Privacy Policy
Last Updated: November 10, 2025
BGPworks Co., Ltd., (“BGPworks,” “Company,” “we,” “our,” or “us”), doing business as BoxHero, is headquartered in Seoul, South Korea, and is the primary entity responsible for processing your personal information under applicable laws, including:
Personal Information Protection Act (“PIPA”)
Credit Information Use and Protection Act
Act on Promotion of Information and Communications Network Utilization and Information Protection
Protection of Communications Secrets Act
In accordance with PIPA Article 30, this Privacy Policy explains our procedures and standards for processing and protecting your personal information. It also informs you of your rights and how you can address related inquiries or grievances.
This Policy applies to your use of BoxHero, including our website, mobile applications, and related features and services (collectively, the “Services”). By using the Services, you agree to the terms of this Privacy Policy. If you do not agree, you should not access or use the Services.
If you have any questions, please contact us at support@boxhero.io.
1. Information We Collect and How We Use It
In providing the Services, we process only the minimum personal information necessary, and in accordance with Korean law.
1.1 Information Processed Without Additional Content
Under the Korean Personal Information Protection Act (PIPA) Article 15(1)(2), processing is required by law. In line with the Consumer Protection in Electronic Commerce Act (Article 6), we retain certain records:
Contracts and cancellations: Consumer identifiers and related records are stored for 5 years.
Payments and supply of goods/services: Payment and supply records are stored for 5 years.
Consumer complaints or disputes: Consumer identifiers and dispute resolution records are stored for 3 years.
Under PIPA Article 15(1)(2) and the Protection of Communications Secrets Act (Article 15-2), service usage data may be disclosed to investigative authorities with a valid court warrant. These records are retained for 3 months.
For account-related services under PIPA Article 15(1)(4) (performance of a contract), we process and retain the following:
Account registration and management: Required information includes your email address and profile name. Optional information may include your phone number or profile photo. This data is stored until account deletion.
Third-party login (Google, Apple, Kakao): Required information includes an external account ID and profile name, with email address as optional. If retention is required by law, data will be kept for the statutory period (e.g., 5 years).
Payment management: Required information includes payment method details (card issuer and last 4 digits of the card number). These are retained as required under applicable laws.
1.2 Information Processed With User Content
For certain optional services, we may process additional information as follows:
Feedback and Surveys: Optional information may include your email address and profile name.
Feature Updates, Promotions, and Newsletters: Optional information may include your email address and profile name.
Referral or Affiliate Programs: Optional information may include your user ID and referrer ID.
This information is retained until your account is deleted, unless a longer retention period is required by law.
1. Information We Collect and How We Use It
In providing the Services, we process only the minimum personal information necessary, and in accordance with Korean law.
1.1 Information Processed Without Additional Content
Under the Korean Personal Information Protection Act (PIPA) Article 15(1)(2), processing is required by law. In line with the Consumer Protection in Electronic Commerce Act (Article 6), we retain certain records:
Contracts and cancellations: Consumer identifiers and related records are stored for 5 years.
Payments and supply of goods/services: Payment and supply records are stored for 5 years.
Consumer complaints or disputes: Consumer identifiers and dispute resolution records are stored for 3 years.
Under PIPA Article 15(1)(2) and the Protection of Communications Secrets Act (Article 15-2), service usage data may be disclosed to investigative authorities with a valid court warrant. These records are retained for 3 months.
For account-related services under PIPA Article 15(1)(4) (performance of a contract), we process and retain the following:
Account registration and management: Required information includes your email address and profile name. Optional information may include your phone number or profile photo. This data is stored until account deletion.
Third-party login (Google, Apple, Kakao): Required information includes an external account ID and profile name, with email address as optional. If retention is required by law, data will be kept for the statutory period (e.g., 5 years).
Payment management: Required information includes payment method details (card issuer and last 4 digits of the card number). These are retained as required under applicable laws.
1.2 Information Processed With User Content
For certain optional services, we may process additional information as follows:
Feedback and Surveys: Optional information may include your email address and profile name.
Feature Updates, Promotions, and Newsletters: Optional information may include your email address and profile name.
Referral or Affiliate Programs: Optional information may include your user ID and referrer ID.
This information is retained until your account is deleted, unless a longer retention period is required by law.
1. Information We Collect and How We Use It
In providing the Services, we process only the minimum personal information necessary, and in accordance with Korean law.
1.1 Information Processed Without Additional Content
Under the Korean Personal Information Protection Act (PIPA) Article 15(1)(2), processing is required by law. In line with the Consumer Protection in Electronic Commerce Act (Article 6), we retain certain records:
Contracts and cancellations: Consumer identifiers and related records are stored for 5 years.
Payments and supply of goods/services: Payment and supply records are stored for 5 years.
