Privacy policy

1. What we collect, and how

We receive only the items below. We never receive a resident registration number or any other unique identifier, and we never receive sensitive data — there is no field anywhere on the site that asks for either.

Required

Name, institution, email address, type of institution, and your message

Optional

Role, phone number and timeline — leaving these blank does not stop the form

Collected automatically

The IP address you send from, browser details, and the time of sending

Visit statistics

The address of each page you read, where you clicked, how you arrived, the kind of browser and operating system, the screen size, the country you connected from, and a recording of what you did on the page — clicks, scrolling and navigation. Characters you type into a field are masked and are not recorded.

There are two routes: filling in the inquiry form on this site, or writing to the address below. We collect personal data through no other route, and we neither buy it nor receive it from anyone else.

Visit statistics are kept apart from everything above and are never joined to a name or an email address. A random number is assigned to your browser and kept in a cookie, so returning in the same browser adds to the same record rather than starting a new one. That record holds your browser and operating system, the country you connect from, how you first arrived, and the visits you have made. It does not say who you are, and we have no way of working that out from it. The country is recorded but the address itself is not stored. Section 10 explains this, and how to switch it off.

The IP address is used to block automated repeat submissions from one source, and it appears in the notification email so whoever answers can see where an inquiry came from. If a submission is rejected, the address is also written to the server operations record, which is deleted automatically after 30 days.

2. Why we process it

What you send is used to answer inquiries about adoption, quotes and demonstrations, and to carry on the conversation and the review of your installation setting.

We do not send marketing you have not asked for, we do not use your data for anything unrelated to your inquiry, and we do not use it to build profiles or make automated decisions. If the purpose ever changes, we will ask again.

3. How long we keep it

We keep an inquiry for 3 years from the last contact about it, then erase it. Institutional procurement often runs across budget cycles and fiscal years, and this is the period that lets us pick up where we left off rather than asking you everything again.

If you ask us to erase it sooner, we do so without delay. Where another law requires us to keep something, we keep it only for the period that law sets, and erase it when the period ends.

4. Disclosure to third parties

We do not disclose personal data to third parties. We do not sell it and we do not share it for advertising.

The exception is where a law specifically requires it, or where an investigative authority requests it through the procedure a law lays down. Even then we disclose nothing beyond what is asked for.

5. Processing we entrust to others

The work below is carried out on our behalf by the providers named. Each contract carries the data-protection terms the law requires, and we supervise how each provider handles the data.

Google Workspace

Receiving, sending and holding inquiry mail

Firebase Hosting

Serving the website and holding access records

Cloud Run · Cloud Logging

Handling form submissions and holding operations records

A provider may process the data only as far as the entrusted work requires. It may not use the data for its own purposes or pass it on without our instruction. If the work or the provider changes, we will update this policy and say so.

6. Transfer outside Korea

The processing in section 5 takes place on servers outside Korea. Article 28-8(1)3(a) of the Personal Information Protection Act allows an overseas consignment made to perform a contract to be disclosed in this policy instead of consented to separately, and the disclosure follows.

Legal basis

Personal Information Protection Act Article 28-8(1)3(a) — overseas consignment and storage for performance of a contract, disclosed in this policy

Recipients

Google Asia Pacific Pte. Ltd. (Google Workspace) · Google Cloud Korea LLC (Firebase Hosting, Cloud Run, Cloud Logging)

Recipient contact

Google Workspace and Google Cloud support · 70 Pasir Panjang Road, #03-71, Mapletree Business City II, Singapore 117371

Work entrusted

The three items in section 5 — receiving, sending and holding inquiry mail; serving the website; handling form submissions

Items transferred

Everything listed in section 1, the automatically collected items included

Destination countries

Belgium, Canada, Chile, Denmark, Finland, Ireland, Japan, Mexico, the Netherlands, Singapore, Taiwan and the United States

When and how

At the moment you send an inquiry or open a page, over an encrypted connection, and thereafter in storage distributed across those countries

Purpose

Delivering and holding inquiry mail, serving the website, and handling submissions

Retention

The same as section 3 — 3 years from the last contact

How to refuse, and what it costs

See the second paragraph below.

The destination countries are the Data Center Operations entries of Google’s own published subprocessor list, read on 9 September 2026. Google commits to no single country and replicates data across several, so if that list changes this policy changes with it. The original is at workspace.google.com/terms/subprocessors.html.

If you would rather your data did not leave Korea, telephone us on +82-32-715-5978 instead of using the form. Nothing is held against you for refusing. Online submission and a reply by email are simply not available in that case.

Visit statistics also travel to a server outside Korea, so they are disclosed separately below. They are held apart from anything you send us in an inquiry, and the two are never combined.

Recipient

PostHog, Inc.

Recipient contact

privacy@posthog.com (its published privacy contact)

Work entrusted

Collecting and holding website visit statistics

Items transferred

The visit statistics listed in section 1 — page address, where you clicked, how you arrived, browser and operating system, screen size, country, the recording of what you did on the page, and the history of visits tied to the number given to your browser. No name, email address or telephone number is transferred, and typed characters are masked before anything leaves your browser.

Destination country

Germany (PostHog EU Cloud, on Amazon Web Services). The delivery path runs through Cloudflare’s worldwide edge network, so transit is not confined to one country.

When and how

At the moment you open a page, over an encrypted connection (HTTPS)

Purpose

Understanding which pages are read, so the site can be improved. Nothing else.

Retention

12 months. This is the retention period of PostHog's plan rather than a period we set, and we cannot shorten it.

