Privacy Notice · 개인정보처리방침

Who operates this service

My GSB Schedule (schedule.mygsb.net) is an internal scheduling and events tool of SKK Graduate School of Business, Sungkyunkwan University. This privacy notice is effective as of 2026-07-12.

The operator of My GSB Schedule is Frank Huettner (SKK GSB). For every privacy matter concerning this service, including questions, access, correction, and deletion, please contact the operator at huettner@skku.edu. Privacy matters that concern the whole university, rather than this service specifically, are governed by Sungkyunkwan University's own privacy policy and privacy office.

Our principles

My GSB Schedule follows a small set of data-protection principles, and the rest of this notice explains how each principle is put into practice.

• Data minimization: We collect only the information the service actually needs to do its job.
• Purpose limitation: We use the information we hold only to run course scheduling and events, and for nothing else.
• Encryption: All information is encrypted, both while it is stored and while it travels over the network. The most sensitive fields (your Google login credentials and your personal contact addresses) carry a second layer of encryption on top.
• Data residency: The database that holds this service's information is located in South Korea.
• Proactive deletion: When a person leaves SKK GSB, we delete that person's data ourselves, without waiting for a request.
• No sensitive data and no behavioural tracking: We do not collect sensitive personal information such as health or religion, and we do not track your browsing or use advertising cookies. The one place we record an IP address is an internal access log of administrative access to other people's data, kept as a legal security measure (see Security).
• Transparency: We publish this notice and keep it current.

What we process, and why

• Faculty and staff (signed-in users): For each signed-in user, we hold the display name and the @g.skku.edu login email that come from that user's Google account. In addition, we hold optional profile fields that the user enters personally: a preferred (display) name, up to two contact email addresses (a notification address and an event-invitation address), the user's roles and teaching assignments, the user's start date, the user's scheduling preferences, a coarse dietary preference (none, vegetarian, or vegan, with no free text), and the user's event invitations and RSVP status. The two contact email addresses may be private addresses, are used only for notifications and calendar invites, and carry a second layer of encryption (see Security).
• Calendar connection (optional): If a user connects Google Calendar, MyGSB stores that user's Google authorization so it can keep the user's class schedule in sync. This authorization is deliberately narrow: MyGSB can only create and update a calendar that MyGSB itself makes for the user, and it cannot read or change any of the user's other Google calendars or events. The one exception is the single manager account that hosts events for everyone, which grants broader calendar access so it can send invitations and read replies. Because this authorization acts as a login credential, it carries a second layer of encryption (see Security). Disconnecting Google Calendar, or deleting the account, removes the stored authorization.
• External instructors: For an external instructor, we hold only the instructor's name and a non-functional placeholder identifier, kept so that the schedule can attribute sessions to that instructor. External instructors are not users of this service: they cannot sign in, they are never contacted, and we neither collect nor use their real contact addresses.
• Students: For a student who is enrolled and signed in, we hold the display name and the @g.skku.edu login email from the student's Google account, the student's cohort membership, and, for events the student is invited to, the RSVP status. As with staff, a student may optionally enter a preferred name, up to two contact email addresses (which may be private and are used only for notifications and invitations), and a coarse dietary preference (none, vegetarian, or vegan, with no free text) for event catering. We hold no grades, transcripts, or other academic records: MyGSB is a scheduling and events tool, not a student records system.
• Technical data: We use only functional cookies and local storage, namely a signed session cookie that keeps a user logged in, a small user-interface cookie that remembers the sidebar state, and local storage that remembers display preferences such as light or dark mode and whether you have dismissed an in-app notice. We use no tracking or advertising cookies. A user can block or clear these in the browser, but without the session cookie that user cannot sign in. We do not store profile photos or browser user-agent strings, and ordinary browsing is not logged with an IP address. Server logs and error reports have secrets and credentials removed, and email addresses are automatically detected and removed even where they appear incidentally; other than an internal identifier, we do not add personal data such as names or IP addresses to them. Separately, an internal administrative access log records the IP address of a manager's or superuser's access to other people's personal data, as a legal security measure (see Security).

