KorMarathon Privacy Policy
KorMarathon processes personal information needed to provide its features as described below. If required information is not provided, the relevant feature cannot be used, but public event information remains accessible.
1. Information and purposes
The table below describes the information processed and its purposes. The legal bases for processing without consent and information processed with separate consent are explained below the table. Retention is described in Section 3; analytics, advertising and external processing are described in Sections 5–6 and the External Processing and Overseas Transfer Notice.
| Activity | Information and purposes |
|---|---|
| Member accounts | Signup email or account identifier and email provided by Google; member ID, display alias, email verification, signup, policy acknowledgment and session information: signup, authentication, account management and necessary notices. The authentication provider processes passwords; the operator does not view the original password |
| Reviews, questions and replies | Member identifier, event and distance, rating, tags, intention to participate again, content, creation and update times, status, helpful votes and displayed author information: publication, editing, related displays, verification of posting authority, moderation review and objections |
| Member event-registration requests | Account and contact details, affiliation and relationship to the event, event information, official sources, organizer evidence, images, selected official contact, necessary private attachments and review/result records: receipt, verification, results, follow-up and correction |
| Legacy event submissions | Submitter or contact person's name, affiliation and contact details provided at the time; event information, images, verification materials and processing records: existing submission handling and necessary follow-up or correction |
| Inquiries, promotion and sponsorship discussions | Sender's name, affiliation and contact details needed for responses or discussions; related content, attachments and minimum handling records: responses, discussions, and follow-up or correction of the same matter |
| Issuance history and notifications | Member account key, display name, relevant event, issuance type, status, date/time and necessary correction records; app notification content, read status and email delivery results: personal history management and access, fulfillment, error correction and related notices |
| Privacy-rights requests | Contact details, request content, necessary identity or authority verification and results: handling statutory privacy-rights requests |
| Access and security | IP address, browser/device information, access, error and operation records and results: access functions, security and error handling. Cookies and analytics are described in Section 6 |
Legal bases for processing without consent
Only information necessary for the relevant activities above is processed on the following bases.
- Member accounts and members' own posting features; member event-request handling and necessary contractual follow-up; agreed fulfillment, personal history access, non-promotional notifications and access functions necessary for member features: Article 15(1)(4) of the Personal Information Protection Act (contract performance). This is limited to the individual's necessary information and does not by itself justify all publication to non-members or providers' independent use.
- Responses to inquiries, promotion or sponsorship discussions and follow-up or correction of the same matter; minimum records needed after submission completion to verify or correct content or submission authority; minimum retention of hidden or removed review/comment originals for moderation review and objections; and minimum access records for ordinary error diagnosis and recovery: Article 15(1)(6) (legitimate interests). Processing is limited to minimum information where statutory requirements, including necessity and a comparison with the individual's rights, are met. Post-completion retention follows the limits and early destruction criteria in Section 3.
- Verification, action and results for privacy-rights requests and statutory safeguards: Article 15(1)(2) (statutory duties), limited to information indispensable to duties under Articles 35–38 and Article 29, respectively.
Legacy submissions are processed only where lawful grounds for their original collection and continued processing have been established. If the retention period stated at collection is shorter than Section 3, that shorter period applies.
Information processed with separate consent
Optional promotional emails use the separately consented email address and consent, withdrawal and unsubscribe status under Article 15(1)(1). The basic service remains available without this consent. Consent may be withdrawn through the unsubscribe option or the contact in Section 7.
2. Public information
Non-members may view approved event information, images and official contacts; published review ratings, distances, tags, intention to participate again, content, posting times, helpful-vote counts, displayed author aliases and review counts; and question/reply content and dates. Internal account identifiers, sign-in provider information and private submission materials are excluded from public post information. Information authors enter directly in a post may also become public.
Official contacts are displayed after their publication scope and submission authority are checked. Private contact details or sensitive information, such as health or illness details, entered directly in a post may also become public. Information not intended for publication should be omitted before posting. After posting, correction, deletion or removal from public view may be requested through available editing functions or the email in Section 7. The operator may mask information or exclude it from publication. This notice does not replace any separate consent required to process sensitive information.
Event images may be used in ordinary posts and paid advertising on KorMarathon's official Instagram, Threads and Facebook accounts where the scope of use was stated before submission and the necessary permissions have been confirmed.
