Privacy Policy
Privacy Policy
Cosmax Inc. (the “Company”) processes and securely manage personal information in a lawful manner and in accordance with the Personal Information Protection Act (“PIPA”) and relevant laws and regulations to protect your freedom and rights as a data subject. In accordance with Article 30 of the PIPA, we have established and disclose as follows our privacy policy to guide you through our personal information processing procedures and standards and to ensure prompt handling of privacy-related grievances you may face.
This Privacy Policy applies to Cosmax Package and related services. Where personal information is collected by and from websites of other companies linked to Cosmax Package, this Privacy Policy ceases to apply after personal information is transferred upon your consent.
Primary Personal Information Processing Activities
General collection
First name, Last name, Title/Position, Mobile, E-mail, Shipping address (Include Zip/Postal code)
Processing purpose
Request for subsidiary materials and samples, Register the shipping address for samples
Retention period
Until account termination. Where retention is required under applicable laws, relevant statutory period shall apply before personal information is deleted
Outsourcing of Processing
LOGEN Corp., SQNT Corp., Salesforce Inc.
Complaint-handling department
Department: Product Design Team
Phone: +82 (0)31 789 3065
Email: [email protected]
Table of Content
· Personal information collected, processing purpose, and retention period
· Outsourcing of personal information processing
· Destruction of personal information
· Rights and obligations of data subjects (and legal representatives)
· Personal information security measures
· Installation and operation of automatic collection tools and ways to opt-out
· Chief privacy officer & Responsible Personnel
· Seeking damages relief
· Amendments to the privacy policy
Personal information collected, processing purpose, and retention period
① The Company shall collect and process the minimum personal information necessary to achieve the following purpose. Personal information processed by the Company will not be put to use for other purposes. Where changes are made to the use purpose, the Company will take the necessary measures, including obtaining separate consent under Article 18 of the PIPA. Personal information is processed and retained for such period as required under laws or regulations or as otherwise disclosed to you at the time the Company sought your consent.
Service Name Processing Purpose Items of Personal Information Collected Retention Period
Create account Inquiry of / Request for subsidiary materials and samples [Required]
First name, Last name, Mobile Until account termination;
provided that personal information shall be retained until completion of any pending investigation or inspection conducted for suspected violations of applicable laws or regulations
[Optional]
Title/Position
Address management Register the shipping address for samples [Required]
First name, Last name, Shipping address (Include Zip/Postal code)
② Personal information shall be safely stored and destroyed after an applicable period in the following cases:
1. Until completion of any pending investigation or inspection conducted for suspected violations of relevant laws or regulations
2. Until settlement of claims and debts, if any, arising from the use of the website
③ The Company does not collect personal information belong to children under the age of 14.
Outsourcing of personal information processing
① To facilitate smooth processing of personal information, the Company outsources the processing of personal information as follows:
1. Outsourced entity
Outsourced entity (“Outsourcee”) Outsourced Task
LOGEN Corp. Delivery of samples
SQNT Corp. Operation of the Cosmax Package system and the management/analysis of customer data
② In accordance with Article 26 of the PIPA, the Company outsources the processing of personal information based on a written agreement that specifies the purpose and scope of the outsourcing arrangement, restrictions on sub-processing, safeguard measures, management and supervision of the outsourcee, and liability for damages. The Company also supervises the outsourcee to ensure safe processing of personal information.
③ In accordance with Article 26(6) of the PIPA, the outsourcee obtains approval from the Company when the outsourcee seeks to engage a sub-processor to handle the Company’s processing of personal information.
④ Any changes to the outsourcee or the tasks outsourced will be disclosed via this Privacy Policy without delay.
Destruction of personal information
① The Company destroys personal information in its retention when relevant personal information no longer becomes necessary due to the expiration of the retention period or fulfilment of the processing purpose.
② Where the Company must continue its retention of personal information in accordance with other applicable laws after the expiration of the retention period to which you have consented or fulfillment of the processing purpose, relevant personal information is transferred to a separate database or separately stored.
③ The procedure and method of personal information destruction are as follows:
1. Destruction process:
The Company identifies personal information subject to destruction and obtains approval from the Company’s chief privacy officer to proceed with the destruction.
