bwave Inc. Privacy Policy
Effective Date: September 23, 2022
To protect the freedom and rights of data subjects, bwave Inc. lawfully processes and securely manages personal information in compliance with the Personal Information Protection Act and relevant laws and regulations. Accordingly, in order to inform data subjects of the procedures and standards for processing personal information pursuant to Article 30 of the Personal Information Protection Act and to ensure that related grievances can be handled swiftly and smoothly, bwave Inc. hereby establishes and discloses this Privacy Policy as follows.
Key Indicators for Personal Information Processing
Check the main text of the Privacy Policy for detailed items.
General personal information
Purpose of processing personal information
Retention period of personal information
Entrustment of processing
Grievance handling department
Table of Contents
- Purpose of Processing, Items Collected, and Retention/Use Period of Personal Information
- Processing of Personal Information of Children Under 14 Years of Age
- Entrustment of Personal Information Processing
- Destruction of Personal Information and Procedures
- Rights and Obligations of Data Subjects and Legal Representatives, and Methods for Exercising Them
- Measures to Ensure the Security of Personal Information
- Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
- Collection, Use, and Refusal of Behavioral Data
- Criteria for Determining Additional Use or Provision
- Processing of Pseudonymized Information
- Chief Privacy Officer and Requests for Access to Personal Information
- Remedies for Infringement of Rights
◾️ Purpose of Processing, Items Collected, and Retention/Use Period of Personal Information
① The items, purposes, and retention periods of the personal information processed by bwave Inc. are as follows:
| Category (Task Name) | Purpose of Processing | Items Collected | Retention and Use Period |
|---|
| Maumgyeol Assessment |
- User identification
- Preparation and dispatch of result reports
- Verification of whether the user is under 14 years of age
- Electroencephalogram (EEG) and photoplethysmogram (PPG) testing
- Brain and mental health analysis
- Preparation of statistical data for reporting to the requesting institution
|
RequiredName, gender, email address, phone number, institution requesting the assessment, affiliation, date of birth (age), Maumgyeol service analysis results and reports, measurement data (EEG and PPG measurement result data), survey data (Korean depression/anxiety questionnaire result data), data analysis results (brain health score/mental health score and analysis results for each item)
OptionalName of legal representative, legal representative's mobile phone number, specific health details (disease information/medication information/lifestyle information)
|
6 months from the date the result report is dispatched Until a request for destruction is made |
| Public Relations and Marketing |
- Notice of events and promotions
- Recommendation of products and services
- Notice of new products and services
|
RequiredEmail address
OptionalName, phone number
|
1 year from the event end date
Until consent is withdrawn
|
② The personal information processed is not used for purposes other than those specified above. In the event of a change in the processing purpose, necessary measures will be implemented, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
③ bwave Inc. processes and retains personal information within the retention and use period stipulated by law or the period agreed upon when collecting personal information from the data subject. However, in the following cases, it will be processed and retained until the relevant cause concludes:
- 1) If an investigation or inquiry is underway due to a violation of relevant laws and regulations, until the conclusion of the said investigation or inquiry.
- 2) If a credit/debt relationship remains due to website usage, until the settlement of the said credit/debt relationship.
- 3) If subject to a mandatory retention period under relevant laws and regulations, until the expiration of the said period.
- Protection of Communications Secrets Act: Website visit records (3 months)
- Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.: Records concerning identity verification (6 months))
◾️ Processing of Personal Information of Children Under 14 Years of Age
- ① When collecting personal information from a child under 14 years of age, bwave Inc. obtains the consent of a legal representative and collects the minimum personal information necessary to perform the relevant service.
- ② Furthermore, separate consent is obtained from the legal representative if the child's personal information is to be additionally collected or processed for public relations and marketing purposes.
- ③ When collecting the personal information of a child under 14 years of age, bwave Inc. may ask the child for minimal information, such as the legal representative's name and contact details, and verifies whether the lawful legal representative has consented using the following methods:
- Having the legal representative indicate their consent on the internet site where the consent details are posted, and verifying their identity through mobile phone authentication, etc.
- Other methods similar to the above, notifying the legal representative of the consent details and confirming their indication of consent.
◾️ Entrustment of Personal Information
① For smooth processing of personal information tasks, bwave Inc. entrusts personal information processing as follows:
| Entrusted Party (Trustee) | Entrusted Tasks |
|---|
| NAVER Cloud Corporation |
- Provision of service operating environment through NAVER Cloud
- Data storage
|
② When concluding an entrustment contract, bwave Inc., in accordance with Article 26 of the Personal Information Protection Act, specifies in writing matters regarding responsibilities, such as the prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and managerial protection measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages, and supervises whether the trustee processes personal information securely.
③ If the content of the entrusted tasks or the trustee changes, we will disclose it without delay through this Privacy Policy.
◾️ Destruction of Personal Information and Procedures
- ① bwave Inc. destroys personal information without delay when the information becomes unnecessary, such as upon the expiration of the retention period or achievement of the processing purpose.
- ② If personal information must continue to be preserved under other laws and regulations despite the expiration of the retention period consented to by the data subject or the achievement of the processing purpose, the relevant personal information is transferred to a separate database (DB) or preserved in a different storage location.
- ③ The procedure and method for destroying personal information are as follows:
- Destruction Procedure: Personal information that needs to be destroyed is selected and destroyed after obtaining the approval of the Chief Privacy Officer.
- Destruction Method: Personal information recorded and stored in the form of electronic files is destroyed in a way that renders the records unrecoverable, while personal information recorded and stored on paper documents is shredded or incinerated.
