Legal
Under the Personal Information Protection Act, LAB.CO explains why it processes personal information, how long it keeps it, when it shares, entrusts, or transfers it overseas, and how individuals may exercise their rights.
Controller: LAB.CO
Representative and privacy contact: Keunhye Yoon
Address: 2F, 15 Seocho-daero 53-gil, Seocho-gu, Seoul, Republic of Korea
Telephone: +82 2 555 0858
Email: team@labdotco.org
Effective date: September 29, 2026
Document version: 2026-09-29-r1
1. This Policy applies to personal information the Company handles through the LAB.CO website, telephone, email and Channel Talk consultations, and related operations.
2. The website does not currently provide a separate web inquiry form or class application, booking or payment function. If an independent provider collects information on its own page and in its own name, that provider’s privacy notice applies. This Policy applies once the Company receives information for its own consultation or Service delivery.
3. The Company processes personal information only as needed for its purposes. It does not use it for another purpose or disclose it to a third party without a lawful basis, and it does not sell personal information.
1. Current consultations: a name or alias, telephone number, email, message, attachments, time and consultation record that a user provides by telephone, email or Channel Talk. The actual fields depend on the contact method and information the user chooses to provide.
2. Automatically generated information: access time, pages visited and referral source, browser, device, operating system, country and network information, cookies or browser identifiers, and service and security logs. Cloudflare may process the IP address when routing and securing a web request.
3. If the Company later provides a web inquiry or external form, it may collect the name, email, inquirer type, message, optional telephone number, privacy and optional marketing choices, submission time, receipt number and other fields disclosed on that form.
4. If institutional discussions or a separate program proceed, the Company may process the contact name, organization, role, contact details, quotation, contract, billing and operational correspondence under a separate notice and applicable law.
5. The Company receives information directly by entry, call or email; from an authorized guardian or organization; through an external form; and from records automatically generated when the Services are used.
1. To receive, verify and answer consultations and inquiries; identify the inquirer; and maintain follow-up and response records. Depending on applicable law, the bases are consent, steps requested before a contract and legitimate interests in operating an inquiry service.
2. To plan and administer institutional discussions or separate programs, manage a contract, and resolve disputes. The bases are entering into and performing a contract, legal obligations, and separate consent where needed.
3. To provide and secure the website, prevent abuse, diagnose faults, establish legal claims and respond to rights requests. The bases are legitimate interests in security and legal compliance.
4. To analyze and improve use of the Services under any notice, consent or other lawful basis required by applicable law.
5. To send news and promotions only with opt-in consent or another exception expressly permitted by applicable law. A recipient may object at any time.
6. Before using personal information for an incompatible new purpose, the Company identifies another valid basis and provides any notice or consent required by law.
1. Inquiry and consultation records are retained for one year after the consultation is completed. They may be retained longer when needed for an ongoing consultation, contract, dispute, or legal retention obligation.
2. Website security and access records are retained for one year after creation or for the period set by the relevant provider configuration, contract and applicable law.
3. Institutional information is retained until discussions or the contract end. Contract, accounting and dispute records are retained for the period required by law or reasonably needed to establish or defend claims.
4. Marketing information is retained until consent is withdrawn. Identifiable images and testimonials are retained for the period stated in the separate consent or until withdrawal.
5. If e-commerce begins in the future, the Company will apply the statutory retention periods: five years for contract, withdrawal, payment, and supply records; three years for consumer complaint and dispute records; and six months for display and advertising records.
6. At the end of the applicable period, electronic files are securely deleted and paper records are shredded or incinerated. Information retained by law is separated from active records.
1. The Company does not disclose personal information to a third party unless the individual gives separate consent or the law permits or requires disclosure.
2. Before a disclosure to a school, institution or co-organizer, the Company provides the recipient, purpose, fields, retention period and consequence of refusal, and obtains consent where required.
3. If a business sale, merger, or other organizational change is planned, the Company may transfer information as needed after following the procedures and providing the notices required by law.
4. Service providers acting for the Company are described in Article 6 and are distinguished from disclosures for an independent third-party purpose.
1. The Company currently uses the following providers.
(a) Channel Corporation: web chat, browser identifiers and consultation-record management.
(b) Cloudflare, Inc.: website hosting and delivery, security and incident response, and aggregated usage measurement through Cloudflare Web Analytics.
2. If the Company later provides a web inquiry or external form, it may use the providers below, or equivalent providers, and will update the form and this Policy before use.
(a) Google LLC: inquiry database storage and processing, external forms, and website measurement and tag management through Google Analytics and Google Tag Manager.
(b) Cloudflare, Inc.: inquiry routing and Turnstile bot checks.
