Preface

Medytox Inc. (Hereinafter referred to as “Company”) is in compliance with the Personal Information Protection Act and other applicable statutes to process personal information legitimately and manage them safely for the protection of data subjects’ freedom and rights. Accordingly, according to Article 30 of the Personal Information Protection Act, the following Privacy Policy is established and made public to provide the procedures and standards for the processing of personal information to data subjects and to promptly and smoothly handle any related grievances.

 

 

Article 1 Purpose of Processing Personal Information, Categories of Collected Personal Information, and Retention Period

The Company processes personal information for the following purpose. The processed personal information shall not be used for purpose other than those specified below, and if the purpose of use changes, the necessary measures will be taken accordingly according to Article 18 of the Personal Information Protection Act, such as obtaining separate consent.

Category	Legal Basis	Purpose of Collection and Use	Items Collected	Retention and Use Period
Submit an Inquiry	“Personal Information Protection Act” and “Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.”	Submission of Inquiries and Response on the Processing Results Regarding Product Purchase (Domestic/Overseas), Adverse Events, IR, and Business Partnership (Domestic/Overseas/Others)	Required Items: Name, Organization (Hospital/Company Name), Country, Location, Email Address, Contact Information, Password, Any Personal Information Included in the Inquiry	3 Years
Ethics Management Report	“Personal Information Protection Act” and “Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.”	Identity Verification, Fact-Checking of Reported Matters, Implementation of Necessary Measures Regarding the Reported Matters and Response on the Processing Results	Required Items: Name, Email Address, Contact Information, Password, Any Personal Information Included in the Report Details and Attachment, Service Usage Record, Access Logs and IP Address Information	Retained for Three years After the Purpose of Reporting is Fulfilled, Followed by Immediate Destruction

 

 

Article 2 Matters Concerning Procedures and Methods for the Destruction of Personal Information

① The Company shall immediately destroy the applicable personal information without delay when deemed unnecessary for reasons such as expiry of retention period, achievement of the purpose of processing, etc.

② Where personal information shall continue to be retained in accordance with other statutes despite the expiry of the personal information retention period agreed to by the data subject or achievement of the purpose of processing, the applicable personal information shall be moved to a separate database (DB) or retained in a separate personal information storage location.

③ Procedures, Deadline, and Methods for the Destruction of Personal Information

1. Destruction Procedure

The Company shall select personal information that is subject to destruction, and destruct upon obtaining approval from the Company’s data protection officer.

2. Destruction Deadline

Where the retention period of personal information is expired, the applicable personal information shall be destructed within 5 days from the date on which the retention period expires, and when the personal information is no longer required, the applicable personal information shall be destructed within 5 days from the date on which the processing of personal information is determined to be no longer necessary.

3. Destruction Method

The Company shall destruct the personal information recorded and stored in electronic file format so that the record cannot be recovered, and all personal information recorded and stored in paper documents shall be shredded using a shredder or destroyed by incineration.

 

 

Article 3 Matters Concerning Measures to Ensure the Safety of Personal Information

The Company takes the following actions to ensure the safety of personal information.

1. Administrative Measures: Establishment and implementation of an internal management plan, regular employee training, operation of a dedicated organization.

2. Technical Measures: Management of access control for personal information processing system, installation of access control system and other related protective measures, measures to block access to the internet network, encryption of personal information, storage and inspection of access records, installation and renewal of security program, inspection and remediation of vulnerabilities in personal information processing systems.

3. Physical Measures: Access control to the computer room and the archive room, storing documents and removable storage media in a safe place equipped with a locking device, safety measures against disasters and emergencies, control of entry and exit of removable storage media.

 

 

Article 4 Matters Concerning Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

<Automatic Personal Information Collection Devices Installed and Operated>

① The Company uses cookies that save usage information and retrieve them as needed to provide personalized services and convenience to data subjects.

② Cookies refer to small pieces of information sent to the browser of the data subject by the server (http), which is used for the operation of the website. Cookies are saved on the computer or mobile of the data subject, and are automatically sent to the server from the browser of the data subject upon accessing the website.

③ The Company utilizes “Google Analytics,” a web analytics service provided by Google, Inc. (hereinafter “Google”), to analyze data subjects’ website visits and usage patterns, as well as the size of the data subject population, to deliver optimized information tailored to the data subjects.

Information generated via Google Analytics is subject to Google Privacy Policy, and is transmitted to and stored on Google servers located in the United States.

1. Google Privacy Policy: https://policies.google.com/privacy
2. Google Analytics Terms of Service: https://www.google.com/analytics/terms/kr.html

④ The data subject can configure the browser settings to allow or block cookies.

 

<Matters Concerning the Collection, Use, Provision, and Refusal of Behavioral Information>

The Company is processing behavioral information in a manner that identifies an individual using cookie to provide optimized personalized services and benefits and online personalized advertisement to data subjects in the course of using the service.

 

 

Article 5 Matters Concerning the Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

① The data subject can request (Hereinafter referred to as “Exercise of Rights”) to the Company at any time to access, transfer, correct, delete their personal information, and suspend the processing of it, and withdraw their consent.

