Privacy Policy
Effective 2026-08-23
commitsecurity (“the Company”) complies with the Personal Information Protection Act and establishes and discloses this policy to protect the personal information of data subjects. The Company collects personal information only through the inquiry form on this website and through no other channel.
01Personal information collected and how it is collected
The Company collects the following information, entered directly by the data subject through the website inquiry form.
| Items collected | Company name, name, contact details (email or phone number), areas of interest, message |
|---|---|
| Automatically collected | IP address — collected by the processor handling the inquiry form for spam prevention purposes (see Section 04) |
| Method | Direct entry by the data subject via the website inquiry form |
| Legal basis | Personal Information Protection Act, Article 15(1)(1) — consent of the data subject |
The Company does not install analytics tools or advertising trackers on this website, and this website contains no JavaScript. The Company does not use cookies in the areas it operates directly.
02Purpose of processing
- Reviewing and responding to inquiries
- Discussing service scope and schedule, and providing estimates
- Maintaining a record of pre-contract discussions
The Company does not use collected personal information for any purpose beyond those listed above, and does not use it to send marketing or promotional messages.
03Retention and use period
| Inquiry records | Retained for up to 1 year after the inquiry is closed, then destroyed without delay |
|---|---|
| If a contract is concluded | A separate retention period applies under that contract; where a statutory period applies, that period governs |
If the data subject requests destruction, the Company will destroy the information without delay even before the periods above, unless a statutory retention obligation applies.
04Entrustment of processing
The Company entrusts the receipt and forwarding of inquiry form submissions as follows.
| Processor | Web3Forms |
|---|---|
| Entrusted work | Receiving inquiry form data, forwarding it to the Company's email, spam prevention |
| Retention | Up to 3 years from submission under the processor's policy. The Company deletes the record held by the processor once the inquiry has been answered. |
For spam and abuse prevention, the processor forwards the submitter's IP address and email address to the following spam prevention services as sub-processors.
| CleanTalk | Cloud-based spam protection service |
|---|---|
| Akismet | Spam filtering service operated by Automattic |
When entering into processing agreements, the Company specifies the measures necessary for personal information to be handled safely, and supervises the processor's compliance.
05Transfer of personal information overseas
The processor in Section 04 is located outside the Republic of Korea, so personal information submitted through the inquiry form is transferred overseas as follows.
| Recipient | Web3Forms (contact details available at web3forms.com) |
|---|---|
| Country | India. Data is stored on Amazon Web Services (AWS) infrastructure and, per the processor's policy, may be processed in multiple regions. |
| Items transferred | Company name, name, contact details, areas of interest, message, IP address |
| Purpose | Receiving inquiry form data, forwarding it to the Company's email, spam prevention |
| Timing and method | Transmitted over the network at the moment the data subject submits the form |
| Retention | Same as Section 04 |
The data subject may refuse this overseas transfer. To do so, do not use the inquiry form — email contact@commitsecurity.dev directly and the Company will handle your inquiry without any overseas transfer.
06Provision to third parties
The Company processes personal information only within the purposes stated in Section 02, and does not provide it to third parties except with the separate consent of the data subject or where specifically required by law.
07Rights of the data subject
The data subject may exercise the following rights at any time.
- Request access to personal information
- Request correction of errors
- Request deletion
- Request suspension of processing
Requests may be made in writing or by email to contact@commitsecurity.dev, and the Company will act without delay. Where a data subject requests correction of an error, the Company will not use or provide the information concerned until the correction is complete.
08Destruction procedure and method
The Company destroys personal information without delay once the retention period has elapsed or the purpose of processing has been achieved.
- Information in electronic file form: permanently deleted by a method that prevents recovery or reproduction
- Information recorded on paper: shredded or incinerated
09Security measures
- Access to personal information is limited to the minimum number of people required for the work
- Encryption in transit (HTTPS)
- Multi-factor authentication on accounts that can access inquiry records containing personal information
- Minimisation of collected items and automatic destruction once the retention period has elapsed
10Privacy officer and complaints
The Company designates the following contact point as responsible for personal information processing and for handling complaints and remedying harm relating to it.
| Department | Privacy Office |
|---|---|
| Contact | contact@commitsecurity.dev |
Data subjects seeking remedy for a privacy infringement may also apply to the following bodies for dispute resolution or consultation.
- Personal Information Dispute Mediation Committee — +82 1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Centre — +82 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office, Cyber Investigation Division — +82 1301 (www.spo.go.kr)
- Korean National Police Agency, Cyber Bureau — +82 182 (ecrm.police.go.kr)
11Changes to this policy
This policy applies from its effective date. Where content is added, removed, or amended due to changes in law, policy, or security technology, the Company will announce the change on this website at least 7 days before it takes effect.