NAVER Corporation Privacy Policy (VER 4.0)
NAVER Corporation Privacy Policy (VER 4.0)
NAVER Corporation (the “Company” or “NAVER”) processes personal information lawfully and manages it securely in compliance with the Personal Information Protection Act and other applicable laws and regulations to protect the rights and freedoms of data subjects. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company has established and published this Privacy Policy to inform data subjects of the procedures and standards for processing and protecting personal information and to facilitate the prompt and effective handling of related complaints.
This Privacy Policy applies to the Company’s corporate website (navercorp.com) and NAVER Careers (recruit.navercorp.com) and covers the following:
1. Personal Information Collected, Purposes of Processing, and Retention and Use Periods
2. Provision of Personal Information
3. Entrustment of Personal Information Processing
4. Cross-Border Transfers of Personal Information
5. Retention and Deletion of Personal Information
6. Rights of Data Subjects and Legal Representatives and Methods of Exercising Such Rights
7. Installation and Operation of Automatic Personal Information Collection Devices, and the Right to Refuse
8. NAVER’s Efforts to Protect Personal Information
9. Information on the Data Protection Officer and Personal Information Protection Personnel
10. Changes to the Privacy Policy
1. Personal Information Collected, Purposes of Processing, and Retention and Use Periods
Pursuant to Article 15(1)(4) of the Personal Information Protection Act, NAVER collects and uses the following personal information without the data subject’s consent to perform a contract entered into with the data subject or to take measures at the data subject’s request in the course of entering into a contract.
|
When Information Is Collected |
Purposes of Processing |
Personal Information Collected |
Retention Period |
|
Account registration on the recruitment website (NAVER Careers) |
Managing applicants, conducting the recruitment process, saving job postings of interest, handling recruitment inquiries, and facilitating communication with applicants |
Members residing in Korea: Mobile phone number, name, date of birth, gender, email address (user ID), password, duplicate registration verification information (DI), and NAVER ID (when using NAVER Login) Members residing outside Korea: Name, date of birth, gender, email address (user ID), password, and NAVER ID (when using NAVER Login) |
Until account deletion |
|
Job application and participation in the recruitment process |
Checking application status, managing applications, saving job postings of interest, conducting the recruitment process, editing job applications, verifying eligibility, checking application outcomes, and facilitating communication with applicants |
Name, verification password, email address, phone number, date of birth, gender, nationality, education details (school name, month and year of enrollment and graduation, major, specialization, grades, and graduation status), employment history (company name, job function, position, department, and period of employment/if applicable), military service information (if applicable), veterans’ benefits eligibility information (if applicable), coding test results (if applicable), interview results (if applicable), corporate culture fit assessment results (if applicable), certification/language proficiency information (certification type, level, score, and date obtained/if applicable), and additional materials submitted (if applicable) (Where a reference check is conducted) Reference provider’s name, email address, mobile phone number, department, and job title, as well as information about the applicant’s reputation and employment history collected from the reference provider |
For one year after recruitment results are announced |
|
Submission of 1:1 recruitment inquiries |
Responding to inquiries about job applications |
1:1 inquiry content and attachments |
For one year from the date the inquiry is received |
Pursuant to Articles 15(1)(1) and 23(1)(1) of the Personal Information Protection Act, NAVER collects and uses the following personal information with the data subject’s consent.