Consumer complaints or disputes: Consumer identifiers and dispute resolution records are stored for 3 years.
Under PIPA Article 15(1)(2) and the Protection of Communications Secrets Act (Article 15-2), service usage data may be disclosed to investigative authorities with a valid court warrant. These records are retained for 3 months.
For account-related services under PIPA Article 15(1)(4) (performance of a contract), we process and retain the following:
Account registration and management: Required information includes your email address and profile name. Optional information may include your phone number or profile photo. This data is stored until account deletion.
Third-party login (Google, Apple, Kakao): Required information includes an external account ID and profile name, with email address as optional. If retention is required by law, data will be kept for the statutory period (e.g., 5 years).
Payment management: Required information includes payment method details (card issuer and last 4 digits of the card number). These are retained as required under applicable laws.
1.2 Information Processed With User Content
For certain optional services, we may process additional information as follows:
Feedback and Surveys: Optional information may include your email address and profile name.
Feature Updates, Promotions, and Newsletters: Optional information may include your email address and profile name.
Referral or Affiliate Programs: Optional information may include your user ID and referrer ID.
This information is retained until your account is deleted, unless a longer retention period is required by law.
2. Children’s Privacy
BGPworks does not knowingly process personal information of children under the age of 14. However, if we obtain verifiable consent from a parent or legal guardian, we may process the personal information of children under 14 in accordance with PIPA and other applicable laws.
2. Children’s Privacy
BGPworks does not knowingly process personal information of children under the age of 14. However, if we obtain verifiable consent from a parent or legal guardian, we may process the personal information of children under 14 in accordance with PIPA and other applicable laws.
2. Children’s Privacy
BGPworks does not knowingly process personal information of children under the age of 14. However, if we obtain verifiable consent from a parent or legal guardian, we may process the personal information of children under 14 in accordance with PIPA and other applicable laws.
3. Sharing Personal Information with Third Parties
3.1 We only disclose personal information to third parties within the scope outlined in this Privacy Policy and for the purposes stated at the time of collection. We do not provide personal information to third parties without consent, except in cases permitted under PIPA Articles 17–18 or other applicable laws.
3.2 In accordance with the Korean government’s Guidelines on Processing and Protecting Personal Information in Emergencies, we may provide personal information to relevant authorities without user consent in cases of natural disasters, infectious disease outbreaks, imminent threats to life or safety, or urgent risk of significant property damage.
For details, you may refer to the government’s published guidelines.
3. Sharing Personal Information with Third Parties
3.1 We only disclose personal information to third parties within the scope outlined in this Privacy Policy and for the purposes stated at the time of collection. We do not provide personal information to third parties without consent, except in cases permitted under PIPA Articles 17–18 or other applicable laws.
3.2 In accordance with the Korean government’s Guidelines on Processing and Protecting Personal Information in Emergencies, we may provide personal information to relevant authorities without user consent in cases of natural disasters, infectious disease outbreaks, imminent threats to life or safety, or urgent risk of significant property damage.
For details, you may refer to the government’s published guidelines.
3. Sharing Personal Information with Third Parties
3.1 We only disclose personal information to third parties within the scope outlined in this Privacy Policy and for the purposes stated at the time of collection. We do not provide personal information to third parties without consent, except in cases permitted under PIPA Articles 17–18 or other applicable laws.
3.2 In accordance with the Korean government’s Guidelines on Processing and Protecting Personal Information in Emergencies, we may provide personal information to relevant authorities without user consent in cases of natural disasters, infectious disease outbreaks, imminent threats to life or safety, or urgent risk of significant property damage.
For details, you may refer to the government’s published guidelines.
4. Processing by Service Providers
4.1 To provide the Services, we entrust certain processing activities to the following third-party service providers. If a service provider further sub-contracts entrusted tasks, details of the sub-contractor and scope of work will be disclosed in the service provider’s own privacy policy.
We work with the following trusted providers, each handling specific tasks that are necessary to operate and improve our Services:
Amazon Web Services, (AWS), Heroku, Cloudflare – Hosting and operation of servers, databases, and related infrastructure.
Stripe – Paid subscription and payment processing.
HelpScout – Email-based customer support services.
Postmark – Email delivery server operations.
4.2 In accordance with Personal Information Protection Act (PIPA) Article 26, BGPworks includes in its outsourcing agreements provisions prohibiting the use of personal information for purposes other than those entrusted, requiring technical and managerial security safeguards, restricting sub-outsourcing without prior consent, providing for supervision and audits, and assigning liability for damages. The Company monitors its service providers to ensure they process entrusted personal information safely.
4.3 Under PIPA Article 26(6), if a service provider intends to sub-contract processing activities, it must first obtain the Company’s approval.