(c) Resend, Inc.: delivery of an inquiry notification email to authorized Company staff.
3. If direct sales begin, payment and delivery providers will be identified on the order screen and in a revised Policy.
4. The Company uses contracts and service settings to address purpose limitation, security, subprocessors, oversight and deletion. Provider or task changes will be disclosed in this Policy.
1. Channel Corporation and its infrastructure providers may process chat identifiers, consultation content, and device and usage information in their service countries for web chat and consultation-record management. Cloudflare, Inc. may process web requests, IP addresses, device and network information, and security logs in the United States and its global service locations for website delivery, security and aggregated analytics. Information is transferred over encrypted networks when the Services are used and processed for the consultation period, provider-configured period, or a period required by contract or law.
2. If a web inquiry or external form is later provided, Google LLC may process submitted fields, website-usage information and online identifiers in the United States and other service locations for database, external-form, analytics and tag-management functions. Resend, Inc. may process the name, email, optional telephone number, inquiry type and message, consent choices and receipt number in the United States to deliver an inquiry notification. Cloudflare, Inc. may process the IP address, TLS, browser and device signals, and site information in global service locations for Turnstile security checks.
3. Before using the functions in paragraph 2, the Company identifies the recipient, country, information, purpose, timing and method, retention period, refusal method, lawful transfer mechanism and required safeguards on the relevant screen or in a revised Policy.
4. An individual may decline an optional function, block browser storage or withdraw marketing consent. If an individual does not want a transfer required for a specific online function, the individual may contact the Company by telephone or email, but that function may be unavailable.
1. Where consent is required to process personal information about a child under 14, the Company obtains and verifies consent from a legal representative. An online consultation about a child should be made by a guardian or other properly authorized person.
2. Users should not place resident registration numbers, medical records, financial information or other unnecessary sensitive or official-identification information in a message or attachment.
3. If allergy, health or other sensitive safety information is needed for a separate program, the Company identifies the minimum fields, purpose and period in a separate notice and obtains explicit consent from the guardian or individual, or confirms another lawful condition.
4. The Company does not use children’s information for personalized advertising or send promotional information directly to children.
1. The website currently uses Cloudflare Web Analytics to aggregate page views, paths, referrers, country, device, browser, operating-system and performance metrics. Cloudflare’s official documentation states that this service does not collect or use visitors’ personal data and does not track individual users across customer sites.
2. Channel Talk may store a browser identifier in a cookie or local storage to continue a consultation and may process visit, device and consultation records.
3. If Cloudflare Turnstile is later used on a form, it may process the IP address, TLS and User-Agent details, browser and device signals, and site information to distinguish automated requests. The check may block a form request or require verification but does not make a decision producing legal or similarly significant effects about the individual.
4. If Google Analytics or Google Tag Manager is later enabled, visited pages, access time, source path, clicks, device and browser information, and online identifiers may be processed through cookies or similar technologies. The Company provides any notice, consent and opt-out required before enabling those tools.
5. Users may delete or block cookies and local storage in their browser. Blocking essential storage may prevent security or chat functions from working properly.
1. An individual or legal representative may request access to personal information, ask that it be corrected or deleted, request that processing be suspended, withdraw consent, and exercise other rights recognized by law.
2. A request may be made by email, telephone or writing. The Company may verify identity and authority before acting and responds within the period required by law.
3. A request may be limited where another person’s rights, legal obligations, contract performance, record integrity, dispute response, or an exception under applicable law requires continued processing. The Company explains the reason for the limit and any available remedy.
4. An individual may withdraw consent to receive promotional messages or to use images or testimonials for promotion at any time. Withdrawal does not affect processing that was lawful before withdrawal.
The Company applies safeguards proportionate to the information and risk, including data minimization, access management, encrypted transport, security software and records, provider oversight, physical access controls, incident response and secure deletion procedures.
1. The Company may update this Policy when law, the Services or processing practices change.
2. The Company posts the change and its effective date on the website. It follows any advance-notice or consent procedure required by law, while an urgent security or mandatory legal update may be applied immediately.
3. A new consent will be obtained when applicable law requires one. The revised Policy otherwise applies prospectively from its effective date.
Privacy contact and access-request desk: Keunhye Yoon
Telephone: +82 2 555 0858
Email: team@labdotco.org
The Company reviews privacy inquiries and rights requests without delay. Individuals may seek advice or remedies from the Personal Information Infringement Report Center (privacy.kisa.or.kr / 118), Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972), Korean National Police Agency Cybercrime Reporting System (ecrm.police.go.kr / 182), or Supreme Prosecutors’ Office (www.spo.go.kr / 1301).