|
When Information Is Collected |
Purposes of Processing |
Personal Information Collected |
Retention Period |
|
Submission of partnership proposals |
Receiving partnership proposals and notifying proposers of the outcome |
Company name, proposer’s name, phone number, email address, website URL (if needed for the proposal), and fax number (if needed for the proposal) |
For one month from the date processing is completed |
|
Submission of consultation requests/reports to the Business Ethics Consulting Center |
Receiving consultation requests/reports through the Business Ethics Consulting Center and notifying submitters of the outcome |
Name, contact number, email address, and password for checking the outcome (for anonymous submissions, only the password is collected) |
For six months from the date processing is completed (unresolved inquiries are retained for up to three years) |
|
Submissions through Partners Line and requests for dispute mediation |
Receiving submissions through Partners Line and requests for dispute mediation, and notifying submitters of the outcome |
Submitter’s name, partner company name, contact number, and email address |
For three months from the date processing is completed |
|
Requests for IR meetings and consultations |
Confirming and managing IR meeting requests, ensuring effective communication channels, and providing IR-related information |
Organization name, attendee name, job title, and email address |
Until the purposes of processing are fulfilled or deletion is requested |
|
Participation in earnings announcement conferences |
Identifying event participants and conducting statistical analysis |
Company name, name, email address, country, and investor type |
For three months from the date the event ends |
|
When applying to join the talent pool for future recruitment |
Registration in the talent pool for future recruitment and notification of relevant job opportunities as hiring needs arise |
Name, verification password, email address, phone number, date of birth, gender, nationality, education details (school name, month and year of enrollment and graduation, major, specialization, grades, and graduation status), employment history (company name, job function, position, department, and period of employment/if applicable), military service information (if applicable), veterans’ benefits eligibility information (if applicable), coding test results (if applicable), interview results (if applicable), corporate culture fit assessment results (if applicable), certification/language proficiency information (certification type, level, score, and date obtained/if applicable), and additional materials submitted (if applicable) (Where a reference check is conducted) Reference provider’s name, email address, mobile phone number, department, and job title, as well as information about the applicant’s reputation and employment history collected from the reference provider |
If consent is given to use the information for future recruitment (optional): For five years from the date of submission |
|
Job application and participation in the recruitment process (Legal basis: Article 23(1)(1)) |
Managing applicants eligible for preferential treatment in recruitment under the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities |
[Optional] Disability information (if applicable) |
If consent is given to process sensitive information (optional): For one year after recruitment results are announced If consent is given to use the information for future recruitment (optional): For five years from the date of submission |
On the basis of NAVER’s legitimate interests as a personal information controller under Article 15(1)(6) of the Personal Information Protection Act, including improving the service environment, ensuring service security (preventing misuse and unauthorized use), and maintaining system stability, NAVER collects and uses the following personal information automatically generated during service use until the purposes of processing have been fulfilled:
· IP addresses, cookies, access logs, visit dates and times, service usage records, records of misuse, and device information
2. Provision of Personal Information
NAVER does not process data subjects’ personal information beyond the original scope or provide it to third parties without their prior consent. However, NAVER provides personal information only where the data subject has directly consented to its provision, where NAVER is required to submit it under applicable laws and regulations, or where an imminent risk to the data subject’s life or safety has been identified and the information is provided to address that risk.
Pursuant to Articles 17(1)(1) and 23(1)(1) of the Personal Information Protection Act, NAVER provides the following personal information with the data subject’s consent.
|
Recipient |
Personal Information Provided |
Recipient’s Purposes of Use |
Recipient’s Retention Period |
|
The subsidiary to which the applicant has applied (View application status) |
Name, verification password, email address, phone number, date of birth, gender, nationality, education details (school name, month and year of enrollment and graduation, major, specialization, grades, and graduation status), employment history (company name, job function, position, department, and period of employment/if applicable), military service information (if applicable), veterans’ benefits eligibility information (if applicable), coding test results (if applicable), interview results (if applicable), corporate culture fit assessment results (if applicable), certification/language proficiency information (certification type, level, score, and date obtained/if applicable), and additional materials submitted (if applicable) |
Checking application status, managing applications, saving job postings of interest, conducting the recruitment process, editing job applications, verifying eligibility, checking application outcomes, facilitating communication with applicants, and managing applicants eligible for preferential treatment in recruitment under the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities, verifying eligibility[송1] , etc. |
For one year after recruitment results are announced If consent is given to use the information for future recruitment (optional): For five years from the date of submission |
3. Entrustment of Personal Information Processing
NAVER entrusts some personal information processing activities to external service providers to facilitate the smooth provision of services. NAVER establishes the necessary requirements and manages and supervises these providers to ensure that they process personal information securely in accordance with the Personal Information Protection Act.
Details of these entrustment arrangements are provided below.
|
Entrusted Service Provider |
Entrusted Activities |
Retention Period |
|
NAVER Cloud Corporation (Subcontractors: N Tech Service Corp., NIT Service Corp.) |
Development and maintenance, system operation, and infrastructure management |
Until the purposes of processing have been fulfilled or the entrustment agreement ends |
|
inComms Corp. |
Management of partnership proposals | |
|
BSC Corp. |
Personality and aptitude tests for recruitment | |
|
Grepp, Inc. (Subcontractors: Amazon Web Service, Channel Corp., useB) Codility Limited (Subcontractor: Amazon Web Service) |
Coding tests for recruitment | |
|
Reference Check Korea Corp. Wecruit Specter Inc. (Subcontractors: Amazon Web Service, NHN Cloud Corp., NICE Payments, Danal, Hecto Data) |
Conducting reference checks for recruitment | |
|
Teletogether |
Operation of earnings conference calls |
4. Cross-Border Transfers of Personal Information
The cross-border transfers of personal information described below take place pursuant to Article 28-8(1)(3) of the Personal Information Protection Act (entrustment of processing and storage for contract performance). Data subjects may refuse cross-border transfers of their personal information and may submit such requests through the recruitment website’s 1:1 inquiry service. However, refusing such transfers may restrict their participation in coding tests during the recruitment process where such tests require cross-border transfers of personal information.
