Article 1Purposes of processing personal information
The Company processes personal information for the purposes set out below. Personal information is not
used for any purpose other than those listed, and where the purpose changes, the Company will obtain
separate consent and take other necessary measures in accordance with Article 18 of PIPA.
- Website enquiries and demo requests — verifying the requester, scheduling consultations and
demonstrations, providing materials and quotations for evaluation, and responding to enquiries.
- Conclusion and performance of service agreements — verifying the counterparty, executing and
maintaining contracts, creating and managing service accounts, billing and settlement, technical support.
- Service operation and notices — delivering information necessary for using the service,
notifying changes to terms and policies, preventing misuse and handling disputes.
- Marketing and promotion (with separate consent) — newsletters, seminar and webinar invitations,
and information about new services.
- Service improvement and statistical analysis — analysing access frequency and usage patterns and
producing statistics to improve service quality.
Article 2Categories of personal information processed and how it is collected
1. Categories processed
| Context | Required | Optional |
|---|
| Website demo request / enquiry |
Name, company name, department and title, business email address, contact number |
Size of sales organisation, evaluation objectives, message content |
Service contract and operation
(customer contacts) |
Company, name, department and title, email address, contact number, contract and settlement information |
— |
| Service account users |
User ID, password (stored encrypted), name, organisation and title, email address, usage and access logs |
Contact number, profile image |
| Marketing communications |
Name, email address |
Company name, contact number |
Kakao Login on the HCP portal
(healthcare professionals) |
Name, Kakao account (phone number), Connecting Information (CI) |
— |
2. Information generated automatically
- IP address, access date and time, service usage records and access logs
- Browser and operating system type, device identifiers, referral path
- Preference values stored in cookies and browser local storage (for example, language selection)
3. Collection methods
- Direct entry by the user through the demo request and enquiry forms on the website
- Offline channels such as email, telephone, written contracts and in-person meetings
- Automatic generation and collection during use of the service
- Provided by Kakao when a user (healthcare professional) consents to Kakao Login on the HCP portal
4. Collection through Kakao Login on the HCP portal
On the HCP portal that the Company operates on behalf of a customer (a pharmaceutical company), the Company
receives the name, Kakao account (phone number) and Connecting Information (CI) from Kakao,
and only where the healthcare professional has personally consented to Kakao Login. Consent is given by the
data subject on Kakao's own login screen, and items not consented to are not provided.
Connecting Information (CI) is used solely to match the person against the customer's list of healthcare
professionals and to prevent duplicate registration. It is not used as a substitute for any identity
verification procedure required by law. CI is an online identifier generated by an identity verification agency
under the Act on Promotion of Information and Communications Network Utilisation and Information Protection, and
is not unique identifying information under Article 19 of the PIPA Enforcement Decree.
This information is processed within the scope entrusted by the customer under Article 4 and is
destroyed without delay upon withdrawal of membership. The Kakao Login integration is operated technically under
the Company's own developer account, but the purposes and scope of processing are determined by the customer's
instructions.
As a rule the Company does not collect sensitive information under Article 23 of PIPA
(ideology, beliefs, health, genetic data and the like) or unique identifying information
under Article 24 (such as resident registration numbers). Where collection is legally grounded or
unavoidable, it is processed only with separate consent. Professional details of healthcare professionals, such as
their institution or medical department, do not constitute sensitive information.
Article 3Processing and retention periods
The Company processes and retains personal information within the retention and use period required by
law, or the period consented to by the data subject at the time of collection.
| Purpose | Retention period | Basis |
|---|
| Website enquiries and demo requests | 3 years after the purpose is fulfilled
(destroyed without delay upon withdrawal of consent) | Consent of the data subject |
| Service contracts and account operation | 5 years after termination of the contract | Commercial Act; Framework Act on National Taxes |
| Marketing communications | Until consent is withdrawn or the user opts out | Consent of the data subject |
Kakao Login data on the HCP portal
(name, phone number, CI) | Until withdrawal of membership
(destroyed without delay on withdrawal) | Consent of the data subject · entrustment by the customer |
| Records on contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records on labelling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Service access logs | 3 months | Protection of Communications Secrets Act |
Article 4Personal information processed on behalf of customers
In providing its cloud CRM service Jay CRM to customers (pharmaceutical and biotech companies),
the Company acts as a processor entrusted by the customer with respect to personal information of
healthcare professionals (HCPs) and customer employees that the customer collects and manages.
- The customer is the personal information controller for such data. The legal basis, purposes and
retention periods follow that customer's own privacy policy and consents.
- The Company processes entrusted personal information only within the scope of the customer's instructions
and does not use it beyond the entrusted purpose or provide it to third parties.
- Requests to access, correct, delete or suspend the processing of entrusted personal information are, in principle,
received and handled through the relevant customer. The Company supports the customer as required.
- Pursuant to Article 26 of PIPA, the Company concludes a written data processing agreement with each customer covering
security measures, restrictions on sub-processing, supervision and liability for damages.
- The Company stores and manages data separately per customer so that data belonging to different customers is never commingled.
