Dong-A Socio Holdings Website Privacy Notice
Dong-A Socio Holdings Co., Ltd. (hereinafter referred to as the 'Company') values customers' personal information and complies with the personal information protection provisions of the Personal Information Protection Act and other applicable statutes and regulations. Through this Privacy Notice, the Company informs customers of the purposes and methods for which the personal information they provide is used and the measures taken to protect such personal information. If the Company amends this Privacy Notice, it will provide notice through the website notice board (or by individual notice).
* This Privacy Notice takes effect on May 26, 2026.
Dong-A Socio Holdings Co., Ltd. (hereinafter referred to as the 'Company') lawfully processes and safely manages personal information in compliance with the Personal Information Protection Act and other applicable statutes and regulations to protect the freedoms and rights of data subjects. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Notice to inform data subjects of the procedures and standards for processing personal information and to ensure that related grievances are handled promptly and smoothly.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those stated below. If a purpose of use changes, the Company will take necessary measures, including obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.
2. Processing and Retention Period of Personal Information
① General Processing and Retention Principle
The Company processes and retains personal information within the retention and use period prescribed by statutes or regulations or within the retention and use period consented to by the data subject when personal information is collected.
② Processing and Retention Period by Category
● Consultation and inquiries: One year from registration of the inquiry
However, in any of the following cases, the information will be retained until the relevant grounds cease to exist:
● Investigation or inquiry concerning a violation of applicable statutes or regulations
◦ Until the relevant investigation or inquiry is completed
● Retention under the Company's internal notice
◦ Prevention of re-registration by malicious users, disputes involving infringement of rights such as defamation, and cooperation with investigations: One year
3. Particulars of Personal Information Processed
The Company processes the following particulars of personal information.
① Consultation and Inquiries
● Items collected: Name, telephone number, and email address
● Optional item: Address
4. Provision of Personal Information to Third Parties
① General Principle
In principle, the Company processes customers’ personal information only within the scope specified in the purposes of processing personal information. The Company provides personal information to a third party only where Article 17 or 18 of the Personal Information Protection Act applies, such as where the customer has consented or where special provisions exist in statutes, and does not otherwise provide customers’ personal information to third parties.
② Provision with Consent
To provide services smoothly, the Company provides the minimum necessary personal information in the following cases after obtaining the customer’s consent. The Company destroys such information without delay after the purposes of collection and use have been attained.
Recipient
Personal Information Provided
Recipient's Purpose of Use
Retention and Use Period
Dong-A ST
Name, telephone number, email address; optional: address
Other inquiries (prescription drugs)
Until the purpose of the relevant work has been attained; provided, if separate retention is required by applicable statutes or regulations, for the period prescribed therein
Dong-A Pharmaceutical
Name, telephone number, email address; optional: address
Other inquiries (over-the-counter drugs)
Until the purpose of the relevant work has been attained; provided, if separate retention is required by applicable statutes or regulations, for the period prescribed therein
③ Provision Required by Statutes or Regulations or for Investigation
The Company may provide personal information where provision is required under statutes or regulations, or where an investigative agency requests the information for investigative purposes in accordance with the procedures and methods prescribed by statutes or regulations.
5. Entrustment of Personal Information Processing
① Entrusted Processing
The Company entrusts the processing of personal information (management information) as follows to provide services and stipulates necessary matters in the entrustment agreement to ensure that personal information is safely managed in accordance with applicable statutes and regulations.
Person Entrusted
Entrusted Work
DAi
Website operation and system management
② Matters Specified in Entrustment Agreements
When entering into an entrustment agreement, the Company specifies in a document, such as a contract, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of the person entrusted, and liability for damages pursuant to Article 26 of the Personal Information Protection Act, and supervises whether the person entrusted safely processes personal information.
③ Re-entrustment
Pursuant to Article 26 (6) of the Personal Information Protection Act, a person entrusted must obtain the Company’s consent before re-entrusting the processing of the Company’s personal information.
④ Disclosure of Changes
Any change to the entrusted work or the person entrusted will be disclosed without delay through this Privacy Notice.
6. Procedures and Methods for Destroying Personal Information
① Destruction upon Expiry or Attainment of Purpose
The Company destroys personal information without delay when it becomes unnecessary due to the expiry of the retention period, attainment of the purpose of processing, or other reasons.
② Separate Storage Where Continued Retention Is Required
If personal information must continue to be retained pursuant to other statutes or regulations even after the retention period consented to by the customer has expired or the purpose of processing has been attained, the Company transfers such personal information to a separate database (DB) or stores it in a different location.
③ Destruction Procedures and Methods
● Destruction procedures
Information entered for consultation or inquiries is delivered to the person in charge by email. The person in charge forwards it to the department responsible for the relevant inquiry and destroys it immediately after the purpose of processing has been attained.
● Destruction methods
Information entered for consultation or inquiries is stored in email form. When an email is deleted, the personal information and inquiry records in the email body are deleted by technical means that prevent recovery. If an inquiry is printed on paper, the personal information and inquiry records are destroyed by shredding or incineration.
7. Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercising Them
① Exercise of Rights
Customers may exercise their rights against the Company at any time, including the right to request access to, correction or erasure of, or suspension of processing of their personal information.
※ A request for access, etc. concerning the personal information of a child under 14 years of age must be made directly by the child’s legal representative. A minor customer aged 14 or older may exercise rights concerning his or her personal information directly or through a legal representative.
② Methods of Exercising Rights
Rights may be exercised against the Company in writing, by email, facsimile (FAX), or other means pursuant to Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.
③ Exercise through a Representative
Rights may also be exercised through a representative, such as a legal representative or an authorized person. In such cases, a power of attorney in Form 11 attached to the Notification on Methods of Processing Personal Information (Notification No. 2023-12) must be submitted.
④ Restrictions on Rights
The right to request access to or suspension of processing of personal information may be restricted pursuant to Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.
⑤ Restriction on Requests for Erasure
Erasure of personal information may not be requested where other statutes or regulations specifically require the personal information to be collected.
⑥ Verification of Identity or Authority
When receiving a request for access, correction or erasure, or suspension of processing, the Company verifies whether the requester is the relevant data subject or a duly authorized representative.
A user or legal representative may at any time request access to, correction or erasure of, suspension of processing of, or withdrawal of consent to the personal information of the registered user or a child under 14 years of age through the consultation and inquiry channel.
8. Measures Necessary to Ensure Safety of Personal Information
The Company takes the following measures to ensure the safety of personal information.
① Managerial Measures
● Establishment and implementation of information security policies and guidelines
● Operation of a dedicated organization
● Regular employee training
● Operation of Information Security Day twice a year
② Technical Measures
● Management of access rights to personal information processing systems
● Installation of access control systems
● Encryption of personal information
● Installation and updating of security programs
● Performance of vulnerability assessments
③ Physical Measures
● Access control for computer rooms, document storage rooms, and similar facilities
④ Additional Personal Information Protection Activities
● Publication of an integrated report once a year
● Acquisition of domestic and international information security and privacy certifications (ISO/IEC 27001 and ISO/IEC 27701)
● Information security disclosure
⑤ Additional Security Safeguards
The Company implements various security safeguards as technical measures to protect customers’ personal information. All information submitted by customers is securely stored and managed in security systems protected by firewalls. As managerial measures, the Company establishes procedures necessary to access and manage customers’ personal information, limits the number of personnel handling personal information to the minimum, and provides continuous security training. The Company also designates administrators for systems that process personal information, assigns administrator passwords, and updates them regularly.
9. Installation and Operation of Automatic Personal Information Collection Tools and Refusal Thereof
① Use of Cookies
The Company uses cookies, which store and retrieve usage information from time to time, to provide individualized services to customers.
② Definition of Cookies
A cookie is a small amount of information that the server (HTTP) operating the website sends to the customer’s web browser, and it may be stored on the hard disk of the customer’s PC.
③ Purpose of Using Cookies
● Collection of statistical information concerning the frequency of visits to the website
④ Allowing or Blocking Cookies
● Web browser
◦ Chrome: Settings > Privacy and security > Delete browsing data
◦ Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
● Mobile browser
◦ Chrome: Settings > Privacy and security > Delete browsing data
◦ Safari: Device Settings > Safari > Advanced > Block All Cookies
◦ Samsung Internet: Settings > Personal browsing data > Delete browsing data
⑤ Effect of Refusing Cookies
Refusing to store cookies may make it difficult to use customized services.
10. Collection, Use, and Provision of Behavioral Information and Refusal Thereof
The Company does not collect, use, or provide behavioral information for online customized advertising or similar purposes.
11. Privacy Officer
The Company designates the following privacy officer to exercise general supervision and control over personal information processing and to handle customer grievances and provide remedies for damage related to personal information processing.
① Privacy Officer
● Contact
◦ Telephone: 02-920-8015
◦ Email: audit@donga.co.kr
② Department Responsible for Personal Information Protection
● Department: Risk Management Audit Team
● Contact
◦ Telephone: 02-920-8085
◦ Email: privacy_hd@donga.co.kr
※ Calls will be connected to the department responsible for personal information protection.
③ Inquiries and Grievance Handling
Customers may contact the privacy officer or the responsible department regarding any personal information protection inquiry, grievance, or request for damage relief arising while using the Company’s services or business. The Company will respond to and handle such inquiries without delay.
12. Personal Information Complaint Service
The Company designates the following relevant departments and persons responsible for personal information management to protect customers’ personal information and handle related grievances.