4.4 If there are changes to the scope of entrusted processing or to the list of service providers, we will promptly update this Privacy Policy to disclose such changes.
4.5 Where entrusted processing involves a transfer of personal information outside South Korea, details are provided in Section 5 (Overseas Collection and Transfer of Personal Information).
4. Processing by Service Providers
4.1 To provide the Services, we entrust certain processing activities to the following third-party service providers. If a service provider further sub-contracts entrusted tasks, details of the sub-contractor and scope of work will be disclosed in the service provider’s own privacy policy.
We work with the following trusted providers, each handling specific tasks that are necessary to operate and improve our Services:
Amazon Web Services, (AWS), Heroku, Cloudflare – Hosting and operation of servers, databases, and related infrastructure.
Stripe – Paid subscription and payment processing.
HelpScout – Email-based customer support services.
Postmark – Email delivery server operations.
4.2 In accordance with Personal Information Protection Act (PIPA) Article 26, BGPworks includes in its outsourcing agreements provisions prohibiting the use of personal information for purposes other than those entrusted, requiring technical and managerial security safeguards, restricting sub-outsourcing without prior consent, providing for supervision and audits, and assigning liability for damages. The Company monitors its service providers to ensure they process entrusted personal information safely.
4.3 Under PIPA Article 26(6), if a service provider intends to sub-contract processing activities, it must first obtain the Company’s approval.
4.4 If there are changes to the scope of entrusted processing or to the list of service providers, we will promptly update this Privacy Policy to disclose such changes.
4.5 Where entrusted processing involves a transfer of personal information outside South Korea, details are provided in Section 5 (Overseas Collection and Transfer of Personal Information).
4. Processing by Service Providers
4.1 To provide the Services, we entrust certain processing activities to the following third-party service providers. If a service provider further sub-contracts entrusted tasks, details of the sub-contractor and scope of work will be disclosed in the service provider’s own privacy policy.
We work with the following trusted providers, each handling specific tasks that are necessary to operate and improve our Services:
Amazon Web Services, (AWS), Heroku, Cloudflare – Hosting and operation of servers, databases, and related infrastructure.
Stripe – Paid subscription and payment processing.
HelpScout – Email-based customer support services.
Postmark – Email delivery server operations.
4.2 In accordance with Personal Information Protection Act (PIPA) Article 26, BGPworks includes in its outsourcing agreements provisions prohibiting the use of personal information for purposes other than those entrusted, requiring technical and managerial security safeguards, restricting sub-outsourcing without prior consent, providing for supervision and audits, and assigning liability for damages. The Company monitors its service providers to ensure they process entrusted personal information safely.
4.3 Under PIPA Article 26(6), if a service provider intends to sub-contract processing activities, it must first obtain the Company’s approval.
4.4 If there are changes to the scope of entrusted processing or to the list of service providers, we will promptly update this Privacy Policy to disclose such changes.
4.5 Where entrusted processing involves a transfer of personal information outside South Korea, details are provided in Section 5 (Overseas Collection and Transfer of Personal Information).
5. International Transfers of Personal Information
5.1 We transfer certain personal information collected from users to overseas recipients for hosting, operation, payment, support, and analytics purposes. In accordance with PIPA Article 28-8(2), we provide the following details about such transfers:
Refusal to consent to cross-border transfers may make it impossible to use the Services. If you do not wish to consent, you may withdraw from BGPworks by deleting your account within the Services (Account Settings > Delete Data) or by contacting the Customer Experience Team (support@boxhero.io) for account deletion.
5.2 Under the Korean Personal Information Protection Act (PIPA, Article 28-8(1)(3)), we may entrust the processing and storage of personal information to external service providers. Information is transferred securely in real time and only as necessary for service use. Our trusted providers include:
Amazon Web Services (AWS), Heroku, and Cloudflare: Personal information and data necessary for service use are transferred via secure networks during service use. These providers support application hosting and service operation. Data is retained until account deletion.
Stripe: Payment information is transferred in real time during transactions for the purpose of payment processing. Data is retained until account deletion.
HelpScout: Email addresses are transferred in real time when customer support inquiries are received. This information is used to provide support services and retained until account deletion.
Postmark: Email addresses are transferred in real time during email delivery. This information is used only for email delivery and retained for 30 days.
Yandex: Personal information and data necessary for service use are transferred via secure networks during service use. This provider supports website analytics and usage analysis. Data is retained until account deletion.
5. International Transfers of Personal Information
5.1 We transfer certain personal information collected from users to overseas recipients for hosting, operation, payment, support, and analytics purposes. In accordance with PIPA Article 28-8(2), we provide the following details about such transfers:
Refusal to consent to cross-border transfers may make it impossible to use the Services. If you do not wish to consent, you may withdraw from BGPworks by deleting your account within the Services (Account Settings > Delete Data) or by contacting the Customer Experience Team (support@boxhero.io) for account deletion.