- The HCP portal the Company operates on behalf of a customer, and its Kakao Login integration, represent
technical operation carried out by the Company in order to provide the service. Personal information of healthcare
professionals collected through it likewise falls within the scope of entrusted processing under this Article.
The specific items and purposes are set out in Article 2, paragraph 4.
Article 5Provision of personal information to third parties
The Company processes personal information only within the scope specified in Article 1, and provides it to
third parties only where Articles 17 and 18 of PIPA apply, such as with the consent of the data subject or
under a special provision of law.
The Company currently does not provide personal information to third parties, except in the following cases:
- Where separate consent has been obtained from the data subject
- Where there is a special provision in law or it is unavoidable in order to comply with a legal obligation
- Where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by law
If any new provision to third parties arises, the Company will disclose the recipient, purpose, categories and
retention period in this policy in advance and obtain the required consent.
Article 6Outsourcing of personal information processing
The Company outsources personal information processing tasks as follows in order to provide its services smoothly.
| Processor | Scope of outsourced work | Retention period |
|---|
| Supabase, Inc. |
Hosting and operation of the service database and data storage (domestic Seoul region) |
Until the outsourcing agreement ends, or until account withdrawal / contract termination |
Microsoft Corporation
(Microsoft Azure · Azure OpenAI Service) |
Cloud infrastructure operation, file storage and computation for AI features |
| Kakao Corp. |
Delivery of messages such as KakaoTalk AlimTalk notifications |
| FormSubmit (formsubmit.co) |
Receiving website demo request and enquiry submissions and delivering them by email |
When entering into an outsourcing agreement, the Company specifies in the contract, in accordance with Article 26 of
PIPA, the prohibition on processing personal information beyond the purpose of the outsourced work, technical and
administrative safeguards, restrictions on sub-processing, supervision of the processor and liability for damages,
and supervises whether the processor handles personal information securely.
Any change to the outsourced work or to the processors will be disclosed through this Privacy Policy without delay.
About AI processing — The Company uses the enterprise-grade Azure OpenAI Service.
Customer data is never used to train or retrain external AI models.
Article 7Overseas transfer of personal information
As a rule the Company stores and processes service data on cloud infrastructure in a domestic (Korean) region.
Personal information may nevertheless be transferred overseas as set out below, disclosed here in accordance with
Article 28-8 of PIPA.
| Recipient | Country · time and method of transfer | Items transferred | Purpose and retention |
|---|
| Supabase, Inc. |
United States · remote access where technical support or incident response is required
(the data itself is stored in the domestic Seoul region) |
Personal information stored in order to provide the service |
Database hosting and technical support · until the outsourcing agreement ends |
FormSubmit
(formsubmit.co) |
United States · transmitted over the network when a website enquiry form is submitted |
Name, company name, department and title, email address, contact number, message content |
Delivering the enquiry to the responsible staff by email · destroyed without delay after delivery |
| Microsoft Corporation |
United States and others · remote access where technical support or incident response is required |
The minimum personal information necessary for service operation |
Cloud technical support · until the support case is closed |
Data subjects may refuse the overseas transfer of their personal information; in that case the use of the relevant
service channel may be restricted. Requests to refuse may be sent to the Privacy Officer named in Article 14.
Article 8Procedures and methods for destroying personal information
The Company destroys personal information without delay once the retention period has expired or the purpose of
processing has been achieved and the information is no longer necessary.
1. Procedure
- Personal information whose retention period has expired is destroyed within 5 days of the expiry date. Where personal
information becomes unnecessary because the purpose has been achieved or the service or business has been discontinued,
it is destroyed within 5 days of the date that ground arises.
- Where retention is required under other statutes, the information is moved to a separate database or stored in a
different location and is not used for any purpose other than that retention.
2. Methods
- Electronic files — permanently deleted using technical methods that make the records unrecoverable, such as low-level formatting
- Printed records — shredded or incinerated
Article 9Rights and obligations of data subjects and legal representatives
Data subjects may exercise the following rights against the Company at any time:
- The right to request access to personal information (PIPA Article 35)
- The right to request correction of errors (Article 36)
- The right to request deletion (Article 36)
- The right to request suspension of processing (Article 37)
- The right to request transmission of personal information (Article 35-2)
- The right to refuse, or to request an explanation of, a decision made by a fully automated system (Article 37-2)
- The right to withdraw consent to the collection, use and provision of personal information
How to exercise these rights
- Rights may be exercised in writing, by email or by fax, and the Company will act on such requests without delay.
- Where a data subject requests correction or deletion of erroneous personal information, the Company will not use or
provide that information until the correction or deletion is complete.
- Rights may be exercised through a legal representative or an authorised agent. In that case a power of attorney in the
form prescribed in Annex Form No. 11 of the Public Notice on Personal Information Processing Methods must be submitted.
- Requests for access and for suspension of processing may be restricted under PIPA Article 35(4) and Article 37(2).
- Deletion may not be requested where the personal information is expressly specified as a subject of collection under other statutes.
The Company verifies that the person making a request for access, correction, deletion or suspension is the data subject
themselves or a duly authorised representative.