2. Destruction method:
The Company irreversibly destroys personal information stored in electronic format so that it cannot be reconstructed and shreds or incinerates paper records containing personal information.
Rights and obligations of data subjects (and legal representatives)
① You may, at any point in time, request the Company to provide you with access to, correct, delete, suspend or cease the processing of your personal information, and refuse or request an explanation on automated decisions.
※ Requests for access to personal information belonging to a child under the age of 14 years must be made by the legal representative him/herself. Data subjects aged 14 years and older may exercise their rights themselves or through their legal representatives.
② You may exercise your rights in writing, via email or facsimile, in accordance with Article 41(2) of the Enforcement Decree of the PIPA and the Company shall take necessary measures without delay.
③ You may exercise your rights through your legal representative or an authorized agent. In this case, you must complete and submit a proxy form, in accordance with the Form No. 11 of the Personal Information Protection Commission’s Public Notice on the Processing of Personal Information (Notice No. 2023-12).
④ Your right to access and suspend processing of your personal information may be limited in accordance with Articles 35(4) and 37(2) of the PIPA.
⑤ You may not demand removal of your personal information where such personal information is subject to collection under other applicable laws or regulations.
⑥ Where you have agreed to automated decisions or been provided with advance notice thereof (e.g., via an agreement) and there is a clear statutory provision, your refusal of automated decision will not be upheld and your rights may be limited to a request for an explanation or review of the automated decision. Additionally, your refusal of an automated decision or a request for an explanation thereon may be denied upon justifiable grounds, such as where the request unduly infringes or is likely to unduly infringe upon another’s life, or bodily or property interests.
⑦ The Company shall confirm whether the person exercising the foregoing rights is the data subject him/herself or a duly authorized agent.
Personal information security measures
The company takes the following measures to ensure the safety of personal information.
1. Administrative measures: Establishment and implementation of internal management plans and regular employee training
2. Technical measures: Access controls to personal information processing systems, installing access control systems, encryption of unique identification information, and installation of security software
3. Physical measures: Access controls to the IT and data storage rooms
Installation and operation of automatic collection tools and ways to opt-out
① The Company uses cookies that store and retrieve your user information to provide you with customized services and increase your convenience.
② A cookie is a small piece of information sent from a website server to the browser and stored in your computer or mobile device.
③ By adjusting your web or mobile browser preferences, you may allow or reject cookies. Where cookies are denied, the Company may not provide you with customized services.
1. Allowing/denying cookies on web browsers
- Chrome : More Settings > Privacy and Security > Third-party Cookies > Block Third-party Cookies
- Edge : Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data > Block Third-party Cookies
- Whale : Settings > Privacy > Cookies and Other Site Data
2. Allowing/denying cookies on mobile browsers
- IOS
Chrome : Settings > Privacy and Security > Clear browsing data
Safari : Settings > Safari > Advanced > Block all cookies
- Android
Chrome : Setting > Privacy and Security > Third-party Cookies > Block Third-party Cookies
Samsung Internet: Settings > Site and Downloads >
Chief Privacy Officer & Responsible Personnel
① The Company overseas and is responsible for the processing of your personal information. In order to address any complaints or claims you may have with regards to the processing of your personal information, we have designated a chief privacy officer as follows:
1. Chief Privacy Officer : Process Innovation Division EVP
2. Personal Information Protection Team : I&S Team
3. Phone : 031-8018-0213
4. Email : [email protected]
② For any inquiries related to the protection of your personal information that may arise in the course of using the Company’s services, complaints, or damage claims, please contact our chief privacy officer and the relevant department and the Company will respond to your inquiry without delay.
Seeking damages relief
For damages arising from privacy infringements, you may seek dispute resolution or consult with the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center. For other reporting of privacy infringements or consultation related thereto, please contact the following agencies:
1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
3. Supreme Prosecutor’s Office: 1301 (www.spo.go.kr)
4. Korean National Policy Agency: 182 (ecrm.cyber.go.kr)
Amendments to the privacy policy
① This Privacy Policy shall be effective as of 2026.06.01
② For prior versions of the privacy policy, see below.
없음
2026. 06. 01 ~