1. Savills Korea Co., Ltd (“Savills”) respects personal data privacy and is committed to implement and comply with the data protection principles and provisions under the Personal Information Protection Act (“PIPA”).
Statement of Practices
Categories of Personal Data Held
2. Savills holds the following categories of personal data
ㆍEmployment-related records which include photograph, name, unique identification number such as resident registration number/passport number/alien registration number/driver's license number, fingerprint information, nationality, address, contact information such as email address, mobile phone number, home phone number, education and qualifications, employment history, salary and allowances, participation in Mandatory Provident Fund, terms and conditions of service, housing and medical benefits, leave records, training and development, appraisal reports, conduct and discipline, etc. Provided, however, that the resident registration number is collected or used only if there is a legal basis;
ㆍGeneral administrative records which include personal data collected in connection with the office administration functions, records containing information supplied by data subjects and collected in connection with the handling of inquiries and complaints made to Savills, etc.;
ㆍCustomers records which include name, contact information(phone number, email address), date of birth, account details with bank, name of company where to work and title collected in the course of handling , transactions, complaints and enquiries, etc.; and
ㆍOther Optional Information necessary for performing the contract or information voluntarily provided by the data subject.
Main Purposes of Keeping Personal Data
3. The main purposes of processing the personal data are as follows:
ㆍEmployment-related records are processed for a range of appointments and human resource management purposes, including postings and transfers, training and career development, performance appraisal and promotion, discipline, offer of benefits, etc.;
ㆍGeneral administrative records are processed for the purposes of carrying out various office administration functions, responding to and taking follow-up actions on enquiries and complaints, etc.;
ㆍCustomer records are processed for the purposes of handling customers’ membership applications, transactions, complaints and enquiries, etc.; and
ㆍ Other records are processed for various purposes, which vary according to the nature of the records, such as procurement of stores and equipment, organization of activities, etc.
3. Practices of Personal Data Handling
4. The practices at (a) to (f) below are implemented to ensure that personal data held by Savills is handled in accordance with the data protection principles enshrined in the PIPA.
(a) Collection of personal data
5. When collecting personal data, Savills will satisfy the following:
i. the purposes for which the data is collected are lawful and directly related to a function or activity of Savills;
ii. the manner of collection is lawful and fair in the circumstances of the case; and
iii. the personal data collected is necessary but not excessive for the purpose(s) for which it is collected.
6. When Savills collects personal data from an individual, the individual will be provided with a Personal Information Collection Statement on or before the collection in an appropriate format and manner. Practicable steps will be taken to ensure that –
i. the data subject is informed of whether it is obligatory or voluntary for him/her to supply the data and, if obligatory, the consequences for him/her if he/she fails to do so; and
ii. the data subject is explicitly informed of the purpose for which his/her personal data is to be used, the classes of persons to whom the data may be transferred or disclosed, the rights of the data subject to request access to and correction of the data, and the contact details of the individual to whom any such request may be made.
(b) Accuracy and retention of personal data
7. Personal data collected and maintained by Savills shall be as accurate, complete, and up-to-date as is necessary for the purpose for which it is to be used.
8. Savills maintains a personal data inventory, which contains the kinds of personal data that Savills holds; the purposes for which the personal data is collected, used and disclosed; and how the personal data is stored. The personal data inventory will be reviewed on an annual basis to ensure that it is accurate and up-to-date.
9. Personal data will not be kept longer than necessary for the fulfillment of the purpose for which the data is collected or used. Personal data shall be kept and used for the period from the date of consent to the collection and use of such information till such consent expires; provided that such information shall be kept and used only for resolving disputes, addressing complaints, fulfilling legal obligations after the expiry date of the consent. Personal data that is no longer required should be erased unless such erasure of personal data is prohibited under any law or it is in the public interest for the data not to be erased. Should there be a need to retain the personal data for statistical purposes, such data will be anonymised so that the individuals concerned can no longer be identified.
10. A destruction exercise on records containing personal data will be conducted as and when necessary and in accordance with Savills records management guidelines and procedures. Destruction of paper records would be carried out by irreversible means and electronic records would be cleared or destroyed from storage media before disposal by means of sanitization or physical destruction.
(c) Use of personal data
11. All personal data collected will be used only for purposes, which are directly related to the discharge of Savills’ duties and responsibilities. Relevant personal data may also be disclosed to other entities which are authorized to receive information for the purposes of law enforcement, prosecution or review of decisions. Data subjects would be informed of the possible transferees of their personal data when their personal data is collected.
12. If personal data is to be used for a purpose other than the purposes for which the data is collected, express prior consent preferred in writing would be sought from the data subject concerned. In seeking the data subject’s consent, all practicable steps would be taken to ensure that (i) information provided to the data subject is clearly understandable and readable; and (ii) the data subject is informed that he/she is entitled to withhold his/her consent or withdraw his/her consent subsequently by giving notice in writing.
