b.stage privacy policy
1. Purpose of collection and utilization of personal information
The Company processes the personal information for the following purposes. Personal information processed is not used other than the purpose specified below, and in case of a change in the specified purpose, we intend to take necessary measures, including obtaining separate consent for such changes in the purpose of utilization.
- Member management : Identifying user and verifying identity, confirmation of the intention to sign up, prevention of the abuse by a delinquent member, processing of customer requests such as complaints, conveyance of notifications, confirmation of the intention to withdraw membership
- Utilization of the Services and calculation of the fees for usage : Provision of contents, payment of service fees, sending invoices and fee collections
- Use in marketing and advertisements : Development of new services and specialization of services, conveyance of promotional information including events, provision of services and exposure to advertisements based on demographic characteristics, obtaining information on access frequency and statistics on a member's use of Services
- Management of Inquiries : Receiving business-related inquiries, such as customer inquiries and partnership proposals, and replying to processing results.
- Other : Service inquiries, verification of service validity, seamless provision of high-quality services and service tutorial contents
2. Personal information items collected and method of collection
The Company collects personal information in accordance with relevant laws as follows.
2.1 Where the consent of the data subject is not obtained
[Mandatory processing items] Applicable Act: Article 15(1)4 of the Personal Information Protection Act (performance of a contract)
| Service | Collection type | Items collected | Retention and use period |
|---|---|---|---|
| account.bstage.in | (General) Sign-up | Email, password | Upon withdrawal of membership |
| Kakao Sign-up | Kakao identification information, email | Upon withdrawal of membership | |
| Naver Sign-up | Naver identification information, email | Upon withdrawal of membership | |
| Apple Sign-up | Apple identification information, email | Upon withdrawal of membership | |
| Google Sign-up | Google identification information, email | Upon withdrawal of membership | |
| LINE Sign-up | LINE identification information, email | Upon withdrawal of membership | |
| account.bstage.in. account.mybstage.in, bstage.in | Automatically collected in the process of utilizing the Services | Usage logs, visitation logs, abusive usage logs, IP address, cookies, device information, browser, country of access | 1 year |
[Optional processing items] Applicable Act: Article 15(1)4 of the Personal Information Protection Act (performance of a contract)
| Service | Collection type | Items collected | Retention and use period |
|---|---|---|---|
| account.bstage.in | Edit profile | Profile picture | Upon withdrawal of membership or deletion |
2.2 Where the consent of the data subject is obtained
[Mandatory processing items] Applicable Act: Article 15(1)1 of the Personal Information Protection Act (consent of the data subject)
| Service | Collection type | Items collected | Retention and use period |
|---|---|---|---|
| account.mybstage.in | (General) Sign-up | Email, password, name, mobile phone number | Upon withdrawal of membership |
| (Microsoft) Sign-up | Email, MS userid, name, mobile phone number | Upon withdrawal of membership | |
| Service opening | [Non-business] (Required) Name, date of birth, country | Upon withdrawal of membership | |
| bstage.in | Service inquiry | Name, company name, email, phone number | 3 years, or upon request for deletion |
| support.bstage.in | General inquiry | Name, email | 3 years, or upon request for deletion |
| Technical support | Mobile phone number, name, email | 3 years, or upon request for deletion | |
| Request to increase marketing email sending volume | Email, name, phone number | 3 years, or upon request for deletion |
[Optional processing items] Applicable Act: Article 15(1)1 of the Personal Information Protection Act (consent of the data subject)
| Service | Collection type | Items collected | Retention and use period |
|---|---|---|---|
| account.mybstage.in | Consent to the receipt of promotional information | Upon withdrawal of consent | |
| account.bstage.in | Consent to the receipt of promotional information | Email, FCM token | Upon withdrawal of consent |
3. Duration of utilization and retention of personal information and method to destroy the personal information
In principle, the Company shall destroy the provided personal information upon fulfilling the purpose of collection or provision of the personal information thereof without delay. However, if separate consent has been obtained in continuous retention and utilization of member information, or the personal information is required to be retained under applicable law, such personal information shall be securely stored and utilized within the scope of the prescribed purpose.
