Privacy Policy / 개인정보처리방침

Article 1 (General Provisions)

1. In this Privacy Policy, the term "Personal Information" refers to information relating to a living individual that makes it possible to identify the individual by their name, phone number, etc., including information that, even if it cannot identify a specific individual on its own, can be easily combined with other information to identify them.

2. ACI Worldwide Express Corp. (hereinafter "the Company") highly values the personal information of its customers and strictly complies with the "Personal Information Protection Act," the "Act on Promotion of Information and Communications Network Utilization and Information Protection," and relevant global security standards for data protection.

3. Through this Privacy Policy, the Company informs customers and partners of the purposes and methods for which their personal information is processed within our Warehouse Management System (WMS), and the robust technical measures taken to protect it.

4. The Company discloses this Privacy Policy on the main login page of the WMS so that customers and system users can easily access it at any time.

Article 2 (Purposes and Items of Personal Information Processing)

1. Principle of Minimum Collection and Collection Methods

A. ACI Worldwide Express Corp. collects only the minimum information necessary to provide services such as global e-commerce fulfillment and shipping/delivery agency services.

B. Generated information, such as device information, access logs, and IP addresses, may be automatically created and collected during the use of PC web and mobile web/app services.

2. Consent to the Use of Personal Information

A. The Company has established a procedure for consent to the collection and use of personal information. The sender (or partnering platform) is deemed to have the legal authority to consent to the provision of the recipient's personal information.

B. In principle, the Company restricts the collection, use, and provision of personal information of children under the age of 14.

3. Purpose and Items of Processing

A. Provision of Goods and Logistics Services: Personal information is processed for the purpose of international export/import customs clearance, quarantine, and the end-to-end delivery of goods.
(Items processed: Recipient Name, Shipping Address, Contact Number, Personal Customs Clearance Code (PCCC), and Order Details)

B. System (WMS) and Service Management: Personal information is processed for API-based shipping reservations, automated order synchronization, and real-time delivery tracking.

C. Customer Support and Grievance Handling: Personal information is processed for the purpose of verifying partner or customer inquiries, handling complaints related to shipping/fulfillment.

Article 3 (Retention, Usage Period, and Destruction of Personal Information)

Personal information is destroyed without delay, without exception, once the purpose of collection and use is achieved. However, if retention is strictly required under relevant laws and regulations of South Korea, the Company retains the information for the specified legal period.

Article 4 (Provision of Personal Information to Third Parties)

In principle, ACI Worldwide Express Corp. does not use personal information beyond the specified purposes or provide it to external third parties.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing operations as follows to ensure smooth WMS export fulfillment and global shipping services, and manages and supervises the consignees to ensure that personal information is processed safely.

Article 6 (Rights of Data Subjects and How to Exercise Them)

1. Right to Access and Control Personal Information

Data subjects (users and partners) may request access, correction, deletion, suspension of processing, or withdrawal of consent regarding their registered personal information at any time. For online members and registered system users, information can be viewed and modified directly through the WMS profile settings or the membership termination (withdrawal) process.

2. Methods for Exercising Rights

In addition to the self-service features within the WMS, data subjects may exercise their rights by contacting the Company’s privacy department via the provided contact information (refer to the "Chief Privacy Officer" section). Upon receiving a request for access, correction, or deletion, ACI Worldwide Express Corp. will verify the identity of the requester and take necessary actions without delay.

3. Grounds for Refusal of Requests

The Company may refuse a request for access, correction, or deletion, in whole or in part, in the following exceptional cases:

• A. If there is a significant risk of harming the life, physical safety, property, or other rights and interests of the data subject or a third party.
• B. If the request is likely to cause significant interference with the Company’s core operations, such as the fulfillment of ongoing global export logistics and shipping contracts.
• C. If the request violates applicable laws or prevents the Company from fulfilling its statutory obligations, such as retention requirements under the Customs Act.

Article 7 (Technical and Administrative Measures for Protection)

ACI Worldwide Express Corp. implements the following technical and administrative measures to ensure the safety of personal information processed within the WMS, preventing any loss, theft, leakage, alteration, or damage. However, the Company is not liable for data breaches caused by force majeure events that cannot be prevented by current technology, or incidents resulting from the user's own negligence or inherent risks of the basic internet environment.

1. Technical Measures

• A. Data Encryption: Customers' personal information is protected by strong passwords. Important data, including files and at-rest database records, is encrypted using industry-standard algorithms such as AES-256 and protected through separate security functions.
• B. Secure Transmission (Encryption in Transit): The Company adopts secure communication protocols (TLS 1.2 or higher) to safely encrypt and transmit personal information and API payload data over the network.
• C. Anti-Forgery and Log Protection: Strict security technologies are applied to prevent the forgery or alteration of access logs. All access records to the personal information processing system (WMS) are safely stored and monitored.
• D. Anti-Hacking Measures and Infrastructure Security: The Company implements and continuously updates anti-virus programs to prevent damage from malicious software and block newly discovered threats. To defend against external intrusions, security groups and access control configurations are applied to the production infrastructure (AWS) to restrict unnecessary access, and the database is managed by applying strong account authentication and password policies to block unauthorized access. Furthermore, network traffic and access logs are monitored in real time to ensure system stability.

2. Administrative Measures

• A. Global Security Certification: The Company operates its major systems and infrastructure in accordance with internationally recognized Information Security Management Systems (ISMS), such as ISO 27001.
• B. Information Security Policies: The Company has established and actively enforces comprehensive internal management plans for the safe processing of data.
• C. Principle of Least Privilege: Access to personal information is strictly limited to the minimum number of necessary personnel through Role-Based Access Control (RBAC).
• D. Security Training and NDAs: Regular internal training sessions on data protection obligations are conducted for all handlers. All employees are required to sign strict non-disclosure agreements (NDAs) to prevent human-caused data leaks, and the Company maintains internal audit procedures for policy compliance.
• E. Physical Access Control: Server rooms and physical data storage areas are designated as highly restricted security zones, with all physical access strictly controlled and logged.

Article 8 (Linked Sites)

1. Provision of External Links

ACI Worldwide Express Corp. may provide links to third-party websites or materials to enhance the user experience and provide additional logistics information.

2. Limitation of Liability

In such cases, the Company has no administrative or technical control over these external sites and materials. Therefore, the Company cannot guarantee, nor is it responsible for, the accuracy, reliability, or usefulness of any services or materials provided by external websites.

3. Independent Privacy Policies

When a user clicks on a link and navigates to a third-party website, the privacy policy of that site is entirely independent of the Company's policy. Users are strongly advised to carefully review the privacy and data protection policies of any newly visited websites.

Article 9 (Chief Privacy Officer and Contact Information)

Article 10 (Consultation and Reporting on Privacy Infringement)

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / +82-2-3480-3571
• National Police Agency Cyber Bureau: cyberbureau.police.go.kr / 182
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972

Addendum

Article 1 (Enforcement Date)

This Privacy Policy shall enter into force on February 10, 2025.