Entrustment of personal information processing
Savills may entrust the processing of Personal data collected to third parties during the discharge of Savills’ functions when necessary. Savills entrusts personal data processing as follows.
|
Recipients |
Reasons for entrusting personal data processing |
|
We Want Healthcare |
Medical checkup |
|
Hanwha General Insurance |
Group accident insurance |
|
HRM Plus |
Paying salaries |
|
Qcall |
Delivery Services |
|
Seoul Finance Center |
Parking registration |
|
NICE Investors Service |
Inquiry of personal credit information |
|
SMSL(Savills Management Services Limited) |
For Savills internal purposes |
Provision of personal information to a third party
Savills shall not exceed the prescribed scope or provide personal data to third parties except if the data subject has given prior consent to the provision or disclosure of personal data to a third party or there are special regulations or laws permitting such acts.
(d) Security of personal data
13. Savills observes strictly relevant security standards and regulations. Security arrangements will also be reviewed regularly to ensure that personal data is protected against loss and unauthorised or accidental access, use, disclosure, modification and erasure. The security arrangements adopted include but not limited to the following:
i. restriction of access to personal data on a “need-to-know” basis;
ii. regular review and enhancement of security measures for protection of personal data in the servers, user computers, transmission of electronic messages, etc.;
iii. regular change of passwords for IT facilities, accounting and personnel systems, etc.;
iv. encryption of all backup storage devices that are to be transported to offsite storage;
v. limited staff access rights to office areas storing confidential information; and
vi. provision of clear guidelines to staff as to the types of data that may or may not be disclosed to a phone enquirer and implementation of appropriate identity verification procedures to confirm the enquirer’s identity.
(e) Transparency of the personal data policy and practices
14. This privacy policy and practices can be found on Savills website.
In case of any changes to Savills’ Privacy Policy, the timing of the amendment and effectuation shall be constantly disclosed.
(f) Access to and correction of personal data
15. Savills recognizes an individual’s rights of access to and correction of his/her own personal data in accordance with the PIPA.
i.The data subject is entitled to demand access to personal information handled by Savills pertaining to you or children aged under 14 (only if you are their legal representatives).
ii. The data subject may demand that Savills correct or delete personal information you have read in case the information differs from the truth or is not verifiable. However, if such information must be collected under the relevant laws or regulations, a request to delete it will not be fulfilled.
iii. The data subject may demand that Savills suspend the processing of the personal information. Savills may reject such demand for suspension by giving you a reason for rejection if any of the below reasons is applicable:
1.Either there are special regulations in laws or Savills cannot but process the information to fulfill Savills’s obligations that are required by laws and regulations;
2.Suspension of information processing may harm the life and body of another person or unreasonably prejudice the property or other interests of another person; or
3.Savills’ failure to process personal information interferes with Savills’ performance of a contract with the data subject and the data subject has not explicitly expressed the intention to terminate the contract.
If you have any complaints about the way Savills processes your personal data, or want to make a data access request, please contact Savills at the number below. Savills will do our best to take care of it at the earliest possible time.
Privacy call : 2124-4131
The Chief Privacy Officer and Personal information protection officer of Savills, as prescribed in Article 31(1) of the PIPA is as follows:
Chief Privacy Officer: Kim Donggyoon (Compliance)
Privacy officer: Won JongHun (IT Team leader)
16. When handling a data access or correction request, Savills will check the identity of the requester to ensure that he/she is the person legally entitled to make the data access or correction request.
17. Savills may impose a fee for the direct and necessary cost of complying with a data access request. Savills will clearly inform the requestor the amount to be charged.
18. Savills maintains a Register on Requests for Access to Personal Data recording the data access or correction requests received.
4. International Data Transfer
19. Your Personal Data may be transferred to, and processed in, countries other than the country in which you are a resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not offer the same protection).
20. Our Website servers are located at Amazon Web Services all over the world, and our group companies, affiliated companies and third-party service providers operate globally. This means that when we collect your Personal Data, we may process it in any of these countries.
21. However, we take steps to safeguard your Personal Data in accordance with this Privacy Policy Statement. Further details about the protection given to your Personal Data can be provided upon request by contacting us using the details herein.
Please find details of the overseas transfer of personal information for entrustment of personal information processing or storing.
-Personal information to be transferred overseas: Name of the data subject, contact information, address, Email, bank account.
-Receiving Country: Singapore, Hong Kong, England
-Time and method of the transfer: transferred to remote IT servers via a dedicated network within 1 day of the data subject’s use of the service.
-Receiver of personal information: Savills Management Services Limited, Savills PLC, Savills Asia Pacific Holding Limited (contact information: itpurchasing@savills.asia)
-Third parties’ purpose of receiving personal information: to perform a contract with the data subject, to provide service to the data subject, server operation and security management.
-Use and retention period: Personal information is retained and used as of the date of the consent until the earlier of: (i) when such consent is withdrawn; or (ii) when the purpose of personal information is accomplished. After such use and retention period, the personal information will be kept only within the necessary scope to resolve disputes, address complaints, or fulfill legal obligations.
-Ways and process to refuse overseas transfer and the relevant consequences: The data subject may refuse the overseas transfer of his/her personal information by refusing to consent to overseas transfer. However, if refused, the data subject may not be able to use the services.
5. Incident Reporting and Breach Handling
22. A mechanism is set up for incident reporting and breach handling in case there is loss or leakage of personal data, or there is a reason to believe that the personal data held by Savills has been compromised.
6. Ongoing Monitoring and Review
23. Savills will keep the Privacy Policy and Practices under regular review. Officers responsible for handling personal data will attend relevant training courses and keep up to date with personal data policies.