Global Standard Certification Co., Ltd. (the “Company”) establishes and discloses the following privacy policy pursuant to Article 30 of the Personal Information Protection Act of Korea, in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.
① The Company processes personal information for the purposes set out below. Personal information is not used for any purpose other than those stated, and where the purpose of use changes, the Company takes the necessary measures, including obtaining separate consent as required by the applicable legislation.
| Category | Purpose of processing |
|---|---|
| Clinical study applications | Verifying participant selection criteria, notifying selection results and schedules, contacting participants during the study, and paying transport and other allowances |
| Corporate study enquiries | Receiving enquiries and assigning a contact, replying with quotations and consultations, agreeing the study design and concluding a contract |
| Website operation | Improving the service through per-screen usage statistics, and blocking abuse and automated bulk submissions |
② This website has no membership registration and no payment function. Accordingly, no login ID, password or payment method information is collected.
① The Company may process the following personal information in the course of providing its services.
| Category | Items of personal information |
|---|---|
| Clinical study application (required) | Name, contact number, gender, date of birth, area of residence, the posting applied for |
| Clinical study application (optional) | Email address, contactable hours, how you heard about us |
| Clinical study application (health-related) | Medication currently being taken, recent skin procedures — used solely to verify the inclusion and exclusion criteria |
| Corporate study enquiry (required) | Company name, contact person’s name, contact number, email address, the tests enquired about, the content of the enquiry |
| Corporate study enquiry (optional) | Business registration number, product name, preferred schedule, target claim, whether functional-cosmetic approval has been obtained, purpose of the study, attachments |
| Automatically generated and collected information | Access date and time, the address of the screen accessed, a visitor-distinguishing identifier, cookies |
② Declining to provide optional items does not restrict the acceptance of your application or enquiry.
③ The visitor-distinguishing identifier within automatically generated information is derived from the access IP address and browser information by an irreversible transformation; the Company does not store the access IP address itself.
④ Please ensure that attachments do not contain personal information. Attachments are held in storage accessible only to authorised staff.
① The Company processes and retains personal information within the retention and use period required by law or consented to by the data subject, and destroys it without delay once that period has elapsed.
| Category | Retention period | Basis |
|---|---|---|
| Clinical study application information | 3 years after the study concludes | The period consented to at the time of application |
| Corporate study enquiry information | 3 years after the enquiry is resolved | Management of consultation and contract records |
| Access logs (automatically generated information) | 90 days | Until the purposes of service improvement and abuse detection are achieved |
② Where other legislation prescribes a retention period, the information is retained for that period and destroyed once it has elapsed.
③ Access logs are deleted automatically once their retention period has elapsed.
① As a rule, the Company processes personal information only within the scope of the purposes specified in this policy, and does not provide it to third parties except with the consent of the data subject or on a statutory basis.
② Where personal information is provided to a third party, the Company informs the data subject of the recipient, the purpose of provision, the items provided, the retention and use period, and the right to refuse consent, and obtains the necessary consent in accordance with the applicable legislation.
① Where the Company entrusts the processing of personal information in order to carry out its work, it includes the matters necessary for the protection of personal information in the entrustment contract and supervises the trustee, in accordance with Article 26 of the Personal Information Protection Act.
② The trustees to which the Company currently entrusts personal information processing, and the entrusted work, are as follows.
| Trustee | Entrusted work |
|---|---|
| Supabase Inc. | Storage and management of application and enquiry information and attachments; authentication of administrator accounts |
| Plus Five Five, Inc. (Resend) | Sending acknowledgement and staff notification emails |
| Vercel Inc. | Website hosting and deployment |
③ Where a trustee or the entrusted work changes, the change is disclosed through this policy without delay.
① The Company entrusts personal information processing to overseas operators in order to run this website, and discloses the details below in accordance with Article 28-8 of the Personal Information Protection Act.
| Recipient | Country | Items transferred | Date and method of transfer | Purpose of use and retention period |
|---|---|---|---|---|
| Supabase Inc. | Japan (place of incorporation: United States) | All application and enquiry information and attachments listed in Article 2 | Transferred over the network as and when the service is used | Storage and management / until the end of the retention period in Article 3 |
| Plus Five Five, Inc. (Resend) | United States | Name, email address, contact number, content of the application or enquiry | Transferred over the network on submission | Email delivery / until the end of the log retention period under the provider’s policy |
| Vercel Inc. | United States | Access logs (automatically generated information) | Transferred over the network as and when the site is accessed | Hosting / until the end of the retention period in Article 3 |
② Data subjects may refuse the transfer of their personal information abroad. However, the transfers above are essential to operating the website and receiving applications and enquiries, so if you refuse, you will not be able to use the application and enquiry services.