We process this information to operate the school's course-scheduling and events service. For faculty and staff, the legal basis is the performance of the employment relationship (PIPA Article 15(1)(4), the performance of a contract with the data subject), supported by the school's performance of its statutory duties as an educational institution (Article 15(1)(3)). For students, the same processing rests on the school's statutory education duty (Article 15(1)(3)), supported by the enrollment and education-service relationship (Article 15(1)(4)). We do not rely on your consent for this core processing, because it is necessary to run the school and to perform these relationships. Where a field is optional (for example a preferred name, contact email addresses, a dietary preference, or scheduling preferences), providing it is voluntary and it is used only for the purpose shown where you enter it. Connecting Google Calendar is separate and is based on your consent, which you can withdraw at any time by disconnecting. We do not ask for a Korean resident registration number (주민등록번호) or any other national identification number (a student or staff number is not such an identifier), and we collect no sensitive-category information.

Retention and deletion

We keep a person's data for as long as that person is affiliated with SKK GSB and the service still needs the data. When a person leaves SKK GSB, the operator deletes that person's personal data promptly and without waiting for a request. Deletion happens in two steps: the person is first marked as departed, and the person's data is then deleted permanently, including the profile, the login, any stored calendar tokens, the roles, the memberships, and the RSVP records. Content that the departed person created remains in the service, but without that person's name attached. A person may also request deletion at any time. Beyond deletion tied to a person, we also apply fixed time limits: an event's RSVP records (invitee names, emails, and dietary preferences) are deleted 24 months after the event has ended or been cancelled, and a student's cohort-membership record is kept with its final status (graduated or withdrawn) for historical attribution and then deleted 24 months after that. RSVP records are also removed together with the person or the event whenever that happens sooner.

Overseas processing (cross-border transfers, PIPA Article 28-8)

Some of the providers that run this service are located outside South Korea, so operating My GSB Schedule involves cross-border processing of personal data. The database itself is hosted inside South Korea (the AWS Seoul region), and it is operated on our behalf by Supabase Pte. Ltd, a company based in Singapore. The table below lists, for each recipient, the items transferred, the country, when and how the transfer happens, and the purpose and retention period.

Each recipient publishes its own privacy contact in the privacy policy at the linked domain. A user may refuse this overseas processing by choosing not to use the service and by asking the operator to delete that user's data; because My GSB Schedule runs on this infrastructure, the service cannot be provided without these providers. Under PIPA Article 26, Supabase and Cloudflare act as our processors under data-processing agreements, entrusted with processing personal data on our behalf and bound to process it only on our instructions. Google is different: it is engaged through the university's own Google Workspace agreement, not a separate My GSB Schedule entrustment.

Your rights

On your Profile page you can view and edit your own profile fields, download a copy of all the data MyGSB holds about you, and request permanent deletion of your account and its data. You may also email the operator to exercise your right of access, correction, deletion, or suspension of processing, and the operator will handle such requests promptly. If a data breach affects you, the operator will notify you without undue delay, and in any case within 72 hours.

Security

All information is encrypted while it travels over the network and while it is stored. The most sensitive fields, namely your Google login credentials and your personal contact and invitation email addresses, carry a second layer of encryption on top, so that access to the stored data alone is not enough to read them. Names and schedules must stay readable for the service to do its job, so those are protected instead by access controls, by keeping credentials in a managed secret store, and by removing personal data from logs and error reports. Consistent with our principles, we deliberately collect as little as possible: no photos, no health or religious information, and no tracking of your everyday use of the service.

Administrative access to other people's personal data is recorded in an internal access log. For each such access we record the staff account, the time, the source IP address, the action taken, and which data was involved. This log exists to meet a legal safety-measure duty (keeping a record of who accessed whose personal data); it can be read only by a designated auditor and by system administrators, and it is retained for at least 12 months. Your own access to your own profile is not recorded, and ordinary members (instructors and students) generate no such records because they cannot reach other people's data.

Changes

When we make a material change to this notice, we announce the change inside the app, and the change takes effect with a new effective date shown on this page. This notice is effective as of 2026-07-12.