Skip to main content
In operating the Ad.Control Referral Program (hereinafter the “Program”), Open Rhapsody Co., Ltd. (hereinafter the “Company”) collects and uses personal information as set out below. The Referrer has the right to refuse consent to the collection and use of personal information, and where consent to the required items is refused, participation in the Program may be restricted. The Referred Contact may, after being contacted by the Company, request access to, correction of, deletion of, or suspension of the processing of their personal information, as well as cessation of further contact. This Program is intended for adults (aged 19 or older) for business or work purposes, and does not collect the personal information of children under the age of 14.

​
1. Collection and Use of the Referrer’s Own Personal Information

Items CollectedPurpose of Collection and UseRetention and Use Period
[Required] Name, affiliation, email, phone number, relationship with the referred company and representative, referral detailsReceipt and review of referrals, identification of participants, notification of progress and results, response to inquiries1 year after the end of the referral (rejection, lapse, or completion of payment). However, referrals for which a reward has been paid are subject to the tax retention period below
[When a reward arises] Account information, business registration certificate (if applicable)Payment of rewards and tax processing5 years from the end of the taxable year to which the payment date belongs (the evidence retention period under relevant laws such as the Framework Act on National Taxes)
Processing of Unique Identifying Information (resident registration number, etc.) Resident registration numbers are not collected on the basis of consent, and are processed only where there is a specific statutory basis such as withholding tax or submission of a payment statement under the Income Tax Act (Article 24-2 of the Personal Information Protection Act). Where other unique identifying information (passport number, etc.) must be collected, separate consent is obtained. Copies of identification documents are not requested as a rule, and where collection is unavoidable, information unnecessary for tax filing (such as the last 7 digits of the resident registration number) is masked before processing.

​
2. Collection and Use of the Referred Contact’s (Third Party’s) Personal Information

This Program operates by having the Referrer provide the information of the New Client’s representative (the Referred Contact).
Items CollectedPurpose of Collection and UseRetention and Use Period
[Required] The Referred Contact’s name, affiliation, email, relationship with the Referrer, referral circumstancesSending referral emails and proposing meetings to New Clients, consultation on new adoption of Ad.ControlAs per the retention period table below
Retention Period
CategoryRetention Period
Rejected referrals1 year from the rejection date
Referrals lapsed due to no reply or no meeting held1 year from the lapse date
Referrals lapsed due to no revenue after a meeting was held1 year from the date eligibility lapses
Referrals for which a reward payment arose5 years from the end of the taxable year to which the payment date belongs
Information of representatives who converted into clientsAs per the Company’s client/sales information processing policy
Opt-out or deletion request casesDeleted immediately (minimal information may be separately retained to prevent re-contact)
Legal Basis for Processing and Notice of Third-Party Collection Source The Company receives the Referred Contact’s personal information from the Referrer (a third party). The Referrer must obtain lawful consent from the Referred Contact before providing the Referred Contact’s personal information, and the Company obtains the Referrer’s confirmation thereof (checkbox) upon Referral Registration. The Company directly notifies the Referred Contact, in the body of the first referral email sent to them, of the information source, the purpose of processing, the possibility of a reward to the Referrer, and the method for requesting deletion. In addition to securing the Referrer’s consent, the Company processes such information on the supplementary basis of the Company’s legitimate interest in sourcing new clients (Article 15(1)6 and Article 17(1)2 of the Personal Information Protection Act), to the extent that such interest is manifestly superior to the rights of the data subject. Where a referral email or meeting proposal sent to the Referred Contact constitutes advertising information for commercial purposes under the Network Act, the Company confirms, through the Referrer, that the Referred Contact’s consent to receipt has been secured, and provides the opt-out method together in the body of the email.
This email is sent to you on the introduction of [Referrer name/affiliation]. The Company has received your name, affiliation, and email for the purpose of operating the referral program and consultation on new adoption of Ad.Control. This matter is an introduction received through the A.drop Referral Program, and the Referrer may receive a reward in accordance with the Program policy. If you do not wish to be contacted, please reply to this email and we will delete the relevant personal information and cease further contact.
The Referred Contact has the right to request access to, correction of, deletion of, or suspension of the processing of their personal information, and upon request the Company processes it without delay.

​
3. Provision of the Referrer’s Information to the Referred Contact

By including the Referrer as a CC recipient on the referral email or stating “We are contacting you on the introduction of [name],” the Company provides the Referrer’s information to the Referred Contact.
RecipientItems ProvidedPurpose of ProvisionRetention Period
Representative of the referred client (Referred Contact)The Referrer’s name, affiliation, email, referral circumstancesVerification of the referral channel and proposal of a meetingAs per the Referred Contact’s internal policy
Upon Referral Registration, the Referrer consents to their name, affiliation, and email, as well as the fact of the referral, being notified to the Referred Contact.