5.2 Under the Korean Personal Information Protection Act (PIPA, Article 28-8(1)(3)), we may entrust the processing and storage of personal information to external service providers. Information is transferred securely in real time and only as necessary for service use. Our trusted providers include:
Amazon Web Services (AWS), Heroku, and Cloudflare: Personal information and data necessary for service use are transferred via secure networks during service use. These providers support application hosting and service operation. Data is retained until account deletion.
Stripe: Payment information is transferred in real time during transactions for the purpose of payment processing. Data is retained until account deletion.
HelpScout: Email addresses are transferred in real time when customer support inquiries are received. This information is used to provide support services and retained until account deletion.
Postmark: Email addresses are transferred in real time during email delivery. This information is used only for email delivery and retained for 30 days.
Yandex: Personal information and data necessary for service use are transferred via secure networks during service use. This provider supports website analytics and usage analysis. Data is retained until account deletion.
5. International Transfers of Personal Information
5.1 We transfer certain personal information collected from users to overseas recipients for hosting, operation, payment, support, and analytics purposes. In accordance with PIPA Article 28-8(2), we provide the following details about such transfers:
Refusal to consent to cross-border transfers may make it impossible to use the Services. If you do not wish to consent, you may withdraw from BGPworks by deleting your account within the Services (Account Settings > Delete Data) or by contacting the Customer Experience Team (support@boxhero.io) for account deletion.
5.2 Under the Korean Personal Information Protection Act (PIPA, Article 28-8(1)(3)), we may entrust the processing and storage of personal information to external service providers. Information is transferred securely in real time and only as necessary for service use. Our trusted providers include:
Amazon Web Services (AWS), Heroku, and Cloudflare: Personal information and data necessary for service use are transferred via secure networks during service use. These providers support application hosting and service operation. Data is retained until account deletion.
Stripe: Payment information is transferred in real time during transactions for the purpose of payment processing. Data is retained until account deletion.
HelpScout: Email addresses are transferred in real time when customer support inquiries are received. This information is used to provide support services and retained until account deletion.
Postmark: Email addresses are transferred in real time during email delivery. This information is used only for email delivery and retained for 30 days.
Yandex: Personal information and data necessary for service use are transferred via secure networks during service use. This provider supports website analytics and usage analysis. Data is retained until account deletion.
6. How We Delete Personal Information
6.1 General Principle
When the retention period for personal information has expired, or when the purpose of processing has been fulfilled and the information is no longer necessary, the Company will destroy such personal information without undue delay.
6.2 Continued Retention When Required by Law
If, despite the expiration of the retention period or fulfillment of the processing purpose, BGPworks is required by law to continue retaining certain personal information, such data will be moved to a separate database (DB) or stored in a different location for safekeeping.
* The categories of information retained under other laws and the legal basis for retention are set out in Section 1 (Information We Collect, Purpose of Processing, and Retention).
6.3 Destruction Procedures and Methods
Procedures – When grounds for destruction arise, the Company selects the personal information subject to destruction and proceeds with the deletion after confirmation by a designated company officer responsible for personal information protection.
Methods – Personal information recorded or stored in electronic file format is permanently deleted using technical or physical methods so that the records cannot be recovered or reconstructed. Personal information recorded or stored in paper documents is destroyed by shredding or incineration.
6. How We Delete Personal Information
6.1 General Principle
When the retention period for personal information has expired, or when the purpose of processing has been fulfilled and the information is no longer necessary, the Company will destroy such personal information without undue delay.
6.2 Continued Retention When Required by Law
If, despite the expiration of the retention period or fulfillment of the processing purpose, BGPworks is required by law to continue retaining certain personal information, such data will be moved to a separate database (DB) or stored in a different location for safekeeping.
* The categories of information retained under other laws and the legal basis for retention are set out in Section 1 (Information We Collect, Purpose of Processing, and Retention).
6.3 Destruction Procedures and Methods
Procedures – When grounds for destruction arise, the Company selects the personal information subject to destruction and proceeds with the deletion after confirmation by a designated company officer responsible for personal information protection.
Methods – Personal information recorded or stored in electronic file format is permanently deleted using technical or physical methods so that the records cannot be recovered or reconstructed. Personal information recorded or stored in paper documents is destroyed by shredding or incineration.
6. How We Delete Personal Information
6.1 General Principle
When the retention period for personal information has expired, or when the purpose of processing has been fulfilled and the information is no longer necessary, the Company will destroy such personal information without undue delay.
6.2 Continued Retention When Required by Law
If, despite the expiration of the retention period or fulfillment of the processing purpose, BGPworks is required by law to continue retaining certain personal information, such data will be moved to a separate database (DB) or stored in a different location for safekeeping.
