Previous Privacy Policy (applied Oct. 14, 2026 – Oct. 21, 2026)
This document is the Privacy Policy applied from October 14, 2026 to October 21, 2026. The revised Privacy Policy applies from October 22, 2026. The current Privacy Policy is available here.
Bonsystems Co., Ltd. (the “Company”) establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of the Republic of Korea in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
This Policy applies to personal information collected and used through the websites operated by the Company (bonsystems.com and en.bonsystems.com, the “Website”). When the Company revises this Privacy Policy, it will announce the revision through the notices on the Website, and previous versions can be found at the bottom of this page.
※ Until the day before the effective date (October 13, 2026), the previous Privacy Policy (applied Sep. 15, 2026 – Oct. 13, 2026) applies.
Contents
The Company processes personal information for the following purposes. Personal information is not used for any purpose other than those listed below, and if the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
The Company processes information that data subjects enter directly through the forms on the Website and information that is automatically generated and collected while using the services. If required items are not provided, the relevant service (inquiry response, recruitment, survey participation) cannot be used; optional items may be omitted without any restriction on the use of the services.
| Category (collection channel) | Required items | Optional items | Method of collection |
|---|---|---|---|
| Product/quotation inquiry (Inquiry page) | Name, job title, company name, department, email, contact number, inquiry type, inquiry details | Attachments (drawings, specifications, etc.), consent to receive advertising information (email, text message, phone) | Website inquiry form |
| Manufacturing service inquiry | Name, job title, company name, department, email, contact number, development stage, request details | Attachments, desired price, maximum budget, consent to receive advertising information (email, text message, phone) | Website inquiry form |
| Investment (IR) inquiry | Name, job title, company name, department, email, contact number, inquiry details | Attachments, consent to receive advertising information (email, text message, phone) | Website inquiry form |
| Job application | Name, email, contact number, country, résumé (including education, career, and other information stated in the résumé) | Portfolio | Website job application form |
| Survey | Email, company name, department, job function, name, job title, mobile phone number (for sending gifts), industry, intended application, survey responses | Consent to receive advertising information (email, text message, phone), whether you wish to be contacted by a sales representative | Website survey form |
| Phone/email inquiry | Name, contact number or email, inquiry details | Company name, job title | Phone, email |
| Automatic collection (all pages) | IP address, browser type and version, access date and time, pages visited and referral path, cookies and advertising identifiers (behavioral information) | — | Automatically generated while accessing the Website (see Article 10) |
※ The Company does not collect personal information of children under the age of 14. The Website services are intended for corporate customers, job seekers, and industry professionals.
The Company processes and retains personal information within the retention and use period prescribed by law or consented to by the data subject at the time of collection, and destroys it without delay when the period expires or the purpose of processing has been achieved.
| Category | Retention and use period | Basis for the period / remarks |
|---|---|---|
| Product/quotation, manufacturing service, and investment inquiries | 1 year after the inquiry has been handled | Period for checking the re-inquiry and quotation history of the same customer. If a contract is concluded, contract-related information follows the retention period of the contract documents |
| Job applications | 1 year after the recruitment process ends | For checking re-applications of unsuccessful applicants and handling objections. Destroyed immediately upon the applicant’s request for deletion |
| Surveys | 1 year after the survey ends | Results of response analysis (statistics that cannot identify individuals) may be used without time limit |
| Consent to receive advertising information | Until consent is withdrawn | Consent is reconfirmed every 2 years pursuant to Article 50(8) of the Network Act |
| Access records (IP address, access date and time, etc.) | 1 year | Retention of access records under the Standards for Ensuring the Safety of Personal Information |
| Information that must be retained under other laws | The period prescribed by the relevant law | e.g., transaction books and evidence under the Framework Act on National Taxes and the Commercial Act (5–10 years) — only where a contract has been concluded |
The Company processes personal information only within the scope specified in Article 1 and provides it to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as where the data subject has consented or where there are special provisions in law.
Currently, there is no third party to whom the Company regularly provides the personal information of data subjects.
To provide its services smoothly, the Company entrusts the processing of personal information as follows. When concluding an entrustment contract, the Company specifies, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing for purposes other than the entrusted work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely. If the entrusted work or the trustee changes, the Company will disclose it through this Policy without delay.
| Trustee | Entrusted work | Retention and use period |
|---|---|---|
| Inostone | Website maintenance, operation of the inquiry and survey submission system, processing of submission notifications | Until the entrustment contract ends |
| Cloudways (server location: Seoul, Republic of Korea) | Website server hosting and data storage | Until the entrustment contract ends |
| KT Alpha Co., Ltd. (Giftishow) | Sending survey participation gifts (mobile gift vouchers) on the Company’s behalf — the mobile phone number is not transferred when the Company sends the gift directly | Destroyed immediately after sending |
| Stibee Inc. | Sending emails on the Company’s behalf — survey participation notices, and newsletters and new product news sent to those who have consented to receive advertising information | Until the entrustment contract ends or consent to receive is withdrawn |
For the operation of the Website, the Company transfers (stores and processes) personal information overseas as follows. Data subjects may refuse the cross-border transfer by contacting us at the contact details below (Article 12); if you refuse, the use of the relevant services (receiving inquiry notification emails, personalized advertising, receiving advertising information) may be restricted.
