Public review draft, pending legal and technical approval
Privacy policy · review draft
Expanded review draft based on Korean privacy requirements and DailySafe workflows. Actual retention periods, provider roster and privacy owner remain subject to approval.
Reviewed 2026-11-06 · No approved effective date
01. Controller and scope
DailySafe is a brand of UTE TLI Systems Co., Ltd. Public-site enquiries and workforce records serve different purposes. Controller and processor roles must be documented for each organizational arrangement. The privacy officer's verified name and contact details must be published before approval.
02. Purposes and legal bases
Enquiries, pilots, phone verification, site administration, TBM sign-off, workday corrections and security responses are distinct purposes. The applicable Article 15 legal basis and any consent requirement must be determined per workflow; separate purposes must not be bundled into a single blanket consent.
03. Data categories and sources
The public site may collect a contact name, organization, contact details, message and optional logo. The operational system may process phone, organization, site, timestamps, TBM participation, hours, disputes and corrections. Photo, video and location collection must be disclosed based on actual enabled functions and location precision.
04. Required versus optional information
Account-verification requirements are separated from optional marketing, directory publication and location functions. Where consent is relied on, optional choices should be separate and refusal should not automatically disable unrelated core functionality.
05. Organization and site access
Permission to view a site's TBM does not by itself grant a construction company access to a team's payroll, hours or worker roster. Access requires server-side organization and site scoping, and workers must have a means to exercise rights over their own data. Production enforcement needs verification.
06. Retention by category
Retention depends on the record category. Effective 1 August 2026, occupational risk-assessment records (위험성평가) must be retained for three years under Enforcement Rule Article 37-4(2). Certain occupational safety records listed in Act Article 164 also require three years, subject to category-specific exceptions. Worker-training evidence is not subject to a universal statutory three-year rule: Labor Ministry guidance recommends five years in light of the administrative fine limitation period. A daily TBM record does not automatically constitute every type of education or risk-assessment record. SMS, account, enquiry, workday, location, photo/video and backup retention periods, triggers and deletion procedures still require separate approval. Separately, Article 13 of the Serious Accidents Punishment Act Enforcement Decree requires covered employers/executives to retain written records documenting implementation of specified safety duties for five years after performance, with the statutory small-business exception. This mandatory five-year rule is distinct from the recommendation concerning worker-training evidence.
07. Deletion and lawful retention
Personal data that is no longer necessary must be destroyed without undue delay unless another law requires preservation, in which case it must be separately managed. An append-only event history is not, by itself, a legal basis for indefinite personal retention. Restricted access, separation, anonymization and expiry handling must be verified.
08. Third-party disclosures
Independent third-party disclosures must identify recipients, data categories, purposes, duration and legal bases. 'Partners' is not a sufficiently specific description. The actual recipient register is pending verification of company/team and vendor data flows.
09. Processors and subprocessors
SMS delivery, hosting, email, storage, analytics and subprocessors must be identified from actual production configuration and agreements. A library or optional integration in source code does not prove production processing. The verified vendor list must be published before final approval.
10. Cross-border transfers
Hosting, email, speech and AI providers require actual hosting/access-location verification. Where cross-border transfer occurs, the Article 28-8 basis and applicable disclosures must specify destination, recipient, categories, method and duration. No blanket 'never transferred overseas' claim is made without audit.
11. Location and media
Check-in location, photos and video require specific disclosures of activation, accuracy, purpose, viewers and retention. Whether any out-of-shift tracking exists must be tested rather than assumed. Additional location-information legislation may apply.
12. Cookies, logs and third-party tools
Session cookies, analytics, scripts and browser speech processing must be disclosed based on the deployed build. If the browser provider handles speech, that limitation must be explained. Applicable opt-out and browser controls must be clearly described.
13. Data-subject rights
Individuals may exercise statutory rights to access, correction, deletion and suspension. Requests require identity checks, protection of others, lawful retention exceptions and notification of outcomes. An organization manager cannot waive a worker's statutory rights.
14. Safeguards and incidents
Access control, authentication, logs, encryption, backups and incident response must match actual operations. No claim is made that an independent witness or a particular cryptographic safeguard is deployed across all sites without verification.
15. Privacy contact and changes
Before approval, publish verified privacy-officer/department contact details, company particulars, effective date and version archive. A general website email does not replace verified officer designation. This remains a review draft.