3. Retention and account deletion
Personal information is retained within the periods below only as needed for its purpose and is destroyed without undue delay if it becomes unnecessary earlier. Public event materials without personal information may remain published to provide event information and operational history.
| Information | Retention period or end criteria |
|---|---|
| Member account, profile and account-dependent activity, interests and app notifications | Until account deletion |
| Public reviews, questions, replies and event information | While publication continues. Personal information is processed within the necessary publication scope and on a lawful basis |
| Originals of hidden or removed reviews/comments | Up to 180 days after the final action, only as needed for moderation review and objections |
| Private personal information in legacy submissions and member event requests | Only personal information in contact details, affiliation and evidence needed for submission verification, correction and authority checks; up to two years after submission handling ends |
| Personal information in general inquiries, promotion and sponsorship discussions | Only information needed for follow-up; up to one year after handling or discussions end |
| Personal information in account-linked individual issuance history | Until account deletion. Any outstanding fulfillment or correction duty is limited to the information and period necessary to complete it |
| Optional promotional-email recipient information | Until consent withdrawal or account deletion |
| Privacy-rights request and objection records | Minimum information needed until the request and any ongoing objection handling are completed |
| Records needed for ordinary error diagnosis and recovery | Until the relevant diagnosis and recovery are completed. Providers' access/error records follow the applicable criteria below |
| Analytics, transmission and provider records | The applicable criteria in Section 6 and the External Processing and Overseas Transfer Notice |
Upon account deletion, login-account, profile and account-dependent personal information is destroyed without undue delay. Information for which this Policy specifies a separate lawful retention basis and period is handled under those provisions. Published reviews, questions and replies remain posted after their account link is removed. Requests to correct, delete or suspend processing of remaining personal information may still be submitted after account deletion using the contact in Section 7.
After account deletion, individual issuance records may continue to be retained after removing only information that could identify the individual, such as account links, display names or notes, but only to the extent that the individual can no longer be identified even using other information, taking reasonable account of time, cost and technology. Individual records such as issuance date, event and status remain within that scope.
4. Destruction and safeguards
When a retention period ends or information becomes unnecessary for its fulfilled purpose, KorMarathon checks the information and any statutory retention requirement, then destroys it without undue delay. Electronic information is destroyed so it cannot be restored or reproduced; paper records, if any, are shredded or otherwise destroyed. Information that another law requires to be retained is managed separately under the applicable basis, categories and period. Hiding or removing information from public view is distinguished from destroying its stored original.
Access to personal information is restricted, and authentication, access controls and encrypted communication are applied.
5. External processing and disclosures
KorMarathon entrusts some personal-information processing to external providers to operate the service. Provider roles and entrusted tasks, including inquiry-email handling, and applicable third-party disclosures and overseas transfers are described separately in the External Processing and Overseas Transfer Notice. That notice forms part of this Privacy Policy.
Google Analytics' products-and-services data-sharing feature is used. Google uses the shared data to improve its own products, services, measurement and advertising tools. Microsoft Clarity includes Microsoft's independent advertising and service-improvement processing. Information categories, retention and user controls are described in Section 6 and the External Processing and Overseas Transfer Notice. Google Privacy Policy · Microsoft Privacy Statement.
6. Cookies, analytics and advertising
Cookies or browser storage are used to maintain sign-in and language settings. Visit, page and device information and usage information such as searches, filters, clicks and scrolling may be used for analytics and advertising-related features. Personal information entered in search terms or other input may be included in analytics information.
| Tool | Information and purpose |
|---|---|
| Google Analytics 4 | Page, device, access and interaction information and identifiers such as cookies for visit and usage analysis |
| Microsoft Clarity | Screen information subject to masking settings, clicks, scrolling, device/access information and identifiers such as cookies for usage analysis |
| Ahrefs Web Analytics | Visit, page, device and access aggregates and Google Analytics imports. Basic aggregation does not use cookies or persistent identifiers |
| Vercel Web Analytics and Speed Insights | Visits, referral sources, approximate location, device/browser and page-performance metrics for visit statistics and performance aggregation |
Tool-specific retention and providers' independent processing are described in the External Processing and Overseas Transfer Notice.
Cookies and site data can be restricted or deleted through browser privacy settings. Google Analytics provides a browser opt-out tool; Google and Microsoft personalized advertising can be controlled through their privacy and advertising settings. Turning off personalized advertising differs from stopping all analytics/advertising transmissions. Blocking or deleting cookies does not stop all analytics that do not use cookies, and restricting storage may affect functions such as sign-in. Related privacy-rights requests may be sent to the contact in Section 7.
7. Rights and privacy contact
The KorMarathon Operations Team handles privacy matters and related complaints at contact@kormarathon.com.
Members, non-members, legal representatives and duly authorized agents may request access, correction, deletion, suspension of processing or consent withdrawal by emailing the request details and identifying the information concerned. Identity or authority is checked only as needed, and results are provided within the period and by the method required by law. Where a request is restricted, postponed or refused, the reasons and how to object are explained; objections may be submitted to the same email address.
8. Changes
Revised policies and their effective dates are published on the website. Any separate advance notice or consent required by law is completed before the change is applied.