Chính sách xử lý thông tin cá nhân của Agent (bản tiếng Hàn là bản chính thức). Liên hệ: eiso@eiso.co.kr
In accordance with Article 30 of the Personal Information Protection Act, AGENT Co., Ltd (hereinafter the "Company") establishes and publishes this Privacy Policy to protect the personal information of data subjects who use the eiso AI Management System Platform website (eiso.co.kr, hereinafter the "Website") and to handle related complaints promptly and smoothly.
| Category | Items processed | Purpose of processing | Retention period |
|---|---|---|---|
| Sign-up and member management | User ID, password (stored with one-way encryption), name, company name, telephone number, email, address, member type (general member or corporate member application); for corporate member applications: type of registration (company or individual), business registration number (tax code, optional), number of contact persons | Member identification and login, provision of member-only materials, finding ID and password, member management, guidance and consultation on corporate member applications | Until the member withdraws (Corporate member application records: 1 year after processing is completed, then automatically deleted) |
| Management system establishment and training inquiries, usage applications (document-writing pass) | Company name (Korean and English), contact person's name, title and department, telephone number, fax, email, address, number of employees, business activities, application items (standards to use, writing language), requests; for support and training applications: support type, eiso usage status, support request and desired timing | Receipt and confirmation of applications, consultation on management system support, training and usage, discussion of consultant dispatch and customized training, guidance on quotations and contracts, and contact | Management system establishment and training inquiries: 1 year after processing is completed (automatically deleted after that) Usage applications for passes (document-writing rights): 5 years (Act on the Consumer Protection in Electronic Commerce, etc.: records of contracts, withdrawal of offers and payment) |
| Payment (Pay now, bank transfer) | Invoice number, payment and deposit amount, approval number, mobile phone number, member ID, items purchased, depositor name, business registration number (if a receipt or tax invoice is requested) | Confirmation of payment and deposit, granting of usage rights, issuance of receipts and invoices, cancellation and refunds | 5 years (Act on the Consumer Protection in Electronic Commerce, etc.) |
| Find ISO Reference Materials | Content of the question | Searching for related materials in the reference library (information collection) | Not stored |
| AI functions (establishing and operating management systems, writing training materials): contact person inquiries | Member information (user ID, name, company name, telephone number, email), inquiry content (items entered) | Confirmation of inquiries, guidance on how to use the service, usage fees and training, and contact | 1 year after processing is completed (automatically deleted after that) |
| AI functions (establishing and operating management systems, writing training materials): Write with AI and AI answers (when the AI function is connected) | Content entered when requesting writing or answers with AI (subject, requirements, document text, questions, reference materials for management system document writing (including images), etc.). Member ID, name and contact details are not sent. Logo images in reference materials are not sent (they are inserted only into the Word file on this PC). | Generating AI drafts and answers | Not stored on the Website (Processing by the AI service provider: see Section 4) |
| AI function web research (Management System Operation 1 Context of the Organization and 3 Risk Assessment; ICT Management System Operation 1 AI Context Analysis and 13 Legal Requirements Identification and Monitoring; when the AI function is connected) | Industry entered (size, main products), industry-specific regulations, business region, selected standards, AI role (development, supply, use) and applicable items (personal information processing, automated decisions, etc.), departments and processes for risk assessment, targets of ad hoc checks (names of laws and regulations, news links). The company name, basic information, website, uploaded files and member information are not sent (please do not enter a company name or personal information in the fields above). | Searching the public web for external trends and interested parties' requirements in the industry, applicable laws and regulations, and reference materials for risk assessment, to use as the basis and sources of AI drafts | Not stored on the Website (Processing and web search by the AI service provider: see Section 4) |
| Case-by-case consultation on nonconformities and corrective action (Management System Operation 19 Nonconformity and Corrective Action; ICT Management System Operation 15 Nonconformity and Corrective Action; when the AI function is connected) | Text read from the folder or files you specify (nonconformity reports, audit reports, customer complaint records, etc.), results of other steps stored in this browser, consultation content (agreement, edits and questions regarding proposals), and register rows when preparing a status report. The name of the person in charge is not sent in the status report. Member ID, name and contact details are not sent (please mask customer and personal names before uploading). | Organizing nonconformity candidates, proposing clauses, grades, root causes, corrective measures and schedules, and preparing status reports | Not stored on the Website (only the session number and number of calls) (The register is kept only in the user's browser, and copies of the materials read disappear when that tab is closed. Processing by the AI service provider: see Section 4) |
