svt.bibigo.com Privacy Policy

(Effective as of July 28, 2025)

svt.bibigo.com is committed to protecting your personal information and complies with relevant laws and regulations such as the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.
We make every effort to prevent the leakage and damage of your personal information.

1. Purpose of Collecting and Using Personal Information, Collected Items, and Retention Period
2. Outsourcing of Personal Information Processing Tasks
3. Transfer of Personal Information Overseas
4. Procedures and Methods for the Destruction of Personal Information
5. Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise
6. Measures to Ensure the Security of Personal Information
7. Installation, Operation, and Refusal of Automatic Data Collection Devices
8. Collection, Use, and Refusal of Behavioral Information
9. Personal Information Protection Officer
10. Remedies for Infringement of Data Subject Rights
11. Changes to the Privacy Policy

1. Purpose of Collecting and Using Personal Information, Collected Items, and Retention Period

"svt.bibigo.com" (hereinafter referred to as the "Site") introduces the collaboration between SEVENTEEN, and provides a space where users can download content or take and upload photos. The Site collects and uses only the minimum necessary personal information required for website operation.

2. Outsourcing of Personal Information Processing Tasks

We outsource certain tasks to external service providers to enhance our services. The entrusted companies are required to handle personal information securely in accordance with the Information and Communications Network Act. We stipulate necessary measures and supervise the entrusted companies to ensure compliance.
The information provided to the entrusted companies is limited to the minimum necessary for service delivery and is selectively provided based on the customer's service request.
When signing outsourcing contracts, we specify in writing or electronically: compliance with data protection instructions, confidentiality of personal information, prohibition of third-party provision, liability in the event of an incident, outsourcing period, and the return or destruction of personal information upon completion of the service.
During events hosted on the Site, personal information may also be entrusted to companies not listed in this policy with the user's additional consent.

3. Transfer of Personal Information Overseas

For the purpose of analyzing user activity data, providing statistical insights, and conducting marketing activities such as announcements of various events and promotions, personal information is transmitted or managed overseas as outlined below.
Legal Basis: Article 28-8 (1) 3 of the Personal Information Protection Act (Processing entrustment/storage for contract fulfillment).

If you wish to refuse the overseas transfer of your personal information, you may do so by following the methods described in Article 10 (Operation and Refusal of Automatic Data Collection Devices) of this Privacy Policy.
Please note that refusing overseas transfers may limit access to certain services that require such transfers, such as Google social login and personalized recommendation services based on Braze.

4. Procedures and Methods for the Destruction of Personal Information

(1) Exceptions to the Destruction of Personal Information Personal information will be destroyed without delay when the purpose of collection and use agreed by the user is achieved or when the user requests withdrawal in accordance with the Terms of Use of svt.bibigo.com. However, if retention is required by law, the information will be retained for the period specified by the relevant laws.
(2) Destruction Procedures and Methods When personal information becomes unnecessary, such as expiration of the retention period or achievement of the processing purpose, the information is destroyed without delay. Printed personal information is shredded or incinerated, and personal information stored in electronic file form is deleted using technical methods that prevent data recovery.

5. Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise

You may view, correct, delete, or request the suspension of processing of your personal information at any time.
To view or correct your personal information, click 'Change Personal Information' (or 'Edit Member Information') and follow the identity verification procedure to directly view or correct the information.
To delete or suspend the processing of your personal information, click 'Withdraw Consent (Membership Withdrawal)' and complete the identity verification procedure. Upon withdrawal, your personal information will be processed so that it cannot be reproduced by any means.
Alternatively, you can contact Imx_digital@cj.net or send a written request. Upon verifying your identity (or that of your legal representative), we will process your request to view, correct, delete, or suspend the processing of personal information in accordance with the Personal Information Protection Act.

6. Measures to Ensure the Security of Personal Information

We implement the following technical and managerial measures to prevent the loss, theft, leakage, external attacks, hacking, and other risks to personal information and to ensure the highest level of security.

