1. Purposes of processing
- Identify the requester and organization
- Review regulatory inquiries and provide proposals, estimates and responses
- Confirm newsletter subscriptions, send selected-language regulatory updates and process opt-outs
- Review attachments and maintain consultation records
- Protect, troubleshoot and improve the website
- Comply with law and manage disputes
2. Information we process
- Consultation and booking details: company, contact name, business email, country or region, service interest, selected date/time, timezone, meeting format and inquiry details. The general inquiry form may also collect job title and phone number.
- Newsletter details: business email, preferred language, topics, consent wording version and request, confirmation and opt-out timestamps
- Optional: product, technical or test files submitted by the user
- Automatically generated: IP address, access time, browser/device data, request and error logs
- Consent preferences for analytics and marketing storage technologies
- Do not submit national identifiers, passport details, patient data or health information unless BCG expressly requests it through an approved secure channel.
3. Legal bases
We process information based on the consent provided with an inquiry, steps requested before entering a contract, performance of a contract, and applicable legal obligations. Optional analytics and marketing technologies are used only after consent.
4. Retention
- Inquiry details and consultation records: three years after the consultation ends, unless earlier deletion is appropriate or a longer legal hold applies
- Newsletter details: until opt-out or withdrawal. Suppression status and consent evidence are retained in a restricted form for three years after termination to prevent re-mailing and handle disputes.
- Attachments: 31 days from upload
- Security and access logs: up to 12 months
- Records required by law or for dispute management: for the applicable period
5. Disclosure
BCG does not sell personal information and does not disclose it to third parties without consent or another lawful basis. Where separate disclosure is required, we will explain the recipient, purpose, items and retention period.
6. Service providers and international processing
- Microsoft Azure: website hosting, administrator authentication, email delivery, private attachment/content storage and content-translation support
- Cloudflare: DNS, web security and delivery optimization
- Before launch, provider entities, processing countries, transfer details and retention terms will be finalized against contracts and production settings.
7. Deletion
Information is securely deleted when no longer required. Electronic records are deleted using methods designed to prevent recovery; paper records, if created, are shredded or destroyed.
8. Your rights
You may request access, correction, deletion, restriction or withdrawal of consent by contacting privacy@bcgmed.com. We may verify your identity and will respond under applicable law.
9. Security
- Role-based access restrictions
- HTTPS and private storage
- Access logging, security updates and monitoring
- Expiring, signed attachment download links
10. Privacy contact
- Team: BCG Privacy
- Email: privacy@bcgmed.com
- Phone: +82 (0)31 711 0685
- Privacy officer: [name and title to be confirmed before launch]
11. Changes
We may update this policy when services or laws change. Material changes will be announced on this website before they take effect.
12. Revision history
- October 9, 2026 Added daily unique visitor counts (a hash made with a daily-changing random value, used only in server memory), visits and bounces, country/region/city, acquisition channel and campaign tags, device/browser/OS type and browser language totals to the cookieless visit statistics Current
- October 1, 2026 Added the recording of consultation inquiries in BCG’s internal CRM (ERP) — kept for 3 years from receipt, or for the contract-record period if the inquiry leads to a contract — and their anonymisation afterwards; clarified that the website inquiry inbox also keeps inquiries for 3 years from receipt View previous version
- September 30, 2026 Added the approximate location (country, region, city) derived from the IP address when you send a consultation inquiry, with its purpose and retention · Added the acquisition source recorded with consultation and newsletter requests (first page visited, referring site’s domain, campaign tags) and the session storage item bcg_attribution View previous version
- September 28, 2026 Added consent to advertising information in the newsletter and how it is sent (‘(광고)’ subject mark, opt-out, confirmation every two years) · Added cookieless visit statistics (purpose, what is stored, 13-month retention, how to opt out) View previous version
- September 21, 2026 First published View previous version