Privacy Policy

Article 1. Personal Information Collected and Collection Methods

NINEONELABS Co., Ltd. (the "Company") collects personal information as follows in order to provide services and respond to inquiries.

Items collected	Purpose	Retention period
Project type, budget, schedule, company, name, position, telephone, email, website, inquiry details, referral source, and attachment	Receiving project inquiries, consultation, estimates, and response notifications	3 years
Hospital name/type, person in charge, position, telephone, email, current site/reference URL, selected plan, progress status, and memo	Receiving and responding to medical-landing inquiries and providing estimates	3 years
Visitor/session identifiers, page URL, referrer, device/browser information, screen size, UTM parameters, advertising click identifiers, and interaction events	Service analytics, advertising effectiveness analysis, security, and prevention of misuse	Raw analytics logs: 180 days; raw click-fraud IP evidence: 90 days
IP address, user-agent information, date/time, and reCAPTCHA verification result	Spam prevention, access security, and incident response	3 months, unless a longer period is required by law or for dispute handling

Personal information is collected via submission of the website inquiry form, direct provision by email or phone, and automatic generation during service use.

Article 2. Purpose of Collection and Use

The Company uses the collected personal information only for the following purposes.

1. Receiving project inquiries and consultation, and providing quotes
2. Sending inquiry receipt and operational notifications by email or SMS
3. Analyzing service usage and improving quality
4. Complying with relevant laws and resolving disputes

Article 3. Retention and Use Period

In principle, the Company destroys personal information without delay once the purpose of collection and use is achieved. However, it retains information for a certain period in accordance with the provisions of relevant laws.

• Project and landing inquiries and attachments: 3 years from receipt or the last response
• Raw service analytics logs: 180 days
• Raw click-fraud IP evidence: 90 days
• Records on e-commerce contracts and withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
• Records on payment and supply of goods: 5 years (same Act)
• Records on consumer complaints and dispute handling: 3 years (same Act)
• Service usage records under the Protection of Communications Secrets Act: 3 months

Article 4. Provision to Third Parties

The Company does not provide personal information to third parties without the data subject's consent. The following are exceptions.

1. Where the data subject has given prior consent
2. Where an investigative agency requests it in accordance with the procedures and methods prescribed by law for investigative purposes, or pursuant to the provisions of law

Article 5. Outsourcing of Personal Information Processing

For smooth service operation, the Company outsources personal information processing as follows.

Trustee	Outsourced work
Google LLC	Google Analytics, reCAPTCHA, Maps and Gmail SMTP: analytics, bot prevention, map display, and inquiry email delivery
NAVER Corporation	Naver WCS advertising performance analysis (only after optional marketing consent)
Meta Platforms, Inc.	Meta Pixel advertising performance analysis (only when configured and after optional marketing consent)
Nanosoft	SMS transmission for inquiry and operational notifications

When an overseas service is used, information may be transmitted over the network to the country in which that provider processes data. The Company applies the consent or other lawful basis required by applicable law and limits optional analytics and marketing providers to users who have accepted them.

Article 6. Rights and Obligations of the Data Subject and How to Exercise Them

The data subject may exercise the following rights against the Company at any time.

1. Request to access personal information
2. Request to correct errors, etc.
3. Request for deletion
4. Request to suspend processing

To exercise these rights, contact us by email (cs@nineonelabs.co.kr) and we will act without delay.

Article 7. Procedures and Methods of Destroying Personal Information

The Company destroys the relevant personal information without delay when the retention period has elapsed or the processing purpose has been achieved.

• Electronic files: permanently deleted using an irrecoverable method
• Paper documents: shredded or incinerated

Article 8. Personal Information Protection Officer

The Company designates a Personal Information Protection Officer as follows to oversee personal information processing and to handle related complaints and remedies.

Category	Details
Officer	NINEONELABS Representative
Email	cs@nineonelabs.co.kr

You may also report or seek consultation on personal information infringement with the following organizations.

• Privacy Infringement Report Center: 118 / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 / www.spo.go.kr
• National Police Agency Cyber Bureau: 182 / cyberbureau.police.go.kr

Article 9. Changes to the Privacy Policy

This Privacy Policy applies from the effective date. If there are additions, deletions, or corrections in accordance with laws and policy, the changes will be announced via the website from 7 days before they take effect.