Privacy Policy
COSMAX Inc. (the “Company”) processes personal information lawfully and manages it securely in accordance with the Personal Information Protection Act (“PIPA”) and other applicable laws to protect the freedom and rights of data subjects. Pursuant to Article 30 of the PIPA, the Company establishes and publishes this Privacy Policy to explain its procedures and standards for processing and protecting personal information and to address related grievances promptly and effectively.
1. Purposes, Items, and Retention Periods of Personal Information Processing
1) Personal information processed with the data subject’s consent
| Category | Purpose of processing | Items processed | Processing and retention period | Legal basis |
|---|---|---|---|---|
| Product development inquiry | Domestic development inquiry | [Required] Name, mobile phone number, email address, and inquiry details For sole proprietors: business registration number, representative’s name, and business address [Optional] Attachment (if it contains personal information) | One year after the inquiry is completed | Article 15(1)(1) of the PIPA (consent of the data subject) |
| Product development inquiry | Overseas development inquiry | [Required] First and last name, department and title, mobile phone number, email address, and company and product overview For sole proprietors and influencers: company name, company address, and social media account [Optional] Attachment (if it contains personal information) | One year after the inquiry is completed | Article 15(1)(1) of the PIPA (consent of the data subject) |
| Development contract | Conducting development projects, entering into and performing contracts, managing business relationships, and responding to disputes | The same items as for the domestic or overseas development inquiry above | Five years after the business relationship (contract) ends | Article 15(1)(1) of the PIPA (consent of the data subject); for sole proprietors, Article 15(1)(4) of the PIPA (entering into and performing a contract) |
2. Procedures and Methods for Destroying Personal Information
Pursuant to Article 21 of the PIPA, the Company destroys personal information without delay when its retention period expires or the purpose of processing has been achieved.
[Destruction methods]
∙ Electronic files: permanently deleted using technical methods that prevent recovery
∙ Paper records: shredded or incinerated
3. Outsourcing of Personal Information Processing
| Service provider | Outsourced services |
|---|---|
| COSMAX BTI Co., Ltd. | Responding to overseas customer development inquiries and supporting overseas sales |
4. Measures to Ensure the Security of Personal Information
The Company takes the following measures to protect personal information.
1) Administrative measures
Establishing and implementing an internal management plan and providing regular employee training
2) Technical measures
Managing access rights to personal information processing systems, installing access control systems, encrypting unique identification information, installing security software, and identifying and remediating vulnerabilities in personal information processing systems
3) Physical measures
Controlling access to computer rooms and records storage rooms
5. Installation and Operation of Automatic Data Collection Tools and How to Refuse Them
① To provide individual services and convenience to data subjects, the Company uses cookies and similar automatic collection tools that store and retrieve usage information.
② A cookie is a small amount of information sent by the server (HTTP) operating the website to a data subject’s browser and stored on the data subject’s computer or mobile device.
③ Data subjects can allow or block cookies through their web browser settings.
ㆍ Allowing or blocking cookies in a desktop browser
- Chrome: Select the three-dot menu in the upper right corner > Settings > Privacy and security > Cookies and other site data
- Edge: Select the three-dot menu in the upper right corner > Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari: Safari menu at the top of the browser > Preferences > Privacy > Cookies and website data
ㆍ Allowing or blocking cookies in a mobile browser
- Chrome: Select the three-dot menu in the upper right corner > Settings > Privacy > Clear browsing data
- Safari: Device Settings app > Safari > Advanced > Block all cookies
- Samsung Internet: Select the Tabs icon at the bottom of the mobile browser > Turn on Secret mode
④ Refusing to store cookies may make some website features unavailable or difficult to use.
⑤ The Company uses Google Analytics 4 (GA4), provided by Google LLC, to analyze website visits, traffic sources, page usage, and conversion rates for development inquiries. This may involve processing the time of visit; the addresses and titles of viewed pages; the previous page address; whether an inquiry page was viewed or an inquiry was started; step numbers for overseas development inquiries; whether submission was attempted and completed; online identifiers stored in cookies; language, screen resolution, browser and device information; and approximate location inferred from the IP address. IP addresses may be used to infer location but are not recorded or stored in GA4. GA4 cookies have a default lifetime of up to two years, which may be shorter depending on browser settings. Information entered in an inquiry, including company name, contact person’s name, contact details and email address, inquiry details, and attachments, is not sent to GA4. The Company does not combine GA4 usage records with the inquirer’s information in its CRM or use them for personalized advertising. You can refuse cookie storage using the methods described in paragraph ③ above.
6. Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them
Data subjects (or their legal representatives) may exercise their rights to access, correct, delete, or suspend the processing of personal information, and to withdraw consent, at any time.
These rights may be exercised in writing, by email, or by fax. The Company will respond without delay.
A data subject’s legal representative or a duly authorized agent may also exercise these rights.
7. Privacy Officer and Department Handling Privacy Complaints
① The Company has designated the following privacy officer to oversee personal information processing and address complaints and provide remedies relating to personal information processing.
1) Privacy officer
Name: Jong-ok Ko
Position: Head of the PI Innovation Division
Contact: [email protected]
② Data subjects may contact the privacy department with any questions, complaints, or requests for remedies relating to personal information protection that arise while using the Company’s services. Requests to exercise personal information rights may be submitted to the department responsible for receiving and processing such requests. The Company will respond to and handle these matters without delay.
1) Department responsible for personal information protection
Department: Infrastructure Security Team
Contact: [email protected]
2) Department responsible for receiving and processing requests to exercise personal information rights
Department: Sales Management Team
Contact: +82-31-789-3000, [email protected]
8. Remedies for Infringement of Data Subjects’ Rights
① To seek remedies for a personal information infringement, data subjects may request dispute resolution or consultation from the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency, or the Personal Information Infringement Report Center. For other reports or consultations regarding personal information infringement, please contact the following organizations.
1) Personal Information Dispute Mediation Committee: 1833-6972 (without an area code), www.kopico.go.kr
2) Personal Information Infringement Report Center: 118 (without an area code), privacy.kisa.or.kr
3) National Police Agency: 182 (without an area code), ecrm.cyber.go.kr
9. Changes to This Privacy Policy
This Privacy Policy takes effect on October 19, 2026. Changes from previous versions can be found in the revision history below.
| Version | Effective date | Changes |
|---|---|---|
| v1.0 | 2026-10-19 | Initial version |