| Website guidance chatbot (when the AI function is connected) | Questions entered in the guidance box. Member ID, name and contact details are not sent (please do not enter personal information in your questions). | Generating guidance answers based on the content of the Website | Not stored on the Website (Processing by the AI service provider: see Section 4; rate limits: see Automatic collection below) |
| Questions and answers (Community, online inquiries) | Member ID, name (masked in public questions), email (answer notification), question title and content, whether public, answer by the person in charge | Responding to and answering questions, answer notification emails, posting questions that the member chose to make public | Until the author deletes the question or the member is deleted |
| Company workspace (Optional: only when the company administrator consents) | Company name, members' user IDs and roles (writing, review, approval), saved AI outputs (title and body, stored with encryption for each company), the people and dates of saving, review and approval, operating data (measurements, records, claims, evaluations and incidents entered or imported by your company; objectives, indicators, action plan tasks, changes to objectives, review and monthly closing records; nonconformities and corrective actions; policies and assignment of duties; measuring instruments and documents; internal audits and management reviews; context of the organization, risks, changes and suppliers; processes, design and facilities; food safety, gifts and hospitality; competence and awareness (counts by job title, without people's names); drawings (files are not sent, only fingerprint, size and path). Names and text are encrypted for each company, while numbers, figures and judgments are kept as they are so that they can be analyzed. We recommend entering job titles in the person in charge, approver, auditor and attendee fields; even if people's names are entered, they are encrypted for each company. | Keeping the company's management system operation records, carrying the results of earlier steps into AI writing in later steps, review and approval, and providing information from analyzing and consolidating operating data (judgments, trends, summaries and management review inputs). Uploaded files are not uploaded to the server: they are read in the browser, used only for the task, and cleared from the screen when the task ends. They are not used for AI training, the operator does not view their content, and they are not used for certification audits. | Automatically deleted after the retention period set by the company (3 months, 1 year, 3 years or 5 years); documents and the workspace can be deleted at any time; when a member is deleted, that member's membership information is also deleted |
| Operations calendar weekly email (Optional: only when a workspace member turns it on) | Member ID and email, filtering by job title in charge, email language | Once a week, a notification of the types and number of deadlines of that company (item content is not included) | Not sent when turned off; deleted when the member leaves the workspace or the workspace or member is deleted |
| Monthly summary email for top management (Optional: only when a workspace member turns it on) | Member ID and email, email language, month sent | Once a month (on the first business day), a numerical summary notification of that company's management system operation (only the workspace name and counts or ratios; record content is not included) | Sending stops when you unsubscribe, and the data is destroyed without delay if you are removed from the workspace members or if the workspace or membership information is deleted |
| Automatic collection | Access IP address, access date and time, browser information, cookies for keeping you logged in, visit statistics cookies and visit information (Google Analytics, Section 7) | Preventing fraudulent use (rate limits on login, applications, questions and downloads), keeping you logged in, ensuring service stability, visit statistics (service improvement) | Cookies: up to 7 days Visit statistics cookies: up to 2 years; Google Analytics data: 2 months (configured value) Rate limit records: used only to determine the limit period (up to 24 hours) |
Required items: for sign-up, user ID, password, name and email; for management system establishment and training inquiries and usage applications (document-writing pass), company name, name, telephone number and email (including the selected standards for usage applications); all other items are optional. Personal information is collected from what users enter directly on the Website. Users have the right to refuse consent to the collection and use of required items, but if you do not consent, you cannot sign up, apply or purchase. There is no disadvantage if you do not enter optional items.
The Company does not collect unique identification information or sensitive information such as beliefs or health. This Website is a service for business and organization contact persons and does not accept sign-ups from children under 14. The Company does not send advertising information to users' email addresses or telephone numbers.
The Company destroys personal information without delay once the retention period has passed or the purpose of processing has been achieved. Inquiries that have been processed are automatically deleted 1 year after processing is completed (usage applications and payment records are deleted after being kept for 5 years), and rate limit records are deleted after 24 hours. Electronic files are deleted by a method that cannot be recovered, and printed materials are shredded or incinerated. If information must be retained under other laws, it is stored separately from other personal information for that period.
