Privacy Policy
Privacy Policy
Effective date: June 18, 2026
This is a translation for convenience; the Korean version prevails.
Balanced DietLab Co., Ltd. (the "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other relevant laws, and carefully protects the personal information of data subjects. This policy applies to the website (balanced-diet-lab.com) operated by the Company and its related services (the "Service"), and the Company does not use personal information provided by data subjects for purposes other than those specified in this policy.
1. Items of Personal Information Collected and Collection Methods
The Company collects only the minimum personal information necessary for providing the Service, under the data subject's prior consent. This site does not operate an open membership registration process, and partner login accounts are issued only through separate consultation.
| When Collected | Items Collected | Collection Method |
|---|---|---|
| Consultation Request (Required) | Company/brand name, contact person name, phone number, email, inquiry details, consent record (whether required consent was given and the date/time and IP of consent) | Website consultation request form |
| Consultation Request (Optional) | Product category/form, expected quantity (MOQ), target market, certification requirements, attached materials | Website consultation request form |
| Partner Login | Email address, password (stored with one-way encryption), or Google account identifier, email, and profile name | Login process using a pre-issued account |
| During Service Use (Automatically collected) | Access IP address, access date/time, browser/OS/device information, cookies, service usage records (for security/operational purposes) | Web server logs, cookies |
Principle of Not Collecting Sensitive Information and Unique Identification Information: The Company does not collect any sensitive information under Article 23 of the Personal Information Protection Act (ideology, belief, health, sex life, etc.) or unique identification information under Article 24 (resident registration number, passport number, etc.).
※ The Company does not collect personal information from children under the age of 14. The Company's Service is operated for the purpose of consultation targeted at businesses (B2B).
2. Purpose and Legal Basis for Collection and Use of Personal Information
The Company processes personal information for the following purposes. The legal basis for each processing activity is Article 15(1)(1) of the Personal Information Protection Act (consent of the data subject) and item 4 (conclusion/performance of a contract), and item 6 (legitimate interest).
- Consultation/quotation response (consent-based): Reviewing product concepts, responding regarding manufacturing conditions, and providing quotations/sample information using the collected consultation information
- Contract negotiation (contract performance): Conducting follow-up meetings and contacting for the conclusion of non-disclosure agreements (NDAs) and manufacturing consignment contracts
- Login account management (contract performance): Identity verification, session maintenance, and permission management
- Service security/operation (legitimate interest): Preventing fraudulent use and automated spam, responding to security incidents, and improving service quality
- Fulfillment of legal obligations: Record retention and dispute response in accordance with relevant laws
3. Retention and Use Period of Personal Information
The Company will destroy the information without delay once the purpose of collecting and using the personal information has been achieved or the data subject has requested deletion, provided that information required to be retained under relevant laws will be stored separately for the applicable period.
- Consultation request information: 1 year after the consultation ends retained, then destroyed (until the contract end date if a contract is concluded)
- Consent records (whether required consent was given, date/time, IP): 3 years (Article 22 of the Personal Information Protection Act)
- Partner login information: until account termination (destroyed immediately upon termination)
- Access logs (IP, access records): 3 months pursuant to the Protection of Communications Secrets Act
- E-commerce related records (if applicable): 3 to 5 years pursuant to the Act on Consumer Protection in Electronic Commerce
4. Provision of Personal Information to Third Parties
The Company does not provide personal information to third parties except in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as separate consent from the data subject or special provisions of law. When third-party provision is necessary, the Company notifies the recipient, purpose, items provided, and retention period in advance and obtains separate consent.
5. Outsourcing of Personal Information Processing and Overseas Transfer
The Company outsources personal information processing as follows for the operation of the Service, and some information is transferred and stored overseas.
| Trustee | Outsourced Task | Transfer Country | Retention Period |
|---|---|---|---|
| Supabase Inc. (Lovable Cloud) | Authentication/database hosting, form data storage | United States / EU | Until termination of the outsourcing agreement |
| Google LLC | Social login authentication (when selected by the user) | United States | Until termination of the outsourcing agreement |
| Cloudflare, Inc. | CDN, web security (DDoS/bot blocking) | United States (global edge network) | Until termination of the outsourcing agreement |
Overseas Transfer Notice: Transfers to the above trustees are carried out through lawful procedures under Article 28-8 of the Personal Information Protection Act. If a data subject does not wish an overseas transfer to occur, they may refuse it by not using the consultation request form or by expressing their refusal via email to the data protection officer. In this case, some use of the Service may be restricted.
In accordance with Article 26 of the Personal Information Protection Act, outsourcing agreements specify in writing matters such as prohibition of processing personal information for purposes other than the outsourced task, security measures, restrictions on re-outsourcing, and liability for damages, and the Company supervises the trustees accordingly.
6. Rights of Data Subjects and How to Exercise Them
Data subjects may exercise the following rights regarding their personal information at any time.
- Request to view personal information
- Request for correction/deletion in case of errors, etc.
- Request to suspend processing of personal information
- Withdrawal of consent for the collection and use of personal information
Rights may be exercised by applying via the data protection officer's email below, and the Company will take action without delay (within the statutory deadline) after verifying identity.
7. Procedure and Method of Destroying Personal Information
- Electronic files: permanently deleted using methods that prevent recovery or recreation
- Printed materials/records: shredded or incinerated
Personal information for which the retention period has elapsed is destroyed within 5 days, and information retained under other laws is moved to a separate storage location and blocked from access for purposes other than preservation.
8. Measures to Ensure Security
The Company implements the following managerial, technical, and physical measures to ensure the security of personal information.
- Managerial measures: Establishment and implementation of an internal management plan, regular employee training, and minimization and separation of access rights
- Technical measures: One-way password encryption (bcrypt) storage, TLS 1.2 or higher encryption for communication sections, and database access control
- Leak prevention: Policy blocking compromised passwords (HIBP) and blocking automated bots/spam
- Access control: Retention of access records and prevention of forgery/alteration, and monitoring of unauthorized access
- Physical measures: Use of certified data center access control at trustee facilities
9. Operation and Refusal of Cookies
The Company uses only essential cookies to maintain login sessions and improve service quality, and does not use third-party cookies for advertising tracking purposes. Users can refuse cookie storage in their browser settings, but in this case, some use of the Service, such as login, may be restricted.
10. Data Protection Officer and Contact Information
- Data Protection Officer: Kyunghoon Seo (CEO)
- Email: kim@balanced-diet-lab.com
- Address: 1015, Building A, Indeogwon IT Valley, 40 Imi-ro, Uiwang-si, Gyeonggi-do, Republic of Korea
We accept inquiries regarding the exercise of rights such as viewing, correcting, deleting, and suspending the processing of personal information, as well as inquiries related to personal information processing.
11. Remedies for Infringement of Rights and Interests
You may apply to the following organizations for dispute resolution and consultation.
- Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)
- Personal Information Infringement Report Center (118, privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division (1301, www.spo.go.kr)
- National Police Agency Cyber Investigation Bureau (182, cyberbureau.police.go.kr)
12. Changes to This Policy
This policy applies from its effective date. If there are additions, deletions, or amendments to the content due to changes in laws, policies, or security technology, notice will be given through announcements starting 7 days before (or 30 days before for significant changes) the implementation of such changes.