The duration of retention of personal information by the Company is as follows.
- Where the period of retention and utilization has been otherwise specified in the applicable law
- Records on cancellation of contracts or subscriptions, etc.: 5 years (Article 6(1)2 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.)
- Records on payment settlement and supply of goods, etc.: 5 years (Article 6(1)3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.)
- Records on consumer complaints or dispute handling: 3 years (Article 6(1)4 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.)
- Records on labeling or advertising: 6 months (Article 6(1)1 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.)
- Books and supporting documents relating to all transactions stipulated by tax laws: 5 years (Article 85-3(2) of the Framework Act on National Taxes)
- Service access logs: 3 months (Article 15-2(2) of the Protection of Communications Secrets Act)
The Company shall destroy the information in the following methods based on how the information has been stored.
- Information printed on paper : shred with a shredder or incinerate
- Information stored in the form of electronic files : destroy through initializing or repeated overwriting to render the data irrecoverable
4. Provision of the personal information to a third party
The Company shall not provide personal information to any external party without the prior consent of a user. However, the personal information may be provided if the user provided the consent on the provision of the personal information to utilize the services from external partner companies; the Company is compelled to submit personal information as required by the applicable law, or imminent danger to the user's life or safety has been identified and provision of personal information is necessary to resolve the situation.
| Applicable service | Applicable Act | Status of provision to a third party |
|---|---|---|
| account.bstage.in | Article 17(1)1 of the Personal Information Protection Act (consent of the data subject) | Domestic Provision to a Third Party |
| Article 28-8(1)1 of the Personal Information Protection Act (consent of the data subject) | Overseas Provision to a Third Party |
5. Entrusting the processing of the personal information
The Company commissions the processing of personal information as follows to ensure smooth personal information processing.
- Subcontractor : Amazon Web Services, Inc. | Description of commissioned duties : Operation and management of cloud servers to provide the Services- Subcontractor : DHL Korea | Description of commissioned duties : International Delivery
- Subcontractor : ECMS Express Inc. | Description of commissioned duties : International Delivery Services
- Subcontractor : CJ Logistics CO., Ltd. (Dasung) | Description of commissioned duties : Domestic Delivery Services
- Subcontractor : ebut | Description of commissioned duties : WMS Service Operations
- Subcontractor : CS Sharing | Description of commissioned duties : Online Customer Support
- Subcontractor : ECLS | Description of commissioned duties : OMS Operations
The cases of transfer abroad to entrust the handling of personal information are as follows.
Applicable Act: Article 28-8(1)3(a) of the Personal Information Protection Act (disclosure of the privacy policy)
- Contact the data protection officer : [email protected]
- Country : U.S.A.
- Item of Personal Information transferred : Email, name, mobile phone number, visit record, service use information, inquiry history, purchase history
- Purpose of Transfer : Overseas customer management
- Retention and Use Period : Retained during the service period
- Date and Method of Transfer : Transfer from time to time online during the service provision process
- Contact the data protection officer : [email protected]
- Country : Japan
- Item of Personal Information transferred : Email, name, mobile phone number, visit record, service use information, inquiry history, purchase history
- Purpose of Transfer : Overseas customer management
- Retention and Use Period : Retained during the service period
- Date and Method of Transfer : Transfer from time to time online during the service provision process
- Contact the data protection officer : [email protected]
- Country : Australia
- Item of Personal Information transferred : Email, name
- Purpose of Transfer : To use the service inquiry management system
- Retention and Use Period : Retained for the duration of service use or 3 years from the date of collection
- Date and Method of Transfer : At support.bstage.in, online at the time of submitting an inquiry
- Contact the data protection officer : [email protected]
- Country : U.S.A.
- Item of Personal Information transferred : Email
- Purpose of Transfer : b.stage service information mailing service
- Retention and Use Period : Data will be retained for one month after the email is sent
- Date and Method of Transfer : Occurs when the notification email is sent
If the details of commissioned duties or the subcontractor are changed, the Company shall disclose such information through this privacy policy without delay.