The Company processes the personal information of data subjects only within the scope of the purposes in Section 1 and does not provide it to third parties, except with the consent of the data subject or where laws specifically provide otherwise. The sale and payment of eiso passes (receiving payment, issuing receipts and invoices, cancellation and refunds) are also handled directly by the Company (Terms of Use, Article 2).
The Company outsources personal information processing to operate the Website as follows, and sets out the necessary matters in outsourcing contracts so that personal information is managed safely.
| Processor | Outsourced task |
|---|---|
| Cloudflare, Inc. | Website hosting; storage of member and application databases |
| Resend | Sending notifications of application and inquiry receipt and receipt confirmation emails, emails for finding ID and password, and question and answer notification emails |
| Anthropic, PBC | Generating AI drafts and answers (AI writing in the AI functions (establishing and operating management systems, writing training materials), including reference materials for management system document writing (including images); AI answers and asking questions with AI in Find ISO Reference Materials (including web search); web research on industry, laws and regulations, and risks in the AI functions (searching the public web with Anthropic's web search tool); and the Website guidance chatbot, when the AI function is connected) |
| Google LLC | Visit statistics analysis (Google Analytics 4) |
| Wizice | Website operation and maintenance |
| PaySsam (Paymint) | Card and simple payment processing (Pay now) |
Some of the processors above are located overseas, and personal information is transferred overseas as follows.
| Recipient | Country of transfer | Items transferred | Purpose of transfer · Retention period |
|---|---|---|---|
| Cloudflare, Inc. | United States and other countries where data centers are located (Database: Asia-Pacific region) | Items processed in Section 1 | Hosting and data storage / Retention period in Section 1 |
| Resend | United States | Application content, email address, user ID | Sending emails / Follows the service's policy after sending is processed |
| Anthropic, PBC (when the AI function is connected) | United States | Content entered for AI writing, answers and the guidance chatbot (including reference materials for management system document writing (including images)); industry, business region, standards and AI role used for web research in the AI functions (excluding company name, website and uploaded files) | Generating AI drafts and answers / Follows the service's policy after processing |
| Google LLC | United States | Address of the page visited (excluding search terms after the question mark), previous page address, browser, device, approximate region, time of visit, cookie identifier | Visit statistics / Google Analytics retention period (2 months) |
Privacy inquiry contacts of the recipients: Cloudflare, Inc.: www.cloudflare.com/privacypolicy/ · Resend: resend.com/legal/privacy-policy · Anthropic, PBC: www.anthropic.com/legal/privacy · Google LLC: policies.google.com/privacy
"Download as PPT" and "Download as Word" create files within the user's browser, and those files are not sent to the Website or the processors.
Date and method of transfer: transmitted over the information and communications network at the time the service is used. If you do not want your information transferred overseas, you may inquire by email (eiso@eiso.co.kr) instead of signing up or applying online. In that case, you cannot use the Website's member services or online applications.
The Company uses cookies to keep you logged in and, from October 26, 2026, Google Analytics 4 (GA4) cookies for visit statistics. We do not use cookies for advertising or personalized advertising.
Google Analytics sends the address of the page visited (the part of the address after the question mark, such as search terms, is not sent), the previous page address, browser and device type, approximate region (country and city), time of visit and cookie identifiers (cookies starting with _ga and _ga_, up to 2 years) to Google LLC (United States) and produces visit statistics only. Names, emails, member IDs and entered text are not sent, and Google signals and ad personalization are turned off. The access IP address is used only to estimate the region and is not stored in Google Analytics (according to Google). Statistical data is kept for 2 months.
Refusing cookies: you can block cookie storage in your web browser settings or install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). If you block login cookies, you cannot use services that require login, but blocking visit statistics cookies does not affect your use of the services.
