Bugil High School Attendance System
Privacy Policy
Bugil High School (the “School”) operates the Bugil High School Attendance System (PC web, mobile web, and iOS/Android apps; the “Service”) to manage attendance for evening self-study. The School processes users’ personal information in accordance with the Personal Information Protection Act of the Republic of Korea and discloses this policy as follows. Students and teachers use accounts issued by the School. Parents may sign up themselves after verifying their identity with their enrolled child’s details and the parent phone number registered with the School. No other public sign-up is available.
This English version is provided for convenience. If it differs from the Korean version, the Korean version prevails.
1. Personal information we process and why
| Category | Items | Purpose |
|---|---|---|
| Account | Name, user ID (student number or an ID set by the School), password (stored encrypted), role (student/teacher), classroom display PIN (stored encrypted) | Identification, sign-in, permission management |
| Student records | Grade, class and number; residence type (commuter/dormitory); dormitory building and room; student phone number; parent phone number; dormitory roll-call number (last digits of the parent phone number); study-guidance and seat-helper roles | Attendance management by class and dormitory, dormitory roll call, outing and overnight-leave management, contacting guardians, identity check when a parent signs up |
| Parent accounts | Parent’s name, mobile number, relationship to the child (father/mother), username, password (stored encrypted) — collected with consent at sign-up | Verifying the parent (matched against the parent phone number registered with the School), account management, information about the child’s attendance and school life |
| Teachers | Department, homeroom grade and class, position, supervision schedule | Supervision assignment, approval permissions |
| Attendance and student-life records | Study status (present, restroom, outing, etc.) with reason and location, status history, seating, attendance-check results, outing/early-leave/room-study/overnight certificates, merit and demerit points, activity requests, outing and check-in times | Evening self-study attendance, issuing certificates, student guidance |
| Communication | Chat messages, notices, suggestions and replies, notification contents | Communication between teachers and students, delivering notices |
| Profile photo (optional) | A photo uploaded by the user | Showing the user in chats and elsewhere |
| Automatically generated or collected | IP address, sign-in records (time; PC web, mobile web or app), app installation details (device type, operating system, device model, app version, notification permission), push notification token, sign-in cookie (PC web) | Security (preventing unauthorized sign-in), service stability, sending push notifications, checking school-network connection (Wi-Fi check) |
The Service does not access location (GPS), contacts, the camera, or the microphone. The photo library is accessed only with the user’s permission when choosing a profile photo. The “Wi-Fi check” uses only whether the connecting IP address belongs to the school network — not the Wi-Fi name or the user’s location. We do not collect information for advertising, tracking, or personalized ads.
2. Retention period
- Account information: kept while the user is enrolled or employed, and destroyed without delay when the account is deleted due to graduation, transfer, retirement, etc.
- Parent accounts: kept until the parent deletes the account, then destroyed without delay. The School deletes the account when the child graduates or transfers.
- Operational records such as attendance, certificates, points and chats: kept until one year after the end of the school year, then destroyed.
- Sign-in records and IP addresses: kept for one year, then destroyed.
- Push notification tokens and app installation details: deleted when the user signs out or deletes the app and the token is no longer valid.
- Where other laws require retention, information is kept for the period required.
3. Provision to third parties
The School does not provide users’ personal information to third parties, except where required by law or requested by investigative authorities in accordance with legal procedures.
4. Outsourcing and international transfer
To operate the Service, we entrust the processing of personal information as follows.
| Recipient | Entrusted work | Items transferred · Country |
|---|---|---|
| Doun Company (도운컴퍼니) | Development, operation and maintenance of the Service (apps and web) | All Service data (accessed during server administration and troubleshooting) · Republic of Korea |
| Cafe24 Corp. | Server hosting (storing Service data) | All Service data · Republic of Korea |
| 650 Industries, Inc. (Expo) | Relaying push notifications | Push notification token, notification title and content · United States |
| Apple Inc. (APNs) / Google LLC (FCM) | Delivering push notifications to iPhone and Android devices | Push notification token, notification title and content · United States |
Notification content may include a chat sender’s name and message, notice titles, and similar information. Push notification data is transmitted over the network each time a notification is sent, and each provider processes it only as long as needed for delivery. Users can turn off notifications for this app in their phone settings, in which case this data is not transferred abroad.
5. Destruction
Personal information is destroyed without delay when the retention period ends or the purpose has been fulfilled. Electronic files are deleted so they cannot be recovered, and backups are deleted on their regular cycle (14 days).
6. Users’ rights
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information. Students may ask their homeroom teacher or the Privacy Officer below, and teachers may ask the Privacy Officer; requests are handled without delay. Passwords and profile photos can be changed or removed directly in the Service settings. Parents can delete their account at any time from the parent screen of the app or web; the account and its link to the child are deleted immediately. We do not process personal information of children under 14.
7. Security measures
- Passwords are stored using irreversible encryption (bcrypt).
- All communication is encrypted with HTTPS.
- Access to information and actions is limited by role (student, homeroom teacher, grade head, administrator).
- Sign-in and administrative actions are logged, and repeated failed sign-ins are temporarily blocked.
- Data is backed up daily.
8. Cookies
The PC web uses a cookie to keep users signed in. We do not use advertising or analytics cookies. You can block cookies in your browser settings, but you will not stay signed in.
9. Privacy Officer
| Officer | Doun Hwang (황도운) |
|---|---|
| Contact | [email protected] |
Reports or consultations about privacy infringement can also be made to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 in Korea) and the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972).
10. Changes to this policy
This policy is effective from October 28, 2026. Any changes will be announced in the Service notices and on this page.