​
4. Provision of Personal Information to Third Parties

The Company does not provide personal information externally, except for the provision of the Referrer’s information to the Referred Contact specified in Article 3 of this Policy, where there is separate consent from the data subject, where there is a statutory basis, or where there is a lawful request from an investigative or examining agency.

​
5. Entrustment of Personal Information Processing

The Company entrusts the processing of personal information for the operation of the Program as set out below, and upon entrustment specifies the entrusted party and the entrusted work and manages and supervises them.
Entrusted PartyEntrusted Work
Google LLC (Google Workspace)Sending referral emails, responding to inquiries, data storage
Notion Labs, Inc. (Notion)Management of referrals and milestone tracking
Giftishow BizSending the Meeting Bonus (Naver Pay Points)
Doan Accounting CorporationWithholding tax, payment statements, and documentary evidence processing

​
6. Cross-Border Transfer of Personal Information

The Company entrusts the processing of personal information to overseas operators among the entrusted parties in Article 5 above, and discloses such cross-border transfers in accordance with Article 28-8 of the Personal Information Protection Act as set out below.
TransfereeCountry of TransferItems TransferredDate and Method of TransferPurpose of UseRetention and Use PeriodContact
Google LLCUnited StatesThe Referrer’s and Referred Contact’s name, affiliation, email, phone number, and other items collected under this PolicyTransferred via the information and communications network at the time of service useSending referral emails, responding to inquiries, data storageUntil the entrustment ends or the retention period under this Policy endsGoogle Privacy Team (googlekrsupport@google.com) / Guide for Korean residents: https://policies.google.com/privacy/additional?hl=ko&gl=kr
Notion Labs, Inc.United StatesThe Referrer’s and Referred Contact’s name, affiliation, email, referral detailsTransferred via the information and communications network at the time of service useManagement of referrals and milestone trackingUntil the entrustment ends or the retention period under this Policy endsprivacy@makenotion.com
The data subject may refuse the cross-border transfer, but in the case of refusal, the use of services necessary for operating the Program may be restricted, which may make participation difficult.

​
7. Rights of the Data Subject

Referrers and Referred Contacts may exercise the following rights regarding their personal information at any time:
  1. Request access to, correction of, deletion of, or suspension of the processing of personal information.
  2. Withdraw consent.
  3. Request an explanation of, and raise an objection to, automated decision-making (if applicable) (Article 37-2 of the Personal Information Protection Act).
Rights may be exercised by the following methods, and the Company processes them within 10 days of the date the request is received:
  • Email: support@adrop.io
  • Postal mail: Addressed to the Personal Information Protection Officer at the Company’s address

​
8. Measures to Ensure the Security of Personal Information

The Company takes the following measures for the secure processing of personal information:
  • Restricting access rights to personal information to necessary personnel such as Program operations staff, and managing records of the granting, modification, and revocation of access rights.
  • Encrypting files containing personal information or restricting access to them.
  • Retaining and inspecting access logs of the personal-information processing system.
  • Managing and supervising entrusted parties for personal-information processing.
  • Destroying unnecessary materials after the completion of reward payment and tax filing.

​
9. Destruction of Personal Information

The Company destroys without delay personal information for which the retention and use period has elapsed or the purpose of processing has been achieved. However, where it must be retained under relevant laws, it is separately stored for the relevant period. Electronic files are deleted in a manner that makes recovery impossible, and printouts are shredded or incinerated.

​
10. Personal Information Protection Officer and Inquiries

  • Personal Information Protection Officer: CEO Yusin Kim
  • Department in Charge: A.drop Personal Information Protection Team
  • Inquiry Email: support@adrop.io
  • Contact: 02-420-0906

​
11. Remedies for Infringement of Rights

The data subject may contact the following institutions for relief and consultation regarding personal-information infringement:
  • Personal Information Dispute Mediation Committee: (without area code) 1833-6972 / www.kopico.go.kr
  • Personal Information Infringement Report Center: (without area code) 118 / privacy.kisa.or.kr
  • Cyber Investigation Division, Supreme Prosecutors’ Office: (without area code) 1301 / www.spo.go.kr
  • Cyber Investigation Bureau, National Police Agency: (without area code) 182 / ecrm.police.go.kr

​
12. Changes to the Privacy Policy

This Policy applies from July 1, 2026. Where there is any addition, deletion, or modification of the contents of this Policy, the changes will be announced through the website operated by the Company and the like from before the effective date.