Privacy Notice

Last updated: 2026-04-02

1. Retention

CoreSpan Academy retains personal data only as long as needed to deliver services, satisfy audit requests, and meet legal obligations under the Personal Information Protection Act and related Korean regulations. Registration records, attendance logs, and communications typically remain for thirty-six months unless a longer period is required for active enterprise agreements or dispute resolution. Lab telemetry that could identify individuals is minimized, aggregated where possible, and purged according to schedules published to enterprise sponsors. When retention periods expire, we use secure deletion or anonymization techniques appropriate to the medium. You may request deletion subject to exceptions where law mandates continued storage.

2. Third parties

We share personal data with subprocessors that provide hosting, email delivery, survey tooling, and customer relationship management, each bound by data processing terms consistent with this notice. Subprocessors may operate outside Korea only when Standard Contractual Clauses, adequacy decisions, or equivalent safeguards approved under Korean law are in place. We do not sell personal information. Any transfer to a public authority occurs only with lawful requests and documented internal approval. A current subprocessor list is available on written request to the contact email below.

3. Data collected

We collect identifiers such as name, corporate email, phone number, job title, and billing contacts for enterprise purchases. Technical data includes IP addresses, device types, and cookie identifiers described in the Cookie Notice. Learning data encompasses lab completion markers, quiz attempts, and facilitator notes tied to quality improvement. Payment references may appear on invoices, though payment card data is handled by PCI-compliant processors and not stored on CoreSpan Academy servers. Optional surveys collect feedback with explicit consent banners where required.

4. Scope

This notice applies to visitors of hub-merge.one, registered learners, enterprise sponsors, and summit attendees interacting with CoreSpan Academy digital properties. It does not govern third-party sites linked for convenience; their policies control. If you participate on behalf of an organization, both you and your employer share responsibility for accuracy of roster data provided to us. Children’s services are not directed to individuals under sixteen, and we delete such data if discovered unless parental authorization exists for legitimate educational programs.

5. Contact

For privacy inquiries, data subject requests, or security disclosures, email contact@hub-merge.one with sufficient detail to verify your identity. We respond within fifteen business days where feasible, and within statutory timelines where Korean law prescribes shorter windows. You may lodge a complaint with the Personal Information Protection Commission if you believe processing violates applicable law. Enterprise customers may also use designated privacy liaisons named in their order forms.