Privacy Policy

a. Customer inquiries (Q&A)

• Purpose of processing: Receiving inquiries, reviewing inquiry details, replying by e-mail and any necessary follow-up contact
• Required items: Inquiry type, name, e-mail address, subject, inquiry details
• Optional items: Mobile phone number, telephone number, attachments

b. Job applications

• Purpose of processing: Conducting the recruitment process, verifying applicants, communication regarding the recruitment process and notification of results
• Required items: Name, position applied for, mobile phone number, e-mail address, résumé, career description (experienced applicants only)
• Optional items: Address, education, military service, desired salary, work experience, foreign languages, certifications, cover letter, personal links (blog, etc.), date of birth (if included in the submitted résumé)

Date of birth is not requested as a separate input field. You may apply without entering the optional items.

The Company does not request information that is not necessary for recruitment screening, such as resident registration number, family relations, marital status, physical characteristics or place of origin. Please take care that your submitted documents do not contain unnecessary personal information or the personal information of other people.

c. Ethics consultations and reports

• Purpose of processing: Receiving consultations and reports, verifying and investigating the facts, follow-up actions and replying with the outcome
• Required items: Subject, e-mail address (for replies), report details
• Optional items: Name, mobile phone number

You may submit a report without entering your name or mobile phone number. However, because an e-mail address for replies is collected, this differs from a fully anonymous method that leaves no contact details at all. You may use an e-mail address that does not reveal your real name.

The Company restricts access to report details and reporter information to the personnel who need it to perform their work.

d. Information generated during submission

The Company records the following information to manage submissions and confirm the results of e-mail delivery.

• Submission number, form type, page language, time of submission
• Result of e-mail delivery processing
• Names and sizes of attachments

Original attachments are checked for file type and size in server memory and then forwarded to the e-mail of the persons in charge. They are not saved to the website server's disk or as temporary files.

e. Website access logs and automated input prevention

Web server access logs record the date and time of access, server IP address, request method, requested page path, server port, processing result and processing time, among other things. Visitors' IP addresses, browser identification information (User-Agent), referring pages (Referer) and cookie values are not recorded.

The /api path that handles input form submissions is excluded from web server access logging, and visitors' IP addresses are not stored in the submission records either.

However, to prevent automated input and repeated submissions, visitors' IP addresses are processed temporarily in server memory for 10 minutes and then cleared. This information is not saved to disk and is reset when the application restarts.

f. Collection method and legal basis for processing

The Company collects personal information directly through the input forms and attachments on its website.

Personal information for customer inquiries, job applications, and ethics consultations and reports is processed on the basis of the data subject's consent. Before an input form is submitted, the Company informs the data subject of the purpose of collection and use, the items, the retention period, the right to refuse consent and the consequences of refusal, and obtains consent. Even if you do not consent to the collection and use of the optional items, you can use the relevant service with the required items alone.

The temporary processing of IP addresses for automated input prevention is carried out on the basis of the legitimate interest in website security and stable operation, to the minimum extent that does not unduly infringe the rights of data subjects.

Matters concerning overseas transfer are described in Section 06.

a. Submission records on the website server

The automatic deletion periods above are the criteria for the regular deletion of server submission records. Submission records that no longer need to be kept because their purpose has been achieved are deleted by the persons in charge even before that period expires.

In particular, job application information is deleted by the persons in charge without delay once it becomes unnecessary because the recruitment process has ended; the 180-day automatic deletion function does not replace destruction at the end of the recruitment process.

b. E-mail and attachments

The persons in charge manage the relevant e-mails by applying a retention/deletion label corresponding to the completion date. The same task-specific destruction criteria apply not only to received e-mails but also to copies in the sending account's Sent Items and copies forwarded to other persons in charge.

Misconduct report materials are managed after reviewing the need for retention and are destroyed once no longer needed, even before 5 years have passed.

If the Company intends to keep job application information for a separate purpose, such as maintaining a talent pool for future recruitment, it will inform applicants of the purpose, items and retention period and obtain the necessary consent separately.

c. Cases requiring separate retention

Personal information that must be retained under other laws is stored and managed separately from other personal information for the period specified by those laws.

Where additional retention is necessary to handle a dispute, investigation or lawsuit relating to a specific submission, the Company will confirm a lawful basis for processing and retain, with restricted access, only the information needed for that submission. Once the reason for retention ends, the information is destroyed without delay.

d. Return of application documents

Documents submitted through the website or by e-mail, and documents submitted voluntarily without the Company's request, fall under the exceptions to the return obligation under the Act on the Fairness of Recruitment Procedures and are handled in accordance with the retention periods and destruction criteria above.

For other application documents subject to return under the same Act, the period and method for requesting their return will be announced in the relevant job posting or in a separate notice.

a. Destruction procedure

The Company destroys personal information after confirming what is to be destroyed and whether any legal retention obligation applies.

Submission records on the website server are managed through a regular automatic deletion function and individual deletion by the persons in charge. Automatic deletion runs periodically while the application is running; if the service has been interrupted, items due for deletion are identified and processed after it resumes.

E-mails and attachments are managed through retention/deletion labels and the deletion procedures of the persons in charge in accordance with task-specific retention periods. Items subject to destruction include the inboxes of the persons in charge, the sending account's Sent Items, copies downloaded to business devices, and printouts.

Drafts and attachments that failed during the e-mail sending process go through a deletion procedure, and if automatic cleanup fails, the persons in charge check and clean them up. Copies that temporarily remain in the recovery area for deleted e-mails are permanently deleted in accordance with the service's recovery and retention settings and deletion processing cycle.

b. Destruction method

• Electronic files: Deleted using methods that make them impossible to recover or reproduce
• Paper documents: Shredded or incinerated

a. Visitor cookies and browser storage

The Company does not issue cookies to general visitors and does not use browser storage such as localStorage to store visit information.

The website fonts and the still image shown before video playback are served from the Company's server.

b. Administrator login cookie

When Company employees log in to the administrative functions, an administrator authentication cookie is used to keep them logged in.

• Cookie name: sambu_admin
• Purpose: Administrator authentication and keeping the login session
• Validity: 8 hours
• Path: /api/admin
• Security attributes: HttpOnly, Secure

c. Company introduction video

On first display, the company introduction video shows only a still image from the Company's server and a play button. Before playback, neither the YouTube player nor external thumbnails are loaded.

When the user sees the notice “Playing the video connects to YouTube” and presses the play button, the privacy-enhanced mode player from youtube-nocookie.com is loaded.

From that point, information such as your IP address and browser and device information may be processed by Google LLC, the operator of YouTube, and cookies or similar technologies may be used. Privacy-enhanced mode does not block all information processing.

Information processing by the external service is subject to the Google Privacy Policy. If you do not want an external connection, you can choose not to play the video, and you can still use the other features of the website.

d. External map link

The Google Maps link in the location information is provided as a plain link that takes you to an external site when clicked. The map service is not loaded before you click the link. After you move to the external site, that service's privacy policy applies.

e. Refusing cookies

You can block the storage of cookies or delete cookies already stored in your browser's privacy or cookie settings.

Blocking cookies does not affect normal website browsing or input form submission, but administrator login and some features of the external video service may be restricted.