How to refuse, and what it costs

Use any of the three methods in section 10 and the tool is never loaded, so no transfer takes place. Refusing changes nothing about how the site works for you.

The recipient and the destination come from PostHog’s own published subprocessor list, read on 14 September 2026. If that list changes this policy changes with it. The original is at posthog.com/subprocessors.

7. How we erase it

Once the retention period ends or the purpose is fulfilled, we erase the data without delay.

• Data held as electronic files is permanently deleted by a method that leaves it unrecoverable.
• Anything printed on paper is shredded or incinerated.
• Inquiry mail and the replies to it are erased on the same basis.

8. Your rights, and how to use them

You may exercise any of the following at any time.

• Ask to see the personal data we hold about you
• Ask us to correct anything recorded wrongly
• Ask us to erase it
• Ask us to stop processing it
• Withdraw the consent you gave

Write to the privacy officer in section 12, by letter or email, and we will act without delay and tell you the outcome. You may also act through a legal representative or an agent; if you do, please enclose the authorisation form prescribed as Form 11 of the Notice on Personal Information Processing Methods.

Requests to see, correct, erase or stop processing may be limited under Articles 35(4), 36(1) and 37(2) of the Personal Information Protection Act. Where we limit a request, we will tell you why.

9. Children under 14

The form on this site exists so that staff at an institution can ask about adopting the exhibit. We do not knowingly receive personal data from anyone under 14.

If we learn that data from a child under 14 has reached us, we erase it without delay.

10. Cookies and automatic collection

This site sets one cookie, for visit statistics. There are no advertising pixels and no social login buttons. It uses one visitor analytics tool, PostHog, to learn which pages are actually read.

Here is how it works. A random number is created the first time you arrive and kept in a cookie and in your browser’s storage. This is what changed on 16 September 2026: it used to be erased when you closed the tab, and now it stays, so returning in the same browser adds to one continuing record instead of starting again.

That record holds your browser and operating system, the country you connect from, how you first arrived, and the dates and pages of your visits. It holds no name and no email address, and the number alone gives us no way to work out who you are. It does not follow you to other companies’ sites.

The country you connect from is recorded, but the site is configured so your address itself is not stored.

From 15 September 2026 the site also records what you do on the page, so it can be played back: where you click, how far you scroll, and which page you move to next. It exists to show us which pages are hard to use.

What you type is not recorded. Characters are masked before anything leaves your browser, so this recording cannot tell us what you wrote in a form. Nothing uses your camera or microphone, and nothing is recorded except while you are looking at this site.

There are three ways to refuse. Turn on Do Not Track or Global Privacy Control in your browser and the tool is never even downloaded. Read the site in a private window and everything disappears when you close it. Or switch statistics off for this browser with the control below.

Switching off stores one thing: the fact that you switched off. It exists to remember your choice, and it holds no browsing history and no identifier. Refusing costs you nothing — the site behaves identically either way.

The access records the web server keeps are used only to run the site and look into faults. They are never combined with what an inquiry contains, nor with visit statistics.

11. How we keep it safe

The measures in place are these.

• Encryption in transit — the whole site is served over HTTPS only, with HSTS so a browser cannot fall back to plain text.
• Minimal collection — we do not ask for anything an answer does not require.
• Least access — inquiries are read only by the people who answer them.
• Automated-submission controls — repeated automated requests from one source are blocked, and a hidden field filters out scripted submissions.
• Anonymous by construction — visit records are tied only to a number given to a browser, never to a name or an email address, what you type is never recorded, and section 10 switches it off at any time.

12. Privacy officer and access requests

For any question, complaint or remedy concerning personal data, please use the details below. Requests to see your data are received and handled at the same address.

Privacy officer

백현만 (Representative Director)

Email

contact@mtechlab.co.kr

Telephone

+82-32-715-5978

Address

B1027, 119 Songdomunhwa-ro, Yeonsu-gu, Incheon, Republic of Korea (Songdo-dong, Incheon Global Campus)

We answer these ourselves rather than routing them elsewhere.

13. Where else you can turn

The bodies below handle dispute mediation, advice and reports. They are independent of us, and they are there for when you are not satisfied with how we have handled something, or want help of your own. The contact details are those published by the Personal Information Protection Commission in its policy-drafting guideline.

개인정보 분쟁조정위원회 · Personal Information Dispute Mediation Committee

1833-6972 · www.kopico.go.kr

개인정보침해 신고센터 · Privacy Infringement Report Centre (KISA)

118 · privacy.kisa.or.kr

경찰청 · Korean National Police Agency

182 · ecrm.police.go.kr

If a public authority’s action or inaction under Articles 35, 36 or 37 of the Act has harmed your rights, you may seek an administrative appeal under the Administrative Appeals Act.

14. Changes to this policy

This policy takes effect on 9 September 2026.

If a change in the law or in our own practice means something has to be added, removed or reworded, we will post the change and the date it takes effect on this page at least seven days beforehand — thirty days beforehand for a change that materially affects your rights.

Notice of this amendment. The previous policy said this site used no visitor analytics at all. From 14 September 2026 it uses the visit statistics described in sections 1, 6, 10 and 11. No cookies are set. What is collected and how long it is kept are in sections 1 and 6, and section 10 explains how to switch it off. Amended again on 15 September 2026 to switch on a recording of what you do on the page, with everything you type masked. Amended again on 16 September 2026: a cookie now keeps the visit record after you close the tab, so visits from the same browser join into one continuing record. Sections 1 and 10 describe it, and the way to switch it off is unchanged.

If you need an earlier version, ask at the address above.