Privacy Policy
Effective date: September 1, 2026
This English version is provided for reference only. In the event of any discrepancy between this translation and the Korean original, the Korean version shall prevail.
In accordance with Article 30 of the Personal Information Protection Act (“PIPA”), VETEC Co., Ltd. (“VETEC,” “we,” or “us”) establishes and discloses this Privacy Policy as follows to protect your personal information and to handle related grievances promptly and smoothly.
This Policy applies to the Refinery website (https://refinery.kr) that we operate and the Refinery service that we provide. However, where data that a customer has entered into or connected to the Refinery service contains personal information, the customer is the personal information controller for that personal information and we act as a person entrusted with its processing, so Section 10 below applies.
1. Purposes of processing personal information
We process personal information for the following purposes. If a purpose changes, we will take necessary measures, such as obtaining separate consent in accordance with Article 18 of PIPA.
| Category | Purpose of processing | Consent required |
|---|---|---|
| Inquiries and demo requests | Reviewing and responding to inquiries; consultations and technical reviews; and coordinating schedules for demos and proposals | Required (consent to collection and use when you submit the contact form) |
| Conclusion and performance of contracts | Quotation and contract negotiations, conclusion and performance of contracts, billing and settlement, issuance of tax invoices, and customer support | Not required (necessary to conclude or perform a contract, Article 15 (1) 4 of PIPA) |
| Service operation | Account creation and management, identity verification, permission management, prevention of unauthorized use, response to service failures, and retention of access logs | Not required (performance of contracts and compliance with legal obligations) |
| Usage analysis and improvement | Analysis of website usage statistics, and improvement of content and usability | Required (only if you consent in the cookie banner) |
| Marketing and newsletters | Transmitting advertising information for profit, such as sending materials and announcing seminars and webinars | Required (prior consent under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection) |
| Compliance with legal obligations | Complying with retention obligations under relevant laws, such as tax laws and the Electronic Financial Transactions Act, and responding to disputes | Not required |
2. Items of personal information processed
A. Inquiries and demo requests (entered directly by you)
- Required: Company name, name, email address, phone number
- Optional: Job title, industry, inquiry details
Please do not enter sensitive information or personally identifiable information, such as resident registration numbers or health information, in the inquiry field. We do not collect such information; if it is entered, we will destroy it immediately upon discovery.
B. Conclusion of contracts and use of the service
- Customer’s contact person: Affiliation and department, name, position, email address, phone number
- Account information: Account ID (email), password (stored encrypted), permission level
- Contract and settlement information: Details stated in contracts and purchase orders, and tax invoice information (business registration number and the contact person’s phone number)
C. Information automatically generated and collected while you use the service
- Access IP address, access date and time, service usage records, requested URL, and referrer (traffic source)
- Browser type and version, operating system, device type, screen resolution, and language settings
- Random identifiers generated by cookies and similar technologies
- Only if you consent: Interaction records such as page navigation, clicks, and scrolls, and on-screen interaction records (session replay)
Analytics cookies (Google Analytics and Mixpanel) are activated only if you select “Accept all” in the consent banner shown on your first visit.
For details, please see our Cookie Policy.
D. Personal information collected from sources other than you
We may collect participants’ affiliations, names, positions, phone numbers, and email addresses through the business cards and registration forms they submit directly at offline events such as exhibitions and seminars. In this case, in accordance with Article 20 of PIPA, we will notify you of the source of collection and the purpose of processing without delay upon your request.
3. Processing of personal information of children under 14
Our website and service are intended for business-to-business (B2B) transactions and are not directed at children under the age of 14. We do not collect personal information of children under 14, and if we become aware that such information has been collected, we will destroy it without delay.
4. Processing and retention periods
We process and retain personal information within the retention and use period prescribed by law or the retention and use period to which you have consented.
| Category | Retention period | Legal basis |
|---|---|---|
| Records of inquiries and demo requests | 3 years after the inquiry is resolved (to manage business inquiry history and respond to disputes) | Consent |
| Records related to contracts and transactions | 5 years after the contract ends | Article 33 of the Commercial Act; Article 85-3 of the Framework Act on National Taxes |
| Records of payments and supply of goods | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce |
| Records of consumer complaints and dispute resolution | 3 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce |
| Service access records (login records) | At least 1 year (at least 2 years if personally identifiable information or sensitive information is processed) | Article 8 of the Standards for Measures to Secure the Safety of Personal Information (「개인정보의 안전성 확보조치 기준」) |
| Account information | Destroyed within 30 days after the contract ends (grace period for data export) | Contract |
| Records of consent to receive marketing | Until consent to receive marketing is withdrawn | Consent |
| Information collected by analytics tools | Google Analytics: 14 months; Mixpanel: 12 months; session replay: 30 days | Consent |
We do not operate a separate dormant account policy (separate storage of inactive users’ data), and we destroy personal information without delay once the above retention periods expire.
