Privacy Policy
QuantifiedESG, Inc. (hereinafter referred to as QESG) implements the following policy to protect the personal information and interests of users and to address grievances related to personal information in accordance with Article 30 of the Personal Information Protection Act.
1. Items, Purposes, and Retention Periods of Personal Information Processed
QESG processes personal information solely for the following purposes and does not use it for any other purpose. Personal information is processed within the retention and use period agreed upon at the time of collection. Member-related information is retained for 30 days from the withdrawal request and then destroyed. Non-member inquiries, information managed under individual customer contracts, and security and access logs follow their separate retention periods below or the applicable contract. Information that must be retained by law is stored separately for the statutory period and then destroyed.
| Category | Items Processed | Purpose | Retention Period |
|---|---|---|---|
| Website consultation inquiries | (Required) Name, organization, email, inquiry subject and message (Optional) Phone number | Reviewing and responding to inquiries | 3 years after the inquiry is answered |
| QESG Portal members | (Required) Name, email, password (Optional, when an administrator registers a team member) Notes | Membership registration, identity verification, account management, and service provision | Retained for 30 days from the withdrawal request, then destroyed |
| QESG Portal 1:1 inquiries | (Required) Inquiry subject and message, reply email | Reviewing and responding to inquiries | Retained for 30 days from the withdrawal request, then destroyed |
| Carbon emission measurement platform members | (Required) Email, name, job title, phone number, password, company | Membership registration, identity verification, account management, and service provision | Retained for 30 days from the withdrawal request, then destroyed |
| Carbon emission measurement platform supplier contacts | Name, email, phone number ※ Entered by administrators | Requesting emissions data from and communicating with suppliers | Until the supplier registration is terminated |
| ESG reporting tool members | (Required) Email, name, phone number, password (At sign-up or during use) Organization | Membership registration, identity verification, account management, and service provision | Retained for 30 days from the withdrawal request, then destroyed |
| ESG reporting tool co-authoring | Invitee email, commenter email and comment, activity records ※ Entered by members | Report co-authoring, ownership transfer, and collaboration | Retained for 30 days from the withdrawal request, then destroyed |
| ESG reporting tool 1:1 inquiries | (Required) Name, email, inquiry message (Optional) Inquiry category, report | Reviewing and responding to inquiries | Retained for 30 days from the withdrawal request, then destroyed |
| ESG report assurance applications | On-site contact name, email, and phone number; address; tax invoice contact name, email, and phone number; business registration certificate ※ Entered by the applying member | Scheduling on-site assurance, contracts, and tax invoices | Retained for 30 days from the withdrawal request, then destroyed |
| ESG data management tool contacts | (Required) Name, email (Optional) Organization, notes ※ Entered by an administrator | Assigning data entry contacts and communicating with them | Retained for 30 days from the withdrawal request, then destroyed |
| ESG assessment and supply chain due diligence platform members | (Required) Email, name, phone number, password (Where set for an assessment) Additional input items | Conducting assessments and due diligence, issuing result reports, and managing participation history | Retained for 30 days from the withdrawal request, then destroyed |
| ESG assessment and supply chain due diligence platform sign-up inquiries | (Required) Name, organization, phone number or email, inquiry message | Reviewing and responding to inquiries | 3 years after the inquiry is answered |
| Supply chain due diligence platform participation requests | (Required) Name, email (Optional) Phone number, notes | Reviewing participation requests and sending invitations | Retained for 30 days from the withdrawal request, then destroyed |
| Paid service payments | Buyer name, email, and phone number; payment identifiers; payment amount and status; card issuer and masked card number; virtual account holder and number; tax invoice contact name, email, and phone number | Processing payments and refunds, and issuing tax invoices | Retained for 30 days from the withdrawal request, then destroyed |
| Information automatically generated and collected during service use | IP address, browser information (User-Agent), login date/time and result, request paths, cookies | Preventing fraudulent use and responding to security incidents | Login records: 1 year |
| Information automatically collected through service error monitoring | Browser, OS, and device type; language; access location (country, region, and city, county, or district level); screen path and title; app version; error details; session identifier; URL of failed API requests (requests with a query string are not collected) and status code ※ Screen paths and request URLs may contain internal service identifiers ※ Applied to services in stages | Detecting service errors and ensuring stable operation | 30 days |
2. Provision of Personal Information to Third Parties
QESG provides personal information to third parties only in accordance with Articles 17 and 18 of the Personal Information Protection Act, including cases such as the user's consent or special statutory provisions.
