Privacy policy

1. Purpose, retention and destruction

We process personal information to receive and answer business adoption inquiries on the basis of the data subject’s consent (Article 15(1), subparagraph 1 of the Korean Personal Information Protection Act). We do not use it for other purposes and take the necessary measures if the purpose changes.

Inquiry content and contact details: one year after the response is completed. Consent records: one year after the response is completed. Abuse-prevention logs (IP): 90 days from recording. Inquiries classified as spam: 30 days from classification.

If another law requires preservation, the information is stored separately for the required period.

Expired information is destroyed in a monthly batch, and electronic files are deleted in a way that prevents recovery. Automatic server backups rotate for seven days and are then automatically deleted.

2. Items processed and security measures

Required form input: company name (company_name), work email (work_email), contact person name (contact_name) and employee-count band (employee_band). Optional input: adoption purpose (adoption_goal). You may submit an inquiry without the optional input.

We process consent status (privacy_consent), consent version (consent_version) and the server-recorded consent time. An empty abuse-prevention field (website) and a duplicate-submission identifier are also validated. Automatic server records are limited to access IP and request time for abuse prevention; IP addresses are processed as hashes.

Only staff designated by the Company have access. Transmission is encrypted using HTTPS, server access is restricted to designated administrators and access keys, and access records are retained.

3. Exercising your rights

Data subjects, legal representatives and authorized representatives may use the contact in this policy to request access, correction, deletion, suspension of processing or withdrawal of consent. Requests are handled within 10 days of receipt. If a request is restricted by law, we explain the reason.

4. Privacy officer and contact

Privacy officer / complaint-handling department: Chief Executive Officer

Contact: keymon@blendx.co.kr

5. Third parties, sensitive and pseudonymized information

Provision to third parties: not applicable. Inquiry personal information is not provided to third parties. Entrusted processing is described separately in the next article.

Disclosure of sensitive information and processing of pseudonymized information: not applicable. The inquiry form does not request or disclose sensitive information, and pseudonymized information is not processed.

6. Entrusted processing

Entrusted processing: applicable. Amazon Web Services — inquiry server operation (Seoul region). Cloudflare — website delivery and security. No email-sending processing is entrusted.

The Company manages and supervises processors to protect personal information in the entrusted work.

7. Language preference, cookies and measurement

Language preference: applicable. Only the selected language is saved in the browser’s localStorage under xicon-language. You may delete it in browser site data or block storage; you can still open each language URL directly.

Cookies and external measurement tools: not applicable. Site code contains no cookies, external analytics SDKs or advertising trackers. Up to 200 interface events are kept only in memory, without external transmission or persistent storage. Inquiry input values are excluded from event records.

8. Overseas network routing

Overseas network routing: applicable. Inquiry content is stored on a server in Seoul, Republic of Korea. However, during website delivery and security processing, access IP and request time may pass through countries outside the Republic of Korea where Cloudflare networks are located, depending on the connection route at the time of access. Transit countries vary by route. If you do not want this web-delivery routing, you may email your inquiry to the contact in this policy instead of using the web inquiry form.

9. Processing country and domestic representative

Country of inquiry processing and storage: Republic of Korea (Seoul). Overseas website network routing is described in Article 8. A separate overseas inquiry store and appointment of a domestic representative: not applicable. Privacy requests are received through the contact in Article 4.

10. Publication, effectiveness and changes

Effective date: 2026-11-08. Version: v1.0 (initial version). This policy and the consent text are available in the footer of every language page and in the inquiry form. Changes, including the change date and version, will be posted on this page.