Maumgyeol Privacy Policy
Effective date: 2023-11-09


Bwave Co., Ltd. ("Company"), when providing Maumgyeol, strictly complies with all domestic laws and regulations, including the "Personal Information 
Protection Act," to appropriately process and safely manage private information of the information subject for protection of the subject’s freedom and rights. Thus, in accordance with Article 30 of the "Personal Information Protection Act," the Company has established and disclosed the following privacy policy to inform the information subjects of the procedures and standards for processing personal information and to handle related grievances swiftly and smoothly.


Labeling of Major Person Information
Place your mouse cursor above the icons for important categories, and refer to the below Privacy Policy for more detailed information.
 	 	 	 	 
General Data Collection
Purpose of Processing
Period of personal information retention	
Entrustment of Processing
Grievance handling department

Table of Contents
•	Purpose of Collection, Articles, Period of retention and use
•	Handling of personal information of minors under the age of 14
•	Provision of Personal Information to Third Parties
•	Entrustment of Processing of Personal Information
•	Procedures and Method of the Destruction of Personal Information
•	Rights of Information Subjects & Legal Representatives and Exercising Those Rights
•	Actions Taken to Protect Personal Information
•	Matters Concerning Automatic Personal Information Collection Device (Installation, Operation and Refusal)
•	Information on Collection, Use, and Refusal of Behavioral Data
•	Pseudonymization
•	Privacy Protection Officer and Requesting Access to Personal Information
•	Remedies for Infringement on Rights
 

◾️ Purpose of Collection, Article, Period of retention and use
① The articles of personal information processed by the Company, purpose of collection, and period of retention and use are as follows.


    

        

            
Category (Task name)

            
Purpose of collection

            
Article

            
Period of retention and use

			
Basis of personal information processing

        
        

            
User registration and management

            


				•	Writing and delivery of study report

				•	For purposes of writing statistical analysis results

				•	Confirmation of minors under the age of 19

				•	For purposes of reporting to the sponsor

				•	User identification and verification

				•	Retention and management of member rights

				•	Delivery of various notices and announcements

				•	Prevention of illegal service registration and use

				•	Confirmation of consent of legal representative
			
            
Required: Name, Sex, Korean Depression/Anxiety questionnaire results, Bio-signal data (pulse wave), Cookies, Date of birth, Contact number, E-mail address, E-mail address of legal representative, ID, Name of legal representative, Contact number of legal representative

            


				•	12 months from the date of collection

				•	Until the requested date of destruction

			
			
•	Consent of information subject

        


        

            
Promotion and marketing

            


				•	Delivery of web magazines (Introduction and guidance to Maumgyeol Service)

				•	Delivery of advertising information

				•	Information on events

				•	Recommendation of products and services

				•	Information on new products and services

				•	Delivery of newsletters

			
            

				Required: Email address, Contact number
				

			
            


				•	1 year from the date of collection

				•	Until withdrawal of consent

			
			
•	Consent of information subject

        

        

            
Product and services

            


			•	Writing and delivery of study report

			•	Mental Health Assessment

			•	For purposes of reporting to the sponsor

			•	For purposes of writing statistical analysis results

			•	User identification

			•	Provision of service use data

			•	Provision of contents



			
            

				Required: Measurement data (Pulse waves), Questionnaire data (Korean Depression/Anxiety questionnaire results), Data analysis results (Mental Health Index, Results by category)

				Optional: Medical information (Disease information / Medication information / Lifestyle habits information)

				

			
            


				•	1 year from delivery of study report

				•	Until the requested date of destruction


			
			
•	Consent of information subject

        

    



② The personal information processed shall not be used for purposes other than outlined above, and if purpose of use changes, appropriate measures will be implemented to obtain separate consent according to Article 18 of the Personal Information Protection Act.
③ The Company shall only process and retain the personal information according to the period as required by laws and regulations or within the period of retention and use of personal information consented by the information subject. However, for any of the reasons below, the Company may process and retain the personal information until the end of the specified period:
1) If there is an ongoing investigation regarding a violation of relevant laws and regulations, until the completion of the respective investigation
2) If bond or debt relationship remains due to the use of the website, until the relevant bond or debt relationship is settled
3) If any information is to be retained as required by relevant laws and regulations, until the end of the period as required by those laws and regulations
•	The Act on Protection of Communications Secrets: Data to Prove Communication Facts including Website visit records, etc. (3 months)
•	The Act on Consumer Protection in Electronic Commerce Transactions etc.: Records of contracts or subscription cancellations (5 years)
•	The Act on Consumer Protection in Electronic Commerce Transactions etc.: Records of balance payments and supplies of commodities, etc. (5 years)
•	The Act on Consumer Protection in Electronic Commerce Transactions etc.: Records of processing complaints or disputes by consumers (3 years)
•	The Act on Consumer Protection in Electronic Commerce Transactions etc.: Records of indications and advertisement (6 months)
•	The Act on Promotion of Information and Communication Network Utilization and Information Protection: Records of self-verification (6 months)
•	The Act on Electronic Financial Transactions: Records of electronic finance (5 years)
•	The Act on Promotion of Information and Communication Network Utilization and Information Protection: Records of communications billing service use (5 years) (1 year if under 10,000 won)


