> ## Documentation Index > Fetch the complete documentation index at: https://docs.adrop.io/llms.txt > Use this file to discover all available pages before exploring further. # Referral Program Privacy Policy > Ad.Control Referral Program Privacy Policy In operating the Ad.Control Referral Program (hereinafter the "Program"), Open Rhapsody Co., Ltd. (hereinafter the "Company") collects and uses personal information as set out below. The Referrer has the right to refuse consent to the collection and use of personal information, and where consent to the required items is refused, participation in the Program may be restricted. The Referred Contact may, after being contacted by the Company, request access to, correction of, deletion of, or suspension of the processing of their personal information, as well as cessation of further contact. This Program is intended for adults (aged 19 or older) for business or work purposes, and does not collect the personal information of children under the age of 14. ## 1. Collection and Use of the Referrer's Own Personal Information | Items Collected | Purpose of Collection and Use | Retention and Use Period | | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | \[Required] Name, affiliation, email, phone number, relationship with the referred company and representative, referral details | Receipt and review of referrals, identification of participants, notification of progress and results, response to inquiries | 1 year after the end of the referral (rejection, lapse, or completion of payment). However, referrals for which a reward has been paid are subject to the tax retention period below | | \[When a reward arises] Account information, business registration certificate (if applicable) | Payment of rewards and tax processing | 5 years from the end of the taxable year to which the payment date belongs (the evidence retention period under relevant laws such as the Framework Act on National Taxes) | **Processing of Unique Identifying Information (resident registration number, etc.)** Resident registration numbers are not collected on the basis of consent, and are processed **only where there is a specific statutory basis** such as withholding tax or submission of a payment statement under the Income Tax Act (Article 24-2 of the Personal Information Protection Act). Where other unique identifying information (passport number, etc.) must be collected, separate consent is obtained. Copies of identification documents are not requested as a rule, and where collection is unavoidable, information unnecessary for tax filing (such as the last 7 digits of the resident registration number) is masked before processing. ## 2. Collection and Use of the Referred Contact's (Third Party's) Personal Information This Program operates by having the Referrer provide the information of the New Client's representative (the Referred Contact). | Items Collected | Purpose of Collection and Use | Retention and Use Period | | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------- | | \[Required] The Referred Contact's name, affiliation, email, relationship with the Referrer, referral circumstances | Sending referral emails and proposing meetings to New Clients, consultation on new adoption of Ad.Control | As per the retention period table below | **Retention Period** | Category | Retention Period | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | Rejected referrals | 1 year from the rejection date | | Referrals lapsed due to no reply or no meeting held | 1 year from the lapse date | | Referrals lapsed due to no revenue after a meeting was held | 1 year from the date eligibility lapses | | Referrals for which a reward payment arose | 5 years from the end of the taxable year to which the payment date belongs | | Information of representatives who converted into clients | As per the Company's client/sales information processing policy | | Opt-out or deletion request cases | Deleted immediately (minimal information may be separately retained to prevent re-contact) | **Legal Basis for Processing and Notice of Third-Party Collection Source** The Company receives the Referred Contact's personal information from the Referrer (a third party). The Referrer must obtain lawful consent from the Referred Contact before providing the Referred Contact's personal information, and the Company obtains the Referrer's confirmation thereof (checkbox) upon Referral Registration. The Company directly notifies the Referred Contact, in the body of the first referral email sent to them, of the information source, the purpose of processing, the possibility of a reward to the Referrer, and the method for requesting deletion. In addition to securing the Referrer's consent, the Company processes such information on the supplementary basis of the Company's legitimate interest in sourcing new clients (Article 15(1)6 and Article 17(1)2 of the Personal Information Protection Act), to the extent that such interest is manifestly superior to the rights of the data subject. Where a referral email or meeting proposal sent to the Referred Contact constitutes advertising information for commercial purposes under the Network Act, the Company confirms, through the Referrer, that the Referred Contact's consent to receipt has been secured, and provides the opt-out method together in the body of the email. > This email is sent to you on the introduction of \[Referrer name/affiliation]. The Company has received your name, affiliation, and email for the purpose of operating the referral program and consultation on new adoption of Ad.Control. This matter is an introduction received through the A.drop Referral Program, and the Referrer may receive a reward in accordance with the Program policy. If you do not wish to be contacted, please reply to this email and we will delete the relevant personal information and cease further contact. The Referred Contact has the right to request access to, correction of, deletion of, or suspension of the processing of their personal information, and upon request the Company processes it without delay. ## 3. Provision of the Referrer's Information to the Referred Contact By including the Referrer as a CC recipient on the referral email or stating "We are contacting you on the introduction of \[name]," the Company provides the Referrer's information to the Referred Contact. | Recipient | Items Provided | Purpose of Provision | Retention Period | | -------------------------------------------------------- | --------------------------------------------------------------- | -------------------------------------------------------------- | --------------------------------------------- | | Representative of the referred client (Referred Contact) | The Referrer's name, affiliation, email, referral circumstances | Verification of the referral channel and proposal of a meeting | As per the Referred Contact's internal policy | Upon Referral Registration, the Referrer consents to their name, affiliation, and email, as well as the fact of the referral, being notified to the Referred Contact. ## 4. Provision of Personal Information to Third Parties The Company does not provide personal information externally, except for the provision of the Referrer's information to the Referred Contact specified in Article 3 of this Policy, where there is separate consent from the data subject, where there is a statutory basis, or where there is a lawful request from an investigative or examining agency. ## 5. Entrustment of Personal Information Processing The Company entrusts the processing of personal information for the operation of the Program as set out below, and upon entrustment specifies the entrusted party and the entrusted work and manages and supervises them. | Entrusted Party | Entrusted Work | | ----------------------------- | ------------------------------------------------------------------------ | | Google LLC (Google Workspace) | Sending referral emails, responding to inquiries, data storage | | Notion Labs, Inc. (Notion) | Management of referrals and milestone tracking | | Giftishow Biz | Sending the Meeting Bonus (Naver Pay Points) | | Doan Accounting Corporation | Withholding tax, payment statements, and documentary evidence processing | ## 6. Cross-Border Transfer of Personal Information The Company entrusts the processing of personal information to overseas operators among the entrusted parties in Article 5 above, and discloses such cross-border transfers in accordance with Article 28-8 of the Personal Information Protection Act as set out below. | Transferee | Country of Transfer | Items Transferred | Date and Method of Transfer | Purpose of Use | Retention and Use Period | Contact | | ----------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Google LLC | United States | The Referrer's and Referred Contact's name, affiliation, email, phone number, and other items collected under this Policy | Transferred via the information and communications network at the time of service use | Sending referral emails, responding to inquiries, data storage | Until the entrustment ends or the retention period under this Policy ends | Google Privacy Team ([googlekrsupport@google.com](mailto:googlekrsupport@google.com)) / Guide for Korean residents: [https://policies.google.com/privacy/additional?hl=ko\&gl=kr](https://policies.google.com/privacy/additional?hl=ko\&gl=kr) | | Notion Labs, Inc. | United States | The Referrer's and Referred Contact's name, affiliation, email, referral details | Transferred via the information and communications network at the time of service use | Management of referrals and milestone tracking | Until the entrustment ends or the retention period under this Policy ends | [privacy@makenotion.com](mailto:privacy@makenotion.com) | The data subject may refuse the cross-border transfer, but in the case of refusal, the use of services necessary for operating the Program may be restricted, which may make participation difficult. ## 7. Rights of the Data Subject Referrers and Referred Contacts may exercise the following rights regarding their personal information at any time: 1. Request access to, correction of, deletion of, or suspension of the processing of personal information. 2. Withdraw consent. 3. Request an explanation of, and raise an objection to, automated decision-making (if applicable) (Article 37-2 of the Personal Information Protection Act). Rights may be exercised by the following methods, and the Company processes them within 10 days of the date the request is received: * Email: [support@adrop.io](mailto:support@adrop.io) * Postal mail: Addressed to the Personal Information Protection Officer at the Company's address ## 8. Measures to Ensure the Security of Personal Information The Company takes the following measures for the secure processing of personal information: * Restricting access rights to personal information to necessary personnel such as Program operations staff, and managing records of the granting, modification, and revocation of access rights. * Encrypting files containing personal information or restricting access to them. * Retaining and inspecting access logs of the personal-information processing system. * Managing and supervising entrusted parties for personal-information processing. * Destroying unnecessary materials after the completion of reward payment and tax filing. ## 9. Destruction of Personal Information The Company destroys without delay personal information for which the retention and use period has elapsed or the purpose of processing has been achieved. However, where it must be retained under relevant laws, it is separately stored for the relevant period. Electronic files are deleted in a manner that makes recovery impossible, and printouts are shredded or incinerated. ## 10. Personal Information Protection Officer and Inquiries * Personal Information Protection Officer: CEO Yusin Kim * Department in Charge: A.drop Personal Information Protection Team * Inquiry Email: [support@adrop.io](mailto:support@adrop.io) * Contact: 02-420-0906 ## 11. Remedies for Infringement of Rights The data subject may contact the following institutions for relief and consultation regarding personal-information infringement: * Personal Information Dispute Mediation Committee: (without area code) 1833-6972 / [www.kopico.go.kr](http://www.kopico.go.kr) * Personal Information Infringement Report Center: (without area code) 118 / [privacy.kisa.or.kr](http://privacy.kisa.or.kr) * Cyber Investigation Division, Supreme Prosecutors' Office: (without area code) 1301 / [www.spo.go.kr](http://www.spo.go.kr) * Cyber Investigation Bureau, National Police Agency: (without area code) 182 / [ecrm.police.go.kr](http://ecrm.police.go.kr) ## 12. Changes to the Privacy Policy This Policy applies from July 1, 2026. Where there is any addition, deletion, or modification of the contents of this Policy, the changes will be announced through the website operated by the Company and the like from before the effective date.