1. Scope and the Company's two roles
JH SYSTEM (the "Company") operates the cloud subscription ERP "Afdal ERP" (https://afdalerp.co.kr) and handles personal data in two distinct roles. First, for information the Company collects directly — consultation requests on the website, service sign-up, billing contacts — the Company is the data controller under the Personal Information Protection Act of Korea. Second, for information that customer companies enter into the ERP about their employees and business partners (which may include resident registration numbers, payroll and bank account numbers), the customer company is the controller and the Company acts as its processor. The conditions of that processing are set out in the Personal Data Processing Agreement concluded with each customer.
2. Data the Company collects directly, and purposes
At the consultation stage: name, company name, contact (phone or email), industry, and the enquiry, used to respond to the consultation. During service use: user ID, name, affiliation and role, and access records (time of access, features used), used for account management, security, billing and notices. For billing: the billing contact's name and contact details and business registration details for tax invoicing. In this role the Company does not collect resident registration numbers.
3. Data processed as a processor
Customer companies may enter their employees' resident registration numbers and other unique identifiers into the ERP for statutory tasks such as payroll, year-end tax settlement, withholding tax filings and payment statements. The legal basis and responsibility for collecting such data lie with the customer company as controller; the Company only provides storage, retention and processing functions within the entrusted scope, and does not use entrusted data beyond that purpose or provide it to third parties.
4. Security measures
Sensitive fields such as resident and foreigner registration numbers, payroll and bank account numbers are stored encrypted with AES-256, and all traffic is protected with HTTPS. Access to screens and data is enforced by role on the server, and each customer's data are separated at the database level. Access logs for personal-data screens are retained under Article 8 of the Standards for Ensuring the Safety of Personal Information — for two years, as unique identifiers are processed. System change logs are kept in a tamper-evident form (hash chain), and automatic backups run daily. Data are stored on servers operated by the Company within the Republic of Korea.
5. Outsourcing and overseas transfers
The Company uses the following external providers to operate the Service; changes to this list will be announced by revising this policy.
First, connectivity — Cloudflare, Inc. (United States): website and service traffic passes through its relay network, in the course of which connection information such as IP addresses is processed. Second, email delivery — the mail service of Amazon Web Services, Inc. (United States): recipients' email addresses are processed to send confirmation, notice and verification emails. Third, domestic sub-processing for tax invoicing — Linkhub Co., Ltd. (Popbill, Republic of Korea): names, contact details and business registration details needed to issue and transmit electronic tax invoices, cash receipts, text messages, KakaoTalk notifications and faxes. Fourth, AI document reading — Anthropic, PBC (United States): document images are transmitted only when the customer has switched this feature on. The feature is off by default and operates only after the customer administrator consents and enables it; before transmission, card numbers are removed and documents containing sensitive data are blocked.
Transfers to the overseas providers above are limited to what the Service requires. Data subjects may object to overseas transfer through the contact in Section 8, in which case the related features (email delivery, AI reading) may become unavailable.
6. Retention and destruction
Consultation data are kept for six months after the consultation ends and then destroyed. Service account data are kept until the agreement ends; after termination the data remain available for viewing and export for 30 days and are then destroyed irrecoverably within 7 days, with notice of destruction. Communication access records are kept for at least three months as required by law, and personal-data access logs for two years. Records whose retention is required by law (e.g. e-commerce contract and payment records, five years) are stored separately for the statutory period and then destroyed.
7. Data breach response
Upon becoming aware of a personal data breach, the Company notifies the affected data subjects and reports to the Personal Information Protection Commission or the designated agency within 72 hours in accordance with Article 34 of the Act; breaches discovered in the Company's role as processor are notified to the customer company without delay. Internal procedures are maintained in a separate breach response document.
8. Data subjects' rights and the privacy officer
Data subjects may request access, correction, deletion or suspension of processing of data the Company controls directly. Requests concerning data entered by a customer company must be made to that company as controller; requests received by the Company are forwarded to the customer without delay. The Chief Privacy Officer is BHUIYAN ABDULLAH (Representative), tel +82-70-4125-5333, email support@afdalerp.co.kr. Complaints may also be addressed to the Privacy Call Centre (118) or the Personal Information Dispute Mediation Committee (+82-1833-6972).
9. Cookies
The Service uses a single cookie to keep users logged in, which disappears when the browser is closed. No advertising or behavioural tracking cookies are used.
10. Changes to this policy
Changes to this policy are announced on the website at least 7 days before taking effect (30 days for material changes). This policy takes effect on 15 October 2026 and replaces the draft dated 10 September 2026.