ZeroCall Privacy Policy

The purpose of this Policy is to set out the purposes of processing, items, retention and use periods, provision and entrustment, cross-border transfer and destruction of personal information processed by the Company in the course of providing the service, and the rights of data subjects.

ZeroCall is a tool that users use to communicate with their own customers by phone, text and chat. Accordingly, the Company processes personal information in different capacities depending on the nature of the information.

In this Policy, “user” means members who use the service under the Terms of Use and the administrators and agents of business Clients, and “data subject” means a person identified by the personal information being processed.

1. The Company posts this Policy on its website (https://zerocall.kr/legal/privacy-policy) and on a public page within the service.
2. When this Policy is amended, the Company posts the amendments and the reasons from 7 days before the effective date. Changes that materially affect the rights of data subjects, such as collected items, purposes of use, provision to third parties or cross-border transfer, are posted from 30 days before the effective date and communicated individually by in-service notification, email, text message or similar means.
3. Previous versions of this Policy can be viewed through the links in Article 26 (Revision History).

1. ZeroCall is a business phone service for businesses and adults, and persons under 19 cannot sign up as members. The Company confirms the age of applicants through identity verification by an identity verification agency.
2. The Company does not collect personal information of children under 14, and if it becomes aware that a child's personal information has been collected, it destroys it without delay.

The Company processes personal information for the purposes below and processes only the minimum personal information necessary to achieve them. Processing is based on grounds permitted by the Personal Information Protection Act, such as the consent of the data subject (Article 15(1)1 of the Act), the conclusion and performance of a contract (item 4 of the same paragraph) and compliance with legal obligations (item 2 of the same paragraph).

The Company processes the minimum personal information necessary to provide the service. The items differ depending on the type of sign-up and the functions used, and the following information may be generated and collected in the course of using the service.

1. The Company processes the corporate registration number of corporate members or the resident registration number of sole proprietors, and copies of the contact person's ID card, only to the extent required by the Telecommunications Business Act and by carriers' line activation and caller ID pre-registration procedures.
2. Unique identification information is not used for any purpose other than submission to carriers, is stored in encrypted form, and access is limited to the staff in charge.
3. It is destroyed without delay once submission to the carrier is complete and the period for handling line activation disputes has passed (see Article 12).

1. Information users enter or upload directly during sign-up, corporate verification or use of the service
2. Information received as the result of identity verification from the identity verification agency (Dreamsecurity MOK)
3. Contacts users select from the app's address book and upload
4. Information generated automatically in the course of using the calling, text, chat and AI answering functions
5. Payment result information received from the payment gateway
6. Information provided through the website inquiry form and customer inquiry channels (Channel Talk, email, phone)

The Company processes data subjects' personal information only within the scope notified in Article 4 and does not provide it to third parties except in the following cases.

1. Where the data subject has given separate prior consent
2. Where business verification information is submitted to a carrier for caller ID pre-registration, number porting or line activation under the Telecommunications Business Act
3. Where there is a request from investigative agencies, courts or other relevant authorities following lawful procedures under laws such as the Protection of Communications Secrets Act and the Telecommunications Business Act
4. Where it is deemed necessary for the urgent protection of the life, body or property of the data subject or a third party (to the extent permitted by applicable laws)

The Company entrusts personal information processing work as follows to provide the service smoothly. In accordance with Article 26 of the Personal Information Protection Act, the Company sets out in writing in its entrustment agreements compliance with instructions on personal information protection, prohibition of processing for other purposes, technical and administrative protective measures, restrictions on sub-entrustment, liability for damages and the like, and manages and supervises its trustees.

If trustees change or are added, the Company amends and publishes this Policy.

ZeroCall provides call recording, speech-to-text conversion of recordings (STT) and AI call summaries as basic functions of the service, and provides AI call answering (real-time conversation) when the user configures it. To provide these functions, the Company transfers (entrusts the processing of) personal information to AI service providers outside Korea as follows. The Company obtains consent to cross-border transfer as a separate item at sign-up and records the date and time, means and policy version of consent. All destination countries are the United States, and the Company has confirmed that processing in Korea is not possible because no provider offers a region that processes the models used within Korea.

