1. Purposes of processing
- Identify the requester and organization
- Review regulatory inquiries and provide proposals, estimates and responses
- Confirm newsletter subscriptions (confirmation email), send the newsletter in the selected language, and handle preference changes and opt-outs
- Advertising information: send newsletters that include BCG services, seminars and events to those who separately consented, and confirm that consent every two years
- Review attachments and maintain consultation records
- Protect, troubleshoot and improve the website
- Comply with law and manage disputes
- Respond to consultation inquiries (routing to the right team and time zone for the inquirer’s region) and prevent misuse and spam inquiries
- Understand which routes (search, ads, AI assistants, social media and so on) lead to consultation and newsletter requests, to judge the effectiveness of advertising and content
- Respond to inquiries and manage consultations in BCG’s internal customer relationship management system (CRM, ERP)
2. Information we process
- Consultation and booking details: company, contact name, business email, country or region, service interest, selected date/time, timezone, meeting format and inquiry details. The general inquiry form may also collect job title and phone number.
- Newsletter details: business email, preferred language, topics, the privacy and advertising consent wording versions, request, confirmation and opt-out timestamps and the form used
- Optional: product, technical or test files submitted by the user
- Automatically generated: IP address, access time, browser/device data, request and error logs
- Generated when you send a consultation inquiry: the approximate location derived from your IP address (country, region, city and time zone) and your IP address with the last part masked (for example 203.0.113.x). No precise location such as latitude and longitude is collected, and the full IP address is not stored with the inquiry. A VPN or proxy can make the location inaccurate.
- Consent preferences for analytics and marketing storage technologies
- Acquisition source sent with consultation and newsletter requests: the first page visited and when, the referring site’s domain, campaign tags (utm) and the names of ad click parameters (not their values)
- Do not submit national identifiers, passport details, patient data or health information unless BCG expressly requests it through an approved secure channel.
3. Legal bases
We process information based on the consent provided with an inquiry, steps requested before entering a contract, performance of a contract, and applicable legal obligations. Optional analytics and marketing technologies are used only after consent. Advertising information is sent only with the recipient’s express prior consent under Article 50 of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection, obtained separately from other consents under Article 22 of the Personal Information Protection Act.
4. Retention
- Consultation details and handling history in the website inquiry inbox: three years from receipt
- Consultation inquiries recorded in BCG’s internal CRM (ERP): three years from receipt. If the inquiry leads to a contract, the retention period for contract records applies, to perform the contract and keep the records required by law.
- Acquisition source recorded with a consultation request: for the same period as that inquiry
- Approximate location and masked IP address recorded with a consultation inquiry: for the same period as that inquiry
- Newsletter details: until opt-out or withdrawal. Suppression status and consent evidence are retained in a restricted form for three years after termination to prevent re-mailing and handle disputes.
- Attachments: deleted automatically from the website storage 31 days after upload. The files are not sent to the internal CRM (ERP); only their name, type, size and hash value are recorded there.
- Security and access logs: up to 12 months
- Records required by law or for dispute management: for the applicable period
5. Disclosure
BCG does not sell personal information and does not disclose it to third parties without consent or another lawful basis. Where separate disclosure is required, we will explain the recipient, purpose, items and retention period.
6. Service providers and international processing
- Microsoft Azure: website hosting, administrator authentication, email delivery, private attachment/content storage, content-translation support and the infrastructure of BCG’s internal CRM (ERP)
- Cloudflare: DNS, web security and delivery optimization, and country and region information derived from the IP address
- Before launch, provider entities, processing countries, transfer details and retention terms will be finalized against contracts and production settings.
7. Recording consultation inquiries in BCG’s internal CRM (ERP)
To respond to consultation inquiries sent through this website and manage the consultation, BCG also records them in its internal customer relationship management system (CRM, ERP), which BCG operates itself.
- What is recorded: name, email, company, country (where the approximate location is recorded), inquiry language, service of interest, the inquiry message (with job title, phone number, product name and acquisition source added), the consent record (consent wording version and time), the page address of the inquiry (without search terms or query parameters), campaign tags (utm) and attachment details (file name, type, size and hash value). The attached files themselves are not sent.
- How: once an inquiry is received, the website server sends it directly over an encrypted (HTTPS) connection to a dedicated, signature-protected integration endpoint. BCG operates the internal CRM itself on Microsoft Azure in the Korea Central region; no personal information is provided to a third party in this process. Only authorised BCG staff can view it.
- Retention: three years from receipt. If the inquiry leads to a contract, the retention period for contract records applies, to perform the contract and keep the records required by law. Consultation details in the website inquiry inbox are also kept for three years from receipt.
- After the retention period: information that can identify a person, such as name, email, company and message, is removed so that the record is anonymised; only statistics such as the date of receipt and the inquiry channel remain.
- Deletion requests: even during the retention period, if you ask us to delete your information, we will verify your identity and delete or anonymise it in the website inquiry inbox and the internal CRM without delay, to the extent permitted by law. If the law requires us to keep certain information, we will tell you why and keep it separately.
8. Advertising information
- BCG emails newsletters that include BCG services, seminars and events only to people who separately agreed to receive advertising information. Contact details received through consultation inquiries or bookings are not used to send advertising information.
- Advertising emails start the subject with ‘(광고)’ (advertisement) and state the sender’s name, address, telephone number and email and how to opt out, in Korean and English.
- You can opt out or withdraw consent free of charge at any time using the link in every newsletter or by writing to privacy@bcgmed.com. When we process a consent or opt-out, we tell you the result (sender, date and outcome).
- Every two years from the date of consent we will email you to confirm it. No action is needed to keep receiving the newsletter.
- People who subscribed before this standard without consenting to advertising information are not sent the newsletter. They can subscribe again and consent to receive advertising information to resume it.
