The International Centre of Martial Arts for Youth Development and Engagement under the auspices of UNESCO (ICM) processes personal information lawfully and securely in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws and regulations in order to protect the rights and interests of data subjects. Pursuant to Article 30 of the Personal Information Protection Act, ICM establishes and publicly discloses this Privacy Policy to inform data subjects of the procedures and standards governing the processing and protection of personal information, and to ensure that any related concerns or complaints are handled promptly and appropriately.

ICM processes personal information for the following purposes. Personal information will not be used for any purpose other than those specified below. Where the purpose of processing changes, ICM will take the necessary measures, including obtaining separate consent where required, in accordance with Article 18 of the Personal Information Protection Act.

1. Administration of International Events and Educational Programmes

• Registration for international conferences, seminars, workshops, youth programmes, and other events
• Event administration and participant communication
• Arrangement of airfare and accommodation support, where applicable
• Preparation of event reports and statistical analyses

2. Administration of Grant Schemes and Programme Applications

• Receipt of applications for grant schemes and programmes
• Verification of applicant eligibility
• Evaluation and selection of applicants
• Programme administration and post-project management

3. Newsletter Distribution

• Distribution of ICM News
• Provision of information on ICM events, programmes, and activities

4. Website Operation and Service Improvement

• Analysis of website usage statistics
• Improvement of website services and user experience
• Website operation and security management

ICM collects only the minimum amount of personal information necessary to provide its services.

Personal information collected

Category	Personal Information Collected
International events, educational programmes, and grant applications	Personal information specified in the relevant application page or the applicable consent form
Newsletter subscription	Name, email address

Applications for international events, educational programmes, and grant schemes may be processed through external application platforms announced on the ICM website. In such cases, personal information is collected and processed in accordance with the privacy policy of the relevant external platform.

ICM retains and processes personal information within the retention period prescribed by applicable laws and regulations or within the period agreed upon by the data subject at the time the personal information is collected. The retention periods for each category of personal information are as follows:

Retention periods

Category	Retention Period
International events, educational programmes, and grant applications	Until the retention period specified in the relevant application page or the applicable consent form
Newsletter subscription	Until the data subject unsubscribes from the newsletter

ICM destroys personal information without undue delay once the retention period has expired or the purpose for which the information was collected has been fulfilled. Where personal information is required to be retained under other applicable laws and regulations, such information will be transferred to a separate database or stored separately from other personal information.

1. Destruction Procedures

• Personal information subject to destruction is retained for a prescribed period in accordance with internal policies and applicable laws, where required, and is subsequently destroyed without undue delay.

2. Destruction Methods

• Personal information stored in electronic files is permanently deleted using methods that prevent recovery or restoration. Personal information recorded on paper is destroyed by shredding or incineration.

ICM processes personal information only within the scope of the purposes specified in this Privacy Policy and does not provide personal information to third parties unless:

• the data subject has provided separate consent;
• such provision is permitted or required by the Personal Information Protection Act or other applicable laws and regulations.

Personal information may be provided to third parties in the following circumstances:

• where separate consent has been obtained from the data subject;
• where required by law or necessary to comply with legal obligations;
• where necessary to protect the life, body, or property of the data subject or another person;
• or where otherwise permitted under Articles 17 and 18 of the Personal Information Protection Act.

To facilitate the efficient operation of its services, ICM entrusts certain personal information processing activities to the following service providers.

Entrusted service providers

Service Provider	Entrusted Service
Digital Hero Co., Ltd.	Website operation and maintenance
Stibee Inc.	Newsletter distribution service

When entering into an outsourcing agreement, ICM specifies the necessary safeguards in accordance with Article 26 of the Personal Information Protection Act to ensure that personal information is processed securely. ICM also supervises and monitors the entrusted service providers' handling of personal information. Should the entrusted services or service providers change, this Privacy Policy will be updated and disclosed without undue delay.

