Presigna Privacy Policy

Published version 1 · Prepared 2026-10-12 · Effective 2026-10-14

Presigna Inc. (“Presigna”, “we”) publishes this policy under Article 30 of the Korean Personal Information Protection Act (PIPA) to protect the personal data of the people we deal with and to handle related requests promptly. If the Korean and English versions differ, the Korean version governs.

The Service is business-to-business. Company pages do not ask for names or contact details, and we process personal data only as set out below.

1. What we collect and how

Category	Items	How
Free account	Email address (required), password (required), time you confirmed this policy, company (set by the company link)	Entered on the account screen
Sign-in state	Session identifier (we store only a hash of it), session start and expiry times	Created on sign-in
Work saved to the account	In-progress review of the company card (company and asset information)	Saved automatically while editing the company page signed in
Korean payment (tax invoice)	Company name, business registration number, representative’s name, business address, business type and item, email for the tax invoice	Entered on the payment screen
Korean card payment	Amount, time, KG Inicis transaction number	From KG Inicis. KG Inicis receives card details directly; we do not
Overseas payment (invoice)	Legal name, billing address, country, tax ID (optional), purchase order number (optional), email for the invoice	Entered on the order screen
Overseas PayPal payment	Amount, time, PayPal order and transaction numbers	From PayPal. PayPal receives the payer’s account and card details directly; we do not
Contact email	Sender’s email address and any name, title and content in the message	Email received at contact@presigna.com
Outside questions from members	The text of pre-CDA questions a member company received outside the Service (by email, at events, etc.). It may include the asker’s name, title and affiliation	Sent by the member company in the body of an email. We do not accept attachments (if one arrives, we delete it unopened and ask for the question in the email body). Please remove the asker’s contact details before sending
Business information in public sources	Names of company representatives and of researchers (paper authors, inventors) with their affiliations, as they appear on company cards	Collected from public sources such as company websites, news, papers, patents, clinical trial registries and government records. We do not collect contact details
Service records	Request time, order number and company identifier, error details	Recorded automatically on our servers. IP addresses and email addresses are not recorded

What companies submit on the company page (corrections, disclosure scope, consent to listing, asset information, the post-submission survey) is information about the company and its assets; we do not ask for names or contact details. The survey asks only for a role type (e.g. representative, BD lead). Please do not enter personal data in free-text fields. If we find an email address or phone number in submitted text, we do not reflect it and ask again.
We do not process sensitive data, unique identifiers (such as resident registration numbers) or data of children under 14.

2. Why we use it and on what basis

Free account: sign-in; viewing and editing the account’s company card; showing submission history, review status, consent and membership status; sending verification codes and password reset emails. Basis: providing the account service you asked for (PIPA Article 15(1)(4)).
Payment data: billing, payment confirmation, tax invoices and invoices, refunds and payment disputes. Basis: performing the contract and our tax obligations (Article 15(1)(2) and (4)).
Contact email: replying and keeping a record of the request. Basis: answering your request (Article 15(1)(4)).
Outside questions from members: drafting answers that the member company edits and approves. Basis: performing the membership contract (Article 15(1)(4)); business information about the asker in a question is processed only as far as needed to draft the answer (Article 15(1)(6)).
Business information in public sources: stating facts about companies and assets (representatives, research sources) on company cards with their sources. We process only the minimum items needed, within the purpose for which the information was made public (presenting the company and its research). Basis: Article 15(1)(6).
Service records: incident response and security (Article 15(1)(6)).

3. How long we keep it

Item	Retention
Free account and work saved to it	Until the account is deleted. Deleting it on the “My card” page (내 카드 관리) removes it at once
Unfinished sign-up (email, company, confirmation time)	1 day
Sign-in session	30 days (ends on sign-out or account deletion)
Payment, tax invoice and invoice data	5 years from the filing deadline for the year of the transaction (Framework Act on National Taxes Article 85-3 and the VAT Act; or the period under Article 6 of the Act on the Consumer Protection in Electronic Commerce where it applies)
Outside questions from members	The question text and the email containing it (including our reply) are deleted within 30 days of receipt. After that we keep only the date received and a fingerprint (hash) from which the text cannot be restored
Contact email	3 years from the last exchange. If you ask earlier, we delete it without delay except what the law requires us to keep
Business information in public sources	While the company card is maintained. If the person asks us to stop processing or delete it, we remove it from the card without delay
Service records	90 days (1 year for payment functions)

Point-in-time recovery backups of our database keep deleted data for up to 35 days, after which it is removed automatically.

We give personal data to third parties only where PIPA allows it, such as with consent or where a law specifically provides.
When a biotech consents to listing, its company card is shown to paying buyers we have checked. Cards may include business information from public sources, such as a representative’s name or a researcher’s name and affiliation, with the source. This serves to present facts about the company and its assets within the purpose for which the information was made public, and the person can ask at any time for it to be removed from the card.
When a buyer sends a question directly to a biotech, or requests a meeting or access, we tell that biotech the buyer’s organization name. We do not share the names of the buyer’s staff.