5. Procedures and methods for destroying personal information
When personal information is no longer needed, such as when its retention period expires or the purpose of processing has been achieved, we destroy it without delay (within 5 days unless there is a justifiable reason).
- Destruction procedure: We select personal information for which a reason for destruction has arisen and destroy it with the approval of the privacy officer.
- Destruction method: Electronic files are permanently deleted using methods that make restoration impossible, and paper documents are shredded or incinerated.
- Where preservation is required: Personal information that must be preserved under other laws is kept in a separate database or a different storage location and is not used for any purpose other than preservation.
6. Provision of personal information to third parties
We process your personal information only within the scope specified in Section 1, and we provide personal information to third parties only in cases falling under Articles 17 and 18 of PIPA, such as with your separate consent or where specially provided by law.
We do not currently provide personal information to any third party on a regular basis.
The persons entrusted listed in Section 8 below receive personal information in order to perform work on our behalf; this entrustment is distinct from provision to third parties.
7. Criteria for additional use and provision
In accordance with Article 15 (3) and Article 17 (4) of PIPA and Article 14-2 of the Enforcement Decree of the same Act, we may additionally use or provide personal information without your consent after considering all of the following:
- Whether it is related to the original purpose of collection
- Whether the additional use or provision is foreseeable in light of the circumstances of collection or processing practices
- Whether it unfairly infringes on your interests
- Whether measures necessary to ensure safety, such as pseudonymization or encryption, have been taken
8. Entrustment of personal information processing
To provide our services smoothly, we entrust the processing of personal information as follows.
| Person entrusted | Entrusted work | Consent required | Privacy policy |
|---|---|---|---|
| Vercel Inc. | Website hosting and CDN operation; traffic and performance measurement (no cookies) | Not required | View |
| Web3Forms (Rifat Erdem Sahin) | Transmission of inquiry and demo request form data, and email delivery | Not required | View |
| Google LLC | Analysis of website usage statistics via Google Analytics | Only with consent | View |
| Mixpanel, Inc. | Analysis of product and content usage behavior; session replay and heatmap recording | Only with consent | View |
When concluding entrustment contracts, we specify in writing, in accordance with Article 26 of PIPA, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of persons entrusted, and liability such as compensation for damages. We also supervise whether persons entrusted process personal information safely. If the details of the entrusted work or the persons entrusted change, we will disclose the change through this Policy without delay.
9. Cross-border transfer of personal information
To provide our services smoothly, we transfer personal information across borders as follows. The legal basis differs by recipient:
- Vercel Inc. and Web3Forms: Article 28-8 (1) 3 (a) of PIPA (entrustment and retention necessary to conclude and perform a contract, with the matters in the subparagraphs of paragraph (2) of the same Article disclosed in this Privacy Policy)
- Google LLC and Mixpanel, Inc.: Paragraph (1) 1 of the same Article (separate consent of the data subject). These transfers take place only if you consent to analytics cookies, and we inform you of the matters in the subparagraphs of paragraph (2) of the same Article through the table below in this Privacy Policy, which is linked from the consent banner (items transferred; destination country, date, and method of transfer; recipient; purpose of use and retention period; and how to refuse).
| Recipient (contact) | Country | Date and method of transfer | Items transferred | Purpose of use and retention period |
|---|---|---|---|---|
| Vercel Inc. privacy@ | United States | When you access the website, via network transmission (TLS-encrypted) | Access IP address, access date and time, requested URL, and browser and device information | Website hosting, CDN operation, and traffic and performance measurement / Until the entrustment contract ends or Vercel’s log retention period expires |
| Web3Forms support@ | United States | When you submit the contact form, via network transmission (TLS-encrypted) | Company name, name, email address, phone number, job title, industry, and inquiry details | Forwarding inquiry details by email / Destroyed without delay after forwarding is complete |
| Google LLC https:// | United States and other countries where Google data centers are located | When you use the website after consenting to analytics cookies, via network transmission | Cookie identifiers, access IP address (partially truncated), pages visited, and browser and device information | Analysis of website usage statistics / 14 months |
| Mixpanel, Inc. privacy@ | United States | When you use the website after consenting to analytics cookies, via network transmission | Random identifiers, pages visited, interaction records such as clicks and scrolls, on-screen interaction records (with input values masked), and browser and device information | Analysis of usage behavior and improvement of usability / 12 months |
Method and procedure for refusing the transfer, and the effect of refusal
- Analytics tools (Google Analytics and Mixpanel): You can select “Reject all” in the cookie consent banner shown on your first visit, or withdraw consent at any time via “Cookie Settings” in the footer. Refusing does not restrict your use of the website in any way.