1. No use for training: transferred data is processed only to provide the service and, under each provider's API terms (Google Vertex AI commitment not to train on customer data, OpenAI API data usage policy, Anthropic commercial terms), is not used to train AI models. The Company does not participate in Google Speech-to-Text's data logging program.
2. Refusal and withdrawal of consent: consent to cross-border transfer is required to provide basic functions, so if it is refused, sign-up is restricted. After sign-up, call recording can be turned off in the service settings; when recording is off, no STT or AI summary is generated and those calls are not transferred abroad. If AI call answering is not configured, no transfer occurs. Basic calling and text functions remain available with recording turned off.
3. Where a user processes the voice of a call counterpart or customer through the functions above, the user (member or Client), as the personal information controller for that information, is responsible for informing the data subject of the cross-border transfer and obtaining any necessary consent (see Chapter 5). The Company provides means of notice, such as announcement settings.

When the Company additionally uses or provides personal information without the data subject's consent under Article 15(3) and Article 17(4) of the Personal Information Protection Act, it makes the decision considering the following.

1. Whether it is related to the original purpose of collection
2. Whether additional use or provision is foreseeable in light of the circumstances of collection or processing practices
3. Whether it unfairly infringes the interests of the data subject
4. Whether measures necessary to ensure safety, such as pseudonymization or encryption, have been taken

The Company destroys personal information without delay once the purpose of processing has been achieved. However, it retains information for certain periods under its internal standards or applicable laws as follows. For information entrusted by business Clients (Chapter 5), the retention period notified by the Client to data subjects takes precedence, and the periods below are defaults that are not longer than that.

1. Destruction procedure: when the retention period has passed or the purpose of processing has been achieved, an automated batch that runs daily selects and destroys the relevant data and records the date and time, items, conditions, number of records and method of destruction in a destruction register (which contains no personal information). Information not covered by the batch is destroyed after internal review and approval by the staff in charge.
2. Electronic files: permanently deleted by a method that makes recovery or reproduction impossible, or, where rows must be kept for statistical purposes, identifying information is masked or anonymized.
3. Paper documents: shredded or incinerated.
4. Information subject to destruction that remains in database backups expires together with the backups when the backup retention cycle has passed.

This Chapter applies to the personal information of call counterparts, customers served, contacts, recipients of texts and chats and the like (“customer information”) that members or business Clients (“Clients”) process using ZeroCall. Customer information processed in business call center (CC) services is a typical example.

1. The personal information controller for customer information is the relevant member or Client, and the Company is a trustee entrusted with processing by the member or Client under Article 26 of the Personal Information Protection Act.
2. The Company processes customer information only to provide the service to the member or Client and does not use it for other purposes or provide it to third parties without the member's or Client's instructions.
3. The purposes of collection, items, retention periods and notice to data subjects for customer information are determined by the member or Client under its own privacy policy. Members and Clients must list the Company as a trustee in their own privacy policies.

Requests for access, correction, deletion or suspension of processing of customer information must be made to the member or Client that is the personal information controller. The Company cooperates without delay at the request of the member or Client, and forwards any request received directly by the Company to the relevant member or Client.

As a trustee, the Company implements the following measures for customer information.