6. Instructions for members and their legal representatives to exercise their rights and responsibilities
A member may exercise their right of perusal, revision, deletion and request to cease the processing of the personal information at any time.
Such rights may be exercised in writing, through email, facsimile (FAX) and other means of communications pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company shall process any related request without delay.
A member may exercise their rights through an agent, such as a legal representative or a delegated person. In such a case, a letter of attorney in the form of Attached Form No. 11 of the “Notice on the Methods of Processing Personal Information (Notice No. 2020-7)” shall be submitted.
The request to review, or cease the processing of personal information may result in the restriction on the privileges as a member, in accordance with Article 35(4) and Article 37(2) of the Personal Information Protection Act.
For the request to amend or remove the personal information, the removal shall not be requested if other applicable laws require the item of personal information to be collected.
The Company shall verify the person who tends the request to review, amendment, removal, or cessation of processing of the personal information is the requester themselves, or with a valid power of attorney.
| Department receiving and handling requests to exercise rights | Contact |
|---|---|
| Information Security Team | [email protected] |
7. Measures to secure the safety of the personal information
The Company is exercising the following measures to ensure the safety of personal information.
Managerial measures
- The Company operates a dedicated organization for information security and personal information protection.
- For the protection of personal information, the Company establishes and implements an internal management plan and provides education for personnel handling personal information at least once a year.
- In order to have its information security and personal information protection activities verified, the Company has obtained the ISO27001, ISO27701 and ISMS-P certifications.
Technical measures
- Members' passwords are encrypted using one-way encryption, and a two-factor authentication method is provided in addition to passwords.
- To provide a secure service, the Company regularly conducts penetration testing, source code reviews and vulnerability assessments.
- The Company uses a web application firewall to block attacks exploiting web vulnerabilities, and uses vaccine programs to protect the PCs of its employees.
Physical measures
- The Company designates office areas and controlled areas, and controls entry and exit so that only employees with access rights may enter.
8. Matters regarding installation and operation of the device to collect the personal information automatically and refusals
The Company uses "Cookie," that stores and frequently retrieves usage information in order to provide individual services and convenience to a data subject.
The Cookie is a minuscule piece of information that the server used to operate the website transmits to the browser of the data subject; it is stored on the computer or mobile device of the data subject and is automatically transmitted from the browser of the data subject to the server upon access to the website.
A data subject may configure settings such as the refusal of Cookies through the options of the browser.
How to block Cookies on a web browser
- Chrome: Select '‧‧‧' at the top right of the web browser > New Incognito window (shortcut: Ctrl+Shift+N)
- Edge: Select '‧‧‧' at the top right of the web browser > New InPrivate window (shortcut: Ctrl+Shift+N)
How to block Cookies on a mobile browser
- Chrome: Select '‧‧‧' at the top right of the mobile browser > New Incognito tab
- Safari: Settings on the mobile device > Apps > Safari > Advanced > Block All Cookies
- Samsung Internet: Select the 'Tabs' icon at the bottom of the mobile browser > Turn on Secret mode > Start
If the storage of Cookies is refused, difficulties may arise in utilizing personalized services.
9. Collection, Use, Provision and Refusal of Third-Party Behavioral Information
The company collects and uses online behavioral information to analyze site usage for purposes such as product and service development and customer analysis.
Behavioral information refers to online user activity data that can help identify and analyze user interests, curiosities, preferences, and tendencies, such as website visit history, app usage history, purchase records, and search history.
The company only collects the minimum behavioral information necessary for the minimum purpose of analyzing site usage, and does not collect sensitive behavioral information that may clearly infringe on individual rights, interests, or privacy, such as ideology, beliefs, family and relative relationships, education, medical history, or other social activity records. The company does not collect behavioral information from children under the age of 14 and does not provide personalized advertisements to children under the age of 14.
