Privacy Policy

O:BIJOU (the Company) maintains this policy to protect personal information handled when providing consultation on product planning, development, manufacturing and supply through this website.

Data controller: O:BIJOU

Representative: Lee Ju-hyung

Business registration number: 588-40-00807

Business address: 6F, 31 Gangnam-daero 92-gil, Gangnam-gu, Seoul, Republic of Korea

Privacy officer: Representative Lee Ju-hyung

Privacy inquiries and rights requests: miocid@naver.com

This policy applies to website consultation requests and related consultation and receipt notifications. If additional information is processed to perform a separate contract, the relevant processing and retention terms will be explained separately.

The Company processes personal information to receive consultation requests, verify identity and contact details, review products and quotations, respond to inquiries, notify applicants of receipt and manage consultation history.

Required information: name or brand name, mobile number, and selections for product category, product type, service needed, preparation stage, target launch timing and design support. Undecided selections may be submitted as undecided or requiring consultation.

Optional information: email, additional requests and details you provide in your message, such as reference products, company name or links.

Generated information: application reference number, receipt date and time, consultation status, notification delivery results and internal consultation notes.

Collection methods: information entered directly in the website consultation form or provided during consultation.

Basis for processing: consent to collection and use obtained when you submit a consultation request. You can submit without providing optional information.

Receipt emails provide information needed to process your request and do not constitute consent to advertising. Please do not include unnecessary sensitive information, such as national identification numbers or health information, or personal information belonging to others.

The operating retention standard is to delete consultation requests and history within 90 days after consultation ends. Information is deleted without delay when the purpose is fulfilled or consent is withdrawn and retention is no longer necessary.

Where retention is legally required, only the categories and periods required by applicable law are retained separately and used solely for that retention purpose.

Records needed for contracts are managed separately from consultation history and processed according to the applicable basis and retention period.

The actual categories and retention periods for security and access logs held by external services will be verified and reflected in the service information below.

The Company generally does not disclose consultation applicants' personal information to third parties. If disclosure is needed, it will explain the recipient, purpose, categories and retention period and obtain necessary consent, or process it within the scope permitted by law.

When discussing product specifications with manufacturers or suppliers, the standard is to share product requirements without unnecessary identifiers such as personal contact details. If an applicant's personal information must be provided directly to another company, the processing basis and scope will first be reviewed.

The system operation, storage and messaging services below are managed separately from disclosures that permit a third party's independent use.

The Company uses the following external services to operate the website and manage consultation work. Whether each arrangement constitutes entrusted processing and the applicable contract must be verified. Where applicable, legally required contracts, management and supervision must be in place.

Vercel Inc.: website hosting, server-side consultation processing, and service security and operations.

Google: processing through Apps Script, storing consultation history in Google Sheets, sending email, and handling related sending-account records.

Naver: receiving and storing administrator notifications and consultation emails in the Company's Naver mailbox.

The Company reviews and manages service purposes, access permissions, subprocessing, retention and deletion conditions. Changes to services or processing arrangements will be reflected in this policy.

The current website server, consultation storage and messaging setup includes services from overseas providers. Details that constitute overseas processing or storage must be finalized and disclosed according to the actual account, contract, processing region and applicable legal basis.

[International transfer details — to be finalized after verification]

1. Recipients and contacts: the actual contracting entities for Vercel Inc. and Google and their privacy contact channels

2. Destination countries: to be stated after verifying actual processing and storage locations for each service

3. Information transferred: the submitted consultation and application or notification processing information actually handled by each service

4. Timing and method: the methods used in the actual setup, such as server communication on submission and encrypted communication for spreadsheet storage and email

5. Purpose: providing the website, processing and storing consultation requests, and sending notifications

6. Retention period: to be stated after verifying the Company's retention period and each provider's deletion and backup retention conditions

7. Legal basis: to be stated after confirming the applicable basis. If separate consent is required, a notice and consent process separate from collection and use consent must be prepared.

8. How to refuse and consequences: contact miocid@naver.com. Available alternative consultation channels and any restriction on online applications following refusal must be confirmed and explained.

This international transfer notice is not considered complete while the table remains unconfirmed.

The Company identifies information whose retention period has expired or purpose has been fulfilled and selects it for deletion. Records legally required to be retained are separated after confirming their basis and retention period.

Electronic files are deleted in a way that makes recovery or reproduction difficult, and printed records are destroyed, for example by shredding. Copies managed by the Company, including work mailboxes and downloaded files as well as consultation spreadsheets, are also subject to deletion.

Copies remaining in providers' backup or recovery systems are managed according to their deletion procedures and retention periods. The Company does not promise immediate deletion of backups outside its control.

You may request access to, correction or deletion of, suspension of processing of, or withdrawal of consent for your personal information held by the Company.

How to request: email miocid@naver.com with your request and the minimum information needed to verify your identity. Requests through an agent may require documentation of valid authority.

After verifying the requester or authorized agent, the Company will process the request and explain the result under applicable legal procedures. If legal restrictions or retention obligations prevent full compliance, the reason will be explained.

Your rights are not restricted because you did not provide an email. If further verification is needed, an available contact method will be agreed.

The Company's operating standard is to limit access to staff who need personal information for consultation, manage account permissions and sharing, apply appropriate security settings to systems and transmission, manage accounts, devices and secret keys, and review retained information regularly.

Specific measures include website HTTPS, server-side authentication key controls over consultation storage, restricted access to private consultation spreadsheets, revocation of permissions when staff change, and checks for deletion of expired records.

Measures not yet implemented are not represented as already in place. This section will be finalized after confirming the protections actually implemented.

The current consultation form does not include separate advertising behavior analytics tools or marketing subscription functions. Applicants' personal information is not used for automated decisions that significantly affect individuals.

Hosting or external font providers may process IP addresses and browser or request information when providing the website. Actual logging, cookies and retention settings will be checked before categories and purposes are disclosed.

You may restrict or delete cookies in your browser settings. Before introducing features such as analytics, advertising or Kakao Alimtalk, the required processing notices and consent procedures will be reviewed.

Privacy officer: Representative Lee Ju-hyung

Data controller: O:BIJOU

Privacy contact email: miocid@naver.com

You may use this email for privacy inquiries, rights requests or complaints related to consultation. The Company will review your request and explain the outcome.

Official information on external remedies is available from the Personal Information Portal (privacy.go.kr), the Privacy Infringement Report Center (privacy.kisa.or.kr), and the Personal Information Dispute Mediation Committee (kopico.go.kr).

Effective date: [to be finalized after operational and international transfer details are verified]

Review draft prepared: October 23, 2026

Changes to this policy and their effective dates will be announced on the website, and previous versions will be retained for reference. Changes requiring additional consent will follow applicable legal consent procedures.