QESG may provide personal information to third parties as outlined below:
QESG may provide personal information to third parties as outlined below:
1. Recipient: Professional partners specializing in data verification and due diligence
2. Purpose of provision: Data verification and due diligence, evaluation, analysis, and follow-up monitoring
3. Retention and use period: Member-related information is retained for 30 days from the withdrawal request and then destroyed. Information managed under individual customer contracts follows the contractual retention period. Statutory records are retained separately for the period required by law and then destroyed.
2. Purpose of provision: Data verification and due diligence, evaluation, analysis, and follow-up monitoring
3. Retention and use period: Member-related information is retained for 30 days from the withdrawal request and then destroyed. Information managed under individual customer contracts follows the contractual retention period. Statutory records are retained separately for the period required by law and then destroyed.
Details regarding the provision of personal information to third parties are as follows:
| File Name | Recipient | Information provided | Purpose of Provision | Retention Period of Recipient |
|---|---|---|---|---|
| Employee and Company information | Auditors, consultants | Name, email, contact details | Coordination of on-site assessment schedules | Member-related information: 30 days from the withdrawal request, then destroyed Customer contract information: as agreed in the individual contract |
3. Entrustment of Personal Information Processing
QESG entrusts the processing of personal information as follows to provide its services smoothly.
| Trustee | Entrusted Tasks |
|---|---|
| Amazon Web Services, Inc. | Hosting of service servers and databases, data storage and operation, error and performance monitoring (CloudWatch RUM) (Seoul Region) |
| Amazon Web Services, Inc. (Amazon SES) | Sending emails |
| Google Asia Pacific Pte. Ltd. (Google Workspace SMTP Relay) Contact: googlekrsupport@google.com | Forwarding website inquiries and sending service notices and inquiry acknowledgments by email |
| Korea PortOne Co., Ltd. (PortOne) Contact: security@portone.io | Payment integration and forwarding payment information for paid services |
| KG Inicis Co., Ltd. Contact: private_inicis@kggroup.co.kr | Payment approval, cancellation, settlement, and related transaction processing |
| Channel Corporation (Channel Talk) Contact: privacy@channel.io | Customer support, inquiry reception, and support history management through Channel Talk |
| Slack Technologies Limited Contact: privacy@slack.com | Delivering and storing internal notifications about sign-ups, payments, and service inquiries |
| OpenAI OpCo, LLC Contact: privacy@openai.com | AI conversations and response generation, report and attachment analysis, and related conversation and file processing |
| Google Asia Pacific Pte. Ltd. and its affiliates (Vertex AI Gemini, Cloud Translation) Korean GCP contracting entity: Google Cloud Korea LLC Contact: googlekrsupport@google.com | Generative AI document and image analysis and translation |
When entering into entrustment contracts, QESG stipulates in written agreements, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing for purposes other than the entrusted work, technical and administrative security measures, restrictions on re-entrustment, supervision of the trustee, and liability for damages, and supervises the trustee to ensure safe processing. If the entrusted work or the trustee changes, QESG will disclose the changes through this Privacy Policy.
4. Overseas Transfer of Personal Information
QESG transfers personal information overseas for email delivery, inquiry forwarding, internal notifications, AI analysis, translation, and service error analysis as follows. Member-related information is retained for 30 days from the withdrawal request and then destroyed. Statutory records are stored separately for the period required by law and then destroyed. Separate periods for non-member inquiries and customer contract information are shown below.