| Recipient (contact) | Country, timing and method of transfer | Items transferred | Purpose of use | Retention and use period |
|---|---|---|---|---|
| Twilio SendGrid (USA) Contact: [email protected] | USA; transmitted over the network when an inquiry is submitted | Name, company name, email, contact number and inquiry details entered in the inquiry form, and attachments (if attached to the form) | Sending inquiry notification emails | 30 days after sending (trustee’s log retention period) |
| Google LLC (USA) Contact: Google privacy contact form | USA; transmitted through the browser when accessing the Website | Cookies and advertising identifiers, device and browser information, pages visited, referral path (IP addresses are anonymized) | Website usage statistics analysis (Google Analytics), advertising performance measurement and personalized advertising (Google Ads) | The data retention period set in Google Analytics (up to 14 months) or until the cookie expires |
| Google LLC (USA) — Google Sheets Contact: same as above | USA; automatically transmitted over the network by the submission system when a form is submitted | Name, company name, email, mobile phone number, consent status by channel and date of consent of newsletter subscribers and those who have consented to receive marketing information | Keeping the newsletter subscriber list and the marketing consent register (managing the 2-year reconfirmation of consent) | Until consent to receive is withdrawn |
| Amazon Web Services, Inc. (USA) — cloud servers of Stibee Inc. Contact: AWS compliance support contact form | USA; transmitted over the network when email recipients are registered and emails are sent | Email address, name, company name and other recipient information | Data storage for operating the email sending service (Stibee) | Until the entrustment contract ends or consent to receive is withdrawn |
※ Legal basis for the cross-border transfer: Article 28-8(1)2 (notifying data subjects of the transfer) and 3 (entrustment and storage for the performance of a contract with the data subject) of the Personal Information Protection Act. Transfers related to Google tags (Analytics and Ads) can be refused in the cookie consent settings described in Article 10, and transfers to Google Sheets stop if you do not consent to, or withdraw your consent to, receiving marketing information.
When personal information becomes unnecessary, such as when the retention period has expired or the purpose of processing has been achieved, the Company destroys the personal information without delay.
Data subjects may exercise the following rights against the Company at any time.
You may exercise these rights by writing, phone, or email to the Chief Privacy Officer and the department in charge listed in Article 12, and the Company will notify you of the results within 10 days of receiving the request. You may also exercise your rights through a representative, such as a legal representative or a person delegated by you; in this case, a power of attorney in the form of Annex 11 of the Notice on Methods of Processing Personal Information must be submitted. The Company may verify whether the person making the request is the data subject or a legitimate representative.
If the Company refuses a request to exercise rights, it will inform you of the reason and how to raise an objection, and it will not use or provide personal information subject to a request for correction or deletion until the correction or deletion is completed.
The Company takes the following measures in accordance with Article 29 of the Personal Information Protection Act and the Standards for Ensuring the Safety of Personal Information.
To provide users with individually customized services and to analyze the use of the Website, the Company uses “cookies,” which store usage information and retrieve it from time to time. Cookies are small amounts of information that the server operating the Website sends to the user’s browser, and they are stored on the user’s device.
| Category | Purpose of use | Cookies (examples) | Retention period | Effect of refusal |
|---|---|---|---|---|
| Necessary cookies | Basic operation of the Website, processing form submissions, security (blocking unauthorized access), storing cookie consent choices | wordpress_test_cookie, wpforms_*, bs_cookie_consent | Session – 12 months | Cannot be refused (essential for the Website to function) |
| Analytics cookies | Statistics on the number of visitors, pages visited, and referral paths (Google Analytics) | _ga, _ga_* | Up to 2 years | You are only excluded from statistics; no restriction on use |
| Advertising cookies (behavioral information) | Measuring advertising performance and interest-based personalized advertising (Google Ads) | _gcl_au, _gcl_aw, IDE, test_cookie | Up to 13 months | General advertisements are shown instead of personalized ones |
The Company uses behavioral information, such as users’ Website visit history and search history, for personalized advertising and advertising performance measurement through Google Ads. Behavioral information is processed in a form that does not identify individuals, and the Company does not collect sensitive behavioral information such as information on ideology, beliefs, or health.
Users can refuse the storage of cookies and personalized advertising in the following ways.
Details on the types, names and retention periods of cookies and how to change your cookie settings can be found on the Cookie Notice page (en.bonsystems.com/cookie-policy).
In accordance with Article 50 of the Network Act, the Company sends advertising information for commercial purposes, such as new products, exhibitions, and newsletters, by electronic transmission media such as email, text messages (SMS/KakaoTalk), and phone only where the data subject has separately consented. Consent to receive is obtained separately for each channel (email, text message, phone).
The Company designates the Chief Privacy Officer as follows to take overall responsibility for the processing of personal information and to handle complaints and provide remedies for damage to data subjects in relation to the processing of personal information.
| Role | Name and position | Contact |
|---|---|---|
| Chief Privacy Officer | Changhyun Kim, CEO | Tel. +82-55-552-1562 · Email [email protected] |
| Privacy Manager | Minwoo Hwang, Deputy General Manager | Tel. +82-55-296-9615 · Email [email protected] |
Data subjects may contact the Chief Privacy Officer and the department in charge regarding all inquiries, complaints, and remedies for damage related to personal information protection arising from the use of the Company’s services. The Company will respond to and handle your inquiries without delay.
To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and others. For other reports and consultations on personal information infringement, please contact the following organizations.
A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (access), Article 36 (correction and deletion), or Article 37 (suspension of processing, etc.) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act (Central Administrative Appeals Commission 110, www.simpan.go.kr).
This Privacy Policy applies from October 14, 2026. If there are any additions, deletions, or modifications due to changes in laws, policies, or security technology, the Company will announce them through the notices on the Website at least 7 days before they take effect, and changes that significantly affect the rights of data subjects will be announced at least 30 days in advance.
View previous Privacy Policies