Privacy Policy

1. Purposes of processing

The Company processes personal information received through the website inquiry form, and records of website use, only for the purposes below. If a purpose changes, we will take the necessary steps, such as obtaining separate consent, as required by Article 18 of the Personal Information Protection Act.

• Reviewing inquiries about distribution, distributorships, partnerships, corporate purchasing, and similar matters
• Verifying the inquirer and contacting them to reply and follow up
• Improving the website through analysis of visit statistics

2. Personal information processed and how it is collected

• Required: company, name, email, phone, country, inquiry type, message
• Optional: company website, main sales channels
• Method: entered directly by you in the website inquiry form
• Collected automatically: pages visited, referring source, links and buttons clicked, browser and device type, and time of access

Automatically collected information is used only for visit statistics that do not identify you, and your IP address itself is not stored. While the website is operated, your IP address, browser information, and time of access may be recorded temporarily in the hosting service's server logs.

3. Retention period

The Company keeps personal information for 1 year from the day the inquiry is closed and then deletes it without delay. If you ask us to delete it, we will do so without delay even before then. If an inquiry leads to a contract, we may keep the information for the period required by applicable law.

Records of website use collected automatically are kept for 1 year from the day they are collected and then deleted.

4. Deletion procedure and method

Personal information is deleted without delay once its retention period has passed or its purpose has been fulfilled. Electronic files are deleted so they cannot be recovered, and printed copies are shredded or incinerated.

5. Provision to third parties

The Company does not provide your personal information to third parties, except where you have separately consented or where the law specifically requires it.

6. Processors

To handle inquiries smoothly, the Company entrusts the following processing to the companies below, and its contracts with them set out what is needed to keep personal information secure.

• Vercel Inc.: website hosting and transmission of inquiry form submissions
• Plus Five Five, Inc. (Resend): sending inquiries by email
• PostHog, Inc.: analysis of website visit statistics

7. International transfers

To handle inquiries and analyze visit statistics, the Company transfers personal information outside Korea as follows.

• Vercel Inc. Country: United States · Contact: privacy@vercel.com Information transferred: everything entered in the inquiry form When and how: sent over an encrypted connection when you submit the inquiry Purpose and retention: transmitting the inquiry; not stored after processing
• Plus Five Five, Inc. (Resend) Country: United States · Contact: support@resend.com Information transferred: everything entered in the inquiry form When and how: sent over an encrypted connection when you submit the inquiry Purpose and retention: sending the inquiry by email; delivery records are deleted after the period set by Resend's data retention policy
• PostHog, Inc. Country: United States · Contact: privacy@posthog.com Information transferred: the automatically collected information listed in Section 2 When and how: sent over an encrypted connection when you visit the website Purpose and retention: analyzing website visit statistics; kept for 1 year from collection

If you do not want your information transferred abroad, please email us directly at admin@herba.co.kr instead of using the form. The inquiry form cannot be used without the transfer. You can block the sending of visit statistics with your browser's tracking protection or an ad-blocking extension.

8. Your rights and how to exercise them

You may at any time ask the Company to give you access to, correct, delete, or stop processing your personal information, or withdraw your consent. Email us at admin@herba.co.kr and we will act without delay. You may also exercise these rights through a legal representative or an authorized agent.

9. Security measures

• Encrypted connections (HTTPS) across the website and the entire inquiry transmission path
• Access to inquiry emails limited to the minimum number of staff
• Credentials used to send email (API keys) kept separately and securely

10. Cookies and automatic collection

The Company's website does not use cookies or browser storage. Visit statistics are collected without cookies. To tell visits apart, PostHog's servers generate an encrypted value that changes every day, so you cannot be identified or tracked across days.

If you do not want visit statistics collected, you can block them with your browser's tracking protection or an ad-blocking extension. Blocking them does not limit your use of the website.

11. Privacy officer

The Company has designated the privacy officer below to oversee the processing of personal information and to handle related complaints and remedies.

• Name: HWACHO SHIN
• Title: CEO
• Email: admin@herba.co.kr

12. Remedies for infringement

To seek a remedy for an infringement of your personal information, you may apply for dispute resolution or counseling with the Korean authorities below.

• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea), www.kopico.go.kr
• Personal Information Infringement Report Center: 118 (in Korea), privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 (in Korea), www.spo.go.kr
• Korean National Police Agency: 182 (in Korea), ecrm.police.go.kr

13. Information for users in the EEA and the UK

If you contact us from the EEA or the UK, the Company processes your personal information on the basis of your consent (GDPR Article 6(1)(a)) and of steps taken at your request before entering into a contract (Article 6(1)(b)). Visit statistics collected without cookies are processed on the basis of the Company's legitimate interest in improving the website (Article 6(1)(f)).

You have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent, and you may lodge a complaint with the data protection authority in your country of residence.

Transfers to the United States rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) for Vercel Inc., and on SCCs for Plus Five Five, Inc. (Resend) and PostHog, Inc.

14. Changes to this policy

This Privacy Policy takes effect on October 7, 2026. If it changes, we will announce the change on this page at least 7 days before it takes effect.