Privacy policy

Article 1 (Purposes of processing personal information)

The Operator processes personal information for the following purposes. Personal information being processed is not used for any purpose other than those listed below; if a purpose changes, the Operator will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act of the Republic of Korea. Items processed without the data subject's consent, and the legal basis for each, are set out separately below in accordance with Article 22(3) of the same Act.

1. Receiving and handling enquiries — to reply to enquiries and correction reports you send us and to inform you of the outcome. (Basis: Article 15(1)4 of the Personal Information Protection Act of the Republic of Korea — measures taken at the data subject's request)
2. Delivery and security of the Service — to deliver web pages to your device and to protect the Service from abnormal access. (Basis: Article 15(1)4 of the same Act)
3. Usage statistics — to see which pages are read, and how much, as aggregate figures that identify no one, in order to run the content. (Basis: Article 15(1)6 of the same Act — the Operator's legitimate interest. No cookies or identifiers are created, only aggregate figures are produced, and you can block it, so this is limited to a scope that does not infringe data subjects' rights.)
4. Service usage analysis — to see which features are used and how, so that the Service can be run, processed with Google Analytics 4. (Basis: Article 15(1)6 of the Personal Information Protection Act of the Republic of Korea — the Operator's legitimate interest. Only a random identifier is used; it is not combined with any name or account; results are seen only as aggregated reports; and you can turn it off at any time in the settings. Turning it off places no restriction on your use of the Service.)

This Service has no sign-up, accounts or profiles, and sells no goods or services. It therefore processes no personal information for membership management, identity verification or payment.

Article 2 (Processing and retention periods)

(1) The Operator processes and retains personal information within the retention and use period prescribed by law or the period agreed to when the personal information was collected.

(2) The periods are as follows.

1. Enquiries — until the reply is complete. Once complete, the address and the message are destroyed without delay.
2. Delivery, security and usage statistics — the Operator does not separately collect or retain access records. Records generated in the course of delivery, and the raw data behind usage statistics, are processed by the processor named in Article 5 under its own retention policy; the Operator receives only aggregated statistics. Whether and for how long the raw data is retained is published by that company in its own privacy policy.
3. Usage analysis — user-level data is deleted after 14 months, whether or not you have visited since. If you turn it off in the settings, nothing is collected from then on.

Article 3 (Categories of personal information processed)

The Operator processes the following categories of personal information.

1. Enquiries — only where you send one yourself.
   • Required: email address, message
   • Optional: none
2. Information generated and processed automatically in the course of using an internet service
   • (a) Delivery and security: IP address; request information (requested address and time, browser and operating system type)
   • (b) Usage statistics: the address of the page you viewed, where you came from (referrer), your browser and device type, and how long the page took to appear. When you open a page, one script from Cloudflare Web Analytics is loaded from static.cloudflareinsights.com and measurements are sent to cloudflareinsights.com. It uses no cookies and neither creates nor stores any value that identifies a visitor.
   • The information above is processed by the processor named in Article 5; the Operator does not retain it in a form that identifies anyone.
3. Service usage analysis — the random identifier held in cookies (the _ga family), the pages you viewed and the features you used, your browser, device and screen information, and an approximate region inferred from your IP address. IP addresses are not stored. The script is fetched from www.googletagmanager.com and measurements are sent to *.google-analytics.com. If you turn usage statistics off in the settings, none of this is processed.
4. Fonts, images and other page components are all served by this Service itself. Apart from item 2(b) and item 3 above, no component communicates with an external server.

Article 4 (Provision of personal information to third parties)

The Operator does not provide data subjects' personal information to third parties. Personal information is not sold or shared, and is not provided except where specifically required by law.

Article 5 (Entrustment of personal-information processing)

(1) To provide the Service smoothly, the Operator entrusts personal-information processing as follows.

(2) The entrustment is governed by the processor's published terms of service and Data Processing Addendum, which contain the matters required by Article 26(1) of the Personal Information Protection Act of the Republic of Korea: a prohibition on processing beyond the entrusted purpose, technical and managerial safeguards, limits on sub-processing, supervision of the processor, and liability including compensation.

(3) Any change to the entrusted work or the processor will be published through this policy.

Article 6 (Transfer of personal information outside the Republic of Korea)

(1) The processor named in Article 5 is located outside the Republic of Korea, so merely connecting to the Service transfers request information out of the country.

(2) The transfers to Cloudflare, Inc. and to Google LLC are both made under Article 28-8(1)3 of the Personal Information Protection Act of the Republic of Korea (where entrusted processing or storage is necessary to conclude and perform a contract with the data subject). In accordance with item (a) of that subparagraph, the matters listed in Article 28-8(2) are disclosed here in this policy in place of individual notice.

(3) Details of the transfer:

(4) How to refuse, and what that means — there is no separate application or procedure; the methods below are the whole procedure. It splits in two.

• Delivery and security: every page is delivered through this transmission, so there is no way to prevent it other than not using the Service.
• Visit statistics: blocking cloudflareinsights.com in your browser settings or with an extension does prevent it, and the Service continues to work. Turning off JavaScript also stops the measurement, but in that case the breathing tool itself will not run — the written pages remain readable.
• Usage analysis: turning "Usage statistics" off in the on-screen settings stops the transmission from then on. Blocking www.googletagmanager.com and *.google-analytics.com in your browser settings or with an extension does the same. Cookies already stored are removed when you clear your browser data. Refusing places no restriction on your use of the Service.

