Privacy Policy

LOTTE Biologics Co., Ltd. (“LOTTE Biologics,” the “Company,” “we,” “our,” or “us”) is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, retain, disclose, and protect personal information obtained through our website (the “Website”) and through customer inquiries submitted via the Website, including the “Contact Us” function (collectively, the “Services”).

 

1. Purposes of Collecting and Using Personal Information

The Company processes personal information only for the purposes described below. If the Company intends to use personal information for any other purpose, the Company will take the measures required under applicable laws, including obtaining additional consent where necessary.

Responding to Customer Inquiries

The Company processes personal information submitted through the “Contact Us” function for the following purposes:

• Reviewing and verifying inquiries;

• Communicating with the individual who submitted the inquiry; and

• Providing responses to inquiries.

The Website may also use cookies and similar technologies. Please refer to our Cookie Policy for further information about the types of cookies used, their purposes, and how users can manage their cookie preferences.

 

2. Categories of Personal Information Collected and Methods of Collection

A. Personal Information Collected in Connection with Customer Inquiries

Category	Purpose	Personal Information Collected	Retention Period
Contact Us	Reviewing inquiries and providing responses	Required: Name, country, email address, affiliation	Until five days after the Company completes its response to the inquiry
Contact Us	Reviewing inquiries and providing responses	Optional: Department/company, title/position, telephone number	Until five days after the Company completes its response to the inquiry

Information such as access logs and cookies may be automatically generated and collected while users access or use the Website.

Internal confirmation required: The purpose and retention period applicable to access logs, cookies, and other automatically generated information should be specified before publication.

B. Methods of Collection

The Company collects personal information through the following methods:

• Information submitted through the “Contact Us” function on the Website; and

• Information automatically generated and collected through cookies, server logs, and similar technologies when users access or use the Website.

 

3. Security Measures

The Company implements reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction.

Employees and service providers who process personal information on behalf of the Company are required to maintain the confidentiality and security of such information in accordance with applicable laws, contractual obligations, and the Company’s internal policies.

The Company retains personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy or as otherwise required or permitted by applicable law. Personal information may be retained for a longer period where necessary to comply with legal obligations, respond to governmental or regulatory requests, resolve disputes, or establish, exercise, or defend legal claims.

 

4. Retention and Destruction of Personal Information

The Company destroys personal information without undue delay after the purpose for which the personal information was collected and used has been fulfilled.

Where personal information must be retained for a specified period under applicable laws or regulations, the Company will store such information separately from other personal information and destroy it promptly after the applicable retention period expires.

A. Destruction Procedure

The Company identifies personal information for which the applicable purpose has been fulfilled or the retention period has expired and destroys the personal information in accordance with its internal procedures and applicable laws.

Where retention is required by applicable laws or regulations, the relevant personal information will be stored separately and used only for the legally permitted purpose during the required retention period.

B. Destruction Methods

• Personal information stored electronically is permanently deleted using methods designed to prevent the information from being restored or reproduced.

• Personal information contained in paper records is destroyed by shredding or incineration.

 

5. Entrustment of Personal Information Processing

To facilitate the efficient operation and maintenance of the Website and the processing of customer inquiries, the Company entrusts certain personal information processing activities to the following service provider:

Service Provider	Entrusted Processing Activities	Personal Information Processed	Retention and Use Period
Lotte Innovate Co., Ltd.	Website system operation, improvement, and maintenance	Name, country, email address, inquiry subject, inquiry content, and other information included in the inquiry	Until the termination or expiration of the applicable service agreement, subject to applicable legal and contractual requirements

The Company manages and supervises its service providers in accordance with applicable laws to help ensure that personal information is protected when processed on the Company’s behalf.

If there is a material change to the service provider or the scope of the entrusted processing activities, the Company will disclose the change through this Privacy Policy or by another method required under applicable law.

 

6. Children’s Privacy

The Services are intended for a general audience and are not directed to children.

