Status
Prelaunch review draft · No effective date
Purposes
Accounts · Expert profile review and publication · Contact requests
Retention
Account/profile: until closure or contract end / Contact request: one year from collection
Disclosure
Public profiles and individual contact sharing are separate
Cookies
Login: 7 days · Selected language: 1 year
Privacy contact
ok.lee@globalsemilink.com
1. Operator and scope of this draft
주식회사 글로벌세미링크 operates Global SemiLink, an expert search, profile registration and contact-request service. The registered English company name remains to be confirmed. SemiSynapse AI is a project name for the same service.
This is a review draft dated 9 October 2026, not an effective privacy notice. It identifies current processing and operating procedures that must be ready before it takes effect. Publishing this draft does not establish that consent, deletion or rights-request procedures are operational.
The service is intended to accept overseas users. Korean law is the baseline; other laws apply according to the markets and processing activities involved. This English notice does not represent worldwide legal compliance.
| Item | Details |
|---|---|
| Operator / controller | 주식회사 글로벌세미링크 |
| Representative, registration number and address | To be confirmed |
| Privacy contact | Global SemiLink operations contact: ok.lee@globalsemilink.com |
| Korean privacy officer and telephone | Appointment and details to be confirmed |
| EU representative / GDPR DPO | Whether required, and any appointment, to be confirmed |
2. Purposes and legal bases
Necessary contractual processing and optional consent are separate. Reading this notice or accepting the Terms does not provide blanket consent for all processing. The bases below are proposed for the effective service and require confirmation against actual operations.
Where GDPR applies, necessary account and requested service processing is considered under Article 6(1)(b); optional processing based on a freely given choice is considered under Article 6(1)(a). For a person acting for their employer, contract necessity cannot automatically be assumed. Any reliance on Article 6(1)(f) for business inquiries, security or dispute handling requires a documented purpose, necessity assessment and balancing test before use.
| Purpose | Data | Proposed basis / limit |
|---|---|---|
| Account registration and authentication | Email, password, member ID, role and registration time | Necessary service contract processing: Korean PIPA Article 15(1)(4); GDPR Article 6(1)(b) where applicable |
| Requested profile registration and review | Name, headline and information supplied by the expert | Contract necessity for essential information; assess and separately obtain consent for optional information |
| Public profile publication | The disclosed profile fields in section 4 | Separate informed publication choice and withdrawal process required before publication |
| Contact request review and follow-up | Company, contact name, email, message, target expert and status | Requested pre-contractual steps where applicable; confirm the basis for requests made for an employer |
| Optional telephone contact | Phone number | Separate optional consent; email contact remains available if declined |
| Contact details shared with an identified party | Only the data specified for that introduction | Recipient-specific consent or another applicable lawful basis; no automatic disclosure on submission |
3. Data collected and sources
You supply data through registration, profile and contact forms. The service generates account identifiers, review states, timestamps and request records. The current application does not include purchasing third-party resumes or automatically collecting personal profiles from external websites.
Required fields are necessary for the relevant feature. Optional fields are not required to create an account or submit a contact request by email. Fields currently saved with defaults need a necessity and choice review before launch.
- Do not submit government identification numbers, sensitive health, religious or political information, unnecessary data about other people, trade secrets or unpublished technical material.
- The national-core-technology-related experience flag supports an operational review. It is not certification of a legal designation or permission to transfer technology.
- PDF uploads are controlled by a feature setting. When available, text is extracted for administrative profile review; the original and extracted text are excluded from public search.
- Actual infrastructure logs, including any IP addresses, request paths or device information, and their retention remain to be confirmed. Marketing and analytics providers are not assumed to be installed.
| Feature | Required / generated information | Optional information |
|---|---|---|
| Account | Email and password; member ID, role and creation time. A password hash is stored | None |
| Expert profile | Name and headline; profile ID, review/publication state and timestamps | English name, birth year, nationality, country of residence, education, alias, specialty title, summary, years and dates of experience, employers, titles, responsibilities, company category, availability, specialties, achievements, skills, awards, patent/paper counts, national-core-technology-related experience flag and tags |
| Default profile values | Nationality, residence, availability, company category and the experience flag may be saved with defaults | Necessity and initial choices require review |
| PDF resume, when enabled | Original PDF, extracted text, filename and storage metadata | Submitting a PDF is optional; manual profile entry is available |
| Contact request | Company name, contact name, email and message; target expert, request ID, status, timestamps, internal review notes and consent-confirmation records | Phone number |
| Progress lookup | Hashed lookup code, expiry and the code used for lookup | A private receipt link saved by you |
4. Public profiles and private information
Approved profiles marked public can currently be searched and viewed without signing in. Public information is available to an unrestricted internet audience. Combining professional details can identify you, even when a real name is omitted. An alias does not guarantee anonymity.
