Privacy Policy

1. Information Collected

(Required) Email, name, payment information (bank-transfer confirmation and tax-invoice details). (Optional) Company name, title, categories of interest. (Auto-collected) IP, cookies, access logs, User-Agent. (When downloading a free evaluation sample) Record of acceptance of the evaluation licence — time of acceptance, licence version, page language, a hash of the IP address (the IP address itself is not stored), User-Agent. (When an invoice is issued) The versions of the Terms and licence accepted and the time of acceptance. The Service is for businesses and institutions and does not collect personal information of children under 14.

2. Purpose of Collection and Use

(1) Granting dataset download permissions, (2) Processing payment + issuing receipts / tax invoices, (3) Service notices + B2G sales response, (4) Fraud prevention + security logs, (5) Evidencing acceptance of the evaluation licence for free evaluation samples.

3. Retention Period

Member info: until withdrawal. Payment and tax-invoice records and records of contracts and withdrawals: 5 years under the E-Commerce Act, the Framework Act on National Taxes and the Value-Added Tax Act. Records of complaints and dispute handling (inquiries and refund requests): 3 years under the E-Commerce Act. Quote requests: 1 year from the request (5 years as a contract record if it leads to a contract). Chatbot conversations: 1 year after personal information is masked. Access logs: 3 months under the Protection of Communications Secrets Act. Evaluation-licence acceptance records: 3 years from acceptance, to handle licence-related disputes, then destroyed. Destruction procedure and method: personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay (within 5 days). Electronic files are deleted so that they cannot be recovered, and paper documents are shredded or incinerated. Information that other laws require us to keep is stored separately from other information.

4. Provision to Third Parties

We do not provide users' personal information to third parties. The only exception is where a law specifically requires it or an investigative or other authority requests it following the procedure laid down by law. Payment confirmation (Woori Bank) and tax processing (tax accountant) are not third-party provision; they are processing entrusted to processors under 4-1 below.

4-1. Entrusted Processing (Processors)

To provide the service we entrust the processing of personal information to the processors below (PIPA Article 26). We set the terms needed to keep personal information safe and supervise the processors. Any change of processor or entrusted task will be announced in this Policy.

4-2. Overseas Transfer of Personal Information

To conclude and perform our contract with you, we entrust the processing and storage of personal information to the overseas processors below. Under PIPA Article 28-8(1)(iii) we disclose the recipient, destination country, time and method of transfer, items transferred, purpose, and retention period.

How to refuse overseas transfer

If you do not want your personal information transferred overseas, email privacy@garangbiai.com to refuse. Cloudflare is infrastructure the website cannot run without, so if you refuse you cannot use the services offered through the website (evaluation sample download, invoices, quote requests, etc.). In that case we will arrange another way to do business by phone (+82-10-7794-5422).

5. User Rights (PIPA §35-§37 + GDPR Art. 15-22)

Users have the rights of (a) access, (b) correction/deletion, (c) processing suspension, (d) consent withdrawal, exercisable via privacy@garangbiai.com.

6. Security Measures

(1) AES-GCM encryption (secrets), (2) Access control (separate admin authentication + audit log), (3) HTTPS transport, (4) Regular security audits.

7. Privacy Officer

Name: Jeongseok Hwang / Title: CEO / Email: privacy@garangbiai.com / Phone: +82-10-7794-5422 / Business registration no.: 860-18-02443 / Business address: #402, 4F, 20 Hakdong-ro 24-gil, Gangnam-gu, Seoul, Republic of Korea

8. GDPR Compliance (EU Residents)

For EU residents (GDPR Art. 3), the following rights are guaranteed: ① Right of access (Art. 15): Free copy of your data within 30 days ② Right to rectification (Art. 16): Correct inaccurate data ③ Right to erasure (Art. 17 — "right to be forgotten"): Delete data except legal retention requirements ④ Right to restriction (Art. 18): Pause processing during dispute / verification ⑤ Right to data portability (Art. 20): Receive data in structured, machine-readable format ⑥ Right to object (Art. 21): Object to direct marketing / automated decision-making ⑦ Automated decision-making (Art. 22): Refuse decisions based on profiling Legal basis (Art. 6): · Contract performance (payment / download / license issuance) — Art. 6(1)(b) · Legitimate interest (service improvement / security) — Art. 6(1)(f) · Explicit consent (marketing emails) — Art. 6(1)(a) Exercise GDPR rights: privacy@garangbiai.com (reply within 30 days). Cross-border data transfer: the Republic of Korea has an adequacy decision from the European Commission (December 2021), so transfers from the EU to Korea rely on that decision. Onward transfers from Korea to processors in third countries (such as the USA) follow Section 4-2 and each processor’s Standard Contractual Clauses (SCC).

9. CCPA Compliance (California Residents)

For California residents (CCPA / CPRA), the following rights are guaranteed: ① Right to know: Categories of personal information collected, sources, purposes, recipients ② Right to delete: Request deletion (exceptions: completed transactions, security, legal obligations) ③ Right to correct (CPRA 2023+): Correct inaccurate information ④ Right to opt-out: Refuse "sale" / "sharing" of personal information (GaRangBi does NOT sell personal information) ⑤ Non-discrimination: No service or price discrimination for exercising rights GaRangBi does NOT "sell" California residents' personal information to external third parties (per CCPA §1798.140 (t)(1) definition) nor "share" for advertising purposes. Exercise CCPA rights: privacy@garangbiai.com (reply within 45 days, one 45-day extension permitted).

10. Cookies and other automatic collection tools

We use cookies to keep you signed in (member session cookie), for administrator authentication and for bot protection (Cloudflare Turnstile). We do not use advertising or behavioural-tracking cookies. You can refuse or delete cookies in your browser settings; if you do, some services such as sign-in and invoice issuance will not be available.

11. Remedies for infringement of rights

You may report or seek advice on infringement of personal information from the following bodies (Republic of Korea): · Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr · Personal Information Infringement Report Center (KISA): 118 · privacy.kisa.or.kr · Supreme Prosecutors’ Office: 1301 · www.spo.go.kr · Korean National Police Agency: 182 · ecrm.police.go.kr