Article 7 (Destruction procedure and method)

(1) When personal information is no longer needed, because the retention period has passed or the purpose has been achieved, the Operator destroys it without delay.

(2) Procedure and method:

1. Procedure — once an enquiry has been answered, the Operator selects that email and its contents for destruction and destroys them.
2. Method — personal information recorded and stored as electronic files is permanently deleted in a way that cannot be recovered. No personal information is kept on paper.

(3) There is no personal information that must be preserved under another law.

Article 8 (Rights and obligations of data subjects and legal representatives, and how to exercise them)

(1) You may at any time exercise your rights against the Operator, including requests for access to, correction of, deletion of, and suspension of processing of your personal information.

(2) These rights may be exercised in writing, by email or by similar means under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act of the Republic of Korea, and the Operator will act without delay.

(3) They may also be exercised through a representative, such as your legal representative or an authorised agent. In that case, a power of attorney in the form set out in Annex Form No. 11 of the Notice on Methods of Processing Personal Information of the Republic of Korea must be submitted.

(4) Requests for access and for suspension of processing may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act of the Republic of Korea.

(5) When a request for access, correction, deletion or suspension is made, the Operator verifies that the requester is the data subject or a lawful representative.

The only personal information the Operator could hold is an enquiry email you sent yourself. On request, we will confirm whether it is still held, tell you, and destroy it.

Article 9 (Measures to secure personal information)

The Operator takes the following measures to secure personal information.

1. Keeping the personal information processed to a minimum — there is no membership scheme, and no personal information is collected that the Service does not need. Pages are served as static files, so there is no personal-information processing system operated by the Operator behind them. The usage statistics in Article 3 are aggregated and held by the processor; the Operator only views the dashboard and never receives the raw data.
2. Restricting access — access to the enquiry mailbox is limited to the minimum needed for the work.
3. Encryption in transit — all traffic is HTTPS only, and unencrypted connections are blocked (HSTS).
4. Prompt destruction once the purpose is achieved — personal information from a completed enquiry is destroyed without delay under Article 7.

Article 10 (Devices that collect personal information automatically: installation, operation, and how to refuse them)

(1) The Operator uses the following cookies in order to understand usage. They are not set if you turn usage statistics off in the settings.

(2) Three things, however, are stored in your browser. None of them is transmitted anywhere, and none contains information that identifies you.

(3) The Cloudflare Web Analytics script in Article 3, item 2(b) is a device that measures page views automatically, but it uses no cookies, neither creates nor stores any value that identifies a visitor, and leaves nothing on your device.

(4) How to refuse, and what that means

• The storage in paragraph (2): you can block or clear this site's storage in your browser settings. The Service still works; saved settings return to their defaults and the tool no longer opens without a connection, and that is all.
• The measurement in paragraph (3): as in Article 6(4) — blocking cloudflareinsights.com stops it, and the Service continues to work.
• The cookies in paragraph (1): they are not set if you turn usage statistics off in the settings, and you can delete or block them in your browser settings. In either case there is no restriction on your use of the Service.

Article 11 (Behavioral information: collection, use, provision, and refusal)

The Operator does not collect, use or provide behavioral information for online targeted advertising or similar purposes. There is no advertising on this Service.

Article 12 (Personal information of children under 14)

(1) This Service does not verify users' ages, including whether a user is a child under 14 within the meaning of Article 22-2 of the Personal Information Protection Act of the Republic of Korea, and it is not aimed primarily at children.

(2) Because the Operator processes no personal information on the basis of consent (Article 1), there is no processing for which a legal representative's consent must be obtained under Article 22-2(1) of the same Act. If a child under 14 sends an enquiry, it is used only to reply and destroyed once the reply is complete.

Article 13 (Personal information protection officer)

(1) The Operator designates a personal information protection officer, who takes overall responsibility for personal-information processing and handles data subjects' complaints and remedies.

• Personal information protection officer — LumenTree (the Operator; under Article 31(2) of the Personal Information Protection Act of the Republic of Korea the Operator itself is the officer) · contact-breath@lumen-tree.com

(2) You may direct all enquiries, complaints and requests for remedy concerning personal information arising from your use of the Service to the officer. The Operator will respond and act without delay.

Article 14 (Where to send requests for access)

Requests for access to personal information under Article 35 of the Personal Information Protection Act of the Republic of Korea may be sent to the contact below. The Operator will do its best to handle them promptly.

• Access requests — LumenTree · contact-breath@lumen-tree.com

Article 15 (Remedies for infringement of rights)

(1) To obtain relief for an infringement of personal information, you may apply for dispute mediation or advice to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Centre of the Korea Internet & Security Agency, and similar bodies. For other reports or advice on personal-information infringement, contact the bodies below. These are Korean authorities. From outside Korea, drop the leading 0 and dial +82.

1. Personal Information Dispute Mediation Committee: 1833-6972, no area code (www.kopico.go.kr)
2. Personal Information Infringement Report Centre: 118, no area code (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: 1301, no area code (www.spo.go.kr)
4. National Police Agency: 182, no area code (ecrm.cyber.go.kr)

(2) A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35 (access), 36 (correction and deletion) or 37 (suspension of processing) of the Personal Information Protection Act of the Republic of Korea may file an administrative appeal under the Administrative Appeals Act of the Republic of Korea.

Article 16 (Changes to this policy)

(1) This policy applies from the effective date shown above.

(2) Changes are published on this page. A change that alters what the Service actually does — analytics or advertising, for instance — is made to this policy in the same release that ships the feature, and the effective date above changes at that point too.