose has been fulfilled, be transferred to a separate database or, in the case of paper records, stored separately.

Such data will be retained for the period required under internal policies or applicable laws and regulations and will thereafter be destroyed.
Personal data retained separately will not be processed for any purpose other than the purpose for which they are retained, except where permitted or required by law.

2) Destruction Methods

Personal data stored in electronic format will be permanently deleted using technical methods that prevent the data from being recovered or reproduced.

5. Provision of Personal Data to Third Parties

The Foundation does not, in principle, provide users' personal data to third parties.

Personal data may, however, be provided in the following circumstances:

  • · Where the user has given prior consent; or
  • · Where disclosure is required by applicable laws and regulations or is requested by an investigative authority in accordance with procedures prescribed by law.

6. Outsourcing of Personal Data Processing

The Foundation outsources the following personal information processing activities to facilitate its operations.

Service ProviderOutsourced Activities
NICE PaymentsProviding payment methods for donations
NICE TheBillProcessing CMS direct debit and credit card payments for recurring donations
Toss PaymentsProcessing overseas donations through the English-language website

When entering into outsourcing agreements, the Foundation specifies in contracts or other written documents the matters required under Article 26 of the Korean Personal Information Protection Act. These include prohibitions on processing personal information for purposes other than the outsourced activities, technical and organizational safeguards, restrictions on subcontracting, management and supervision of service providers, and responsibilities such as liability for damages. The Foundation also supervises service providers to ensure that personal information is processed securely.

In accordance with Article 26 Clause 6 of Korean Personal Information Protection Act, service providers must obtain the Foundation's consent before subcontracting the Foundation's personal information processing activities. The Foundation discloses the subcontractors and the activities subcontracted to them through this Privacy Policy.

The Foundation does not outsource the processing of members' or users' personal information to external companies without their consent. If such outsourcing becomes necessary in the future, the Foundation will notify members of the service provider and the activities to be outsourced and obtain prior consent where required.

If such outsourcing becomes necessary, the Foundation will notify users of the relevant service provider and the scope of the outsourced processing and, where required, obtain prior consent.

7. Rights of Users and Legal Representatives

Users may at any time access or correct their registered personal data or request deletion of their account.
Users may access or correct their personal data through the “Edit Personal Information” or “Edit Account Information” function. Users wishing to withdraw their consent or delete their account may select “Delete Account” and complete the required identity verification process.

Users may also submit a request in writing or by email to the person or department responsible for personal data protection. The Foundation will respond to such requests without delay.
Where a user requests correction of inaccurate personal data, the Foundation will not use or provide the relevant data until the correction has been completed.
Where incorrect personal data have already been provided to a third party, the Foundation will promptly notify the relevant third party of the correction so that the data may be corrected accordingly.
Personal data deleted at the user's request will be handled in accordance with the retention periods set out in this Personal Data Protection Policy and will not be accessed or processed for any other purpose.

Individuals under the age of 14 are not eligible to register as individual members or through social login.

8. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of Korean Personal Information Protection Act and the Standards for Measures to Ensure the Security of Personal Information, as notified by the Ministry of the Interior and Safety, the Foundation implements the following technical, organizational, and physical safeguards.

  1. Establishment and Implementation of an Internal Management Plan The Foundation establishes an internal management plan in accordance with legally prescribed security standards and implements it thoroughly.
  2. Limiting and Training Personnel Who Handle Personal Information The Foundation limits the number of personnel authorized to handle personal information and provides regular privacy training to strengthen its management practices.
  3. Access Permission Management The Foundation controls access to personal information by granting, modifying, and revoking access permissions for personal information processing systems, including databases. Records of changes to access permissions are retained for at least three years. The Foundation also operates an intrusion prevention system to block unauthorized external access and requires personnel accessing these systems remotely to use a virtual private network (VPN).
  4. Access Log Management and Protection Against Tampering Access logs for personal information processing systems are securely retained for at least two years. Security measures are applied to prevent tampering, theft, and loss.
  5. Encryption of Personal Information Users' personal information is encrypted when stored. Important data is encrypted both in storage and during transmission, and additional security features are applied.
  6. Protection Against Hacking and Other Cyberattacks The Foundation installs, regularly updates, and inspects security software to prevent the disclosure or damage of personal information caused by hacking, malware, and other external attacks. Systems are operated in areas with restricted external access, and technical and physical monitoring and blocking measures are maintained continuously.
  7. Physical Access Controls The Foundation designates separate areas for storing personal information and establishes and implements entry control procedures to prevent unauthorized physical access.
  8. Dedicated Privacy Organization The Foundation maintains a dedicated privacy organization to monitor compliance with this Privacy Policy and promptly takes corrective action when violations are identified. However, the Foundation assumes no liability for problems arising from the disclosure of personal information, including user IDs and passwords, due to users' own negligence or problems on the internet.

9. Installation and Operation of Automatic Data Collection Technologies and How to Refuse Them

The Foundation uses cookies, which store and retrieve usage information, to provide personalized services and convenience to data subjects.

Cookies are small pieces of information sent by the server (HTTP) operating a website to a data subject's browser. They are stored on the data subject's computer or mobile device and are automatically transmitted from the browser to the server when the website is accessed.

Data subjects may allow or block cookies through their browser settings.

10. Personal Data Protection Inquiries and Complaints

For inquiries or complaints concerning personal data protection, please contact the Foundation at:
Privacy Officer: Head of Operations, Ronald McDonald House Korea
Email: contact@ronaldmcdonaldhousekr.org

Users may submit inquiries or complaints relating to the processing or protection of their personal data through the contact information above. The Foundation will review and respond to such inquiries without delay.
For additional assistance or consultation concerning personal data infringement, please contact the relevant organizations below:

  1. Personal Information Dispute Mediation Committee
    Website: www.kopico.go.kr
    Telephone: 1833-6972
  2. Personal Information Infringement Report Center
    Website: privacy.kisa.or.kr
    Telephone: 118
  3. Public Prosecution Service
    Website: www.spo.go.kr
    Telephone: 1301
  4. Cyber Investigation Bureau, Korean National Police Agency
    Website: ecrm.cyber.go.kr
    Telephone: 182 (no area code required)