Privacy
Privacy Policy
MuseBlossom Inc. ("MuseBlossom," "we," or "the Company") treats personal information with care and complies with the Personal Information Protection Act (PIPA) of the Republic of Korea and other applicable laws. This policy explains what personal information we collect, why we collect it, how long we keep it, and how it is deleted.
1. Purposes of processing
We process personal information only for the purposes listed below. If a purpose changes, we will obtain your consent in advance.
- Receiving and responding to inquiries, and reviewing proposals or partnership opportunities
- Processing product demo requests, verifying the requester and their organization, and providing access to demo environments
- Delivering technical materials (such as the EU AI Act compliance guide) and related follow-up communications
- Sending quotations and proposals, and confirming details required to enter into and perform a contract
- Analyzing usage statistics and improving the quality of our website
- Preventing misuse, handling disputes, and meeting legal obligations
2. Information we collect and how
We collect personal information that you enter or submit yourself through inquiry and demo request forms. Fields marked optional are not required; you can submit an inquiry without providing them.
| Type | Items | Purpose |
|---|---|---|
| Required | Company name, contact person's name, phone number (mobile or landline), email address | Receiving and responding to the inquiry; identifying the point of contact |
| Optional | Company details (department and job title, industry, company size, website address, services under consideration and expected volume), inquiry content | Preparing consultation and proposal materials suited to the inquiry |
| Optional | Uploaded file — a copy of the business registration certificate. This document contains the trade name, business registration number, representative's name, place of business, and business type. | Verifying the existence and status of the business, assessing eligibility for a demo or contract, and preparing tax invoice issuance |
| Collected automatically | IP address, browser and device information, date and time of access, service usage records, cookies | Security and misuse prevention; usage statistics |
We do not collect sensitive information such as beliefs, trade union membership, health, or sex life, and we do not collect resident registration numbers. When submitting a business registration certificate, please upload a copy that does not display a resident registration number. If a file containing such unnecessary information is submitted, we will delete that information without delay.
3. Retention periods
We delete personal information without delay once the purpose of collection has been achieved, except where a law prescribes a specific retention period.
| Category | Retention period |
|---|---|
| Inquiry, consultation, and demo request information (company name, name, phone number, email, company details, inquiry content) | 3 years after the inquiry is closed. Deleted without delay upon your request. |
| Uploaded file (business registration certificate) | Deleted within 6 months of verification. Where a contract is concluded, retained for 5 years after the business relationship ends, as required for supporting documents under the Framework Act on National Taxes. |
| Material download records and marketing consent | Until consent is withdrawn, or up to 2 years from the last consent to receive communications. |
| Website access logs | 3 months, in line with the retention standard for communication confirmation data under the Protection of Communications Secrets Act. |
| Records of contracts, withdrawal of subscription, payment, and supply of goods | 3 to 5 years under the Act on Consumer Protection in Electronic Commerce. |
4. Disclosure to third parties
We do not disclose your personal information to third parties beyond the purposes stated in Section 1, except in the following cases:
- You have given separate prior consent
- A law specifically provides for it, or an investigative authority requests it following the procedures and methods prescribed by law
- Submission to a managing agency is necessary to carry out a government-funded program or joint R&D project in which you have applied to participate (separate consent will be obtained before submission)
5. Outsourcing of processing
We outsource part of our personal information processing as set out below. Our outsourcing agreements set out requirements for secure handling, restrictions on further subcontracting, and a prohibition on use beyond the agreed purpose, and we supervise our processors accordingly.
| Processor | Outsourced work |
|---|---|
| [Cloud infrastructure provider] | Operation and management of servers hosting the website and stored data |
| [Email delivery service] | Sending inquiry responses and notices |
| [Web analytics service] | Analysis of website usage statistics |
Replace the bracketed entries above with the actual providers in use (for example AWS, Google Workspace, Google Analytics). Any change to outsourcing arrangements will be disclosed through this policy.
6. Cross-border transfers
Personal information may be transferred outside the Republic of Korea to the extent that we use cloud and analytics services operated by overseas providers. The items transferred, destination country, recipient, timing and method of transfer, purpose of use, and retention period are as follows.
| Recipient | Country | Items transferred | Purpose and retention period |
|---|---|---|---|
| [Recipient name / contact] | [Country] | [Items] | [Purpose] / until the outsourcing agreement ends |
If no cross-border transfer actually takes place, replace this section with a single sentence: "We do not transfer personal information outside the Republic of Korea." If overseas cloud services or Google Analytics are in use, the table must be completed.
7. Deletion procedures
- Procedure — Personal information whose retention period has expired or whose purpose has been achieved is deleted with the approval of the Privacy Officer. Information that must be retained under other laws is moved to a separate database.
- Electronic files — Permanently erased by a method that prevents recovery or reconstruction. Uploaded business registration certificates are deleted together with any backup copies.
- Paper records — Shredded or incinerated.
8. Your rights and how to exercise them
You may exercise the following rights at any time:
- Request access to your personal information
- Request correction of inaccurate information
- Request deletion
- Request suspension of processing
- Withdraw consent
Requests may be submitted by email to contact@museblossom.com or by phone at +82-2-938-5007. We will act on your request within 10 days of receipt and inform you of the outcome. Requests made through a representative require a letter of authorization. Rights may be restricted where a law limits access, or where granting the request would unreasonably harm the life, body, or property interests of another person.
9. Security measures
- Administrative — An internal management plan is established and implemented; the number of staff handling personal information is kept to a minimum and they receive regular training.
- Technical — Access rights management, access control systems, encrypted storage of personal information and uploaded files, TLS for data in transit, retention and tamper-protection of access logs, and installation and updating of security software.
- Physical — Access control for server rooms and document storage areas.
10. Cookies and automated collection
We use cookies to provide tailored information and to analyze how the website is used. A cookie is a small piece of data that a website stores in your browser. You can refuse or delete cookies through your browser settings.
- Chrome — Settings > Privacy and security > Third-party cookies
- Edge — Settings > Cookies and site permissions
- Safari — Preferences > Privacy
Refusing cookies may limit the use of some features.
11. Children under 14
Our website is intended for business customers, and we do not collect personal information from children under the age of 14. If we become aware that such information has been collected, we will delete it without delay.
12. Privacy Officer and access requests
We have designated a Privacy Officer to oversee personal information processing and to handle inquiries, complaints, and remedies for data subjects.
| Role | Details |
|---|---|
| Privacy Officer | Eunsun Cho / CEO / +82-2-938-5007 / contact@museblossom.com |
Requests for access to personal information may be submitted to the team above, and we will handle them promptly.
13. Remedies for infringement
If you need advice or redress regarding a privacy infringement, you may contact the following bodies in the Republic of Korea:
- Privacy Infringement Report Center — 118 within Korea / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee — 1833-6972 / kopico.go.kr
- Supreme Prosecutors' Office, Cyber Investigation Division — 1301 within Korea / spo.go.kr
- National Police Agency, Cybercrime Reporting — 182 within Korea / ecrm.police.go.kr
If your rights or interests have been harmed by a disposition or omission of the head of a public institution in relation to a request concerning personal information, you may file an administrative appeal under the Administrative Appeals Act.
14. Changes to this policy
This Privacy Policy takes effect on the effective date below. If it is amended due to changes in law, policy, or our internal practices, we will post notice on our website at least 7 days before the change takes effect. For significant changes that are disadvantageous to users, notice will be given at least 30 days in advance.
- Date of notice: 31 July 2026
- Effective date: 31 July 2026
This English version is provided for convenience. In the event of any discrepancy, the Korean version of this Privacy Policy prevails.