Member privacy policy

The World Arts Federation (the “Federation”) processes member personal data in accordance with applicable law and this policy.

1. Data and purposes

• Authentication account: email, Supabase Auth user identifier, email-confirmation state, authentication providers, linked sign-in methods and session information are used for registration, sign-in, account security and password setup or reset.
• Member registration: name, optional introduction, preferred language, registration date and membership type are used to identify the member, provide My Page and administer membership services.
• Policy consent: policy code, version and acceptance time document the required consent. For preaccepted registration, the stored acceptance time is the time an administrator recorded the verified consent in the system, not a representation of the earlier offline consent time.
• Administrator preaccepted registration: initial registration source, operation identifier, input fingerprint, evidence reference, policy versions, handling administrator and processing time are used to verify offline intake, prevent duplicate processing and support audit. The evidence reference is a limited locator for the intake record, not the source document itself.
• Incomplete account provisioning: for the short period after WAF creates a new authentication account but before member or administrator registration finishes, normalized email, operation identifier, purpose, authentication user identifier and a restricted error code are used for reconciliation and safe cleanup.
• Regular membership applications: headquarters or chapter selection, selected chapter, state, processing history and replacement or rejection reasons are used for intake and review.
• Application files: business card, self-introduction and profile photograph, together with file type, size, format, checksum and retention deadline, are used for review and integrity checks.
• Chapter administration: join and leave requests, affiliation, processing history and reasons are used to administer and display chapter affiliation.
• Positions: Korean position name, optional English name and assignment or end time are used for display and administrator search.
• Dues and member numbers: actual amount, currency, payment date, recognized validity, per-renewal Membership ID, member Certificate No., record state and revision, creation operation and input fingerprint, correction or void reasons and administrator actions are used to verify dues, display numbers, prevent duplicate processing and correct errors. This feature does not collect bank login credentials or transfer-evidence files.
• Notices and mail: notice type, related request identifier, creation and read time, language, latest delivery-request state and restricted error code are used to notify results and recover delivery operations.
• Security and operations: request time, pseudonymized limited identifiers, access or error codes and administrator actions are used to prevent abuse, enforce authorization and respond to incidents.

Email remains authoritative in Supabase Auth and is not duplicated in the member profile. An email held for incomplete provisioning is deleted with the reservation when the operation completes or is safely cancelled. Plaintext passwords are not stored in the Federation database, logs or responses.

2. Legal basis

Data is processed to create and administer the account, perform requested membership services, document required consent, protect the service, prevent duplicate operations and comply with law. Optional introduction data may be omitted. Required account data and required policy consent are necessary to provide member services.

3. Retention

1. Member profiles, initial registration source, preaccepted evidence reference, policy acceptances, membership types, positions, affiliations, applications, notifications and member-targeted administrator histories are processed until account deletion and are deleted with the member hard-delete operation.
2. An incomplete provisioning reservation is processed until member or administrator registration completes or safe removal of the authentication account created by that operation is confirmed. The reservation, including its normalized email, is then deleted.
3. Finalized regular-application files are available for no more than 14 days. Incomplete upload requests normally expire after 24 hours, while physical deletion may wait until the last signed upload window has safely expired.
4. Approved deletion first blocks access and then removes private files, the authentication user and member data.
5. WAF does not currently operate a separate statutory-retention repository outside the member aggregate. If a separate legal retention obligation is actually established, the affected data, legal basis, period, authorized users and deletion time will be defined and the data will be segregated from member information.

Dues, validity, member numbers and the member's correction or void audit records are deleted with member hard deletion. Automatic numbering counters contain no member-level identifier. Any applicable separate statutory retention obligation must be reviewed during approval before operational activation; software implementation does not constitute that review.

4. Sharing

The Federation operates a publicly accessible member directory, without requiring sign-in, to introduce public officers and help visitors look up registered members.