A. US

The Services are not directed to children under the age of 13, and the Company does not knowingly collect personal information online from children under the age of 13.

If the Company becomes aware that it has collected personal information online from a child under the age of 13 without the authorization required under applicable law, the Company will take appropriate steps to delete the information.

If you believe that a child under the age of 13 has submitted personal information to the Company, please contact the Chief Privacy Officer or the department responsible for handling privacy inquiries using the contact details provided in Section 8 below.

The U.S. COPPA rules apply to online services directed to children under 13 and to general-audience services that have actual knowledge that they collect personal information online from a child under 13. The amended COPPA Rule should therefore be reviewed against the Website’s actual audience and data collection practices. [ftc.gov], [ftc.gov], [ecfr.gov]

B. EU

If European data protection law applies to the processing of your personal data, the Company will process your personal data only where an appropriate legal basis exists. Depending on the circumstances, the applicable legal basis may include:

1. Performance of a contract: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

2. Compliance with a legal obligation: Processing is necessary for the Company to comply with an applicable legal or regulatory obligation.

3. Legitimate interests: Processing is necessary for the Company’s or a third party’s legitimate interests, provided that those interests are not overridden by your interests, fundamental rights, or freedoms. Such interests may include responding to inquiries, maintaining the security of the Website, and improving the Company’s services.

4. Consent: You have provided valid consent to the processing of your personal data for a specific purpose. Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

The GDPR recognizes six possible legal bases, including consent, performance of a contract, legal obligation, vital interests, public interest, and legitimate interests. Accordingly, the Company should identify and document the legal basis that actually applies to each processing activity rather than describe “consent or direction” as a single legal basis.

If certain personal data is required to respond to your request or perform a contract and you do not provide that data, the Company may be unable to respond to your request or provide the relevant service. Where required by applicable law, the Company will explain the consequences of not providing the requested data.

Subject to applicable law, you may have the right to:

• Request access to your personal data;

• Request correction of inaccurate or incomplete personal data;

• Request deletion of your personal data;

• Request restriction of the processing of your personal data;

• Object to the processing of your personal data;

• Request the portability of your personal data;

• Withdraw consent where the processing is based on consent; and

• Lodge a complaint with the competent data protection supervisory authority.

Requests to exercise these rights may be submitted using the contact details provided in Section 8 below.

 

7. Your Privacy Rights

Subject to applicable law, you may request access to, correction of, deletion of, or suspension or restriction of the processing of your personal information.

The Company will take reasonable steps to verify the identity of the person making the request before processing the request. The Company may request only the information reasonably necessary to verify the requester’s identity and authority.

The Company will respond to verified requests in accordance with applicable law. In certain circumstances, the Company may be permitted or required to deny or limit a request. If so, the Company will provide an explanation where required by applicable law.

To submit a privacy-related request, please contact the Company at lbkrm@lotte.net.

 

8. Chief Privacy Officer and Department Responsible for Privacy Inquiries

The Company has designated a Chief Privacy Officer and a department responsible for handling inquiries and complaints concerning the processing and protection of personal information.

Individuals may contact the Chief Privacy Officer or the responsible department regarding privacy inquiries, complaints, requests to exercise privacy rights, or requests for remedies arising from the use of the Services. The Company will review and respond to such inquiries in accordance with applicable law.

Category	Contact Details
Chief Privacy Officer	Taehyung Lim
Department Responsible for Privacy Inquiries	Risk Management
Telephone	+82-2-3213-8250
Email	lbkrm@lotte.net

 

9. Changes to This Privacy Policy

The Company may update this Privacy Policy to reflect changes in applicable laws, the Company’s personal information processing practices, or the operation of the Website.

If the Company makes a material change to this Privacy Policy, the Company will provide notice through the Website or by another method required under applicable law.

Effective Date: August 19, 2026

Previous versions of this Privacy Policy may be accessed through the link below.

[View Previous Versions]