- Hosting (Vercel) and contact form (Web3Forms): As these are entrustments essential to providing the service, it is difficult to refuse them individually. If you wish to refuse, please stop using the website or submitting the contact form, or contact us by phone or email using the contact details in Section 18 below. In that case, submitting inquiries through the form may be restricted.
When transferring personal information across borders, we take safety measures such as encryption in accordance with Article 28-8 (4) of PIPA, and if a recipient re-transfers personal information to a third country, we will verify this and reflect it in this Policy.
10. Personal information in Customer Data (our status as a person entrusted)
Equipment, process, and operational data that customers connect to or enter into the Refinery service (“Customer Data”) may contain personal information of customers’ employees. In this case, because the customer determines the purposes and methods of processing, the customer is the personal information controller and we are the person entrusted.
- We process Customer Data only within the scope of the purposes set out in the contract with the customer and the personal information entrustment contract.
- Customer Data in a form that can identify a customer or an individual is not used for our marketing, and is not used to train artificial intelligence models. However, we may use information that has been anonymized and aggregated so that individual customers or individuals cannot be re-identified (information that does not constitute personal information, such as equipment specifications, power and efficiency indicators, and operation and improvement history) for service improvement and research.
- Requests from data subjects for access to, correction or erasure of, or suspension of processing of personal information contained in Customer Data are handled by the customer as the personal information controller. If we receive such a request directly, we will forward it to the customer without delay.
- We do not provide Customer Data to third parties without the customer’s instructions.
11. Measures to ensure the safety of personal information
In accordance with Article 29 of PIPA and Article 30 of the Enforcement Decree of the same Act, we take the following measures to ensure safety.
- Managerial measures: Establishing and implementing an internal management plan, minimizing the number of persons who handle personal information and training them regularly, and maintaining an access permission management log
- Technical measures: Differentiated granting and regular review of access permissions to personal information processing systems, operation of intrusion prevention and detection systems, encrypted storage of personally identifiable information and passwords, TLS encryption in transit, retention of access logs and prevention of their forgery or alteration, and installation and updating of security programs
- Physical measures: Access control for places where personal information is stored, such as computer rooms and data storage rooms
12. Possibility of disclosure of sensitive information and how to choose non-disclosure
We do not process sensitive information and do not provide any service in which your sensitive information could be disclosed.
13. Processing of pseudonymized information
We currently do not pseudonymize personal information for purposes such as compiling statistics, scientific research, or archiving in the public interest. If we do so in the future, we will revise this Policy to disclose the purposes and items of processing, the retention period, and matters regarding provision to third parties.
Separately, Section 10 and the Terms of Service govern cases in which we anonymize and aggregate Customer Data that does not constitute personal information, such as equipment specifications and power and efficiency data, so that individual customers or equipment cannot be re-identified, and use it for service improvement and research.
14. Installation and operation of automatic collection tools for personal information, and the denial thereof
We use automatic collection tools such as cookies and local storage (localStorage) to provide you with individually tailored services and to analyze usage.
- Essential: Storing cookie consent status (
cookie_consent) and language selection (lang)
These are used without consent because they are required for the site’s basic functions. If you block them in your browser settings, your choices will not be saved and the banner may be shown repeatedly. - Analytics: Cookies and local storage set by Google Analytics and Mixpanel
These are installed and operated only if you consent. - How to refuse: (1) Select “Reject all” in the cookie banner; (2) change your choice at any time via “Cookie Settings” in the footer; (3) refuse or delete cookies in your browser settings
Detailed paths for each browser are provided in our Cookie Policy.
15. Collection, use, and refusal of behavioral information
We do not provide personalized advertising to you, and we do not allow third-party advertising companies to collect behavioral information on this website. However, we process behavioral information as follows to improve our service.
| Whether you are identified | We do not combine behavioral information with account identifiers or login information, and we process it only on the basis of random identifiers stored in your browser. |
|---|---|
| Items collected | Pages visited and the order of visits, time spent, interaction records such as clicks and scrolls, on-screen interaction records (session replay), traffic sources, and browser, device, and operating system information |
| Collection method | Automatically collected through cookies, local storage, and JavaScript SDKs when you visit the website after consenting to analytics cookies |
| Purpose of collection | Used only to analyze service usage and improve content and usability, and not used for personalized advertising. |
| Retention and use period | Google Analytics: 14 months; Mixpanel: 12 months; session replay: 30 days. The information is destroyed once these periods expire. |
| Method and procedure for refusal | Select “Reject all” in the cookie banner, withdraw consent via “Cookie Settings” in the footer, block or delete cookies in your browser, or install the Google Analytics Opt-out Browser Add-on |
Session replay is a feature that reproduces your on-screen interactions. We have configured it to mask all input values so that what you enter in the contact form, such as your name, email address, and phone number, is not recorded.