• The default list shows currently published officers, including officers who have not registered as members.
• Name and position searches include public officers, active Regular, Special and Honorary Members, and active Associate Members with a current public position that has neither ended nor passed its display deadline. Nonpayment alone does not exclude name or position results. Members undergoing deletion are excluded.
• Public fields are name, current public positions, affiliation (headquarters or chapter), and an optional introduction of up to 50 characters and three lines. The introduction may be omitted or deleted.
• Membership ID search uses only numbers on recorded dues entries whose recognized validity currently applies. A name result does not guarantee current card validity. A number result does not authenticate the searcher or verify the authenticity of a physical membership card.
• Email, Certificate No., payment amounts, payment history and validity dates are not disclosed in directory results. Queries and submitted member numbers are not saved in general logs or analytics events.
• Search engines are asked not to index the directory, but this is not access control: anyone may open it. Members no longer meeting public eligibility, or undergoing deletion, are excluded from member search. Officer information follows its content publication status. Requests to correct, delete or restrict public information may be sent to the Secretariat.

This disclosure scope is described in the privacy policy provided at registration or preaccepted registration. Outside this public directory, disclosure to third parties is limited to cases provided by law or separate consent, with the recipient, purpose, data and retention period explained beforehand.

5. Processors and international processing

The service may use Supabase for authentication, database and private file storage; Vercel for application hosting; Cloudflare Turnstile for abuse prevention on registration, sign-in and recovery requests; and configured mail providers for authentication, application and notification email. When Google login is enabled, Google account identifiers, verified email and basic profile information may be processed. Sign-in methods using the same verified email may be linked to an existing authentication user under Supabase Auth policy. Google login is activated only after its operating configuration is complete.

6. Deletion

Data is marked for deletion when its purpose or retention period ends. Private files are deleted through the storage provider's deletion facility. If an external deletion step fails, access remains blocked and only a restricted error code is retained for retry. Member hard deletion removes the member profile, initial registration source, preaccepted reference, policy acceptances and registration or correction logs targeted to that member. Member-identifying names, target emails, telephone numbers, plaintext passwords, evidence-reference text and filenames are not copied into new administrator or operations logs.

7. Member rights

Members can review and edit their name, introduction and preferred language and review their membership type, active positions, chapter history, applications, notifications and policy acceptances. Associate Members can request deletion from My Page; deletion for Regular, Special and Honorary Members follows the administrator approval process. Other access, correction, deletion and restriction requests may be made to the WAF Secretariat.

Members may also view their own dues status, recognized validity, member numbers and payment history. They may request corrections from the Secretariat. Only System Administrators may change these records. Content Administrators may read the necessary dues, numbers and payment history; Chapter Administrators may see only status and validity for members currently affiliated with their current assigned chapter. Detailed change audits are limited to System Administrators.

A member may request correction where a preaccepted evidence reference is factually incorrect or contains a clear clerical error. Only a System Administrator may change the reference after reviewing the reason. The initial registration source, registration operation, input fingerprint and fact of policy consent remain unchanged, and correction logs do not copy the old or new reference text.

8. Cookies and local storage

The site uses a functional public-language cookie, an administrator-language cookie, authentication session cookies, a language-hint flag and a same-day membership-guide snooze value. Preference and hint values are never used for authorization.

9. Data protection measures

The Federation implements appropriate administrative, technical and physical safeguards for the secure processing of personal data in accordance with applicable law.

10. Contact

World Arts Federation, represented by Lee Young Joon

3F, SW TOWER, PENTAWON Building C, 117 Gwacheon-daero 12-gil, Gwacheon-si, Gyeonggi-do, Republic of Korea

Telephone: +82 1544-9811

Email: worldartfed@gmail.com

11. Remedies

Members may contact the competent Korean privacy authorities and dispute-resolution bodies for consultation or dispute resolution.

12. Changes

Changes to this policy will be published with a version and effective date, and material changes will be announced in advance.