Notice on Personal Information Processing Policy

Privacy Policy

BH Biotech Co., Ltd. (hereinafter referred to as the 'Company') establishes and discloses this privacy policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and handle related complaints promptly and smoothly. This policy is effective from November 15, 2024.

Article 1 (Scope of Application)

This privacy policy applies to all members (including domestic and foreign users) who use the company's services. All terms and privacy policies of the company are provided in Korean, English, and Chinese, with the Korean version taking precedence.

Article 2 (Purpose of Processing Personal Information)

The company processes personal information for the following purposes. Collected personal information is not used for purposes other than those specified.

• 1.Membership registration and management
• -Confirming membership intent, identity verification, maintaining and managing membership eligibility
• -Preventing misuse and restricting service usage

• 2.Service provision and customer support
• -Providing online services, handling customer inquiries, service consultation

• 3.Compliance with legal obligations
• -Fulfilling legal obligations (e.g., record keeping under the E-Commerce Act)

Article 3 (Retention and Processing Period)

The company retains personal information for the period prescribed by law and destroys it without delay once the purpose is achieved.

• 1.Membership registration and management
• -Retention period: Until membership withdrawal
• -Exception: Retained for the period specified by relevant laws, if necessary
• -Example: 5 years under the Consumer Protection Act in E-commerce

• 2.Service usage records
• -Retention period: 1 year after service termination

• 3.Legal obligation records
• -Transaction and payment records: 5 years
• -Consumer complaints or dispute resolution records: 3 years

Article 4 (Items of Personal Information Processed)

The personal information processed during membership registration and service use is as follows:

• 1.Required items
• -ID, password, name, email, country code, mobile number

• 2.Automatically collected items
• -IP address, access logs, service usage history

• 3.Optional items
• -The company does not request optional items.

Article 5 (Provision of Personal Information to Third Parties)

The company does not provide personal information to third parties.
However, it may be provided in accordance with the law or with the data subject’s consent.

Article 6 (Entrustment of Personal Information Processing)

The company does not outsource personal information processing tasks.
If necessary, the contents will be disclosed and prior consent obtained.

Article 7 (Overseas Transfer of Personal Information)

The company processes and stores all members’ personal information, including that of foreign users, on servers located in Korea as follows:

• 1.Storage location
• -All personal information is managed on servers located in Korea.

• 2.Consent for international transfer
• -Personal information of foreign users may be transferred from their country to Korea for service provision, with consent obtained at registration.

Article 8 (Procedure and Method of Personal Information Destruction)

The company destroys personal information without delay when the retention period expires or the purpose is achieved.

• 1.Destruction procedure
• -Upon occurrence of destruction reasons, personal information is destroyed with the approval of the person in charge.

• 2.Destruction method
• -Electronic files: Deleted using technical methods that prevent recovery
• -Printed documents: Shredded or incinerated

Article 9 (Rights of Data Subjects and How to Exercise)

Data subjects may exercise the following rights:

• 1.Request to access personal information

• 2.Request to correct or delete errors

• 3.Request to suspend processing

• 4.How to exercise rights
• -Multilingual support: Requests can be submitted in Korean, English, or Chinese.
• -Submission method: Via email or customer center on the website.
• -Processing time: Results will be notified within 10 days of receipt.

Article 10 (Measures for Personal Information Protection)

The company takes the following measures to ensure the safety of personal information:

• 1.Administrative measures
• -Establish and implement internal management plans for personal information protection
• -Regular training for handlers of personal information

• 2.Technical measures
• -Encryption and access control of personal information
• -Operation of security systems and intrusion prevention systems

• 3.Physical measures
• -Access control and enhanced security for storage facilities

Article 11 (Personal Information Protection Officer)

The company designates the following person in charge to handle inquiries and requests related to personal information protection:

• 1.Personal Information Protection Officer
• ●Name: Ho-Seon Ahn
• ●Position: CEO
• ●Email: aho@bhbiotech.co.kr

• 2.Department in charge of personal information protection
• ●Department Name: Management Support Team
• ●Contact: hyn@bhbiotech.co.kr

Article 12 (Changes to the Privacy Policy)

This privacy policy is effective from November 15, 2024.
It may be modified due to changes in laws or company policies, and any changes will be announced on the website at least 10 days in advance.