16. Rights and obligations of data subjects and legal representatives, and how to exercise them
You may exercise the following rights against us at any time:
- Request access to your personal information (Article 35 of PIPA)
- Request correction or erasure of your personal information if it contains errors, etc. (Article 36)
- Request suspension of processing of your personal information (Article 37)
- Request transmission of your personal information (Article 35-2, once it takes effect)
- The right to withdraw consent
- The right to refuse, or request an explanation of, automated decisions (Article 37-2; see Section 17 below)
You may exercise these rights in writing, by phone, or by email using the contact details in Section 18 below, and we will take action without delay (within 10 days). If you request correction or erasure because your personal information contains errors, etc., we will not use or provide that personal information until the correction or erasure is complete.
You may exercise your rights through an agent, such as a legal representative or a person you have authorized. In this case, a power of attorney in the form of Annex Form No. 11 of the Notice on Methods of Processing Personal Information (「개인정보 처리 방법에 관한 고시」) must be submitted.
However, the exercise of rights may be restricted in cases falling under Article 35 (4), the proviso to Article 36 (1), or Article 37 (2) of PIPA, such as where other laws specify the personal information as subject to collection, and we will inform you of the reason.
17. Automated decisions
We do not make completely automated decisions (including decisions made by a system to which artificial intelligence technologies are applied) that have a significant effect on your rights or obligations.
The Refinery service performs anomaly detection, forecasting, and optimization analysis on equipment and process data, but the subject of this analysis is data on equipment and processes, and the service does not evaluate or make decisions about individuals. In addition, we do not use the following to train artificial intelligence models: inquiry details; contract information; and any Customer Data that can identify a customer or an individual (the use of anonymized and aggregated information for service improvement and research is governed by Section 10).
If we introduce automated decisions about individuals in the future, we will disclose in advance through this Policy that fact, its purpose and scope, the main types of personal information used and their relationship to the decision, the processing procedure, and the method and procedure for refusing or requesting an explanation.
18. Privacy officer and grievance-handling department
We have designated a privacy officer as follows to take overall responsibility for the processing of personal information and to handle your complaints, remedy damages, and address similar matters related to the processing of personal information.
| Category | Name | Title | Phone | |
|---|---|---|---|---|
| Privacy officer | HS Yoon | Head of Group | +82-42-935-3721 | info@vetec.co.kr |
You may contact the privacy officer about any personal information protection inquiries, complaints, remedies for damages, or other related matters arising from your use of our services. We will respond to and handle your inquiries without delay.
19. Department receiving and processing access requests
You may submit a request for access to personal information under Article 35 of PIPA to the department below. We will endeavor to process your request promptly.
| Contact person | Phone | |
|---|---|---|
| HS Yoon, Head of Group | +82-42-935-3721 | info@vetec.co.kr |
20. Remedies for infringement of data subjects’ rights and interests
To obtain remedies for infringement of your personal information, you may apply to the agencies below for dispute resolution, consultation, and other assistance. Please use them if a personal information dispute with us is not resolved amicably.
| Agency | Phone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 (no area code needed) | www.kopico.go.kr |
| Personal Information Infringement Report Call Center (KISA) | 118 (no area code needed) | privacy.kisa.or.kr |
| Cyber and Technology Crime Investigation Division, Supreme Prosecutors’ Office | 1301 (no area code needed) | www.spo.go.kr |
| Electronic Cybercrime Report & Management System (ECRM), Korean National Police Agency | 182 (no area code needed) | ecrm.police.go.kr |
21. Operation and management of visual data processing devices
We do not operate fixed or mobile visual data processing devices in connection with the website and service to which this Policy applies.
22. Changes to this Privacy Policy
This Privacy Policy is effective as of September 1, 2026. If content is added, deleted, or modified due to changes in laws, policies, or security technologies, we will give notice through website announcements starting 7 days before the changes take effect (30 days before, for changes unfavorable to you).
The current Policy was announced on September 1, 2026 and is effective as of September 1, 2026. The revision history is as follows.
| Effective date | Summary of changes | Full text |
|---|---|---|
| September 1, 2026 | Initial version | Current |
Previous versions that have not yet been archived are available upon request at info@vetec.co.kr.
Business information
- Company name
- VETEC Co., Ltd.
- Representative
- YJ Choi
- Address
- 24, Techno 3-ro, Yuseong-gu, Daejeon, Korea
- info@vetec.co.kr
- Tel
- +82-42-935-3721
- Business registration number
- 130-81-49638
- Hosting service provider
- Vercel Inc.