Separate publication choice and withdrawal procedures are required before this notice takes effect. An administrator's approval or public setting alone is not evidence of the expert's consent. Editing an already public profile may immediately change the published information.
- You must be able to decline or withdraw publication without losing unrelated account access. Declining publication prevents public search visibility and contact opportunities that depend on it.
- A withdrawal process must stop publication within the service. Copies made by others and search-engine caches may be outside our direct control; available follow-up measures must be explained.
| Visibility | Information |
|---|---|
| Public profile | Alias, headline, specialty title and summary, education, residence country, experience years/dates, employers, titles and responsibilities, company category, availability, specialties, achievements, skills, awards, patent/paper counts, national-core-technology-related experience flag, tags and keyword-match information |
| Excluded from public responses | Dedicated Korean/English name fields, email, birth year, nationality, resume PDF and extracted text, filename, storage path and internal operator notes |
| Free-text fields | Names, contact details or third-party information entered into a public alias, summary, career or achievement field can be exposed with that field |
5. Retention periods
The following periods are the chosen policy for the effective service. Account closure, automated deletion and backup deletion are not yet all operational and must be implemented and verified before launch.
Data must be deleted without undue delay when no longer necessary, including following a valid consent withdrawal or erasure request, even before a maximum period ends. A specific legal preservation duty may require limited separate retention; the basis, data and period must be identified. A blanket five-year commerce retention rule is not applied to this service, which has no current payment feature.
| Data | Policy | Implementation status |
|---|---|---|
| Account and expert profile | Until account closure or the service contract ends, then deletion without undue delay. Delete unnecessary optional data on consent withdrawal | Closure and linked deletion procedures require implementation |
| Resume original, extracted text and metadata | Same period as the profile. Delete previous originals and extracted text without undue delay after successful replacement | Feature setting, old files and backup deletion require verification |
| Contact request, notes and related consent confirmation | One year from collection for request handling, follow-up and complaints | Scheduled and earlier requested deletion require implementation |
| Progress lookup code | Lookup access expires after 90 days; hash and expiry records follow the contact-request retention period | Lookup expiry does not delete the underlying request |
| Login cookie | Up to 7 days; browser cookie removed on logout or deletion | Server token validity and revocation must be considered separately |
| Language cookie | Up to 1 year after selection or until you remove it | Set when you select a language |
| Operational logs and backups | Minimum necessary period; actual provider settings, purposes and periods to be confirmed | Confirm residual backup periods, access restrictions and deletion cycle |
7. Service providers and international transfers
Actual hosting, database, file storage and logging contracts and regions are under review. Vercel and Supabase are the selected direction, not proof that migration, contracts or data locations have been verified. We do not claim that there are no processors or international transfers.
Before launch, identify providers, tasks, data, subprocessors, retention and countries, and put appropriate instructions, security, supervision and deletion obligations in place.
For overseas storage, access or disclosure, confirm the recipient and contact, destination, data, timing, method, purpose, period, legal basis and the means and consequences of refusal. Where GDPR Chapter V applies, assess the relevant adequacy decision or safeguards for the actual transfer and onward transfers. No executed Standard Contractual Clauses or completed transfer assessment is claimed.
| Item | Status |
|---|---|
| Actual hosting, database, file and log providers | To be confirmed |
| Storage, backup and remote-access countries | To be confirmed |
| Transfer details and legal mechanism | To be confirmed before the relevant transfer |
| Transfer questions or objection requests | ok.lee@globalsemilink.com; effects of refusal depend on the confirmed service arrangement |
8. Deletion procedures to be established
On expiry, closure, contract end or a valid erasure or withdrawal request, a designated operator must identify the affected data and any specific legal preservation duty, then delete without undue delay. Any legally required retained data must be separated and its use restricted.
Electronic records must be removed from active databases and file stores using appropriate methods that prevent recovery or reuse. The procedure must cover derived search data, original and extracted resumes, old files and related requests as applicable. Any paper copies must be securely destroyed.
Backup expiry, access restrictions, preventing deleted data from being reintroduced after restoration, and provider deletion confirmation remain to be established. These are required procedures, not a claim that a deletion system is already working.
9. Access, correction, deletion and withdrawal
Subject to applicable law, you may request access, correction, erasure, restriction or suspension of processing and withdrawal of consent. Withdrawing public-profile publication can be separate from closing an account. An authorized representative may act with appropriate evidence of authority.
