Privacy Policy
In operating the PBA 7-Layer Business Radar (the “Service”), YLIA Co., Ltd. (the “Company”) establishes and discloses the following privacy policy in accordance with the Personal Information Protection Act of Korea, so that it can protect the personal information of data subjects and handle related grievances promptly and smoothly.
Effective date: September 20, 2026
This is a translation provided for convenience. The Korean version prevails.
1. Purposes of Processing Personal Information
The Company processes personal information for the purposes below, and will obtain consent in advance if those purposes change.
- Sending the diagnostic result report (PDF) by email
- Receiving requests for a consultation (consulting) based on diagnostic results, and providing guidance and contact
- Providing marketing information (with separate consent): newsletter and insight emails, seminar and program announcements, announcements of new services and events
- Statistical analysis and improvement of service usage (on the basis of information that does not identify individuals)
- Research on and improvement of the diagnostic methodology (limited to information processed into a form in which individuals cannot be identified)
2. Personal Information Items Processed
You can use the diagnostic without consenting to the collection and use of personal information (an anonymous diagnostic). In that case we do not collect information that can identify an individual, such as a name or email.
| Category | Items | When collected |
|---|---|---|
| Required (with consent) | Name, email address | When you consent to the collection and use of personal information at the start of the diagnostic |
| Optional (with consent) | Company / brand name, role | When you consent to the collection and use of personal information at the start of the diagnostic |
| Required (when requesting a consultation) | Name, email address, consultation request message (optional) | When you request a consultation after an anonymous diagnostic, collected with consent obtained on the request screen |
| Diagnostic information | Business stage, industry, team size, question responses and diagnostic results, result-fit rating, annual revenue and last-12-month growth band (optional entry) | During the diagnostic (including anonymous diagnostics). In an anonymous diagnostic this information alone cannot identify an individual. If you consent to the collection of personal information or request a consultation, it is processed as personal information together with your name and email. |
| Automatically collected | Cookie identifiers, pages visited and usage events, device and browser information, referral source (UTM) | While using the service (see section 6) |
The Company does not collect personal information from children under the age of 14.
3. Processing and Retention Periods
- Personal information collected for a diagnostic or a consultation request: one year from the date of collection. However, if the data subject withdraws consent or requests deletion, it is destroyed without delay.
- Consent to receive marketing information: one year from the date of collection, or until that consent is withdrawn, whichever comes first
- Temporarily saved information from a diagnostic that was not completed: 30 days from the date of the last entry
- Diagnostic information that cannot identify an individual: may be retained for service improvement and statistical purposes.
- Where a consulting contract has been concluded, information may be retained for the period set out in the contract in order to perform the contract and to run a follow-up diagnostic.
- When personal information is destroyed, freely entered information such as industry and the referral source (UTM) information are deleted along with it, so that the remaining diagnostic information cannot identify an individual.
4. Procedure and Method for Destroying Personal Information
Personal information whose retention period has passed or whose processing purpose has been achieved is destroyed without delay. Information held in the form of electronic files is permanently deleted by a method that makes it unrecoverable.
5. Provision to Third Parties and Outsourcing of Processing
The Company does not provide the personal information of data subjects to third parties. It outsources processing as follows in order to operate the service.
| Processor | Outsourced work | Storage location |
|---|---|---|
| Supabase, Inc. | Operation of the database and the operator authentication system | Republic of Korea (AWS Seoul region) |
| Amazon Web Services, Inc. | Web service hosting | Republic of Korea (Seoul region) |
In outsourcing contracts, the Company sets out the relevant requirements and supervises the processor so that personal information is managed safely.
6. Installation and Operation of Automatic Collection Devices (Cookies), and How to Refuse Them
The Company uses Google Analytics 4 to analyze usage statistics, and cookies are installed in the process. Cookies do not contain directly identifying information such as a name or email address.
If you do not want cookies stored, you can block cookies in your browser settings or install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). Blocking cookies places no restriction on using the diagnostic.
7. Transfer of Personal Information Abroad
The following information is transferred abroad as a result of using Google Analytics 4.
| Item | Details |
|---|---|
| Recipient | Google LLC (contact: privacy.google.com/contact) |
| Country of transfer | United States |
| Items transferred | Cookie identifiers, pages visited and usage events, device and browser information |
| Date and method of transfer | Transmitted over the network while the service is used |
| Purpose of use | Statistical analysis of service usage |
| Retention period | The data retention period set in Google Analytics (up to 14 months) |
| How to refuse, and the effect of refusing | You can refuse by the method in section 6, and refusing places no restriction on your use of the service. |
8. Rights and Obligations of Data Subjects and How to Exercise Them
Data subjects may at any time ask the Company to give access to, correct or delete their personal information, to suspend its processing, or to withdraw their consent. If you send a request by email to the privacy officer below, we will act on it without delay (within 10 days). You may also exercise these rights through a legal representative or an authorized agent.
9. Measures to Secure Personal Information
- Keeping the number of operators who can access personal information to a minimum, and managing accounts and permissions separately
- Database access control (row-level security policies) and management of server-only authentication keys
- Encryption in transit (HTTPS)
- Invalidating existing login sessions when an operator changes their password
- Retaining access records for the operator-facing system that handles personal information — the account used, the time of access, the source IP address, and the action performed — for at least one year, and reviewing them at least once a month
10. Privacy Officer
| Category | Details |
|---|---|
| Name | Choi Jong Hoon (CEO) |
| info@ylia.io | |
| Contact | +82-10-9025-5093 |
11. Remedies for Infringement of Rights
To obtain relief for an infringement of your personal information, you may apply to the bodies below for dispute resolution or advice.
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (개인정보침해신고센터): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office (대검찰청): 1301 (www.spo.go.kr)
- National Police Agency (경찰청): 182 (ecrm.police.go.kr)
12. Changes to This Privacy Policy
This privacy policy applies from September 20, 2026. If its contents change, we will give notice through the service from 7 days before the change takes effect.