SANDS Lab, Inc. (the “Company”) respects the freedoms and rights of data subjects and processes personal information lawfully and securely in accordance with the Personal Information Protection Act of the Republic of Korea (“PIPA”) and other applicable laws and regulations.
In accordance with Article 30 of PIPA, this Privacy Policy explains the procedures and standards applied by the Company when processing personal information and how privacy-related questions, requests, and complaints are handled.
Article 1. Purposes of Processing, Categories of Personal Information, and Retention Period
- The Company processes only the minimum personal information necessary for the purposes described below. Personal information will not be used for any purpose other than those stated below. If a purpose of processing changes, the Company will take the measures required under applicable law, including obtaining additional consent where necessary.
| Type | Content |
|---|---|
| Processing Activity | Website inquiries |
| Purposes of Processing | Identifying the person submitting an inquiry; responding to product and service inquiries; providing product adoption, proof-of-concept and technical consultations; reviewing partnership and technical collaboration proposals; and conducting related follow-up communications |
| Categories of Personal Information | Required: Name, company or organization, telephone number, email address, and inquiry details / Optional: Role or job title, department, and product of interest |
| Collection Method | Website inquiry form, Email |
| Legal Basis | Consent of the data subject under Article 15(1)(1) of PIPA |
| Retention Period | Three years from completion of the inquiry |
-
Where the Company is required to retain personal information under applicable law, the information may be retained for the period prescribed by that law.
-
The Company does not use personal information collected through website inquiries for advertising, newsletters, or other marketing purposes unless separate consent has been obtained.
-
Data subjects may refuse to consent to the collection and use of their personal information. However, refusal to provide required information may prevent the Company from receiving or responding to an inquiry.
-
Refusal to provide optional information will not result in any disadvantage in submitting or processing an inquiry.
-
The Company does not request resident registration numbers, passport numbers, driver’s licence numbers, health information, biometric information, or other sensitive or unique identification information through its website inquiry form. Data subjects should not include such information in their inquiry.
Article 2. Provision of Personal Information to Third Parties
-
The Company processes personal information within the scope of the purposes stated in Article 1 and does not provide personal information to third parties without the prior consent of the data subject.
-
The Company may provide personal information to a third party only where:
a) the data subject has provided separate consent;
b) such provision is specifically required by law or is necessary for compliance with a legal obligation; or
c) the provision is otherwise permitted under Articles 17 and 18 of PIPA.
-
If personal information is provided to a third party, the Company will disclose or notify the data subject of the recipient, purpose of provision, categories of information provided, and retention and use period.
-
AWS, Slack, and Google process personal information as service providers supporting the Company under the Company’s instructions. Such outsourced processing is distinguished from an independent provision of personal information to a third party.
Article 3. Outsourced Processing of Personal Information
- The Company engages the following external service providers to operate its website and to receive, process, and respond to inquiries.
| Service Provider | Outsourced Services | Personal Information Processed | Retention Period |
|---|---|---|---|
| Amazon Web Services(AWS) | Hosting and operation of the website and PostgreSQL database on AWS EC2, including server operation and data storage | Personal information collected through the website inquiry form | Three years from completion of the inquiry or until termination of the service agreement |
| Slack Technologies, LLC and its affiliates | Transmission of inquiry notifications to relevant Company personnel through a webhook and storage of notification messages | Name, company or organization, telephone number, email address, inquiry details, and any optional information submitted by the user | Three years from completion of the inquiry or until deletion of the relevant message |
| Google LLC | Sending, receiving, and storing emails used to respond to inquiries through Gmail and Google Workspace | Name, email address, inquiry and response content, and other personal information included in the email | Three years from completion of the inquiry or until deletion of the relevant email |
- The Company enters into written agreements with its service providers that address:
a) restrictions on processing personal information beyond the purpose of the outsourced services;
b) technical and administrative security measures;
c) restrictions and controls concerning subprocessors;
d) the Company’s oversight of the service provider;
e) liability relating to personal information breaches; and
f) the return or destruction of personal information upon completion of the outsourced services.
-
The Company oversees its service providers to ensure that personal information is processed securely. Changes to a service provider or to the scope of outsourced processing will be disclosed through this Privacy Policy without undue delay.
-
Service providers may use affiliates or subprocessors to deliver their services. The Company reviews and manages material changes based on the subprocessor information published by each service provider.
Article 4. Overseas Transfers of Personal Information
- The Company transfers personal information to service providers located outside the Republic of Korea in order to notify relevant personnel of new inquiries and respond to those inquiries.
| Recipient and Contact Information | Country | Personal Information Transferred | Purpose | Timing and Method | Retention Period | Legal Basis |
|---|---|---|---|---|---|---|
| Slack Technologies, LLC and its affiliates / Email: privacy@slack.com / Address: 50 Fremont Street, San Francisco, CA 94105, USA | United States | Name, company or organization, telephone number, email address, inquiry details, role or job title, department, product of interest, and other information included in the inquiry notification | Notifying relevant Company personnel of a new inquiry and assigning and handling the inquiry | Transmitted through an encrypted network via webhook when an inquiry is submitted | Three years from completion of the inquiry or until deletion of the relevant message | Separate consent under Article 28-8(1)(1) of PIPA |
| Google LLC / Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | United States | Name, email address, inquiry and response content, and other personal information included in the email | Sending, receiving, and storing inquiry-related emails and responding to inquiries | Transmitted through an encrypted network when an email is sent or received | Three years from completion of the inquiry or until deletion of the relevant email | Separate consent under Article 28-8(1)(1) of PIPA |
-
The Company’s website and PostgreSQL database are hosted on an AWS EC2 server located in the Republic of Korea. Personal information stored in the website database is not stored on an overseas server.