The designated request address is ok.lee@globalsemilink.com. Include your account email or request number and the action you seek. Do not send passwords, government identification numbers or an entire resume. Identity and authority checks should use only the minimum necessary information.
Mail receipt and replies, case ownership, identity checks, legal response deadlines and outcome or refusal notices must be verified before this notice takes effect. There is currently no working self-service account deletion or full-data transfer feature.
The Korean PIPA Article 35-2 transfer right applies to specified controllers, data and statutory conditions. Applicability and the method are under review; this draft does not promise an automated export or a transfer facility for every user.
10. Additional rights where GDPR applies
GDPR applicability depends on actual activities, such as offering services to people in the EEA or monitoring their behavior there. Whether an EU representative or DPO is required remains to be assessed. Accepting overseas users does not itself complete these assessments.
Where the conditions apply, you may obtain access and a copy, rectify data, seek erasure, restrict processing, object to processing and withdraw consent. For automated processing based on consent or contract, portability may let you receive data you provided in a structured, commonly used, machine-readable format and request direct transmission where technically feasible, subject to others' rights.
You may object on grounds relating to your situation where processing relies on legitimate interests; applicable legal exceptions must be assessed. Consent withdrawal does not affect processing that was lawful before withdrawal. Rights regarding solely automated decisions with legal or similarly significant effects apply where the statutory conditions are met.
Requests must normally receive a response within one month. If complexity or the number of requests justifies a lawful extension, the first month must include notice of the reasons and extension, up to two additional months. These response procedures must be operational before launch.
You may lodge a complaint with a competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. Contacting us first is not a condition for making that complaint.
12. Security measures
Measures confirmed in the current application include password hashing, authentication, administrator-role checks, exclusion of private fields from public responses, and hashing and expiry checks for progress codes. Login cookies restrict script access and use a secure-connection setting in production mode.
Actual HTTPS and database transport, minimum administrator privileges, secret management, access logging and review, backup restoration and deletion require operational verification. Internal policies, staff training, incident response, provider oversight and physical access responsibilities also require confirmation. We do not claim certification, completed periodic audits or encryption of every stored field.
Company management must define responsibility, provide appropriate resources and confirm the Korean privacy officer's role and contact arrangements before the notice takes effect.
13. Search ranking, automated decisions and AI training
Search currently uses public-profile text, tags and experience filters. Keyword-match percentages indicate how many search terms appear in profile text, not certification of expertise, hiring suitability or the likelihood of a contract. Profile approval and contact status are handled by operators.
The current application does not show a flow sending personal data to external generative AI, training a model on resumes, or approving or rejecting hiring or contracts solely by automated processing. Ordinary search ranking is not automatically classified as a decision covered by Korean PIPA Article 37-2 or GDPR Article 22.
If a legally covered automated decision is introduced, its actual logic, data, process, significance, legal basis and applicable explanation, human-review, challenge or refusal rights must be disclosed and supported first. This notice does not authorize AI training or external AI disclosure.
14. Children and minors
The proposed service is for adult professionals and company contacts. Minimum age, eligibility and age checks must be confirmed before launch. No age-verification or parental-consent verification process is currently implemented.
The baseline proposal is not to operate a service collecting data from children under 14 in Korea. If such information is identified, appropriate restriction, protection and deletion procedures must be followed. Other jurisdictions' age and consent requirements must be assessed separately; this draft does not impose a single invented worldwide threshold.
15. Privacy contact, incidents and complaints
The designated contact for privacy questions, access requests and complaints is the Global SemiLink operations contact at ok.lee@globalsemilink.com. The Korean privacy officer's name and title, telephone and postal address remain to be confirmed. Mail receipt and replies must be verified before it is treated as an operational channel.
An incident procedure must identify facts and affected data, contain harm and support recovery, then notify individuals and authorities when required by the applicable law and deadlines. Notices should explain the incident, affected data, protective action, steps individuals can take and contact and remedy routes. A functioning incident-response operation is not claimed by this draft.
In Korea, privacy complaints and advice are available from the KISA Privacy Infringement Report Center (118 within Korea) and the Personal Information Dispute Mediation Committee (1833-6972). Where GDPR applies, you may complain directly to your competent supervisory authority.
16. Changes and effective date
Draft date: 9 October 2026. Version: 2026-10-09-draft-1. Effective date: to be confirmed. This draft is not applied retrospectively as an earlier effective policy.
After adoption, material changes to purposes, data, disclosures or retention must explain what changes, why and when through an accessible service notice, with previous versions available. Publication of an amendment does not replace fresh consent or individual notification where required.