◾️ Disclosure of sensitive information and non-disclosure selection method

① The Company collects sensitive information for provision of services.
② Sensitive information include information about health and sexual activity, genetic information, ideas and beliefs, membership in trade unions and political parties, political views, and criminal history data.
③ Sensitive information of the information subject is included in the information disclosed in the process of providing service, which poses a risk of privacy infringement.  If you wish to not disclose this information, you may select disclosure method as follows:

◾️ Handling of personal information of minors under the age of 14

① When collecting personal information from a minor under the age of 14, the Company can request the minimum required information with the consent of the minor’s legal representative.
② Also, if additional personal information needs to be collected or processed for promotion and marketing purposes, separate consent must be obtained from the minor’s legal representative.
③ When collecting personal information from a minor under the age of 14, the Company can request the minimum required information including the name and contact information of the minor’s legal representative, and confirm consent from the legal representative via one of the following methods.
•	Send the legal representative a notification via e-mail containing consent information and receiving a confirmation email that they give consent

◾️ Provision of Personal Information to Third Parties
 
① The Company processes the information subject’s personal information only within the scope outlined in the Purpose of Collection, and does not provide personal information to any third party without the information subject’s consent, or unless demanded by applicable laws pursuant to Article 17 and 18 of the "Personal Information Protection Act."
② The Company can provide necessary organizations with personal information without consent from the information subject in the event of a disaster, communicable disease, incidents or accidents that can lead to death or physical endangerment, and/or emergency situations that can lead to immediate financial loss. Examples
In this case, the Company provides only minimum required information as demanded by applicable laws, and does not provide personal information for any other purpose.
③ For smooth service provision, the Company shall provide the minimum required personal information with the consent of the information subject for the following reasons.

◾️ Entrustment of Processing of Personal Information

① The Company entrusts personal information processing tasks as follows for smooth processing of personal information.


    

        

            
Entrusted party (Entrustee)

            
Entrusted task

            
Re-entrustment

        
        

            
Naver Cloud Co., Ltd

            

			•	Delivering a Service Infrastructure with Cloud Computing
			
            

        
        

    


The Company has entrusted the following affairs overseas for personal information processing tasks.
② In case of entrustment, the Company manages and supervises whether the entrusted entity complies with laws and regulations on personal information protection by limiting the entrusted entity's processing of personal information to that necessary to execute the entrusted tasks, applying technical and administrative protective measures, and restricting re-entrustment, pursuant to Article 26 of the "Personal Information Protection Act."
③ Any modifications of the entrusted task or entrusted party shall be shared immediately through this Privacy Policy.

◾️ Procedures and Method of the Destruction of Personal Information

① The Company immediately destroys the information subject's personal information once the purpose of the collection and use of personal information is fulfilled.
② If any information is to be retained beyond the consented period of retention or even after meeting the purpose of collection as required by relevant laws and regulations, the personal information shall be moved to a separate database (DB) or stored separately.
③ The procedure and method of destruction is as follows:
  •	Destruction procedures: Company requests personal information that needs to be destructed, and destructs personal information after approval from the Privacy Protection Officer.
  •	Destruction method: Personal information recorded and stored in electronic form is securely deleted by technical means to prevent its recovery or restoration, while personal information recorded and stored in written form is shredded or incinerated.


◾️ Rights of Information Subjects & Legal Representatives and Exercising Those Rights

① At any time, the information subject may exercise rights such as access,·revision,·deletion,·suspension of processing of personal information to the Company.
② The information subject can exercise his/her rights via face-to-face communication, e-mail, FAX, etc., pursuant to Article 41-1 of the "Personal Information Protection Act" and the company shall take necessary measures without delay.
③ The information subject can exercise his/her rights through his/her legal representative or an authorized agent. In this case, a power of attorney according to Annex No. 11 of the "Guidelines on the Method of Processing Personal Information (No. 2020-7)" must be submitted.
④ The right to access personal information and request suspension of processing may be restricted in accordance with Article 35(4) and Article 37(2) of the "Personal Information Protection Act."
⑤ The request for correction and deletion of personal information cannot be made if the personal information is specified as the subject of collection under other laws.
⑥ The Company verifies whether the person making the request for access, correction, deletion, or suspension of processing is the information subject or a legitimate representative in accordance with the information subject's rights.


