1. Purposes of processing
- Identify the requester and organization
- Review regulatory inquiries and provide proposals, estimates and responses
- Confirm newsletter subscriptions (confirmation email), send the newsletter in the selected language, and handle preference changes and opt-outs
- Advertising information: send newsletters that include BCG services, seminars and events to those who separately consented, and confirm that consent every two years
- Review attachments and maintain consultation records
- Protect, troubleshoot and improve the website
- Comply with law and manage disputes
- Respond to consultation inquiries (routing to the right team and time zone for the inquirer’s region) and prevent misuse and spam inquiries
- Understand which routes (search, ads, AI assistants, social media and so on) lead to consultation and newsletter requests, to judge the effectiveness of advertising and content
2. Information we process
- Consultation and booking details: company, contact name, business email, country or region, service interest, selected date/time, timezone, meeting format and inquiry details. The general inquiry form may also collect job title and phone number.
- Newsletter details: business email, preferred language, topics, the privacy and advertising consent wording versions, request, confirmation and opt-out timestamps and the form used
- Optional: product, technical or test files submitted by the user
- Automatically generated: IP address, access time, browser/device data, request and error logs
- Generated when you send a consultation inquiry: the approximate location derived from your IP address (country, region, city and time zone) and your IP address with the last part masked (for example 203.0.113.x). No precise location such as latitude and longitude is collected, and the full IP address is not stored with the inquiry. A VPN or proxy can make the location inaccurate.
- Consent preferences for analytics and marketing storage technologies
- Acquisition source sent with consultation and newsletter requests: the first page visited and when, the referring site’s domain, campaign tags (utm) and the names of ad click parameters (not their values)
- Do not submit national identifiers, passport details, patient data or health information unless BCG expressly requests it through an approved secure channel.
3. Legal bases
We process information based on the consent provided with an inquiry, steps requested before entering a contract, performance of a contract, and applicable legal obligations. Optional analytics and marketing technologies are used only after consent. Advertising information is sent only with the recipient’s express prior consent under Article 50 of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection, obtained separately from other consents under Article 22 of the Personal Information Protection Act.
4. Retention
- Inquiry details and consultation records: three years after the consultation ends, unless earlier deletion is appropriate or a longer legal hold applies
- Acquisition source recorded with a consultation request: for the same period as that inquiry
- Approximate location and masked IP address recorded with a consultation inquiry: for the same period as that inquiry
- Newsletter details: until opt-out or withdrawal. Suppression status and consent evidence are retained in a restricted form for three years after termination to prevent re-mailing and handle disputes.
- Attachments: 31 days from upload
- Security and access logs: up to 12 months
- Records required by law or for dispute management: for the applicable period
5. Disclosure
BCG does not sell personal information and does not disclose it to third parties without consent or another lawful basis. Where separate disclosure is required, we will explain the recipient, purpose, items and retention period.
6. Service providers and international processing
- Microsoft Azure: website hosting, administrator authentication, email delivery, private attachment/content storage and content-translation support
- Cloudflare: DNS, web security and delivery optimization, and country and region information derived from the IP address
- Before launch, provider entities, processing countries, transfer details and retention terms will be finalized against contracts and production settings.
7. Advertising information
- BCG emails newsletters that include BCG services, seminars and events only to people who separately agreed to receive advertising information. Contact details received through consultation inquiries or bookings are not used to send advertising information.
- Advertising emails start the subject with ‘(광고)’ (advertisement) and state the sender’s name, address, telephone number and email and how to opt out, in Korean and English.
- You can opt out or withdraw consent free of charge at any time using the link in every newsletter or by writing to privacy@bcgmed.com. When we process a consent or opt-out, we tell you the result (sender, date and outcome).
- Every two years from the date of consent we will email you to confirm it. No action is needed to keep receiving the newsletter.
- People who subscribed before this standard without consenting to advertising information are not sent the newsletter. They can subscribe again and consent to receive advertising information to resume it.
8. Cookieless visit statistics
To improve this website, BCG keeps its own visit statistics without cookies or device identifiers.
- Purpose: to understand which pages are read and which lead to consultation requests and newsletter signups, so that we can improve our content and site structure.