| Recipient | Country | Items Transferred | Purpose | Timing and Method | Retention Period |
|---|---|---|---|---|---|
| Functional Software, Inc. (Sentry) Contact: compliance@sentry.io | United States | Error analysis data from the ESG reporting tool, ESG data management tool, and ESG assessment and supply chain due diligence platform: IP address, browser information, account identifiers (email, name), company identifier, request and screen information, and screen recordings for some services | Detecting and analyzing service errors | Transmitted over an encrypted network when error analysis data is collected | Member-related information: 30 days from the withdrawal request, then destroyed |
| Google Asia Pacific Pte. Ltd. (Google Workspace SMTP Relay) Contact: googlekrsupport@google.com | United States | Recipient email; inquirer name, organization, phone number, and email; inquiry subject and message; service email content | Forwarding website inquiries and sending service notices and inquiry acknowledgments by email | Transmitted over an encrypted network when inquiry, acknowledgment, or other service emails are sent | Member-related information: 30 days from the withdrawal request, then destroyed Non-member inquiries: 3 years after the inquiry is answered |
| Slack Technologies Limited Contact: privacy@slack.com | United States | Registrant name, email, organization, phone number, and inquiry; payment email, product, amount, and payment method | Delivering and storing internal notifications about sign-ups, payments, and service inquiries | Transmitted over an encrypted network when sign-up, payment, or inquiry notifications occur | Member-related information: 30 days from the withdrawal request, then destroyed Non-member sign-up inquiries: 3 years after the inquiry is answered |
| OpenAI OpCo, LLC Contact: privacy@openai.com | United States | Personal information in questions, conversations, reports, and attachments; user ID, name, email, and report identifier | AI conversations and response generation, report and attachment analysis, and related conversation and file processing | Transmitted over an encrypted network when AI analysis, question, or document processing features are used | Member-related information: 30 days from the withdrawal request, then destroyed Customer contract information: as agreed in the individual contract |
| Google Asia Pacific Pte. Ltd. and its affiliates (Vertex AI Gemini) Contact: googlekrsupport@google.com | United States | Personal information in prompts, documents, images, and other analysis inputs | Generative AI document and image analysis and response generation | Transmitted over an encrypted network when generative AI analysis features are used | Member-related information: 30 days from the withdrawal request, then destroyed Customer contract information: as agreed in the individual contract |
| Google Asia Pacific Pte. Ltd. and its affiliates (Cloud Translation) Contact: googlekrsupport@google.com | United States | Personal information in text submitted for translation | Translation | Transmitted over an encrypted network when translation features are used | Member-related information: 30 days from the withdrawal request, then destroyed Customer contract information: as agreed in the individual contract |
5. Rights of Users
Users may exercise the following rights regarding personal information protection at any time:
1. Request for access to personal information
2. Request for correction in case of errors
3. Request for deletion
4. Request for suspension of processing
2. Request for correction in case of errors
3. Request for deletion
4. Request for suspension of processing
6. Destruction of Personal Information
Member-related personal information is retained for 30 days from the withdrawal request and then destroyed. To request withdrawal, contact info@qesg.co.kr. Non-member inquiries, information managed under individual customer contracts, and security and access logs are retained for the periods in Section 1 or the applicable contract and then destroyed.
1. Destruction Procedure
Information whose retention period has ended is identified and destroyed. Information that must be retained by law is stored separately for the statutory period and then destroyed, and is not used for other purposes. The same rules apply to member-related information processed by external trustees.
Information whose retention period has ended is identified and destroyed. Information that must be retained by law is stored separately for the statutory period and then destroyed, and is not used for other purposes. The same rules apply to member-related information processed by external trustees.
2. Destruction Method
Electronic files are deleted using methods that prevent recovery. Paper documents are shredded or incinerated.
Electronic files are deleted using methods that prevent recovery. Paper documents are shredded or incinerated.
7. Installation, Operation, and Refusal of Automatic Data Collection Tools
QESG may use ‘cookies’ to provide stable and convenient services to users. Cookies are small data sent by the server operating the website to the user's browser and may be stored on the user's device.
1. Purpose of use
- Essential cookies: Providing functions strictly necessary for service use, such as storing access tokens to maintain login and authentication status
- Functional/analytical cookies: Storing user preferences, improving service quality, and analyzing usage statistics
2. Installation, operation, and refusal of cookies: Users can refuse or delete the storage of optional cookies through web browser settings.
- However, as essential cookies are strictly necessary for service provision, refusing them may restrict login capabilities and basic service usage.
- Essential cookies: Providing functions strictly necessary for service use, such as storing access tokens to maintain login and authentication status
- Functional/analytical cookies: Storing user preferences, improving service quality, and analyzing usage statistics
2. Installation, operation, and refusal of cookies: Users can refuse or delete the storage of optional cookies through web browser settings.
- However, as essential cookies are strictly necessary for service provision, refusing them may restrict login capabilities and basic service usage.
To detect service errors, QESG operates an error monitoring tool (CloudWatch RUM) that runs in the browser. It does not use tracking cookies (it stores only a cookie that remembers your refusal) and may store values needed for transmission in browser storage.
If you do not wish this tool to collect your information, please turn it off in the "Error monitoring" setting on the service screen (at the bottom of the screen or in the account menu). This setting applies to the browser you are using and is stored in a cookie, so you must set it again if you delete cookies. In browsers that block cookies, it is not stored and may apply only to the current screen. Information already collected before you turn it off is deleted when the retention period ends, and other tabs apply the setting after they are refreshed. This setting applies only to error monitoring and does not restrict service functions.