* The categories of information retained under other laws and the legal basis for retention are set out in Section 1 (Information We Collect, Purpose of Processing, and Retention).
6.3 Destruction Procedures and Methods
Procedures – When grounds for destruction arise, the Company selects the personal information subject to destruction and proceeds with the deletion after confirmation by a designated company officer responsible for personal information protection.
Methods – Personal information recorded or stored in electronic file format is permanently deleted using technical or physical methods so that the records cannot be recovered or reconstructed. Personal information recorded or stored in paper documents is destroyed by shredding or incineration.
7. Your Rights and Choices
7.1 Your Rights
You may exercise the following rights with respect to your personal information (“Rights Requests”) at any time:
Access and obtain a copy of your personal information
Request transmission of your personal information
Request correction or deletion of your personal information
Request suspension of processing
Withdraw your consent to processing
7.2 How to Exercise Your Rights
You may exercise these rights in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act through the following methods:
Logging into the Services and using “Account Settings” to directly view, correct, delete, suspend processing, or withdraw consent;
Submitting a request via the “Help” function on the website;
Sending a written request to our Seoul office (#E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea); or
Contacting us by email at support@boxhero.io.
You may also, at any time, reject automated decisions or request an explanation regarding such decisions through the “Help” function.
7.3 Exercising Rights Through a Representative
Rights requests may also be exercised through a legal representative or an authorized agent. In such cases, you must submit a power of attorney in the form prescribed in Annex 11 of the Public Notice on the Methods of Processing Personal Information.
7.4 Legal Restrictions
Your right to access or suspend the processing of personal information may be restricted under PIPA Article 35(4) and Article 37(2). Where other laws require the collection or retention of certain personal information, deletion may not be requested.
7.5 Identity Verification
We will verify whether the individual making the request is the data subject or a duly authorized representative.
7.6 Contact for Rights Requests
We will respond to rights requests without undue delay and, in any event, within ten (10) days of receipt (or immediately in the case of transmission requests).
Rights Request Contact
Department: Customer Experience Team
Address: #E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea (04782)
Email: support@boxhero.io
7. Your Rights and Choices
7.1 Your Rights
You may exercise the following rights with respect to your personal information (“Rights Requests”) at any time:
Access and obtain a copy of your personal information
Request transmission of your personal information
Request correction or deletion of your personal information
Request suspension of processing
Withdraw your consent to processing
7.2 How to Exercise Your Rights
You may exercise these rights in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act through the following methods:
Logging into the Services and using “Account Settings” to directly view, correct, delete, suspend processing, or withdraw consent;
Submitting a request via the “Help” function on the website;
Sending a written request to our Seoul office (#E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea); or
Contacting us by email at support@boxhero.io.
You may also, at any time, reject automated decisions or request an explanation regarding such decisions through the “Help” function.
7.3 Exercising Rights Through a Representative
Rights requests may also be exercised through a legal representative or an authorized agent. In such cases, you must submit a power of attorney in the form prescribed in Annex 11 of the Public Notice on the Methods of Processing Personal Information.
7.4 Legal Restrictions
Your right to access or suspend the processing of personal information may be restricted under PIPA Article 35(4) and Article 37(2). Where other laws require the collection or retention of certain personal information, deletion may not be requested.
7.5 Identity Verification
We will verify whether the individual making the request is the data subject or a duly authorized representative.
7.6 Contact for Rights Requests
We will respond to rights requests without undue delay and, in any event, within ten (10) days of receipt (or immediately in the case of transmission requests).
Rights Request Contact
Department: Customer Experience Team
Address: #E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea (04782)
Email: support@boxhero.io
7. Your Rights and Choices
7.1 Your Rights
You may exercise the following rights with respect to your personal information (“Rights Requests”) at any time:
Access and obtain a copy of your personal information
Request transmission of your personal information
Request correction or deletion of your personal information
Request suspension of processing
Withdraw your consent to processing
7.2 How to Exercise Your Rights
You may exercise these rights in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act through the following methods:
Logging into the Services and using “Account Settings” to directly view, correct, delete, suspend processing, or withdraw consent;
Submitting a request via the “Help” function on the website;
Sending a written request to our Seoul office (#E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea); or
Contacting us by email at support@boxhero.io.
You may also, at any time, reject automated decisions or request an explanation regarding such decisions through the “Help” function.
7.3 Exercising Rights Through a Representative
Rights requests may also be exercised through a legal representative or an authorized agent. In such cases, you must submit a power of attorney in the form prescribed in Annex 11 of the Public Notice on the Methods of Processing Personal Information.
7.4 Legal Restrictions
Your right to access or suspend the processing of personal information may be restricted under PIPA Article 35(4) and Article 37(2). Where other laws require the collection or retention of certain personal information, deletion may not be requested.
