Privacy Policy
GCsoft publishes this policy under Article 30 of the Personal Information Protection Act to protect personal information and to handle related concerns promptly.
This English translation is provided for convenience only. If there is any discrepancy, the Korean version prevails.
Article 1 (Purposes of processing)
GCsoft (the "Company") processes personal information only for the following purposes.
- Inquiries, consultations and quotes
- Performing contracts (S2B, etc.): issuing Claude accounts, onboarding and setup, issuing tax invoices
- Providing services such as the GC EDU connectors: sign-in and school verification, permissions, and action (audit) logs
- Processing documents uploaded by users (for example, reading HWP documents)
- Service reliability, abuse prevention, and handling inquiries and complaints
- Meeting legal obligations
Article 2 (Information processed and how it is collected)
| Category | Items | How collected |
|---|---|---|
| Inquiries | (Required) name, email, school or institution / (Optional) phone number | Email, contact page |
| Contracts | Institution name, contact person's name, email and phone, name and email of Claude account users, tax invoice details | S2B, email |
| Connector sign-in and use | Google account email, name, account identifier, school domain, role (teacher or admin), usage and action logs | Google sign-in, generated during use |
| School data | Student names, student IDs and classes, device information and timetables, within the scope the school connects | Processed on the school's behalf from systems it connects (Argos MDM, Google directory and Classroom, etc.) |
| Uploaded documents | Contents of documents users upload (which may include personal information) | Uploaded by the user |
| Collected automatically | IP address, access time, access logs, browser and device information, cookies | Generated while using the website and services |
The Company does not collect payment details such as card numbers through its website or services.
Article 3 (Retention periods)
- Inquiry records: 3 years after resolution
- Records of contracts and cancellations: 5 years (E-Commerce Act)
- Tax invoices and transaction evidence: 5 years (Framework Act on National Taxes)
- Consumer complaint and dispute records: 3 years (E-Commerce Act)
- Connector account information: until the school's agreement (including any license or free period) ends or deletion is requested
- Action (audit) logs: 1 year from creation
- School data: for the term of the outsourcing agreement with the school; destroyed or returned to the school promptly when it ends
- Uploaded documents: deleted promptly after processing, and never kept longer than 24 hours after upload.
- Website access logs: 3 months (Protection of Communications Secrets Act)
Article 4 (Student information processed on behalf of schools)
- For student information processed in GCgos, School Helper and similar services, the school is the controller and the Company is a processor acting only within the outsourcing agreement and the school's instructions.
- The Company does not use student information for any other purpose or provide it to third parties, and keeps each school's data separate.
- The school, as controller, is responsible for any lawful basis required to process information about students under 14, such as consent from a legal guardian. Students do not sign up for the Company's services directly.
- Requests to access, correct or delete student information can be made through the student's school, and the Company acts on the school's request without delay.
Article 5 (Provision to third parties)
The Company processes personal information only within the purposes in Article 1 and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act allow, such as with consent or as required by law.
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| Anthropic, PBC (United States) | Creating and using Claude accounts | Name and email of the account user | As set by Anthropic's privacy policy |
This provision is made with consent obtained when a contract to purchase Claude accounts is signed. Without consent, Claude accounts cannot be issued.
Article 6 (Outsourcing of processing)
The Company outsources the following processing to deliver its services and supervises the processors as required by law.
| Processor | Outsourced work |
|---|---|
| Cloudflare, Inc. | Domain (DNS), network and security; running service servers and storing data (Workers, D1, R2, etc.); tunnels connecting the Company's servers to the internet |
| Google LLC | Business email (Google Workspace); connector sign-in (Google sign-in) |
The website and some services run on servers the Company operates itself (located in the Republic of Korea), with external access routed through Cloudflare.
Article 7 (Transfers abroad)
The Company transfers personal information abroad as follows to deliver its services. These are outsourcing and storage necessary to conclude and perform contracts with data subjects under Article 28-8(1) of the Personal Information Protection Act, and are disclosed in this policy.
| Recipient (country) | Items | When and how | Purpose | Retention |
|---|---|---|---|---|
| Cloudflare, Inc. (United States; global data centers) · [email protected] | Access information, connector accounts and action logs, school data, uploaded documents | Transmitted over the network during use | Service delivery, data storage, security | Per Article 3 |
| Google LLC (United States) | Email addresses and message contents, sign-in information | Transmitted when sending or receiving mail and signing in | Business email, sign-in | Per Article 3 |
| Anthropic, PBC (United States) | Name and email of Claude account users | Transmitted when a Claude account is issued | Creating and using Claude accounts (third-party provision) | As set by Anthropic |
Data subjects may refuse transfers abroad by writing to [email protected]. Services delivered only through these providers will then be unavailable.
Article 8 (Rights of data subjects)
Data subjects may at any time request:
- Access to their personal information
- Correction of errors
- Deletion
- Suspension of processing
Send requests to [email protected]; the Company will act without delay. Requests about student information entrusted by a school are handled under Article 4.
Article 9 (Destruction)
When the retention period ends or the purpose has been achieved, the Company destroys personal information without delay. Electronic files are permanently deleted so they cannot be recovered, and paper records are shredded or incinerated.
Article 10 (Security measures)
- Administrative: an internal management plan, and keeping the number of people handling personal information to a minimum
- Technical: access control and permissions, encryption in transit (HTTPS), separation of data by school, action logs, security updates
- Physical: access control at the location of the Company's servers
Article 11 (Cookies)
The Company uses cookies to remember the website language and to keep users signed in to its services. It does not use advertising or visitor-tracking cookies or analytics tools. Users can refuse cookies in their browser settings, which may limit some services such as sign-in.
Article 12 (Privacy Officer)
- Privacy Officer: Gichan Park
- Email: [email protected]
Article 13 (Remedies)
For remedies or advice on privacy violations, contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (privacy.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation: 1301 (spo.go.kr)
- Korean National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)
Article 14 (Changes)
Changes to this policy are announced on the website 7 days before they take effect, or 30 days before for changes that materially affect data subjects' rights.