|
Name of the Recipient (Entrusted Service Provider) |
Codility Limited |
|
Recipient’s Contact Information | |
|
Country to Which Personal Information Is Transferred |
United States (AWS US East Region used) |
|
Personal Information Transferred |
Basic information (name and email address) linked to the account created during participation in the coding test, and coding test results |
|
Timing and Method of Transfer |
Information about applicants taking the coding test is entered into the coding test platform provided by the service provider |
|
Recipient’s Purpose of Use |
Conducting coding tests as part of the recruitment process |
|
Retention and Use Period |
Until the entrustment agreement ends |
5. Retention and Deletion of Personal Information
For the retention period of personal information processed by the Company, please refer to “Retention Period” as stated in “1. Personal Information Collected, Purposes of Processing, and Retention and Use Periods.”
In the case that the personal information is no longer necessary due to expiration of the retention period or achievement of the purpose of processing, the Company destroys the relevant personal information without delay. Even where the purpose of collecting and using personal information has been achieved, if there is a need to preserve the personal information pursuant to other statutes, the Company retains the relevant data for a certain period. Such information is used solely for retention purposes and is not used for any other purpose.
|
Related statute |
Retained information |
Retention period |
|
Protection of Communications Secrets Act, Article 15-2 (Duty of Telecommunications Business Operators to Cooperate) |
Login records |
3 months |
All personal information for which its purpose of collection and usage has been fulfilled, such as upon membership withdrawal, termination of the service, or expiration of the consented retention period, is destroyed by methods that render it unrecoverable and unreproducible. Information for which other statutes impose a preservation obligation is likewise destroyed by such methods without delay after the relevant period has elapsed. In the case of electronic files, the information is safely deleted using technical methods that prevent recovery and reproduction, and printed materials are destroyed by shredding or incineration.
6. Rights of Data Subjects and Their Legal Representatives and Methods of Exercising Such Rights
Data subjects may, at any time, request access to, correction of, or deletion of their personal information, suspension of processing, and withdrawal of consent, among other things (hereinafter "Exercise of Rights"). For personal information concerning a child under the age of 14, requests such as access may be made by the child's legal representative, and in the case of a minor aged 14 or older, the minor may exercise such rights personally or through a legal representative.
Rights may be exercised through an agent, such as a legal representative or a person delegated with authority; in such case, a power of attorney in the form of Attached Form No. 11 under the "Notice on personal information processing methods[U1] " must be submitted. NAVER verifies whether the person exercising such rights is the data subject or a legitimate agent.
Data subjects may, at any time, view or correct their registered personal information and may request deletion of information or suspension of processing. If you contact us using the methods below to exercise your rights, we will take action without delay.
· Access and modify your personal information on NAVER Careers (Link)
· For other exercises of data subject rights, please send an email to the Data Protection Officer (privacy@naver.com)
A data subject's right to request access to personal information and suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act. Where other statutes specify an obligation to collect or preserve the relevant personal information, deletion of such personal information may not be requested.
7. Installation and Operation of Automatic Personal Information Collection Devices, and the Right to Refuse
NAVER may, in order to improve the service usage environment, ensure service security (such as preventing fraudulent use by malicious members and unauthorized use), and secure stability, utilize information that is automatically generated and collected.
A cookie is a very small text file that is stored on a PC or mobile device through the data subject's browser when accessing a website. When the data subject subsequently revisits the website, the server reads the cookie stored on the device to maintain the settings configured by the data subject, thereby facilitating convenient use of internet services. Data subjects have a choice regarding cookies and may, by setting options in their web browser, allow all cookies, be asked for confirmation each time a cookie is stored, or refuse the storage of all cookies. However, if the storage of cookies is refused, some inconveniences may be experienced in using some services that require login.