If you do not wish this tool to collect your information, please turn it off in the "Error monitoring" setting on the service screen (at the bottom of the screen or in the account menu). This setting applies to the browser you are using and is stored in a cookie, so you must set it again if you delete cookies. In browsers that block cookies, it is not stored and may apply only to the current screen. Information already collected before you turn it off is deleted when the retention period ends, and other tabs apply the setting after they are refreshed. This setting applies only to error monitoring and does not restrict service functions.
In demo (trial) environments, use fictitious or anonymized data and do not enter actual personal information or confidential customer information.
8. Personal Information Protection Officer and Manager
QESG designates a Personal Information Protection Officer and a Personal Information Protection Manager as follows to take overall responsibility for personal information processing duties and to handle complaints and damage relief for users.
▶ Personal Information Protection Officer
Name: Hye-ju Kim
Title: Director (Head of Strategic Business Team)
Contact: 02-6956-2410, info@qesg.co.kr
※ You will be connected to the department in charge of personal information protection.
Name: Hye-ju Kim
Title: Director (Head of Strategic Business Team)
Contact: 02-6956-2410, info@qesg.co.kr
※ You will be connected to the department in charge of personal information protection.
▶ Personal Information Protection Manager (also serving as Information Security Manager)
Name: Junhyeon Yoon
Title: Team Leader (Head of Development Team)
Contact: 02-6956-2410, info@qesg.co.kr
Users may contact the Personal Information Protection Officer and the competent department regarding any inquiries, complaints, or damage relief requests related to personal information protection arising from the use of QESG's services (or business). QESG will respond to and resolve such inquiries. Name: Junhyeon Yoon
Title: Team Leader (Head of Development Team)
Contact: 02-6956-2410, info@qesg.co.kr
9. Changes to the Privacy Policy
This Privacy Policy applies from its effective date.
10. Measures to Ensure the Security of Personal Information
In accordance with Article 29 of the Personal Information Protection Act, QESG takes the following technical, administrative, and physical measures to ensure security:
1. Regular internal inspections
QESG conducts internal inspections at least once a year to ensure the security of personal information processing.
2. Establishment and implementation of an internal management plan
QESG has established and implements an internal management plan (Personal Information Management Guideline) for the safe processing of personal information.
3. Access control
QESG applies multi-factor authentication (MFA) to the management consoles of systems that process personal information and grants only the minimum privileges required for each task.
4. Retention of access records
QESG retains management console activity records (AWS CloudTrail) and service audit logs.
5. One-way encryption of passwords
User passwords are stored as one-way hashes, so even QESG cannot know the original passwords.
6. Encryption in transit
Information exchanged between users and the services is encrypted with TLS 1.2 or higher.
7. Physical security
Service servers are operated in Amazon Web Services (AWS) data centers.
QESG conducts internal inspections at least once a year to ensure the security of personal information processing.
2. Establishment and implementation of an internal management plan
QESG has established and implements an internal management plan (Personal Information Management Guideline) for the safe processing of personal information.
3. Access control
QESG applies multi-factor authentication (MFA) to the management consoles of systems that process personal information and grants only the minimum privileges required for each task.
4. Retention of access records
QESG retains management console activity records (AWS CloudTrail) and service audit logs.
5. One-way encryption of passwords
User passwords are stored as one-way hashes, so even QESG cannot know the original passwords.
6. Encryption in transit
Information exchanged between users and the services is encrypted with TLS 1.2 or higher.
7. Physical security
Service servers are operated in Amazon Web Services (AWS) data centers.
This policy was revised on November 10, 2026. It takes effect on the date this revised policy is actually posted on the website, which is also its notice date. Items on error monitoring (CloudWatch RUM) and newly launched services (QESG Portal members and QESG Portal 1:1 inquiries) apply 30 days after the notice date.
Revision History
| Date | Summary of Changes | Full Text |
|---|---|---|
| Revision date: November 10, 2026 Notice and effective date: the date this revised policy is posted on the website RUM and QESG Portal items: 30 days after the notice date | Reorganized items, purposes, and retention periods by service; standardized member-related retention to 30 days from withdrawal requests; added trustees and overseas transfers; updated security measures; designated a Personal Information Protection Manager; added CloudWatch RUM and QESG Portal items (applicable 30 days after the notice date) | Current |
| January 5, 2026 | Wording revised (effective date unchanged) | View previous version |
| January 1, 2025 | Effective | - |