- How: BCG’s server counts visits when it delivers a page. No new cookie, local storage, device identifier or tracking script is stored or run, and no third-party analytics tool such as Google Analytics is used.
- What is stored: daily totals only (Korea time) — views per page address (without search terms or query parameters), the referring site’s domain (for example google.com or naver.com) or ‘direct’, the number of visits to the consultation page, consultation requests and newsletter signup requests, and the number of requests classified as automated (bots).
- What is not stored: IP addresses, browser or device details, the full address of the previous page, search terms, form contents, email addresses or anything else that could identify you or tell visitors apart. The browser type and previous page used to classify a request are discarded as soon as the totals are added.
- Retention: daily totals are deleted automatically after 13 months. Website security and access logs are separate from these statistics and are kept for the period stated in the Privacy Policy (Retention).
- How to opt out: if you reject ‘Analytics cookies’ or choose ‘Reject optional’ in ‘Cookie settings’ at the bottom of each page, your visits and requests are not counted while that choice is stored. The choice is remembered for 180 days in the bcg_consent item described in this policy; no new cookie is created for these statistics. Visits made before any choice are counted.
- Use: only authorised BCG staff can see the totals in the administration screens. They are not shared with third parties or used for advertising.
9. Acquisition source of consultation and newsletter requests
To judge the effectiveness of advertising and content, BCG records how you found this website when you send a consultation or newsletter request.
- What is recorded: when and on which page you first arrived (without search terms or query parameters), the referring site’s domain (for example google.com or chatgpt.com — never the full address or search terms), campaign tags on the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the names of ad click parameters (such as gclid — never their values) and the resulting category (for example Naver search, search ads, AI assistant, social, direct). If you arrive again through another route in the same tab, the latest route is recorded too.
- How: the information is kept only in the browser tab’s session storage (sessionStorage, item bcg_attribution); no cookie is created. It is deleted when the tab is closed and is sent to BCG only with a consultation or newsletter request.
- Use and retention: the acquisition source received with a consultation request is kept for the same period as that inquiry and used by authorised staff only to handle the inquiry and to judge advertising effectiveness. For newsletter requests it is not stored with the subscription; it is only added to daily totals.
- How to opt out: if you reject ‘Analytics cookies’ or choose ‘Reject optional’ in ‘Cookie settings’ at the bottom of each page, nothing is stored and a request carries only the domain of the site you came from immediately before the form page.
10. Deletion
Information is securely deleted when no longer required. Electronic records are deleted using methods designed to prevent recovery; paper records, if created, are shredded or destroyed.
11. Your rights
You may request access, correction, deletion, restriction or withdrawal of consent by contacting privacy@bcgmed.com. We may verify your identity and will respond under applicable law.
12. Security
- Role-based access restrictions
- HTTPS and private storage
- Access logging, security updates and monitoring
- Expiring, signed attachment download links
13. Privacy contact
- Team: BCG Privacy
- Email: privacy@bcgmed.com
- Phone: +82 (0)31 711 0685
- Privacy officer: [name and title to be confirmed before launch]
14. Changes
We may update this policy when services or laws change. Material changes will be announced on this website before they take effect.
15. Revision history
- October 9, 2026 Added daily unique visitor counts (a hash made with a daily-changing random value, used only in server memory), visits and bounces, country/region/city, acquisition channel and campaign tags, device/browser/OS type and browser language totals to the cookieless visit statistics Current
- October 1, 2026 Added the recording of consultation inquiries in BCG’s internal CRM (ERP) — kept for 3 years from receipt, or for the contract-record period if the inquiry leads to a contract — and their anonymisation afterwards; clarified that the website inquiry inbox also keeps inquiries for 3 years from receipt View previous version
- September 30, 2026 Added the approximate location (country, region, city) derived from the IP address when you send a consultation inquiry, with its purpose and retention · Added the acquisition source recorded with consultation and newsletter requests (first page visited, referring site’s domain, campaign tags) and the session storage item bcg_attribution View previous version
- September 28, 2026 Added consent to advertising information in the newsletter and how it is sent (‘(광고)’ subject mark, opt-out, confirmation every two years) · Added cookieless visit statistics (purpose, what is stored, 13-month retention, how to opt out) View previous version
- September 21, 2026 First published View previous version