Legal
Privacy policy
AriBnC processes only the minimum business-contact information needed for enquiries made through this website. No form on this site collects health data. What follows is the disclosure required by the Personal Information Protection Act, with its effective date and revision history.
When you send a form on this website, its content goes straight through Google Apps Script (Google LLC) into an intake record (a spreadsheet) in AriBnC's Google Workspace account, and the same content is delivered to AriBnC's business mailbox (info@aribnc.com). If sending fails, the page shows what you entered with a button that opens it in your mail program; it reaches the business mailbox when you send that email. This website stores no cookies or other data in your browser.
This policy takes effect on 2 October 2026. Any revision will be announced on this page 7 days before it takes effect (30 days before for changes that materially affect your rights). Revision history: 2 October 2026 — first version, in effect.
1. What we collect and why
Listed by the route through which it reaches us. Each form shows its consents separately, and every one starts unticked.
| Route | Items | Purpose | Retention |
|---|---|---|---|
| Enquiries, quote and consultation requests (web forms) | Company or organisation, contact name, job title, country, business email, phone, enquiry content, project details (optional), files you attach when replying to our email | Replying, preparing a quotation, assessing a possible contract | Destroyed without delay once the reply has been sent and any quotation or contract review is over (if a contract is concluded, kept for the contract term and any retention period required by law). |
| B2B ingredient access request | Company name, contact name and title, company email, business registration number, country, ingredient of interest, review stage or purpose, enquiry content, confidentiality confirmation | Verifying the business and deciding what may be sent | Destroyed without delay once the business has been verified and the material sent. |
| Job applications (by email) | Name, phone, email, education, work history, the CV and career description you send, and optional material (portfolio, certificates, publication list) | Running the process and telling you the outcome | Destroyed without delay once the selection process is over and the outcome has been notified. Kept longer only where the applicant has separately consented, and only for the period consented to. |
| Research programme — enquiry before applying | Name, institution and department, institutional email, track of interest, question | Replying to the enquiry. How to apply is set out in the call itself. | Destroyed without delay once the enquiry has been answered. |
| App waitlist | Email, market of interest, device type | A single notification at launch | Destroyed after the notification is sent, or immediately on request |
| AI research enquiries (ABCI) | Name, organisation, business email, organisation type, programme of interest, enquiry content | Replying and discussing joint research | Deleted without delay once the reply and discussion are complete. |
| Requests for certificate copies | Company name, contact name, business email, items requested, recipient and purpose | Sending the requested documents | Deleted without delay once the request has been handled and answered. |
| Promotional email (optional consent) | Name, business email | Sending regulatory updates and company news, which may be promotional | Until you withdraw consent |
| Collected automatically when you use the website | IP address, time of access, page requested, browser information (hosting server access logs) | Serving the website, security and troubleshooting | Deleted when the hosting provider's (Netlify, Inc.) log-retention period ends. |
No form collects health status, disease, medication, drinking, diet or genetic information — the liver-wellness app waitlist included. AriBnC processes personal data only for the purposes in this table and does not provide it to third parties except where Articles 17 and 18 of the Personal Information Protection Act allow, such as with your separate consent or where a law specifically requires it. We do not knowingly collect personal information from children under 14.
2. Processors and cross-border transfer
The processors and what they do are published here, and this page is updated when they change.
AriBnC entrusts the following processing to processors. (1) Google LLC — receiving web-form submissions (Google Apps Script), keeping the intake record, and handling business email and documents (Google Workspace). (2) Netlify, Inc. — hosting this website and processing the access logs this involves. Sub-processors engaged by each processor are listed by them (Google Workspace: workspace.google.com/terms/subprocessors; Netlify: netlify.com/legal/subprocessors). If a processor or the entrusted work changes, we update this section without delay.
Because of the entrustment above, personal data are transferred outside Korea (Personal Information Protection Act, Art. 28-8(1)(iii): entrustment or storage needed to conclude or perform a contract, disclosed in this policy). Recipients and contact: Google LLC (USA · https://support.google.com/cloud/contact/dpo); Netlify, Inc. (USA · privacy@netlify.com). Countries: the United States and other countries where each company operates data centres. When and how: at the moment you send a form or visit the website, over an encrypted connection (HTTPS). Items: the items listed for each form in section 1, and access logs. Recipients' purpose and retention: to perform the entrusted work above, until the retention period in section 1 ends or the processing contract ends (access logs: Netlify, Inc.'s log-retention period). How to refuse and the effect: if you do not want your data transferred abroad, contact us by phone (+82-70-7462-9418) or fax (+82-31-281-3385) instead of the forms or email, or visit us by appointment (the transfer of access logs can only be avoided by not using the website). In that case web-form submission and replies by email are not available.
Trial-participant data handled in our clinical work lives in validated systems entirely separate from this website, governed by the sponsor and site contracts and institutional review board (IRB) approval. It is outside the scope of this policy.
3. Your rights
Ask through the contact details in section 5 and we act within the period the Act sets. You may also act through an agent.
See what we hold
You can ask which of your personal data we hold and how it has been used.
Correct or delete
You can have inaccurate data corrected and unnecessary data deleted. Where a law requires us to keep something, we tell you which law.
Stop the processing
You can require processing to stop. Withdraw consent and we stop processing for that purpose and destroy what we hold.
Under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act you may exercise these rights in writing, by email or by fax, and through an agent. On receiving a request we verify that it comes from you or a properly authorised agent and then act without delay. Deletion cannot be required where another statute expressly names that personal data as something to be collected (proviso to Article 36(1)).
4. Destruction, safeguards, cookies
Personal data are destroyed without delay once the retention period ends or the purpose is met. Intake records and emails are deleted so they cannot be recovered; printed material is shredded or incinerated. Where another law requires retention, the data are kept separately, with the legal basis and items recorded.
Under Article 29 of the Personal Information Protection Act, AriBnC limits access to the intake record and the business mailbox to staff who need it for their work, and encrypts the website and form transmission (HTTPS). Personal data are not kept in personal accounts or in outside services the company has not approved.
This site uses no cookies or browser storage. There are no advertising or tracking cookies; if analytics are ever introduced, this section is updated and a consent step added before they go live.
5. Chief privacy officer and where to complain
| Item | Detail |
|---|---|
| Chief privacy officer | Co-CEOs Yunsuk Chun and Jongkyu Kim · +82-70-7462-9418 · info@aribnc.com |
| Access, correction, deletion and suspension requests | info@aribnc.com · +82-70-7462-9418 · fax +82-31-281-3385. Requests are acted on without delay. |
| Head office | 1F Cheongsol Building, 16-6 Eondong-ro 125beon-gil, Giheung-gu, Yongin-si, Gyeonggi-do, Republic of Korea |
| Dispute mediation and reporting | Personal Information Dispute Mediation Committee 1833-6972 (from within Korea) · www.kopico.go.kr — Personal Information Infringement Report Center (KISA) 118 (from within Korea) · privacy.kisa.or.kr |
| Law enforcement | Supreme Prosecutors' Office 1301 (from within Korea) · www.spo.go.kr — Korean National Police Agency Cyber Investigation Bureau 182 (from within Korea) · ecrm.police.go.kr |
Requests to access, correct, delete or suspend processing can be made through the enquiry form, by email, by phone or by fax. We verify identity and reply within the statutory period.