◾️ Rights and Obligations of Data Subjects and Legal Representatives, and Methods for Exercising Them
- ① The data subject may exercise rights against bwave Inc. at any time, such as requesting access, correction, deletion, or suspension of processing of personal information.
- ② The exercise of rights may be conducted in writing, by email, facsimile (FAX), etc., directed to the company in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and bwave Inc. will take action on this without delay.
- ③ The exercise of rights may also be done through an agent, such as the data subject's legal representative or a delegated person. In this case, a power of attorney must be submitted in accordance with Form No. 11 attached to the "Notification on Personal Information Processing Methods (No. 2020-7)."
- ④ The data subject's rights to request access and suspension of processing of personal information may be restricted under Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.
- ⑤ A request for the correction and deletion of personal information cannot be made if that personal information is specified as a collection target in other laws and regulations.
- ⑥ Upon a request for access, correction, deletion, or suspension of processing in accordance with the data subject's rights, bwave Inc. verifies whether the person making the request is the data subject or a legitimate agent.
◾️ Measures to Ensure the Security of Personal Information
bwave Inc. takes the following measures to ensure the security of personal information:
- 1) Managerial measures: Establishment and implementation of an internal management plan, operation of a dedicated organization, and regular employee training
- 2) Technical measures: Management of access rights to personal information processing systems, installation of an access control system, encryption of personal information, and installation and updating of security programs
- 3) Physical measures: Access control for computer rooms and data storage rooms, etc.
◾️ Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
bwave Inc. does not use "cookies" that store and frequently retrieve the usage information of data subjects.
◾️ Matters Concerning the Collection, Use, and Refusal of Behavioral Data
bwave Inc. does not collect, use, or provide behavioral data for online customized advertising, etc.
◾️ Processing of Pseudonymized Information
bwave Inc. processes personal information by pseudonymizing it so that specific individuals cannot be identified, for the purposes of compiling statistics, scientific research, and preserving records for public interest, as follows:
- Matters concerning the processing of pseudonymized information
| Category | Purpose of Processing | Processed Items | Retention and Use Period |
|---|
| Maumgyeol Assessment |
Development of Maumgyeol service EEG and PPG analysis models |
Gender, date of birth (age), institution requesting the assessment, Maumgyeol service analysis results and reports, measurement data (EEG and PPG measurement result data), survey data (Korean depression/anxiety questionnaire result data), data analysis results (brain health score/mental health score and analysis results for each item) |
Until the conclusion of the research |
| Maumgyeol Assessment |
Provision of test result statistical information to requesting institutions |
Gender, institution requesting the assessment, date of birth (age), Maumgyeol service analysis results and reports, data analysis results (brain health score/mental health score and analysis results for each item), affiliation |
3 years from the date the statistics are generated |
- Matters concerning the provision of pseudonymized information to third parties
| Recipient | Purpose of Provision | Provided Items | Retention and Use Period |
|---|
| Yeongdeungpo Fire Station |
Preparation and verification of statistical data |
Gender, institution requesting the assessment, date of birth (age), data analysis results (brain health score/mental health score and analysis results for each item), affiliation |
1 year from the date of receiving the statistical information |
Additionally, in accordance with Article 28-4 of the Act (Obligation to Take Security Measures for Pseudonymized Information, etc.), we take necessary technical and managerial protection measures to ensure the security of pseudonymized information, such as storing and managing it separately to prevent re-identification and keeping records of the details of its processing.
- Managerial measures: Establishment and implementation of an internal management plan, regular employee training, etc.
- Technical measures: Management of access rights to personal information processing systems, installation of an access control system, encryption of unique identifying information, and installation of security programs
◾️ Chief Privacy Officer and Requests for Access to Personal Information
- ① bwave Inc. is fully responsible for the processing of personal information and has designated a Chief Privacy Officer as follows to handle data subjects' complaints and provide damage relief related to personal information processing.
- ② Data subjects may request access to their personal information pursuant to Article 35 of the Personal Information Protection Act using the contact information below. bwave Inc. will strive to process data subjects' requests for access to personal information promptly.
| Category | Person in Charge | Contact Information |
|---|
| Chief Privacy Officer |
Position: Director
Name: Lee Se-wan |
sewan.lee@bwaveeeg.com |
| Department in Charge of Personal Information |
Department: Business Management Team |
official@bwaveeeg.com |
| Request for Access to Personal Information |
Department: Business
Management TeamPerson in Charge: Lee Se-wan |
sewan.lee@bwaveeeg.com |
③ Data subjects may direct any inquiries, complaints, or requests for damage relief related to personal information protection arising from the use of bwave Inc.'s services (or business) to the Chief Privacy Officer and the designated department. bwave Inc. will respond to and handle inquiries from data subjects without delay.
◾️ Remedies for Infringement of Rights
- ① bwave Inc. guarantees the data subject's right to informational self-determination and strives to provide consultation and damage relief for personal information infringements. If you need to file a report or require consultation, please contact the designated department.
- ② Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the KISA Personal Information Infringement Report Center, etc., to seek relief for personal information infringement. For other reports and consultations regarding personal information infringement, please contact the institutions below:
- Personal Information Dispute Mediation Committee: (No area code) 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: (No area code) 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: (No area code) 1301 (www.spo.go.kr)
- National Police Agency: (No area code) 182 (ecrm.cyber.go.kr)
③ A person who has suffered an infringement of rights or interests due to a disposition or omission by the head of a public agency in response to a request under the provisions of Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may request an administrative appeal in accordance with the Administrative Appeals Act.
- - Central Administrative Appeals Commission: (No area code) 110 (www.simpan.go.kr)
◾️ Matters Concerning Changes to the Privacy Policy
- ① This policy takes effect on September 23, 2022.