For personal information the Company processes on behalf of customers under Article 4, please direct your request to the
relevant customer. Requests received directly by the Company are forwarded to the customer without delay.
Article 10Personal information of children under the age of 14
The Company's services are business-to-business services intended for corporate customers and
do not collect or use the personal information of children under the age of 14.
If the Company becomes aware that such information has been collected, it will destroy the information without delay and,
where the consent of a legal representative is required, take the measures prescribed in Article 22-2 of PIPA.
Article 11Installation and operation of automatic collection devices, and how to refuse them
The Company uses cookies and browser local storage, which store and retrieve usage information, in order to
provide individually tailored services.
1. Purposes
- Essential — maintaining login sessions, security and prevention of misuse
- Functional — remembering user preferences such as the selected language
- Analytics — statistical analysis of visits and usage patterns to improve the service
The Company does not install or operate third-party advertising identifiers or trackers that collect behavioural information
on this website for targeted advertising.
2. How to refuse cookies
You may refuse the storage of cookies or delete stored cookies through your browser settings. If you refuse essential cookies,
some services such as login may be difficult to use.
- Chrome — Settings > Privacy and security > Third-party cookies / Delete browsing data
- Edge — Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari — Settings > Privacy > Prevent cross-site tracking / Block all cookies
- Firefox — Settings > Privacy & Security > Cookies and Site Data
Article 12Measures to ensure the security of personal information
Pursuant to Article 29 of PIPA and Article 30 of its Enforcement Decree, the Company takes the following security measures.
1. Administrative measures
- Establishment and implementation of an internal management plan, with regular self-inspections
- Designating the minimum number of personnel who handle personal information and providing them with regular training
- Designation of a Privacy Officer with clearly defined responsibilities
2. Technical measures
- Differentiated access rights to the personal information processing system (RBAC) and two-factor authentication for administrator accounts
- Operation of access control systems such as intrusion prevention systems to block unauthorised access
- One-way encryption of passwords and encryption of important information at rest and in transit (TLS)
- Retention and management of access logs with measures to prevent forgery or alteration
- Installation and periodic updating of security software; vulnerability assessment and remediation
- Data isolation per customer, with backup and recovery procedures
3. Physical measures
- Establishment and operation of access control procedures for server rooms and document storage areas
- Storage of documents and portable media containing personal information in a secure place with a lock
Article 13Processing of pseudonymised information
The Company may process pseudonymised information without the consent of data subjects for purposes such as compiling
statistics, scientific research and archiving in the public interest, in compliance with Articles 28-2 through 28-7 of PIPA.
- Purpose — analysis of service usage statistics and research to improve service quality
- Items pseudonymised — service usage records and similar data with identifiers removed or replaced
- Retention — until the purpose is achieved
- Safeguards — separate storage of additional information, minimised access rights, prohibition of re-identification and
immediate suspension, retrieval and destruction if re-identification occurs
Where pseudonymised information is provided to a third party, it does not include information that could be used to identify a specific individual.
Article 14Privacy Officer and department handling access requests
The Company has designated a Privacy Officer who takes overall responsibility for personal information processing and
handles complaints and remedies related to it.
| Item | Details |
|---|
| Entity | J Tech International Co., Ltd. (CEO Young-jo Kim) · Business Reg. No. 319-87-04032 |
| Address | 929, 9F Gangdong Empire Bldg., 90 Jinhwangdo-ro, Gangdong-gu, Seoul, Korea |
| Privacy Officer | Young-jo Kim (Chief Executive Officer) |
| Contact | contact@jtech-inter.com · +82 10-6778-7512 |
| Department for access requests | Same as the Privacy Officer · contact@jtech-inter.com |
Data subjects may direct any enquiry, complaint or request for remedy relating to personal information protection arising from
use of the services to the Privacy Officer. The Company will respond without delay.
Article 15Remedies for infringement of rights
Data subjects may apply to the following bodies for dispute resolution or consultation regarding infringement of personal information.
| Body | Telephone | Website |
|---|
| Personal Information Dispute Mediation Committee | +82-1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Centre (KISA) | 118 (within Korea) | privacy.kisa.or.kr |
| Supreme Prosecutors' Office, Cyber Investigation Division | 1301 (within Korea) | www.spo.go.kr |
| National Police Agency, Cyber Bureau | 182 (within Korea) | ecrm.police.go.kr |
A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a
request under PIPA Article 35 (access), Article 36 (correction or deletion) or Article 37 (suspension of processing) may file an
administrative appeal under the Administrative Appeals Act.
Article 16Changes to this Privacy Policy
This Privacy Policy is effective from 6 September 2026.
Where content is added, deleted or amended due to changes in law, policy or the Company's internal rules, the Company will give
notice through the website at least 7 days before the change takes effect (at least 30 days in advance for
significant changes).
Previous versions of this Privacy Policy are available on request from the Privacy Officer.
Version history
v1.1 — 6 September 2026 · added the items collected through Kakao Login on the HCP portal
(name, Kakao account phone number, Connecting Information) with their purposes and retention period
v1.0 — established and effective 6 September 2026
This English version is provided for convenience only. In the event of any discrepancy, the Korean version prevails.