③ Please direct any refusal to the contact details for the Data Protection Officer set out in Article 13.
① Where personal information becomes unnecessary — because the retention period has elapsed, the purpose of processing has been achieved, or otherwise — the Company destroys it without delay.
② Where personal information must continue to be retained under other legislation, it is stored and managed separately from other personal information.
③ Personal information for which grounds for destruction have arisen is destroyed under the responsibility of the Data Protection Officer. Electronic files are deleted by a method that prevents recovery or reproduction, and paper documents are destroyed by shredding or incineration.
① Data subjects may at any time exercise against the Company the rights provided by the applicable legislation, including access to personal information, the right to request transmission (where legally applicable), correction and deletion, suspension of processing, and withdrawal of consent.
② These rights may be exercised in writing, by email, by fax or by any other method prescribed by the applicable legislation, and the Company acts on them without delay to the extent the legislation provides.
③ Data subjects may exercise their rights through a representative, such as a legal representative or a duly authorised agent, and the Company may verify whether the person is the data subject or a legitimate representative.
④ Requests for access, correction, deletion and suspension of processing may be restricted where the applicable legislation so provides.
① The Company implements the following administrative, technical and physical measures to secure the safety of personal information.
| Category | Principal measures |
|---|---|
| Administrative | Establishing and implementing an internal management plan, minimising the number of staff who handle personal information, regular training and inspections |
| Technical | Access rights management, access control, encryption of sensitive information, operation of security software, retention of access logs and prevention of tampering |
| Physical | Secure storage of documents and portable media containing personal information, and access control to the premises |
② The specific retention period for access logs and related matters are managed in accordance with the Standards for Securing the Safety of Personal Information applicable to the Company and the actual operation of its personal information processing systems.
① The Company may use cookies and other automatic collection technologies in order to provide a more convenient service and to analyse how the service is used.
② A cookie is a small piece of information sent by a website server to the user’s browser, which may be stored on the user’s device.
③ Users may allow or block the storage of cookies in their browser settings. Menu names differ between browser versions, so please refer to the current privacy and cookie settings menu of your browser.
④ Blocking cookies may restrict the use of some services, such as staying signed in and personalised features.
① Where the Company collects and uses behavioural information such as website visit history or search history, it clearly discloses the items collected, the method and purpose of collection, the retention and use period, and how to refuse.
② The Company does not collect, for the purpose of tailored advertising, sensitive behavioural information that is likely to markedly infringe an individual’s rights, interests or privacy.
③ For children the Company knows to be under 14 years of age, it applies the protective measures required by the applicable legislation in relation to processing behavioural information for tailored advertising.
① Where the Company intends to use or provide personal information additionally without the consent of the data subject pursuant to Article 15(3) and Article 17(4) of the Personal Information Protection Act, it considers the following matters as a whole.
| Criterion | What is examined |
|---|---|
| Relevance of purpose | Whether the purpose of the additional use or provision is related to the purpose for which the information was originally collected |
| Foreseeability | Whether the additional use or provision is foreseeable in light of the circumstances of collection or established processing practice |
| Infringement of interests | Whether it unfairly infringes the interests of the data subject |
| Safety measures | Whether measures necessary to secure safety, such as pseudonymisation or encryption, have been taken |
① The Company designates the following Data Protection Officer and responsible department to take overall responsibility for personal information processing and to handle complaints and remedy damage for data subjects.
| Category | Details |
|---|---|
| Data Protection Officer | LEE EUNKYUNG · Director, GSC Anti-Aging Lab · sales3@gsckorea.co.kr |
| Responsible department | GSC Anti-Aging Lab · Contact: LEE EUNKYUNG · sales3@gsckorea.co.kr |
② Data subjects may direct enquiries, complaints and requests for remedy arising from their use of the Company’s services to the contact details above.
① Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act and related legislation to the department below.
| Category | Details |
|---|---|
| Receiving department | GSC Anti-Aging Lab |
| Contact | LEE EUNKYUNG |
| sales3@gsckorea.co.kr |
① Data subjects may apply to the following bodies for dispute resolution or consultation in order to obtain redress for infringement of personal information.
| Body | Contact · Website |
|---|---|
| Personal Information Dispute Mediation Committee | +82-1833-6972 · www.kopico.go.kr |
| Privacy Infringement Report Centre | +82-118 · privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | +82-1301 · www.spo.go.kr |
| Korean National Police Agency | +82-182 · ecrm.police.go.kr |
② These bodies are separate from the Company. For any other report or consultation concerning infringement of personal information, please refer to the current guidance published by the relevant body.
① This privacy policy applies from 5 August 2026.
② Where the content of this privacy policy changes, the changes and the date they take effect are disclosed through the website and by other means in accordance with the applicable legislation.
