Privacy policy

Who we are

The controller under this policy is Decisionary, based in Seoul, Republic of Korea.

Decisionary does not run its own servers. Your data is stored on the servers of the providers listed in section 5, which hold and process it on our behalf. Decisionary decides what is kept, for how long and when it is deleted, and is responsible for it.

Privacy officer: Seoksoo Ko (founder)

Send privacy questions, requests and complaints to the email below.

hello@decisionarypro.com

What we process

We only process what you enter or send us. We do not ask for sensitive data such as health or beliefs, so please do not send it.

• Inquiry form: name, company, work email, who you are, what you want to build, current product or systems, budget range, timing, attached files, and the case you came from (if you used a case page); the source tag of your visit, if the link included one
• Call booking: name, email, company, what you want to build, booking time and video call link
• Email: your address and the content of your message
• Website visits: access logs kept by our hosting provider for security (IP address, browser information, time of visit)

Purposes and legal bases

• Reviewing and answering your inquiry, holding a call and preparing an estimate or proposal: steps you request before a contract (GDPR Art. 6(1)(b); Korean PIPA Art. 15(1)4). The Korean form also asks for consent.
• Keeping inquiry records and following up: our legitimate interest in answering inquiries properly and keeping a history (GDPR Art. 6(1)(f))
• Meeting legal obligations and handling disputes: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))
• Website security and operation: legitimate interest (Art. 6(1)(f))

We do not send marketing emails or sell personal data. We do not use automated decision-making or profiling.

If you leave out required fields we may not be able to answer. You can always email us with only what you want to share.

How long we keep data

We keep data only as long as we need it and delete it without delay once the purpose is met. Because the data sits on the servers of the providers in section 5, we delete it ourselves in each service (inquiry form, Notion, email and call booking) according to the rules below. The same rules apply to attachments downloaded to the founder's work devices.

• Deleted immediately: messages unrelated to our services (spam, advertising, misdirected email), sensitive data you sent without being asked, and data from children under 14 are deleted as soon as we notice them.
• Deletion request or withdrawn consent: we delete the data without delay and confirm within 10 days. Contract and dispute records described below may be kept where the law allows.
• Inquiries and calls that do not go ahead: kept for one year from our last contact, then deleted. If you contact us again within that time, we can pick up where we left off.
• Attached files (briefs, requirement documents and similar): these may be your confidential material, so we handle them separately and delete them within 30 days once it is decided the project will not go ahead.
• If an inquiry leads to a contract: transaction records such as contracts and tax invoices are kept for the periods set by law (5 years under the Korean Framework Act on National Taxes, up to 10 years under the Korean Commercial Act). Other consultation notes are deleted one year after the contract ends.
• Agency work (white-label): we process an agency's client data only on the agency's instructions and return or delete it at the end of the project, as agreed with the agency.
• Ongoing disputes or legal requests: the related records are kept until the matter is resolved.
• Website access logs: kept for the period set by our hosting provider (GitHub).

Electronic files are deleted so they cannot be recovered, and paper documents are shredded. We check once a month for data past its retention period.

Data deleted from a provider's service may remain in that provider's backups for a limited time before being erased under its own policy.

Where your data is stored

We use the services of the providers below, and your data is stored on their servers. Under their data processing agreements (DPAs) they process it only on our behalf and do not use it for their own purposes.

• Tally BV (Belgium): stores inquiry form responses, EU servers
• Cal.com, Inc. (United States): stores call bookings
• Notion Labs, Inc. (United States): stores and organises inquiry records
• Google LLC (United States): stores email and calendar events; video calls (Google Meet)
• GitHub, Inc. (United States): hosts the website and its access logs

We do not share personal data with other third parties unless the law requires it.

International transfers

When you submit the form, book a call or email us, your data is sent over the network to the servers of the providers above. The data, purposes and retention are as described in sections 2 to 4.

• Republic of Korea: where Decisionary is based. The European Commission has adopted an adequacy decision for Korea.
• European Union: where Tally stores data.
• United States: where Cal.com, Notion, Google and GitHub process data. Transfers are protected by each provider's data processing agreement with the EU Standard Contractual Clauses, or by the EU-U.S. Data Privacy Framework where the provider is certified.

If you do not want your data transferred abroad, you can choose not to contact us, but we will then be unable to answer.

Your rights

You can exercise these rights at any time.

• Access your data and get a copy
• Correct inaccurate data
• Have your data deleted
• Restrict or stop processing
• Object to processing
• Receive your data in a portable format
• Withdraw consent where we asked for it. This does not affect processing before the withdrawal.

Email us at the address below. After confirming your identity we will respond within 10 days, free of charge.

hello@decisionarypro.com

Cookies and browser storage

This website does not use cookies. In your browser it stores only your language choice (local storage) and, if the link you followed included one, a source tag for the visit (session storage, cleared when you close the tab). These stay on your device; the source tag is sent only with an inquiry form you submit. We have not installed analytics, advertising or tracking tools.

The inquiry form (Tally) and booking page (Cal.com) open on those providers' sites, where their own cookie policies apply.

Security

• Access to personal data is limited to the founder.
• The website and forms only exchange data over encrypted connections (HTTPS).
• Data is stored on servers protected by each provider's security measures, such as encryption in transit and at rest.
• Data we no longer need is deleted according to the retention periods above.

Children

This website is for business clients. We do not knowingly collect data from children under 16 (under 14 in Korea). If we learn that we have, we delete it straight away.

Complaints

Please tell us first and we will respond. You can also contact the following bodies.

• EU/EEA residents: the data protection authority in the country where you live or work
• Personal Information Dispute Mediation Committee (Korea): +82 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (Korea): 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office (Korea): 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

Changes to this policy

When we change this policy we post it on this page with the effective date. Changes that significantly affect your rights are announced 7 days in advance.