7.5 Identity Verification
We will verify whether the individual making the request is the data subject or a duly authorized representative.
7.6 Contact for Rights Requests
We will respond to rights requests without undue delay and, in any event, within ten (10) days of receipt (or immediately in the case of transmission requests).
Rights Request Contact
Department: Customer Experience Team
Address: #E1005, 7, Yeonmujang 5ga-gil, Seongdong-gu, Seoul, Republic of Korea (04782)
Email: support@boxhero.io
8. How We Protect Your Personal Information
To safeguard personal information, we implement the following measures:
8.1 Administrative Measures
Establishing and implementing internal management plans
Conducting regular employee training
Assigning responsibility to designated personnel, including the Personal Information Protection Manager and the Customer Experience Team as the contact point for privacy matters.
8.2 Technical Measures
Managing and restricting access rights to personal information systems
Installing and operating access control systems and related safeguards
Blocking external internet access from systems that process personal information
Encrypting personal information
Maintaining and auditing access logs
Installing and updating security programs
Performing regular vulnerability assessments and applying necessary patches
8.3 Physical Measures
Restricting access to computer rooms, data storage rooms, and other secure facilities
Storing physical documents and media in locked, safe locations
Implementing safety measures against disasters and accidents
Controlling the removal and entry of auxiliary storage devices
8. How We Protect Your Personal Information
To safeguard personal information, we implement the following measures:
8.1 Administrative Measures
Establishing and implementing internal management plans
Conducting regular employee training
Assigning responsibility to designated personnel, including the Personal Information Protection Manager and the Customer Experience Team as the contact point for privacy matters.
8.2 Technical Measures
Managing and restricting access rights to personal information systems
Installing and operating access control systems and related safeguards
Blocking external internet access from systems that process personal information
Encrypting personal information
Maintaining and auditing access logs
Installing and updating security programs
Performing regular vulnerability assessments and applying necessary patches
8.3 Physical Measures
Restricting access to computer rooms, data storage rooms, and other secure facilities
Storing physical documents and media in locked, safe locations
Implementing safety measures against disasters and accidents
Controlling the removal and entry of auxiliary storage devices
8. How We Protect Your Personal Information
To safeguard personal information, we implement the following measures:
8.1 Administrative Measures
Establishing and implementing internal management plans
Conducting regular employee training
Assigning responsibility to designated personnel, including the Personal Information Protection Manager and the Customer Experience Team as the contact point for privacy matters.
8.2 Technical Measures
Managing and restricting access rights to personal information systems
Installing and operating access control systems and related safeguards
Blocking external internet access from systems that process personal information
Encrypting personal information
Maintaining and auditing access logs
Installing and updating security programs
Performing regular vulnerability assessments and applying necessary patches
8.3 Physical Measures
Restricting access to computer rooms, data storage rooms, and other secure facilities
Storing physical documents and media in locked, safe locations
Implementing safety measures against disasters and accidents
Controlling the removal and entry of auxiliary storage devices
9. Automatic Collection and Behavioral Information
9.1 Cookies and Behavioral Information
The Company uses cookies to process behavioral information in order to provide users with optimized services and benefits during their use of the Services. Cookies are small data files sent by the server (http) operating the website to a user’s browser and stored locally.
9.2 Information Collected
In accordance with PIPA Article 15(1)(1), BGPworks may automatically collect the following types of behavioral information when you access the Services:
Device and settings information (e.g., device type, OS platform, browser type, IP address, language settings, time of access)
Service usage patterns (e.g., login history, inventory updates, team invitations, activity logs, pages visited, feature usage statistics)
9.3 Purpose of Collection
Behavioral information is collected and used for the following purposes: maintaining service access and login status; analyzing visitor statistics (e.g., repeat visits, time spent on pages); and developing new features and improving the Services.
9.4 Retention and Disposal
Behavioral information collected via cookies is retained for up to one (1) month from the date of collection, after which it is permanently destroyed.
9.5 Limitations on Collection
The Company only collects the minimum behavioral information necessary to generate service usage statistics and improve the Services. We do not collect any sensitive behavioral information that could infringe on your rights or privacy, such as political opinions, medical history, or other protected categories.
9.6 User Control of Cookies
You may adjust your browser settings to allow or block cookies. Methods vary by browser:
Web Browsers
Chrome: Menu (⋮) > New Incognito Window (Ctrl+Shift+N)
Edge: Menu (…) > New InPrivate Window (Ctrl+Shift+N)
Mobile Browsers
Chrome: Menu (⋮) > New Incognito Tab
Safari: Device Settings > Safari > Advanced > Block All Cookies
Samsung Internet: Tabs > Turn on Secret Mode > Start
9.7 Contact for Behavioral Information
For questions, objections, or concerns regarding the collection or use of behavioral information, please contact:
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
9. Automatic Collection and Behavioral Information
9.1 Cookies and Behavioral Information
The Company uses cookies to process behavioral information in order to provide users with optimized services and benefits during their use of the Services. Cookies are small data files sent by the server (http) operating the website to a user’s browser and stored locally.