Responsibility
Department / Position
Telephone
Email
Receipt and handling of personal information related to recruitment
HR Strategy Team
02-920-8165
ohwooho@donga.co.kr
Receipt and handling of personal information for other inquiries (IR)
IR Team
02-920-8186
huks94@donga.co.kr
Receipt and handling of personal information for other inquiries (prescription drugs)
CS Team (Dong-A ST)
02-920-8640
jbha71@donga.co.kr
Receipt and handling of personal information for other inquiries (over-the-counter drugs)
CX Team (Dong-A Pharmaceutical)
02-920-8351
jjlee@donga.co.kr
13. Remedies for Infringement of Rights and Interests
① External Dispute Resolution and Consultation
To obtain relief from a personal information infringement, customers may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Privacy Infringement Report Center, or other relevant institutions. For other reports or consultations concerning personal information infringement, please contact the following institutions.
● Personal Information Dispute Mediation Committee
◦ Telephone: 1833-6972 without area code
◦ Website: www.kopico.go.kr
● Privacy Infringement Report Center
◦ Telephone: 118 without area code
◦ Website: privacy.kisa.or.kr
● Supreme Prosecutors’ Office
◦ Telephone: 1301 without area code
◦ Website: www.spo.go.kr
● National Police Agency Cybercrime Reporting System
◦ Telephone: 182 without area code
◦ Website: ecrm.cyber.go.kr
② Internal Consultation and Reporting
The Company endeavors to guarantee data subjects’ right to informational self-determination and to provide consultation and remedies for damage caused by personal information infringement. If a report or consultation is required, please contact the following department.
● Department: IR Team
● Contact
◦ Telephone: 02-920-8179
◦ Email: beatdd@donga.co.kr
③ Administrative Appeals
A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request made under Article 35 (Access to Personal Information), Article 36 (Correction or Erasure of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal pursuant to the Administrative Appeals Act.
● Central Administrative Appeals Commission
◦ Telephone: 110 without area code
◦ Website: www.simpan.go.kr
14. Installation and Operation of Fixed Visual Data Processing Devices
When installing and operating fixed visual data processing devices for facility safety and the prevention of crimes and fires, the Company lawfully and appropriately manages such devices in accordance with applicable statutes and regulations and endeavors to prevent infringement of customers’ rights and interests.
① Grounds and Purposes for Installation
Pursuant to Article 25 (1) of the Personal Information Protection Act, the Company installs and operates fixed visual data processing devices for the following purposes.
● Facility safety and fire prevention
● Management and control of access by persons and vehicles
● Crime prevention for the safety of employees and visitors
● Prevention of vehicle theft and damage in parking facilities
● Prevention of unlawful intrusion by outsiders
② Number Installed, Installation Locations, and Recording Scope
● Number installed: 61
● Installation locations
◦ Main entrances to the building
◦ Rooftop
◦ Parking facilities
◦ First-floor lobby, etc.
● Recording scope: Areas sufficient to identify persons entering and exiting
③ Management Officer, Responsible Department, and Persons Authorized to Access Visual Data
● Management officer
◦ General Affairs Team 1
◦ Telephone: 02-920-8106
◦ Email: redmoon@donga.co.kr
● Person authorized to access
◦ Telephone: 02-920-8109
◦ Email: bluesally@donga.co.kr
④ Recording Hours, Retention Period, Storage Location, and Processing Method
● Recording hours: 24 hours
● Retention period: 30 days from the date of recording
● Storage location: Dong-A Socio Holdings Visual Data Management Room
● Processing method
◦ Records are maintained concerning use beyond the intended purpose, provision to third parties, destruction, and requests for access, etc.
◦ Visual data is permanently deleted upon expiry of the retention period
⑤ Method and Place for Accessing Visual Data
● Method
◦ Contact the visual data management officer in advance
◦ Visit the Company to access the relevant visual data
● Place: Dong-A Socio Holdings Visual Data Management Room
⑥ Measures Taken in Response to Requests for Access to Visual Data, etc.
A customer may request the visual data management officer to permit access to or confirmation or erasure of his or her personal visual data. The Company will take necessary measures without delay upon receiving a request for access to or confirmation of the existence of personal visual data.
● Scope of requests
◦ Personal visual data in which the requesting customer appears
◦ Data clearly necessary to protect the customer’s life, body, or property from harm
● Grounds for denying requests
◦ Material obstruction of a criminal investigation, maintenance of prosecution, or court proceedings
◦ High likelihood of infringing another person’s privacy
◦ Other legitimate grounds for denial
⑦ Measures Necessary to Ensure the Safety of Visual Data
● Collection and recording controls
◦ Visual data is not collected for purposes other than those stated above
◦ Sound-recording functions are not used
● Access controls
◦ Access is limited to authorized persons
◦ Data is managed in access-controlled areas and security systems protected by passwords and locking devices
● Management and destruction
◦ Records concerning use beyond the intended purpose, provision to third parties, requests for access, and destruction of personal visual data are kept and managed
◦ Visual data is managed as Confidential or higher
◦ Unauthorized access, playback, and external removal are prohibited
◦ Data is permanently deleted upon expiry of the retention period
15. Amendments to the Privacy Notice
If this Privacy Notice is added to, deleted, or amended due to changes in statutes, policies, or security technologies, the Company will announce the reasons for and details of the amendment on its website. Customers may also review previous versions of the Privacy Notice below.