1. Retaining personal information access records (access date and time, account, IP, data subject processed, task performed) for 5 years, and providing an access record screen that Client administrators can view and monthly review reports
2. Automatic destruction on expiry of the retention period (Article 12) and provision of the destruction register; providing functions for Client administrators to extend retention periods and delete members
3. Suspending accounts unused for 60 days, expiring passwords after 90 days, locking after 5 failed logins, restricting allowed IPs, managing trusted devices, and blocking concurrent logins with the same account
4. Storing call transcripts (STT) with AES-256 encryption, masking phone numbers on screen, notifying users to confirm the business purpose before viewing recordings or personal information, and retaining download records
5. Retaining the history of granting, changing and revoking permissions (date, handler, IP, values before and after) for 5 years

1. The Company sub-entrusts the processing of customer information to the trustees listed in Article 9, and consent to sub-entrustment is obtained through the member's agreement to the Terms of Use or the personal information processing entrustment agreement with the Client.
2. When call recording, STT, AI summary or AI call answering functions are used, customer information (call audio and transcripts) is transferred outside Korea (United States) in accordance with Article 10. Before using these functions, members and Clients must inform data subjects of the cross-border transfer through their own privacy policies and call announcements and, where required by law, obtain consent.
3. Members and Clients may stop cross-border transfers by disabling these functions in the service settings.

1. Agent and administrator accounts for call center services are issued, changed and deleted by the Client, and the Company processes the name, mobile phone number (ID), department, position and branch registered by the Client, as well as access records and permission change history generated during use of the service.
2. The Company processes this information only for account authentication, security, access record management and compliance with legal obligations, and the retention period follows Article 12.
3. Before issuing accounts, the Client is responsible for informing its employees of this processing.

Data subjects may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction or deletion in case of errors, etc.
3. Request suspension of processing
4. Withdraw consent and cancel membership
5. Request an explanation of, and refuse, automated decisions (where applicable)

The Company implements the following measures in accordance with the Standards for Ensuring the Safety of Personal Information. Details can be found in the Security Policy (https://zerocall.kr/legal/security).

1. Administrative measures: establishing and implementing an internal management plan, minimizing personal information handlers and training them regularly, managing and supervising trustees, and operating incident response procedures
2. Technical measures: one-way encryption of passwords; encrypted storage of dates of birth, call transcripts and unique identification information; encryption in transit (HTTPS, SIP over TLS); access permission management and access control (allowed IPs, trusted devices, two-factor authentication); retention and monthly review of access records; malware prevention; and regular vulnerability checks
3. Physical measures: physical access control by cloud providers and office access control

The Company uses cookies in its web service to keep users logged in, for security and for convenience. The website uses Google Analytics for visit statistics, only for statistical purposes that do not identify individuals.

Users can refuse or delete cookies in their browser settings (Chrome: Settings → Privacy and security → Cookies / Safari: Preferences → Privacy / Edge: Settings → Cookies and site permissions). If cookies are refused, some functions such as staying logged in may be restricted.

The Company does not collect or use behavioral information for targeted advertising. If it does so in the future, it will separately notify the items, purposes, retention period and how to refuse, and obtain consent in accordance with applicable laws.

The Company does not currently process pseudonymized information. If it pseudonymizes information for statistics or research in the future, it will disclose the purposes, items and retention period in this Policy in accordance with Article 28-2 and the following articles of the Personal Information Protection Act.

The Company designates the following Chief Privacy Officer to take overall responsibility for personal information processing and to handle data subjects' complaints and provide remedies.

Data subjects may contact the above for inquiries, complaints and remedies relating to personal information protection, and the Company will respond and act without delay.

Data subjects may apply to the following organizations for dispute resolution or consultation to obtain remedies for infringement of personal information. Please contact them if you are not satisfied with the Company's handling or need further help.

1. Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
2. Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (no area code), privacy.kisa.or.kr
3. Cyber Investigation Division, Supreme Prosecutors' Office: 1301 (no area code), www.spo.go.kr
4. Cyber Investigation Bureau, Korean National Police Agency: 182 (no area code), ecrm.cyber.go.kr

In addition, a person whose rights or interests have been infringed by a disposition or omission of the head of a public institution regarding a request for access, correction, deletion or suspension of processing of personal information may file an administrative appeal under the Administrative Appeals Act (행정심판법).

This Policy may be amended due to changes in laws, policies or the service. When it is amended, the amendments and reasons are posted on the website from 7 days (30 days for material changes) before the effective date in accordance with Article 2.