9.2 Information Collected
In accordance with PIPA Article 15(1)(1), BGPworks may automatically collect the following types of behavioral information when you access the Services:
Device and settings information (e.g., device type, OS platform, browser type, IP address, language settings, time of access)
Service usage patterns (e.g., login history, inventory updates, team invitations, activity logs, pages visited, feature usage statistics)
9.3 Purpose of Collection
Behavioral information is collected and used for the following purposes: maintaining service access and login status; analyzing visitor statistics (e.g., repeat visits, time spent on pages); and developing new features and improving the Services.
9.4 Retention and Disposal
Behavioral information collected via cookies is retained for up to one (1) month from the date of collection, after which it is permanently destroyed.
9.5 Limitations on Collection
The Company only collects the minimum behavioral information necessary to generate service usage statistics and improve the Services. We do not collect any sensitive behavioral information that could infringe on your rights or privacy, such as political opinions, medical history, or other protected categories.
9.6 User Control of Cookies
You may adjust your browser settings to allow or block cookies. Methods vary by browser:
Web Browsers
Chrome: Menu (⋮) > New Incognito Window (Ctrl+Shift+N)
Edge: Menu (…) > New InPrivate Window (Ctrl+Shift+N)
Mobile Browsers
Chrome: Menu (⋮) > New Incognito Tab
Safari: Device Settings > Safari > Advanced > Block All Cookies
Samsung Internet: Tabs > Turn on Secret Mode > Start
9.7 Contact for Behavioral Information
For questions, objections, or concerns regarding the collection or use of behavioral information, please contact:
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
9. Automatic Collection and Behavioral Information
9.1 Cookies and Behavioral Information
The Company uses cookies to process behavioral information in order to provide users with optimized services and benefits during their use of the Services. Cookies are small data files sent by the server (http) operating the website to a user’s browser and stored locally.
9.2 Information Collected
In accordance with PIPA Article 15(1)(1), BGPworks may automatically collect the following types of behavioral information when you access the Services:
Device and settings information (e.g., device type, OS platform, browser type, IP address, language settings, time of access)
Service usage patterns (e.g., login history, inventory updates, team invitations, activity logs, pages visited, feature usage statistics)
9.3 Purpose of Collection
Behavioral information is collected and used for the following purposes: maintaining service access and login status; analyzing visitor statistics (e.g., repeat visits, time spent on pages); and developing new features and improving the Services.
9.4 Retention and Disposal
Behavioral information collected via cookies is retained for up to one (1) month from the date of collection, after which it is permanently destroyed.
9.5 Limitations on Collection
The Company only collects the minimum behavioral information necessary to generate service usage statistics and improve the Services. We do not collect any sensitive behavioral information that could infringe on your rights or privacy, such as political opinions, medical history, or other protected categories.
9.6 User Control of Cookies
You may adjust your browser settings to allow or block cookies. Methods vary by browser:
Web Browsers
Chrome: Menu (⋮) > New Incognito Window (Ctrl+Shift+N)
Edge: Menu (…) > New InPrivate Window (Ctrl+Shift+N)
Mobile Browsers
Chrome: Menu (⋮) > New Incognito Tab
Safari: Device Settings > Safari > Advanced > Block All Cookies
Samsung Internet: Tabs > Turn on Secret Mode > Start
9.7 Contact for Behavioral Information
For questions, objections, or concerns regarding the collection or use of behavioral information, please contact:
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
10. Personal Information Protection Manager
10.1 We take the protection of your personal information seriously and have designated a company officer to act as the Personal Information Protection Manager (“Designated Contact”). This individual is responsible for overseeing compliance with applicable laws and handling all privacy-related requests, inquiries, and complaints.
However, BGPworks cannot be held responsible for damages arising from causes outside of our control, such as a user’s own negligence or incidents that occur in areas not managed by the company, despite our compliance with legally required technical, physical, and administrative safeguards.
Personal Information Protection Manager
Name: Heehong Moon
Position: Director, CEO
Email: bbirec@bgpworks.com
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
10. Personal Information Protection Manager
10.1 We take the protection of your personal information seriously and have designated a company officer to act as the Personal Information Protection Manager (“Designated Contact”). This individual is responsible for overseeing compliance with applicable laws and handling all privacy-related requests, inquiries, and complaints.