9. Cookieless visit statistics
To improve this website, BCG keeps its own visit statistics without cookies or device identifiers.
- Purpose: to understand which pages are read, from which countries, channels (search, search ads, AI services, social, email and so on) and devices visitors arrive, and which pages lead to consultation requests and newsletter signups, so that we can improve our content and site structure.
- How: BCG’s server counts visits when it delivers a page. No new cookie, local storage, device identifier or tracking script is stored or run, and no third-party analytics tool such as Google Analytics is used.
- Counting unique visitors: to count the same visitor only once a day, the first part of the IP address (the first three blocks of an IPv4 address, the first 48 bits of an IPv6 address) and the browser information (User-Agent) are turned into a one-way value (hash) together with a random value created anew every day. This value is used only in server memory — to remove duplicates within the day, to separate visits after 30 minutes without activity and for the last-30-minutes realtime view (at most 48 hours) — and the random value is discarded every day and never stored. Visits on different days or on other websites therefore cannot be linked, and a person who returns on another day is counted as a new visitor.
- What is stored: daily and hourly totals only (Korea time) — visitors, visits (a new visit starts after 30 minutes without activity), page views, visits that viewed only one page, and the total time between page views. These totals are broken down by page address (without search terms or query parameters), entry and exit page, the referring site’s domain and acquisition channel, campaign tags (utm_source, utm_medium, utm_campaign; values containing an email address or long numbers are discarded), the country, region and city estimated by Cloudflare from the IP address, device type (desktop, mobile, tablet), browser and operating system name (without versions) and browser language. Consultation requests, newsletter signup requests and requests classified as automated (bots) are also counted.
- What is not stored: IP addresses, the hash and random value above, the raw browser information, the full address of the previous page, search terms, form contents, email addresses or anything else that could identify you or reconstruct one visitor’s path. Regions and cities with fewer than three visitors are not shown in the administration screens.
- Retention: daily totals are deleted automatically after 13 months. Website security and access logs are separate from these statistics and are kept for the period stated in the Privacy Policy (Retention).
- How to opt out: if you reject ‘Analytics cookies’ or choose ‘Reject optional’ in ‘Cookie settings’ at the bottom of each page, your visits and requests are not counted and no hash is made while that choice is stored. The choice is remembered for 180 days in the bcg_consent item described in this policy; no new cookie is created for these statistics. Visits made before any choice are counted.
- Use: only authorised BCG staff can see the totals in the administration screens. They are not shared with third parties or used for advertising.
10. Acquisition source of consultation and newsletter requests
To judge the effectiveness of advertising and content, BCG records how you found this website when you send a consultation or newsletter request.
- What is recorded: when and on which page you first arrived (without search terms or query parameters), the referring site’s domain (for example google.com or chatgpt.com — never the full address or search terms), campaign tags on the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the names of ad click parameters (such as gclid — never their values) and the resulting category (for example Naver search, search ads, AI assistant, social, direct). If you arrive again through another route in the same tab, the latest route is recorded too.
- How: the information is kept only in the browser tab’s session storage (sessionStorage, item bcg_attribution); no cookie is created. It is deleted when the tab is closed and is sent to BCG only with a consultation or newsletter request.
- Use and retention: the acquisition source received with a consultation request is kept for the same period as that inquiry and used by authorised staff only to handle the inquiry and to judge advertising effectiveness. For newsletter requests it is not stored with the subscription; it is only added to daily totals.
- How to opt out: if you reject ‘Analytics cookies’ or choose ‘Reject optional’ in ‘Cookie settings’ at the bottom of each page, nothing is stored and a request carries only the domain of the site you came from immediately before the form page.
11. Deletion
Information is securely deleted when no longer required. Electronic records are deleted using methods designed to prevent recovery; paper records, if created, are shredded or destroyed. When the retention period of a consultation inquiry ends, information that can identify a person is removed so that the record is anonymised; only statistics such as the date of receipt and the inquiry channel remain. Information that must be kept under other laws is stored separately from other information and only for the required period.
12. Your rights
You may request access, correction, deletion, restriction or withdrawal of consent by contacting privacy@bcgmed.com. We may verify your identity and will respond under applicable law.
13. Security
- Role-based access restrictions
- HTTPS and private storage
- Access logging, security updates and monitoring
- Expiring, signed attachment download links
14. Privacy contact
- Team: BCG Privacy
- Email: privacy@bcgmed.com
- Phone: +82 (0)31 711 0685
- Privacy officer: [name and title to be confirmed before launch]
15. Changes
We may update this policy when services or laws change. Material changes will be announced on this website before they take effect.
16. Revision history
- October 9, 2026 Added daily unique visitor counts (a hash made with a daily-changing random value, used only in server memory), visits and bounces, country/region/city, acquisition channel and campaign tags, device/browser/OS type and browser language totals to the cookieless visit statistics Current
- October 1, 2026 Added the recording of consultation inquiries in BCG’s internal CRM (ERP) — kept for 3 years from receipt, or for the contract-record period if the inquiry leads to a contract — and their anonymisation afterwards; clarified that the website inquiry inbox also keeps inquiries for 3 years from receipt View previous version
- September 30, 2026 Added the approximate location (country, region, city) derived from the IP address when you send a consultation inquiry, with its purpose and retention · Added the acquisition source recorded with consultation and newsletter requests (first page visited, referring site’s domain, campaign tags) and the session storage item bcg_attribution View previous version
- September 28, 2026 Added consent to advertising information in the newsletter and how it is sent (‘(광고)’ subject mark, opt-out, confirmation every two years) · Added cookieless visit statistics (purpose, what is stored, 13-month retention, how to opt out) View previous version
- September 21, 2026 First published View previous version