As a general principle, ICM does not transfer personal information collected through its website outside the Republic of Korea. However, limited information is transferred overseas for the purpose of analysing website usage through Google Analytics, as follows:

• Recipient : Google LLC (https://analytics.google.com)
• Destination Country : United States
• Timing and Method : Automatically transmitted via the internet when the website is accessed
• Information Transferred : Cookies, device and browser information, IP address, and website usage data (no personally identifiable information is transmitted)
• Purpose : Website traffic analysis and service improvement
• Retention : 14 months from the date of collection of user and event data
• How to Opt Out : Install the Google Analytics Opt-out Browser Add-on or configure browser settings to block cookies (https://tools.google.com/dlpage/gaoptout)

Where overseas transfer of personal information becomes necessary in connection with international events or international cooperation programmes, ICM will inform data subjects of the recipient, destination country, purpose of transfer, items transferred, and retention period, and will implement all procedures required under the Personal Information Protection Act and other applicable laws and regulations.

ICM implements the following administrative, technical, and physical measures to ensure the security of personal information in accordance with Article 29 of the Personal Information Protection Act.

1. Administrative Measures

• Minimization of personnel handling personal information and provision of training on personal information

2. Technical Measures

• Management of access rights to personal information processing systems
• Installation and periodic updates of security software

3. Physical Measures

• Access control for facilities where personal information is stored, including server rooms and records storage rooms

ICM may use cookies to provide users with a more convenient browsing experience and to improve the operation and management of its website. Cookies are small pieces of information sent by the server operating the website to the user's web browser and stored on the user's computer or mobile device. ICM uses Google Analytics to analyse website usage and generate statistical information for the purpose of improving its services. The information collected through Google Analytics is as follows:

• Data Controller: Google LLC (https://analytics.google.com)
• Collection Method: Cookies and JavaScript on web pages
• Information Collected: Cookies, device and browser information, IP address, and website usage history (no personally identifiable information is collected)
• Purpose of Collection: Analysis of website usage statistics and service improvement
• How to Opt Out: Install the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)

Users may refuse or delete cookies by changing the settings of their web browser.

• Microsoft Edge : Settings → Cookies and site permissions → Manage and delete cookies and site data
• Google Chrome: Settings → Privacy and security → Cookies and other site data

Please note that if cookies are disabled, certain features of the website may not function properly.

Data subjects may, at any time, exercise their rights under the Personal Information Protection Act, including the right to request access to, correction or deletion of, suspension of the processing of, or withdrawal of consent for their personal information. A data subject or their legal representative may exercise these rights by submitting a request in writing, by email, or through other available means to the Personal Information Protection Officer or the department responsible for personal information protection. ICM will process such requests without undue delay in accordance with applicable laws and regulations.

Where ICM processes the personal information of children under the age of 14, it will take the necessary measures, including obtaining the consent of the child's legal representative, in accordance with the Personal Information Protection Act and other applicable laws and regulations. The procedures for obtaining the consent of the legal representative and the categories of personal information collected will be separately notified through the relevant programme or project application page or the applicable Consent to the Collection and Use of Personal Information.

ICM has designated the following Personal Information Protection Officer to oversee personal information processing, handle complaints from data subjects, and provide remedies for any infringement of rights relating to personal information.

1. Personal Information Protection Officer

• Position : Head of the Strategic Planning Team
• Contact : unescoicm@unescoicm.org

2. Department Responsible for Personal Information Protection

• Department : Strategic Planning Team
• Contact : unescoicm@unescoicm.org

Data subjects may apply for dispute resolution or consultation regarding personal information infringements through the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Centre of the Korea Internet & Security Agency (KISA), or other relevant organisations. For reporting or consultation regarding other personal information infringements, please contact the following:

• Personal Information Dispute Mediation Committee — Tel: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Centre (KISA) — Tel: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office — Tel: 1301 (www.spo.go.kr)
• Korean National Police Agency — Tel: 182 (ecrm.police.go.kr)

Any person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request made pursuant to Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

This Privacy Policy shall take effect on 29 July 2026. Where any additions, deletions, or amendments are made to this Privacy Policy, ICM will publish the changes on its website.