However, BGPworks cannot be held responsible for damages arising from causes outside of our control, such as a user’s own negligence or incidents that occur in areas not managed by the company, despite our compliance with legally required technical, physical, and administrative safeguards.
Personal Information Protection Manager
Name: Heehong Moon
Position: Director, CEO
Email: bbirec@bgpworks.com
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
10. Personal Information Protection Manager
10.1 We take the protection of your personal information seriously and have designated a company officer to act as the Personal Information Protection Manager (“Designated Contact”). This individual is responsible for overseeing compliance with applicable laws and handling all privacy-related requests, inquiries, and complaints.
However, BGPworks cannot be held responsible for damages arising from causes outside of our control, such as a user’s own negligence or incidents that occur in areas not managed by the company, despite our compliance with legally required technical, physical, and administrative safeguards.
Personal Information Protection Manager
Name: Heehong Moon
Position: Director, CEO
Email: bbirec@bgpworks.com
Personal Information Contact
Department: Customer Experience Team
Email: support@boxhero.io
11. How to Resolve Complaints and Disputes
11.1 Reporting and Consultation
If you wish to report or seek consultation on personal information infringement, you may contact the following institutions in South Korea:
Personal Information Dispute Mediation Committee
http://www.kopico.go.kr, ☎ 1833-6972Personal Information Infringement Report Center
http://privacy.kisa.or.kr, ☎ 118Supreme Prosecutors’ Office Cybercrime Investigation Department
http://www.spo.go.kr, ☎ 1301 or 02-3480-2000National Police Agency Cyber Bureau
http://www.police.go.kr, ☎ 182
11.2 Administrative Appeals
In accordance with PIPA Articles 35–37, if your rights or interests are infringed due to the action or inaction of a public institution in response to your request, you may file an administrative appeal under the Administrative Appeals Act.
Central Administrative Appeals Commission
http://www.simpan.go.kr, ☎ 110
11. How to Resolve Complaints and Disputes
11.1 Reporting and Consultation
If you wish to report or seek consultation on personal information infringement, you may contact the following institutions in South Korea:
Personal Information Dispute Mediation Committee
http://www.kopico.go.kr, ☎ 1833-6972Personal Information Infringement Report Center
http://privacy.kisa.or.kr, ☎ 118Supreme Prosecutors’ Office Cybercrime Investigation Department
http://www.spo.go.kr, ☎ 1301 or 02-3480-2000National Police Agency Cyber Bureau
http://www.police.go.kr, ☎ 182
11.2 Administrative Appeals
In accordance with PIPA Articles 35–37, if your rights or interests are infringed due to the action or inaction of a public institution in response to your request, you may file an administrative appeal under the Administrative Appeals Act.
Central Administrative Appeals Commission
http://www.simpan.go.kr, ☎ 110
11. How to Resolve Complaints and Disputes
11.1 Reporting and Consultation
If you wish to report or seek consultation on personal information infringement, you may contact the following institutions in South Korea:
Personal Information Dispute Mediation Committee
http://www.kopico.go.kr, ☎ 1833-6972Personal Information Infringement Report Center
http://privacy.kisa.or.kr, ☎ 118Supreme Prosecutors’ Office Cybercrime Investigation Department
http://www.spo.go.kr, ☎ 1301 or 02-3480-2000National Police Agency Cyber Bureau
http://www.police.go.kr, ☎ 182
11.2 Administrative Appeals
In accordance with PIPA Articles 35–37, if your rights or interests are infringed due to the action or inaction of a public institution in response to your request, you may file an administrative appeal under the Administrative Appeals Act.
Central Administrative Appeals Commission
http://www.simpan.go.kr, ☎ 110
12. Changes to This Policy
This Privacy Policy applies from the effective date stated above. If we make material changes to this Policy, we will provide advance notice of the changes and their effective date, either through a pop-up on our Services or by direct notice to you, as required by law.
Previous versions of this Privacy Policy will remain available for your reference.
Previous Versions: [LINK]
12. Changes to This Policy
This Privacy Policy applies from the effective date stated above. If we make material changes to this Policy, we will provide advance notice of the changes and their effective date, either through a pop-up on our Services or by direct notice to you, as required by law.
Previous versions of this Privacy Policy will remain available for your reference.
Previous Versions: [LINK]
12. Changes to This Policy
This Privacy Policy applies from the effective date stated above. If we make material changes to this Policy, we will provide advance notice of the changes and their effective date, either through a pop-up on our Services or by direct notice to you, as required by law.
Previous versions of this Privacy Policy will remain available for your reference.
Previous Versions: [LINK]
Features
Use Cases
Tools
© 2025 BoxHero, Inc.
Features
Use Cases
Tools
© 2025 BoxHero, Inc.
Features
Use Cases
Tools
© 2025 BoxHero, Inc.