Behavioral information collected by third parties through the company's web and app services is as follows.
•Collection Tool Name: Google AdSense, AdMob
•Collector: Google
•Collection Tool Type: Advertising cookies, SDK
•Behavioral Information Collected : Page visit history within web/app services, usage records such as clicks, and advertising identifiers
•Purpose of Collection: Provision of personalized advertising based on user behavioral information, analysis of advertising effectiveness
Members can block or allow personalized ads collectively by adjusting their web browser's cookie settings. However, changing cookie settings may limit the use of certain services, such as automatic website login.
[Allow/Block Behavioral Data Collection]
10. The staff in charge of protection of the personal information
The Company is designating the staff in charge of protection of the personal information in the following to oversee the affairs on personal information processing, and respond to the complaints of the members and provide remedies for the infringement of a member's rights pertaining to the personal information processing. A user may direct any inquiries on the protection of personal information while using the Services offered by the Company, processing of the complaints and remedies for the infringement of rights to the officer and department responsible for personal information protection. The Company will provide a response to an inquiry of the member without delay.
- The staff in charge of protection of the personal information- Name : Jeon Jiyong
- Position : CPO
- e-mail : [email protected]
- Name of Department : Information Security Team
- e-mail : [email protected]
11. Instructions on requesting remedies for the infringement of rights
A member may request a consultation or dispute resolution to Personal Information Dispute Mediation Committee, Korea Internet & Security Agency and Personal Information Infringement Report Center to get remedies for personal information infringement. Please direct the inquiries and reports on personal information infringement to the agencies listed below.
- Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)
- Personal Information Infringement Report Center (118, privacy.kisa.or.kr)
- National Police Agency (182, ecrm.police.go.kr)
12. Children's personal Information
The company does not provide services to children under the age of 19 and does not knowingly collect or request personal information from children.
13. Revisions to Privacy Policy
- Effective Date : November 10, 2026
- Our Previous Privacy Policy may be found at the bottom of this policy.
Annex
This annex applies respectively to users residing in or having nationality in certain countries. In the event of a conflict between the following additional terms and provisions of the body of this Privacy Policy, the following terms shall control.
A. For members residing in the European Economic Community (EEA), the UK or Switzerland
If the member resides in the EEA (European Union and Iceland, Liechtenstein, Norway), the UK or Switzerland, the company transfers the member's personal information to a country outside Europe, such as Korea.
As a company headquartered in Korea, the EU Commission has determined that Korea's Personal Information Protection Act provides adequate protection in accordance with EU standards.
B. For members residing in California
The company collects and shares members' personal information described in the above privacy policy for the purpose of providing services, but does not sell personal information.
Members have the right to access and request deletion of personal information collected by the company in accordance with the CPRA. You can check how to access, manage, and delete members' personal information at the b.stage customer center (support.bstage.in) [FAQ - Accounts/Admin].
You have the right to request a list of personal information you have provided to third parties for marketing purposes during the immediately preceding calendar year and the identity of the third parties. To make such a request, please contact us at [email protected].
If you have any questions about our Privacy Policy, please email us at [email protected] or write to:
bemyfriends, Inc.
18000 Studebaker Rd # 700, Cerritos, CA 90703, USA
C. For members residing in Japan
With respect to users who use the services of the Company in certain countries or regions, the Company may share personal information between the Group Companies for the purposes listed in '1. Purpose of collection and utilization of personal information'.The Company shall take measures, such as requiring the Group Company that shares personal information to provide for matters relating to confidentiality and data protection, and accordingly establish a system for appropriately managing personal information.
The group companies of the Company and the countries to which personal information of the Company is transferred are as follows:
- bemyfriends Co., Ltd. (Republic of Korea)
- bemyfriends Inc. (U.S.A.)
- bemyfriends japan Inc. (Japan)
If you have any questions about our Privacy Policy, please email us at [email protected] or write to:
東京都港区六本木三丁目2番1号 住友不動産六本木グランドタワー 8 F株式会社bemyfriends Japan