◾️ Measures to secure security

① The Company takes the following measures to ensure the safety of personal information.
  1) Administrative measures: Establishment and implementation of an internal management plan, operating a dedicated organization, and conducting regular employee training
  2) Technical measures: Managing the rights to access the personal information processing system, etc., installing access control systems, encrypting personal information, installing and updating security programs
  3) Physical measures: Controlling access to computer rooms, data storage rooms, etc.
② To secure safety of personal information, the Company is taking the following measures beyond what is outlined in applicable laws and regulations.

◾️ Matters Concerning Automatic Personal Information Collection Device (Installation, Operation and Refusal)

① The Company uses “cookies” for the below purposes. Cookies are very small text files sent to the computer browser or mobile application of the users by the server(http) used for operation of the websites, and will be stored in hard-disks of the users' computer or mobile phones. 
  1) Purpose of cookies: Retention of user settings, maintenance of user log-in, provision of convenient services
  2) Disadvantages to user if cookies are not saved: Use of certain services requiring log-in may be difficult. 
  3) Installation, management and rejection of cookies: Depending on the web browser or application, you may reject cookies as follows: 
•	Android: Settings > Apps > Select service > Storage > Clear cache
•	iOS: Settings > Privacy & Security > Tracking > Select ‘Disable’ for selected service app

◾️ Information on Collection, Use and Rejection of Behavioral Data

The Company shall not import, utilize, or provide activity/behavior information for customized online advertisements, etc.

◾️ Pseudonymization
① Company pseudonymize the personal information collected for use in statistics, scientific research and public records in order to secure anonymity of the individual, and processes them as follows.
•	Matters concerning Pseudonymization

    

        

            
Category (Task name)

            
Purpose of collection

            
Article

            
Period of retention and use

        
        

            
User registration and management

            
Scientific research for advancement of services

            
Questionnaire data (Korean Depression/Anxiety questionnaire results), Data analysis results (Mental Health Index, Results by category), Date of birth, Sex, Measurement data (Pulse waves)

            
•	Permanent property

        
    


② Pursuant to Article 28-4 of GDPR (Obligation to Take Safety Measures for Pseudonymized Information), the Company takes necessary technical and operational measures to secure safety of psedonymized information. This includes storing and managing pseudonymized information separately from the additional information to prevent re-identification, and recording and saving of pseudonymization process.
  1) Administrative measures: Establishment and implementation of an internal management plan, conducting regular employee training
  2) Technical measures: Managing the rights to access the personal information processing system, etc., installing access control systems, encrypting personal identifiable information, installing security programs

◾️ Privacy Protection Officer and Requesting Access to Personal Information

① The Company takes overall responsibility for the handling of personal information and designates a privacy protection officer to handle complaints and remedies related to personal information processing.
② Information subject may demand access to his/her personal information to the departments below, pursuant to Article 35 (Access to Personal Information). The Company will make efforts to promptly process requests for access to personal information from information subjects. 


    

        

            
Category

            
Responsible person

            
Contact information

        
        

            
Privacy Protection Officer

            
Title/Position: Name of COO: Se-Wan Lee

            
sewan.lee@bwaveeeg.com

        
        

            
Requesting Access to Personal Information

            
Name of department: Development Team Responsible Person: Jae-Hyung Lee

            
jh.lee@bwaveeeg.com

        
    


② Information subjects may contact the privacy protection officer or the department in charge to inquire about any matters related to the protection of personal information, file complaints, and seek remedies arising from the use of the Company's services (or business). The Company will respond and handle inquiries from information subjects promptly.

◾️ Remedies for Infringement on Rights

① The Company strives to actively guarantee the information subject’s rights (the right to control one’s own personal information) and make remedies for infringement on rights. Information subjects wishing to report or consult may contact the responsible department.
② Information subjects may apply for dispute resolution or consultation regarding remedies for damages caused by personal information breaches to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency Personal Information Breach Report Center, and other relevant organizations. For reporting and consulting on other personal information breaches, please contact the following institutions: Please make inquiries to the following organizations if you need to report or consult in regards to the violation of personal information.
•	Personal Information Dispute Mediation Committee: (Toll free)1833-6972 (www.kopico.go.kr)
•	KISA Report Center for Personal Information Breach: (Toll free)118 (privacy.kisa.or.kr)
•	Cyber Crime Investigation, Supreme Prosecutors' Office: (Toll free)1301 (www.spo.go.kr)
•	National Police Agency Cyber Bureau: (Toll free)182 (ecrm.cyber.go.kr)
③ Individuals who have suffered from infringements of rights or interests due to dispositions or actions by the head of a public agency pursuant to the provisions of Article 35 (Request for Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the "Personal Information Protection Act" may request administrative adjudication in accordance with the Administrative Adjudication Act.
•	Central Administrative Appeals Commission: (Toll free)110 (www.simpan.go.kr)

◾️ Amendment to the Privacy Policy
① This Privacy Policy is effective as of November 9, 2023.