Effective 7 October 2026 · Version 2026-10-15.1

Privacy Policy

How OWNB processes personal information, including contracted processing and overseas processing.

1. Data controller

Sunrich International Patent & Law Firm is the controller of personal information processed for OWNB accounts, consultations, trademark searches, filings, and rights management. The Privacy Officer is Yoon Bae Kim. Contact ownb@sunrichpat.com or 02-563-4598 with privacy enquiries.
HEDGEROW WORKS is a processor that handles only the minimum information needed for system development, maintenance, and incident response. It does not independently determine the purposes or methods of processing for legal services.

2. Purposes and categories of information

•
Accounts and authentication: social or email account identifiers, sign-in email, name or nickname, and authentication and access records.
•
Consultation, applications, and representation: personal or corporate name, contact email, phone number, address, contact person, business details, marks, classes, designated goods, consultation messages, and submitted documents.
•
Payments, refunds, and receipts: order number, amount, payment method, payer name, payment and refund status, refund account, and information required for tax documents.
•
Progress and rights management: case, application, and registration numbers, authorization details, official status, deadlines, and delivery and viewing records.
•
Security, quality, and traffic analysis: IP address, device and browser, access time, referral source, search terms, UTM parameters, error and activity records, and cookie or local-storage identifiers.
•
Information requiring separate treatment by law is explained at the relevant input step and is processed only within the scope supported by that notice and the applicable legal basis.

3. Retention periods

•
Account information: deleted without delay after account closure, except for minimum records retained for a legally supported period to prevent disputes or misuse.
•
Authorization, case, and rights-management information: retained while case handling and agreed post-registration management continue, and afterward for periods required for disputes or legal obligations.
•
Contracts, withdrawal, payments, and supply records: five years under applicable e-commerce laws.
•
Consumer complaints and dispute records: three years. Advertising and representation records: six months.
•
Access and security logs: a reasonable period needed for security and misuse response, or the period required by applicable law.

4. Disclosure to third parties

The Firm does not disclose personal information to third parties without separate consent, a legal obligation, or another legitimate basis necessary to perform the contract. If a user selects online payment, the order number, amount, and payment information may be provided to the selected payment service provider for payment and refunds. The recipient and information are explained again on the relevant screen.
Application information and documents necessary for filing, authorization, and procedural work are submitted to the Korean IP Office, Patent-ro, and other relevant authorities within the scope of applicable law and the authority to act.

5. Contracted processing

•
HEDGEROW WORKS: system development and maintenance, security updates, and incident response.
•
Supabase: authentication, database, and file storage.
•
Netlify: web hosting, CDN, and security logs.
•
Resend: authentication and progress emails.
•
OpenAI: assistance with trademark searches and report wording. Direct identifiers are removed or minimized wherever possible.
•
NICE Payments or Toss Payments: payment and cancellation processing when the user selects the relevant payment method.

6. Overseas processing and transfers

Information may be encrypted and transmitted to or processed on the overseas infrastructure of the processors below. Transfers are made on the basis of contract performance and contracted processing under the Personal Information Protection Act, together with the required notices and safeguards. Users who do not wish to use overseas processing may stop account registration or use of the relevant feature, but core online services may then be unavailable.
•
Supabase Pte. Ltd. (primary storage region: Singapore; privacy@supabase.com): account, application, and operational data and files. Encrypted transfer occurs during service use and storage. Backups are deleted under the provider's policy after the contractual and statutory retention periods.
•
Netlify, Inc. (United States and worldwide CDN regions; privacy@netlify.com): IP, device, request path, and security logs. Encrypted transfer occurs when pages are requested. Retention continues until the hosting or security purpose is fulfilled or for the provider's specified period.
•
Resend, operated by Plus Five Five, Inc. (United States; privacy@resend.com): recipient email, name, message content, and delivery results. Encrypted transfer occurs when emails are sent. Retention continues until delivery and incident-response purposes are fulfilled or for the contractual period.
•
OpenAI, L.L.C. (United States; privacy@openai.com): the minimum mark, business, designated-goods, and search information needed for analysis. Encrypted transfer occurs when an administrator requests analysis. API abuse-monitoring logs are generally deleted within 30 days but may be retained longer to meet legal obligations. API inputs are not used for model training without separate consent.

7. Deletion procedures and methods

Information is deleted so that recovery is difficult when its retention period ends or its purpose is fulfilled. Records required by law are stored separately, used only for that purpose, and then deleted. Electronic files are deleted to prevent recovery or reproduction; paper documents are shredded or incinerated.

8. Your rights

Users may request access, correction, deletion, restriction of processing, and withdrawal of consent. Requests to ownb@sunrichpat.com or 02-563-4598 are handled after identity verification within statutory deadlines. Deletion may be restricted where statutory retention duties or ongoing legal relationships apply; the reasons will be explained.

9. Automatic collection and your choices

OWNB may use cookies or browser local storage to maintain sign-in, save application drafts, and analyze referrals, errors, and security. Internal navigation records include page types, their sequence, and recorded times, but not form contents or document and order identifiers. You may restrict or delete storage in browser settings, but essential functions such as sign-in and draft saving may not work properly.
Detailed navigation paths, first and last pages, search terms, and detailed campaign values in internal analytics are deleted from the operational database within seven days of collection. A daily cleanup removes details older than six days; visit counts, total page views, and referral categories are retained. Disaster-recovery backups follow the hosting provider's separate retention period and are not used for routine visitor analysis. If a backup is restored, expired details are purged before use. This policy covers OWNB's internal analytics, not Naver's separate collection and retention described below.
Naver advertising measurement is optional. The official Naver script is loaded only in browsers where the user has reviewed the notice and consented. Your choice, the notice version, and the time of your choice are stored in that browser. No Naver tracking signals are sent before consent. Declining does not affect filing, payment, or consultation services.
With consent, Naver Corporation may collect IP addresses, browser and device information, cookie identifiers, public-page visits, advertising referrals, and application-completion signals to measure advertising performance. Completion means the customer's initial filing-fee transfer notification was successfully received, not that the Firm verified payment or recognized revenue. Naver's official notice specifies a one-year retention period for behavioral information, followed by deletion or separate storage. NHN DATA conducts the tracking review. OWNB does not include customer names, emails, trademark names, reports, bank account numbers, or payment amounts in tracking signals. Payment-page conversion events are processed in a separate neutral document without personal identifiers.
You may withdraw consent at any time using the Naver advertising measurement setting below. You may also block or delete browser cookies or use Naver's personalized advertising settings at https://gam.naver.com/optout/main. Withdrawal stops further tracking calls but does not automatically delete data already sent or existing cookies. Settings apply per browser. The external review screen requires separate consent and sends only test signals; it does not create real applications or payments.

10. Security and privacy complaints

The Firm minimizes access permissions and uses encryption in transit, access logs, backups, vulnerability checks, and processor oversight. Privacy concerns may also be raised with the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee, the Korean National Police Agency, or another relevant authority.

11. Policy changes

This policy takes effect on 15 October 2026. This revision explains internal page-navigation records and optional, consent-based Naver advertising measurement. Important changes will be announced before taking effect. Previous versions and notices presented when consent was given are retained with contract and consent records.
Allow Naver advertising measurement
Change your advertising measurement consent for this browser. Declining or withdrawing consent does not affect trademark applications, payments, or progress updates.
For questions about these documents or their scope, contact us through OWNB chat or the firm's contact details.