CyberGround (hereinafter the "Site") establishes and discloses this Privacy Policy in accordance with relevant laws, such as the "Personal Information Protection Act," to protect the personal information of data subjects and to promptly and smoothly handle related grievances.

Article 1 (Personal Information Collected and Purpose of Use)

The "Site" collects the minimum amount of personal information necessary for the following purposes. The personal information being processed will not be used for purposes other than the following, and necessary measures, such as obtaining separate consent, will be implemented if the purpose of use changes.

1. Membership Registration and Management
   • Items Collected (Required): Email Address, Password, Nickname
   • Purpose: Member identification, service provision, delivery of notices, prevention of duplicate registration, Customer Support (CS).
2. Service Provision and Operation
   • Items Collected (Required): Learning progress, CTF challenge scores and rankings, problem-solving records generated during service use.
   • Purpose: Provision of core "Service" functions (learning, challenges), calculation of rankings, management of learning achievements.
3. Information Automatically Generated and Collected During Service Use
   • Items Collected: IP Address, Cookies, Service usage logs (access times, etc.), learning environment access records.
   • Purpose: Prevention of fraudulent use, monitoring of service misuse and abnormal access (e.g., attack attempts), service quality improvement, and statistical analysis.

Article 2 (Processing and Retention Period of Personal Information)

1. The "Site" processes and retains personal information within the period of retention and use specified by law or agreed upon by the data subject at the time of collection.
2. Membership and Management Information: Until the time of membership withdrawal.
3. Service Provision (Learning Records): Destroyed without delay upon membership withdrawal.
4. However, information related to the following reasons will be retained until the end of the specified period:
   • If an investigation or inquiry is in progress due to a violation of relevant laws, until the said investigation is concluded.
   • To restrict re-registration and manage account suspension due to violations of the Terms of Service (such as Prohibited Conduct in Article 5), records of misuse and identifying information (hashed identifiers) may be retained for 1 year after withdrawal before being destroyed.

Article 3 (Provision of Personal Information to Third Parties)

The "Site" processes the data subject's personal information only within the scope specified in Article 1 (Personal Information Collected and Purpose of Use). Personal information is provided to third parties only in cases falling under Articles 17 and 18 of the "Personal Information Protection Act," such as with the data subject's consent or special provisions in the law.

(Note: The "Site" does not sell or rent user personal information. Aggregated, anonymized threat statistics are not personal information.)

Article 4 (Entrustment of Personal Information Processing)

The "Site" may entrust the processing of personal information as follows for smooth operations.