② Rights can be exercised in writing, by telephone, email, fax, internet or other means according to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take immediate actions accordingly.

③ Rights can be exercised through a representative, such as a legal representative or an authorized representative. In this case, a power of attorney following [Attachment 11] “Notification on Personal Information Processing Methods” shall be submitted. 

④ The right of the data subject to request access to and suspension of the processing of personal information can be limited according to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑤ Where the applicable personal information is explicitly specified to be collected under other statutes, the deletion of the relevant personal information cannot be requested.

⑥ The Company shall check whether the person who exerted the right is the data subject or an authorized representative.

⑦ The data subject can exert their rights through the department specified below. The Company shall reply within 10 days (without delay in the case of a data transmission request) from the date of receiving request from a data subject to exercise their right.

▶ Department responsible for receiving and handling requests to exercise personal information rights

Department Name: Compliance Management Department

E-mail: it.medytox@medytox.com

 

 

Article 6 Matters Concerning Data Protection Officer

The Company designates the relevant department as shown below to handle complaints related to personal information and to protect the customer’s personal information.

Medytox Data Protection Officer: Vice President Chang Seonghun (Compliance Management Department)

Email: it.medytox@medytox.com

 

 

Article 7 Remedies for Infringement of Data Subjects’ Rights and Interests

The data subject can request dispute settlement or consultation or other assistance in order to obtain remedies for personal information infringements to Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), etc. Please call the below agencies for reports or consultation concerning other personal information infringement.

1. Personal Information Dispute Mediation Committee: (Without an area code) 1833-6972 (www.kopico.go.kr)

2. Personal Information Infringement Report Center: (Without an area code) 118 (privacy.kisa.or.kr)

3. Supreme Prosecutors’ Office Republic of Korea: (Without an area code) 1301 (www.spo.go.kr)

4. Korean National Police Agency Electronic Cybercrime Report & Management System: (Without an area code) 182 (ecrm.cyber.go.kr)

5. Korea Online Privacy Association (OPA): 02-550-9500 (eprivacy.or.kr)

 

In addition, those whose rights or interests have been infringed due to a disposition made or an omission committed by the head of a public institution in response to a request made by a data subject for the access, correction, deletion, suspension of the processing of personal information, etc., an administrative appeal may be filed in accordance with the Administrative Appeals Act.

▶ Central Administrative Appeals Commission: (Without an area code) 110 (www.simpan.go.kr)

Seoul Administrative Appeals Commission	(Without an area code) 120	Gangwon Special Self-Governing Province Administrative Appeals Commission	033-249-2478
Busan Administrative Appeals Commission	051-888-2301	Chungcheongbuk-do Administrative Appeals Commission	043-220-2336
Daegu Administrative Appeals Commission	053-803-2581	Chungcheongnam-do Administrative Appeals Commission	041-635-2118
Incheon Administrative Appeals Commission	032-440-2298	Jeonbuk Special Self-Governing Province Administrative Appeals Commission	063-280-2134
Jeonnam-Gwangju Special Metropolitan City Administrative Appeals Commission	061-286-2636 (Jeonnam) 062-613-1552 (Gwangju)	Gyeongsangbuk-do Administrative Appeals Commission	054-880-2246
Daejeon Administrative Appeals Commission	042-270-3423	Gyeongsangnam-do Administrative Appeals Commission	055-211-2541
Ulsan Administrative Appeals Commission	052-229-2284	Jeju Special Self-Governing Province Administrative Appeals Commission	064-710-2385
Gyeonggi-do Administrative Appeals Commission	031-8008-2134	Sejong Special Self-Governing City Administrative Appeals Commission	044-300-2852

 

 

Article 8 Matters Concerning the Operation and Management of Fixed Visual Data Processing Devices

The Company informs the user of the purposes for which personal video information processed through fixed visual data processing devices is used and how such information is managed.

① Basis and Purpose of the Installation of Fixed Visual Data Processing Devices

The Company installs and operates the fixed visual data processing devices for the purposes specified below according to Article 25(1) of the Personal Information Protection Act. 

- Facility safety and management, fire prevention

- Crime prevention for customer safety

- Prevention of vehicle theft and damage

※ The device can be installed in cases where the parking facility has a capacity of more than 30 vehicles, according to Article 6(1) of the Enforcement Decree of Parking Lot Act.

