Privacy Policy
Privacy Policy
Effective and last updated: 2026-04-29
General
Dropdown Co., Ltd. (hereafter "Company") processes personal data collected through growthcareer.xyz (hereafter "Site") and the Fan to Pro program (hereafter "Program") offered through the Site, in accordance with this policy.
The Company complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Act on the Consumer Protection in Electronic Commerce, and other relevant laws of the Republic of Korea. The original Korean version of this policy is authoritative in case of any discrepancy.
Personal data we collect
a. Provided directly by the user during application
- Name, email, mobile phone number
- Date of birth
- University (current or graduated)
- Visa status (D‑2, D‑4, F‑2, F‑4, F‑6, other)
- Residence
- Consent status and timestamp
b. Collected additionally during payment processing
- Depositor name, deposit date and time, deposit amount
- Refund account information when refunds occur (bank name, account number, account holder)
c. Automatically collected
- IP address, access logs, cookies, device info, browser info
- Visit timestamps and page navigation paths
Purpose of processing
- Program application intake, identity verification, eligibility review
- Payment guidance, deposit confirmation, refund processing
- Class schedule, materials, certificate guidance, and announcements
- Concert project matching and issuance of the concert participation letter to actual participants
- Customer support, inquiry response, dispute resolution
- De-identified statistical analysis and service improvement
- Compliance with legal obligations (business record retention, etc.)
Outsourcing of personal data processing
To provide stable services, the Company outsources personal data processing to the following parties. The Company specifies the items required for safe processing in accordance with Article 26 of the Personal Information Protection Act.
| Processor | Outsourced work | Location |
|---|---|---|
| Supabase Inc. | Database hosting, applicant data storage | Seoul (ap-northeast-2) |
| Vercel Inc. | Website hosting, serverless function execution | Global CDN |
| Union Pictures | Concert project matching and issuance of the concert project participation letter to actual participants | Republic of Korea |
Third-party provision of personal data
The Company does not provide personal data to third parties without prior consent. The following are exceptions where separate consent may not be required.
Users who confirm interest in the concert project field experience have their name, contact, and visa status provided to Union Pictures for matching purposes. This is done through a separate consent process.
- When required by law or by a lawful request from an investigating authority
- When processed in a form that does not identify any individual, for purposes such as statistics or academic research
Retention and use period
- Application (before payment): 30 days from the date of application. Automatically discarded if no payment is made.
- Enrollment record (payment complete): 1 year from the program start date. After that, identifying information is destroyed and only de-identified statistical data is kept.
- Payment and refund records: kept for 5 years under Article 6 of the Act on Consumer Protection in Electronic Commerce.
- Consumer complaint and dispute records: kept for 3 years under Article 6 of the Act on Consumer Protection in Electronic Commerce.
- Access logs: kept for 3 months under the Protection of Communications Secrets Act.
Rights of the data subject and how to exercise them
Users may exercise the following rights at any time.
Send requests to hello@dropdown.xyz. After identity verification, we respond within 10 days.
- Right to access personal data
- Right to correction and deletion of personal data
- Right to suspension of processing
- Right to withdraw consent
Cookies and automatically collected information
The Company uses cookies to provide a personalized experience. You can refuse or delete cookies in your browser settings, although some features may not work fully as a result.
Safeguards
- TLS 1.3 encryption in transit
- Row Level Security in Supabase, with service-role-only access at rest
- Minimum admin access and regular reviews
- Access logs for the personal data processing system
Data protection officer
- Company: Dropdown Co., Ltd.
- Representative: Hwang Jae-ha
- Contact: hello@dropdown.xyz
Remedies for rights violations
If you need to report or consult about a personal data violation, you can contact the following organizations.
- Personal Information Infringement Report Center: dial 118 / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972 / kopico.go.kr
- Supreme Prosecutors' Office Cyber Investigation: 1301 / spo.go.kr
- National Police Agency Cyber Bureau: 182 / ecrm.cyber.go.kr
Revision history
- 2026-04-29: First effective version