If the visit statistics feature provided by the hosting provider (Cloudflare) is turned on, the address of the page visited, browser, country and so on are processed for statistical purposes only. This feature does not use cookies and does not identify individuals.
| Chief Privacy Officer | Yoon Ji-yeon |
|---|---|
| Department in charge and contact | AGENT Co., Ltd · Email eiso@eiso.co.kr |
| Address | Room 222, Building 1, 40 Yongmeori-gil, Tangjeong-myeon, Asan-si, Chungcheongnam-do, Republic of Korea |
If you need to report or seek advice on a personal information infringement, you may contact the following organizations.
If this Privacy Policy is changed, we will announce it in the Website's announcements from 7 days before it takes effect. For important changes affecting the rights of data subjects, we will announce it from 30 days before it takes effect. You may request previous versions of the policy from the department in charge in Section 8.
This Privacy Policy applies from October 19, 2026.
Revision history: 2026-10-06 Established · 2026-10-07 Added Find ISO Reference Materials, contact person inquiries for core functions, and rate limit records · 2026-10-08 Outsourcing and overseas transfer for AI functions (Anthropic), retention period for applications and inquiries (1 year after processing is completed), scope of email sending, designation of Chief Privacy Officer (Certification Team Leader) · 2026-10-14 Payment information (kept for 5 years), AGENT Co., Ltd entrusted with sales and payment tasks (receiving payment and receipts), outsourcing of card payment to PaySsam (Paymint) · 2026-10-16 Website guidance chatbot (questions: not stored; outsourcing and overseas transfer to AI service provider Anthropic), questions and answers (member information, questions and answers: until the author deletes them or the member is deleted; answer notification emails) · 2026-10-16 In line with the revised Terms of Use, AGENT Co., Ltd changed from processor to seller (provision to a third party, consent given in the purchase application), and PaySsam (Paymint) became the seller's processor · 2026-10-16 Operator and seller changed to AGENT Co., Ltd: no provision to third parties, PaySsam (Paymint) is the Company's processor · 2026-10-16 Chief Privacy Officer Yoon Ji-yeon, address in Asan · 2026-10-16 Main telephone number changed · 2026-10-16 Items supplemented (required and optional items and disadvantages of refusing consent, retention period of 5 years for purchase applications, business registration number and browser information, non-processing of unique identification information, sensitive information, pseudonymized information, children and advertising information, inquiry contacts of overseas recipients, deadline for handling access requests (10 days) and receiving department, contact point for Vietnamese users' rights, security measures, visit statistics, notice of policy changes) · 2026-10-16 Questions in Find ISO Reference Materials are not sent to the standards question server (removed from the scope of outsourcing to Wizice) · 2026-10-17 Web search for asking questions with AI (questions may be used as web search terms via Anthropic) · 2026-10-17 Renamed "Certification and Training Inquiries" to "Management System Establishment and Training Inquiries" and changed their purpose of use · 2026-10-17 Contact email changed (eiso@eiso.co.kr) · 2026-10-17 Added reference materials for management system document writing (including images) to what is sent for AI writing · 2026-10-18 Company workspace (optional, stored encrypted after consent) · 2026-10-18 Reflected the approach of granting document-writing rights (passes) instead of selling documents (files) (document set purchase application changed to usage application) · 2026-10-18 Added support type, eiso usage status, request content and desired timing to management system establishment and training inquiries (consultant dispatch and customized training discussions) · 2026-10-18 Added member type to sign-up (general member or corporate member application) and corporate member application information (type of registration, business registration number, number of contact persons) · 2026-10-18 Deleted telephone contact: inquiries by email (eiso@eiso.co.kr) only · 2026-10-19 Specified retention period for corporate member application records (1 year after processing is completed) · 2026-10-19 Added visit statistics (Google Analytics 4) cookies and overseas transfer (applies from October 26, 2026) · 2026-10-19 Specified web research on industry, laws and regulations, and risks in the AI functions (items sent and not sent) · 2026-10-23 Specified the content sent for case-by-case consultation on nonconformities and corrective action, and storage in the browser · 2026-10-24 Specified operating data in the company workspace (for analysis, encrypted for each company) and the provision of analyzed and consolidated information; uploaded files are not uploaded to the server and are cleared from the screen when the task ends; output files are stored in the computer folder you designate (only the folder name and permission are remembered in the browser) · 2026-10-27 Supplemented operating data items (added registers, drawings as fingerprints only, recommended recording of job titles), operations calendar weekly email (optional), monthly summary email for top management (optional)