5. Processors

Processor	Task
Amazon Web Services	Hosting and data storage (Seoul region); sign-in and verification emails (Amazon Cognito); internal notification emails (Amazon SES)
Google LLC (Google Workspace)	Sending, receiving and storing company email (contact@presigna.com)
KG Inicis Co., Ltd.	Korean card payments. We send only the order number, amount, product name and company name
PayPal Pte. Ltd.	Overseas PayPal payments. We send only the order number, amount and product name
Anthropic, PBC	Drafting company cards from public sources and drafting answers to members’ outside questions (AI). Account and payment data and contact email are not sent

Our contracts with processors set the protections required for personal data, and we supervise their handling. We update this policy when processors change.
Card and account details that KG Inicis and PayPal receive directly from payers are handled under each company’s own privacy policy.

6. Transfers outside Korea

Recipient (contact)	Country	Items	Purpose	When and how	Retention
Google LLC (privacy inquiries: support.google.com/policies/contact/data_privacy_office)	United States and other countries where Google operates data centers	Email addresses, names and content in contact and company email	Sending, receiving and storing email	Over the network when email is exchanged	Retention for contact email and outside questions in Section 3
Anthropic, PBC (privacy@anthropic.com)	United States	Business information in public sources, such as names of representatives and researchers; the content of members’ outside questions (which may include the asker’s name and affiliation)	Drafting company cards and members’ answer drafts	Over the network when a card draft or answer draft is made	Deleted within 30 days of receipt (Anthropic’s policy; longer where a usage policy review is needed)

These transfers are processing and storage entrusted to others that is needed to perform the service contract, disclosed in this policy (PIPA Article 28-8(1)(3)).
If you do not want your data transferred abroad, you may write to us by post at 2-515, 126 Yeouinaru-ro, Yeongdeungpo-gu, Seoul, Republic of Korea instead of email. Business information removed from a card at your request under Section 4 is no longer sent for card drafting.
Our service servers and the storage of account and payment data are in the AWS Seoul region (Republic of Korea).

7. Destruction

We destroy personal data without delay when the retention period ends or the purpose is achieved. Account deletion takes effect immediately.
Data we must keep under other laws (payment data in Section 3) is stored separately from other data and destroyed when that period ends.
Electronic files are deleted so they cannot be recovered; personal data received on paper is shredded.

8. Your rights

You may ask us at any time to give you access to, correct, delete or stop processing your personal data, or to withdraw consent.
You can delete a free account yourself on the “My card” page (내 카드 관리). For other requests, write to contact@presigna.com. A representative may act for you with proof of authority.
We act on a request within 10 days of receipt and tell you the result. Where the law allows us to refuse or delay, we tell you why.
People whose business information from public sources appears on a company card may ask for the source, the purpose of processing and their right to ask us to stop processing, and we tell them at once. If they ask us to stop processing or delete it, we remove it from the card without delay.

9. Security

Organizational: access to personal data is limited to the Representative Director.
Technical: encrypted connections (HTTPS) throughout; encryption of stored data; passwords are held and checked by Amazon Cognito, not by us; session identifiers are stored only as hashes; cloud permissions limited to what each function needs; automatic checks for personal data in submissions.
Physical: servers and data rely on the physical security of AWS data centers.

10. Cookies and browser storage

We do not use analytics, advertising or tracking cookies.
Signing in with a free account sets one sign-in cookie (30 days, HttpOnly and Secure). You cannot sign in if you block it.
Your chosen language, in-progress work on the company page and the time of your last submission from this browser are kept in your browser’s storage (localStorage) and are not sent to our servers (for signed-in members, in-progress work is also saved to the account as described in Sections 2 and 3). You can clear them in your browser settings.

11. Privacy officer

Privacy officer: Hyunsuk Shin (Representative Director)
Contact: contact@presigna.com
Access requests are received and handled by the privacy officer.

12. Remedies

For advice or remedies about a privacy infringement in Korea, you may contact:

Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
Supreme Prosecutors’ Office: 1301, www.spo.go.kr
Korean National Police Agency: 182, ecrm.police.go.kr

13. Users outside Korea

Personal data of overseas buyers’ staff is also processed under this policy in the Republic of Korea (AWS Seoul region).
Personal data of people in Japan is also protected to the extent required by Japan’s Act on the Protection of Personal Information, and requests are received as in Section 8.
Personal data of people in the European Union or the United Kingdom is transferred to the Republic of Korea under the adequacy decisions for Korea. In addition to the rights in Section 8, these people may complain to the supervisory authority where they live. If we begin to provide the Service regularly to buyers in the EU or UK, we will appoint a representative and give additional notices where required.

14. Changes

This policy applies from 2026-10-14. We post changes on the Service at least 7 days before they take effect (30 days for changes unfavorable to users) and keep earlier versions available.

Controller

Presigna Inc. (Representative Director Hyunsuk Shin) · 2-515, 126 Yeouinaru-ro, Yeongdeungpo-gu, Seoul, Republic of Korea · Business registration no. 680-87-03667 · contact@presigna.com