· How to block cookies in a web browser
o Chrome : Select "⁝" at the top right of the web browser > New Incognito Window (shortcut: Ctrl+Shift+N)
o Edge : Select "…" at the top right of the web browser > New InPrivate Window (shortcut: Ctrl+Shift+N)
· How to block cookies in a mobile browser
o Chrome : Select "⁝" at the top right of the mobile browser > New Incognito Tab
o Safari : Device Settings > Apps > Safari > Advanced > Block All Cookies
o Samsung Internet : Select the "Tabs" icon at the bottom of the mobile browser > Turn on Secret Mode > Start
8. NAVER’s Efforts to Protect Personal Information
NAVER makes every effort to safely manage data subjects' personal information and protects personal information to a level beyond what is required under the Personal Information Protection Act.
NAVER establishes and implements an internal management plan for personal information.
NAVER establishes an internal management plan for personal information that includes matters such as the designation of a Data Protection Officer and the organization and operation of the personal information protection organization, and checks each year whether the internal management plan is being properly implemented.
NAVER implements access control and access authorization restriction measures for personal information.
To block unauthorized access to personal information, NAVER has established and implements standards for the granting, changing, and revocation of access authority to personal information processing systems, and installs and operates network firewalls and intrusion detection systems. In addition, NAVER minimizes the number of employees who process personal information and reduces the possibility of personal information leakage by separating the external internet network from the internal network on the work PCs of employees who are able to download personal information from the personal information processing system.
NAVER implements encryption measures to safely store and transmit personal information.
In addition to passwords, unique identification information, account numbers, and card numbers, which statutes require to be encrypted, NAVER additionally encrypts and stores email addresses, mobile phone numbers, and the like. NAVER also safely transmits and receives personal information over networks through encrypted communications, among other methods.
NAVER implements measures to retain personal information access records and prevent forgery and falsification.
NAVER retains and manages records of personnel handling personal information accessing the personal information processing system, regularly inspects access records and the like to prevent misuse, abuse, loss, forgery, and falsification of personal information, and safely stores such access records to prevent their falsification, theft, or loss.
NAVER installs and updates security programs for personal information.
NAVER regularly backs up data to prepare against damage to personal information and uses the latest antivirus programs to prevent leakage of or damage to data subjects' personal information or data.
NAVER implements physical measures for the safe storage of personal information.
To prevent members' personal information from being leaked or damaged due to hacking or computer viruses, NAVER installs its systems in areas where access from outside is controlled, and establishes and operates access control procedures.
NAVER establishes and operates a detailed plan to be implemented in the event of a crisis arising from a disaster or calamity.
NAVER establishes a detailed plan, including crisis response guidelines, and maintains and operates a response system to minimize inconvenience to data subjects in the event a crisis occurs.
NAVER safely manages printouts and copies containing personal information.
NAVER destroys printed personal information after review and takes measures such as detecting and deleting files copied to external storage media.
Personal information for which the purpose of use has been achieved is destroyed by methods that render it unrecoverable and unreproducible.
In the case of electronic files, the information is safely deleted using technical methods that prevent recovery and reproduction, and printed materials are destroyed by shredding or incineration.
A dedicated organization is operated for personal information protection.
NAVER was the first domestic company to establish a Customer Information Protection Team, in 2007. Even now, the dedicated personal information protection department continuously carries out technical and managerial protective measures to ensure that all employees company-wide properly comply with their obligations to protect data subjects' personal information.
9. Information on the Data Protection Officer and Personal Information Protection Personnel
NAVER designates a Data Protection Officer and personal information protection personnel as follows to handle data subjects' inquiries and complaints related to personal information.
|
Data Protection Officer |
Personal Information Protection Personnel |
|
Name : David Lee (CPO) Department : Data Protection&Privacy Contact : privacy@naver.com / 1588-3820 |
Name : Lee Jaerim (Leader) Department : Data Protection&Privacy Contact : privacy@naver.com / 1588-3820 |
If you need to report or consult regarding any other infringement of personal information, you may contact the agencies listed below.
|
Agency |
Contact |
|
Personal Information Dispute Mediation Committee (KOPICO) |
www.kopico.go.kr / 1833-6972 |
|
Personal Information Infringement Report Center (KISA) |
privacy.kisa.or.kr / 118 (No area code) |
|
Supreme Prosecutors’ Office of the Republic of Korea (SPO) |
www.spo.go.kr / 1301 (No area code) |
|
National Police Agency (Republic of Korea) |
ecrm.police.go.kr / 182 (No area code) |
10. Changes to the Privacy Policy
In the event of any addition, deletion, or modification to the content of this Privacy Policy, NAVER will provide advance notice through a "Notice of Change" at least 7 days prior to the revision.
Previous versions of the Privacy Policy can be found in the "NAVER Corporation Privacy Policy List."
· Date of announcement : August 26, 2026
· Effective date : September 30, 2026