② Number of Units Installed, Installation Location, and Area of Coverage

Category	No. of Cameras	Installation Location and Area of Coverage
Medytox Global Business Center	83 units	Building lobbies, parking lot (indoor / outdoor), elevators, and building perimeters
Gwanggyo R&D Center	83 units	Elevator halls on each floor, entrances/corridors on each floor, building lobbies, parking lot entrances, underground parking lots, and inside the elevators
	2 units	B4 animal laboratory
Medytox Plant I (Ochang)	5 units	Main gate access road, Medycafe entrance, areas around Medycafe, smoking area, and parking lot
	2 units	Production building entrance, production building 1F lobby
	9 units	Main building lobby, 2-4F corridor/lobby, 3F AHU room entrance, in front of the electrical substation on the right side of the main building
Medytox Plant II (Osong)	7 units	Main gate access road, plant perimeter, behind the waste storage area, outdoor parking lot, perimeter fence, roadside along the site perimeter, vicinity of security office
	7 units	Greenhouse entrance, greenhouse rear door, areas surrounding the greenhouse (lawn, side area, and side gate), greenhouse basement storage, inside the greenhouse
	12 units	Administration building lobby, 1-5F stairways/corridors/entrances of administration building, CEO’s office entrance, inside Medycafe, Plant building lobby
	5 units	Underground parking lot entrance, inside the underground parking area, administration building/plant building entrance
Medytox Plant III (Osong)	7 units	Company main gate, Toxin building lobby, Toxin building parking area, Toxin building rear entrance
	5 units	Security office entrance, visitor parking lot, areas surrounding the office building, Osong R&D center rear entrance
	10 units	Filler building entrance, Filler building lobby, Filler building material receiving area, inside the parking area of Filler building, Filler building freight elevator entrance, Filler building basement elevator
	23 units	Inside Building E parking area, Building E main entrance, Building E visitor parking lot, areas surrounding Building E, Building E stairway No.1 B1-3F, Building E stairway No.4 1-3F, Building E production management 1F

 

③ Management Officer and Authorized Personnel

The Company has the below management officer and authorized personnel for personal video information assigned to protect your personal video information and handle related complaints.

Location	Category	Name	Position	Department	Contact Information
Integrated	Management Officer	Park Youngsu	Director	Management Support Division	043-717-6201
Medytox Global Business Center	Authorized Personnel	Noh Daesung	Deputy General Manager	Seoul Building Management Team	02-6901-5462
Gwanggyo R&D Center	Authorized Personnel	Lee Minchol	Manager	Gwanggyo Security Team	031-8065-8139
Medytox Plant I (Ochang) Medytox Plant II (Osong) Medytox Plant III (Osong)	Authorized Personnel	Song Soojin	Deputy General Manager	General Affairs Team	043-717-6206
	Authorized Personnel	Yoon Kiwon	Manager	General Affairs Team	043-717-6019

 

④ Recording Hours, Retention Period, and Processing Method of Personal Video Information

Category	Recording Hours	Retention Period	Storage Location
Medytox Global Business Center	24 hours	30 days from the recording date	1F disaster prevention control room
Gwanggyo R&D Center	24 hours	30 days from the recording date	1F information desk, B1 disaster prevention control room
Medytox Plant I (Ochang)	24 hours	30 days from the recording date	Production office, 3F server room in the main building
Medytox Plant II (Osong)	24 hours	30 days from the recording date	Security office, 3F server room in the administration building
Medytox Plant III (Osong)	24 hours	30 days from the recording date	Toxin building/ Building E security office

- Processing Method: Requests such as use of personal video information for purposes other than the original purposes, provision to third parties, destruction, access, etc. are recorded and managed. Upon expiration of the retention period, the information is permanently deleted in a manner that prevents restoration (Printouts are shredded or incinerated).

⑤ Matters Concerning Outsourcing of Installation and Management of Fixed Visual Data Processing Equipment

The Company is outsourcing the installation and management of the fixed visual data processing equipment as shown below, and stipulates the necessary matters according to the relevant statutes to ensure the safe management of personal information when entering into an outsourcing agreement.

Category	Service Provider	Person in Charge	Contact Information
Medytox Global Business Center	Bunker M	Deputy General Manager, Noh Daesung	02-6901-5462
Gwanggyo R&D Center	Bunker M	Manager, Lee Minchol	031-8065-8139

 

⑥ Matters Concerning the Methods and Locations for Reviewing Personal Video Information

- Method of Review: The information can be reviewed by contacting the management officer of personal video information in advance and visiting the relevant institution.

- Location for Review

Site	Review Location
Medytox Global Business Center	1st floor security team
Gwanggyo R&D Center	B1 disaster prevention control room, 1st floor information desk Department in Charge - Research support team/ Access control department - Gwanggyo security team
Medytox Plant I (Ochang) Medytox Plant II (Osong) Medytox Plant III (Osong)	General Affairs Team of the Management Support Division

 

⑦ Measures in Response to Data Subjects’ Requests for Review to Personal Video Information

If you wish to review, confirm the existence of, or delete your personal video information, you may make a request to the operator of the fixed visual data processing devices at any time. However, it is limited only to the personal video information in which you are recorded. The Company shall immediately take action upon the request to provide review to, confirm the existence of, or delete your personal video information.

⑧ Measures for Securing the Safety of Personal Video Information

The personal video information handled by the Company is safely managed through measures, including encryption. In addition, as part of the administrative measures for personal video information protection, the Company is granting different levels of access to personal information, and in order to prevent the forgery and alteration of personal video information, the date and time of generation of personal video information, purpose of review at the time of viewing, viewer, date and time of review are recorded and managed. Additionally, to ensure safe physical storage of personal video information, locking devices are installed.