-
Data subjects may refuse to consent to the overseas transfer of their personal information. However, due to the Company’s current inquiry-handling system, refusal may prevent the Company from receiving inquiry notifications, assigning the inquiry to the appropriate personnel, or responding by email.
-
The Company implements appropriate safeguards for overseas transfers, including access controls, protection of data in transit, and oversight of service providers.
-
If the recipient, destination country, purposes, timing and method, or retention period of an overseas transfer changes, the Company will notify data subjects and take any measures required under applicable law.
Article 5. Destruction of Personal Information
-
The Company destroys personal information without undue delay when the applicable retention period expires, the purpose of processing has been achieved, or the information is otherwise no longer necessary.
-
Where personal information must continue to be retained under applicable law, it will be stored separately from other personal information.
-
Personal information is destroyed as follows:
| Type | Method |
|---|---|
| Prodedure | The Company identifies personal information subject to destruction and destroys it in accordance with its internal procedures. |
| Database and electronic files | Electornic records are permanently deleted using methods designed to prevent restoration or recovery. |
| Slack messages | The relevant message is deleted. Residual backup data is deleted in accordance with Slack's retention policies and contractual terms. |
| Emails | The relevant email is deleted. Residual backup data is deleted in accordance with Google’s applicable retention policies and contractual terms. |
| Paper records | Paper documents are shredded or incinerated. |
Article 6. Rights of Data Subjects and How to Exercise Them
- Data subjects may exercise the following rights at any time:
a) request access to their personal information;
b) request correction or deletion;
c) request suspension of processing;
d) withdraw consent to the collection and use of personal information; and
e) withdraw consent to the overseas transfer of personal information.
-
These rights may be exercised in writing or by email or fax. The Company will respond without undue delay.
-
A data subject may exercise these rights through a legal representative or an authorized agent. In such cases, an appropriate power of attorney must be submitted.
-
The right to request access to personal information or suspension of processing may be restricted where permitted under applicable law.
-
Personal information may not be deleted where another law expressly requires its collection or retention.
-
The Company may verify the identity of the requester or the authority of a representative before handling a privacy rights request.
-
The Company will refer privacy rights requests to the department responsible for privacy matters and notify the requester of the result without undue delay.
Article 7. Security Measures
The Company implements administrative, technical, and physical measures designed to protect personal information.
| Category | Measures |
|---|---|
| Administrative measures | Establishing and implementing internal privacy management procedures, limiting the number of personnel authorized to handle personal information, and providing regular privacy training |
| Technical measures | Managing access rights, applying the principle of least privilege, implementing access controls, protecting data in transit, managing access logs, installing and updating security software, and conducting system security reviews |
| Physical measures | Controlling physical access to systems and locations where personal information or related documents are stored |
Article 8. Automatic Collection Technologies and Browser Storage
-
The Company does not use website analytics tools, advertising pixels, reCAPTCHA, or other technologies that automatically transmit personal information or behavioral data to the Company’s servers or third-party servers for user identification or behavioral analysis.
-
The website may use browser storage to retain language, display, or other user environment preferences.
-
Information stored in browser storage remains solely on the user’s device and is not transmitted to the Company’s server or a third-party server.
-
Users may delete locally stored information through their browser settings or browser data deletion functions. Deleting this information may reset language, display, or other website preferences.
Article 9. Privacy Contact Department
The Company has designated the following department to handle privacy-related inquiries, complaints, requests for relief, and privacy rights requests.
| Item | Details |
|---|---|
| Department | Threat Analysis Team |
| Telephone | +82-2-704-7502 |
| Fax | +82-2-704-7508 |
| acaciasu@sandslab.io |
Data subjects may contact the department above regarding any privacy-related inquiry, complaint, request for relief, or exercise of rights. The Company will respond and take appropriate action without undue delay.
Article 10. Remedies for Infringement of Privacy Rights
Data subjects may contact the Company or the following organizations for reporting, consultation, or dispute resolution concerning an infringement of privacy rights.
| Organization | Telephone | Website |
|---|---|---|
| KISA Personal Information Infringement Report Center | 118 within Korea | privacy.kisa.or.kr |
| Personal Information Dispute Mediation Committee | +82-1833-6972 | www.kopico.go.kr |
| Korean National Police Agency Cybercrime Reporting System | 182 within Korea | ecrm.police.go.kr |
These organizations are independent of the Company and may be contacted where a data subject requires additional assistance or is not satisfied with the Company’s handling of a privacy complaint or request.
Article 11. Changes to This Privacy Policy
-
This Privacy Policy takes effect on September 21, 2026.
-
If this Privacy Policy is amended, the Company will disclose the amendments and their effective date on its website.
-
Previous versions of this Privacy Policy will remain available through the Company’s website.
- Date of publication: September 21, 2026
- Effective date: September 21, 2026
Language
This English Privacy Policy is a translation of the Korean Privacy Policy. If there is any inconsistency or conflict between the Korean and English versions, the Korean version will prevail to the extent permitted by applicable law.