Privacy Policy
Privacy Policy
Privacy Policy
MEDI&GENE Co., Ltd. ("Company") complies with the Personal Information Protection Act and is committed to protecting users' personal information and rights. The Company has established the following Privacy Policy to ensure the proper handling of personal information and to promptly address any concerns related to personal data.
Should this Privacy Policy be amended, the Company will provide notice through the website's announcements section or by individual notification.
A. Personal Information Collected and Collection Methods
Personal Information Collected
- Name
- Email Address
- Mobile Phone Number
Collection Method
- Through the Company's website
Purpose of Collection and Use
- Service provision
- Customer relationship management
- Sales and marketing activities
Retention Period
Personal information will be destroyed immediately upon termination of the service, unless a longer retention period is required by applicable laws and regulations.
B. Changes to this Privacy Policy
This Privacy Policy shall take effect from its effective date. Any additions, deletions, or modifications resulting from changes in applicable laws, regulations, or Company policies will be announced through the website at least seven (7) days prior to the effective date of such changes.
C. Measures to Ensure the Security of Personal Information
Pursuant to Article 29 of the Personal Information Protection Act, the Company implements the following technical, administrative, and physical measures to safeguard personal information:
- Regular Internal Audits
The Company conducts regular internal audits (once per quarter) to ensure the security and proper handling of personal information. - Minimization and Training of Personnel Handling Personal Information
The Company designates only authorized personnel to handle personal information and provides appropriate training to minimize access and ensure proper management. - Establishment and Implementation of Internal Management Plans
The Company establishes and implements internal management plans to ensure the secure processing of personal information. - Technical Measures Against Hacking and Cyber Threats
The Company installs security software, performs regular updates and inspections, and operates systems within access-controlled areas to prevent unauthorized access, data leakage, and damage caused by hacking, malware, or other cyber threats. - Encryption of Personal Information
Users' personal information, including passwords, is encrypted and securely stored. Additional security measures such as file encryption and secure transmission methods are applied to sensitive data. - Retention and Protection of Access Logs
Access records to personal information processing systems are retained and managed for a minimum of six (6) months. Security measures are implemented to prevent tampering, theft, or loss of such records. - Access Control
The Company restricts access to personal information through authorization management, modification, and revocation procedures. Intrusion prevention systems are utilized to prevent unauthorized external access. - Secure Storage of Documents
Documents and storage media containing personal information are stored in secure locations equipped with locking devices. - Physical Access Control
The Company maintains separate physical storage facilities for personal information and operates access control procedures to prevent unauthorized entry.
D. Retention and Use Period of Personal Information
- The Company processes and retains personal information within the period prescribed by applicable laws or within the retention period agreed upon by the data subject at the time of collection.
- The retention periods for personal information are as follows:
For Marketing and Advertising Purposes
- Retention Period: Up to three (3) years from the date consent is obtained.
- Purpose: Service provision, customer management, sales, and marketing activities.
- Legal Basis: Records related to consumer complaints or dispute resolution shall be retained for three (3) years pursuant to applicable laws.
E. Procedures and Methods for Destruction of Personal Information
The Company shall, in principle, destroy personal information without delay once the purpose of processing has been achieved.
Destruction Procedure
Personal information provided by users is transferred to a separate database (or separate physical documents in the case of paper records) after the purpose of collection has been fulfilled and is retained for a certain period in accordance with internal policies and applicable laws before being destroyed. Such information will not be used for any purpose other than those required by law.
Destruction Period
- Where the retention period has expired, personal information shall be destroyed within five (5) days from the expiration date.
- Where personal information becomes unnecessary due to the achievement of the processing purpose, termination of the service, or discontinuation of business operations, such information shall be destroyed within five (5) days from the date it is deemed unnecessary.
Destruction Method
Electronic files containing personal information shall be permanently deleted using technical methods that prevent data recovery.
F. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
- The Company uses cookies to store and retrieve user information in order to provide customized services.
- Cookies are small pieces of information sent by a website server (HTTP) to a user's web browser and may be stored on the user's computer hard drive.
Purpose of Cookies
Cookies are used to analyze user visits and usage patterns, frequently searched terms, security access status, and other information in order to provide optimized services and content.
Refusal of Cookies
Users may refuse the storage of cookies by adjusting their web browser settings through: Tools > Internet Options > Privacy
Consequences of Refusal
Disabling cookies may limit the availability of certain customized services.
G. Chief Privacy Officer and Contact Information
- The Company designates the following person as the individual responsible for overseeing personal information protection and handling related inquiries, complaints, and remedies.
Chief Privacy Officer (CPO)
- Position: Privacy Policy Administrator
- Email: master@mediandgene.com
- Tel: +82-2-6954-2220
- Data subjects may contact the Chief Privacy Officer regarding any inquiries, complaints, or requests for remedies related to personal information protection arising from the use of the Company's services. The Company will respond promptly and appropriately.
H. Rights and Obligations of Data Subjects and Legal Representatives
- Data subjects may exercise the following rights with respect to the Company at any time:
- Access to personal information
- Correction of personal information
- Deletion of personal information
- Suspension of processing of personal information
- Requests to exercise the rights described above may be submitted to the Company in writing, by email, facsimile (FAX), or other methods prescribed by Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. The Company will take appropriate action without delay.
- Such rights may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney must be submitted in accordance with the prescribed form under the Enforcement Rules of the Personal Information Protection Act.
- Requests for access to personal information or suspension of processing may be restricted pursuant to Article 35(5) and Article 37(2) of the Personal Information Protection Act.
- Requests for correction or deletion may be restricted where the relevant personal information is required to be collected or retained under applicable laws.
- When responding to requests for access, correction, deletion, or suspension of processing, the Company will verify whether the requester is the data subject or a duly authorized representative.