1. (1) Technical Measures
   • Personal information is protected by passwords, and important data is protected through encryption of files and transmission data, as well as by using separate security functions.
   • Antivirus programs are used to prevent damage from computer viruses, with regular updates to prevent personal information breaches.
   • Security devices that use encryption algorithms are employed to safely transmit personal information over networks.
   • Regular vulnerability assessments and intrusion detection systems are installed to monitor for illegal intrusions and to prevent personal information leaks due to hacking.
2. (2) Managerial Measures
   • The number of personnel handling personal information is minimized, and relevant staff are provided with security training.
   • Access rights to personal information processing systems are granted according to internal procedures, with regular reviews and revocation of access rights.
   • Internal procedures are established and monitored to ensure compliance with the personal information protection policy.
   • Management and supervision of data processors (entrusted companies) handling personal information.

7. Installation, Operation, and Refusal of Automatic Data Collection Devices

We use 'cookies,' which are small text files sent by the website's server to the user's browser, to store and retrieve user information from time to time. Cookies are used to authenticate users when they log in to the Site and to enhance their experience.
Cookies identify the user's computer but do not personally identify the user. Users have the choice to accept or refuse cookies.
You can configure your web browser settings (via the Tools > Internet Options menu) to accept all cookies, selectively accept cookies, or refuse all cookies. You can also choose to be notified before cookies are installed. Please note that if you refuse essential cookies, you may not be able to use certain services that require user registration.
CJ CheilJedang Co., Ltd. uses cookies for the following purposes:
To analyze access frequency and visit times, understand user preferences and interests, and utilize this information for targeted marketing (including advertisements) and service improvements.
※ Information generated/collected during service use.

8. Collection, Use, and Refusal of Behavioral Information

We collect and use behavioral information to provide users with optimized customized services, benefits, and online targeted advertisements.
We collect behavioral information as follows:

Additionally, the following online ad service providers are permitted to collect and process behavioral information:

svt.bibigo.com only collects the minimum necessary behavioral information for online targeted ads and does not collect any sensitive behavioral information that may clearly infringe upon an individual's rights, interests, or privacy, such as beliefs, family relations, educational or medical history, or social activities.
You may block or allow online targeted ads by changing your web browser's cookie settings. Please note that changing cookie settings may affect the availability of some services, such as automatic login.

► How to Block/Allow Targeted Ads via Web Browser

1. (1) Microsoft Edge
   • Click the '...' button at the top right of Edge, then select 'Settings'.
   • Click 'Privacy, Search, and Services' on the left panel and choose the tracking prevention level under the "Tracking Prevention" section.
   • Select whether to always use "Strict" tracking prevention when browsing InPrivate.
   • Under the "Privacy" section, choose whether to send "Do Not Track" requests.
2. (2) Chrome Browser
   • Click the '︙' button (Customize and Control Google Chrome) at the top right, then select 'Settings'.
   • Scroll down to 'Advanced Settings' and click it.
   • Under the 'Privacy and security' section, click 'Site Settings'.
   • In the 'Cookies' section, check 'Block third-party cookies and site data'.

9. Personal Information Protection Officer

CJ CheilJedang Co., Ltd. appoints a Personal Information Protection Officer to protect customers' personal information and handle related complaints. For any inquiries or requests regarding personal information, please contact the officer below. We will respond promptly and sincerely.

► Personal Information Protection Officer

• Name: Hwa Jeong Ryu
• Position: CPO
• Contact: +82-2-6740-4060, theprivacy@cj.net
  ※ Available on weekdays from 9 AM to 12 PM and 1 PM to 5 PM (KST)
  ※ Calls will be directed to the Personal Information Protection Department.

► Personal Information Protection Department / Personal Information Access Request Department

• Department: HQ Marketing IMX
• Contact: Imx_digital@cj.net
  ※ Available on weekdays from 9 AM to 12 PM and 1 PM to 5 PM (KST)

10. Remedies for Infringement of Data Subject Rights

If you need to report or consult on matters related to personal information infringement, you may contact the following organizations for assistance:

We are committed to safeguarding your right to self-determination over your personal information and to providing consultation and remedies in the event of personal information infringement. For consultations or reports, please contact the department below:

► Customer Consultation and Reporting for Personal Information Protection

• Department: HQ Marketing IMX
• Email: Imx_digital@cj.net
  In accordance with Articles 35 (Access to Personal Information), 36 (Correction and Deletion of Personal Information), and 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, any individual who has suffered infringement of rights or interests due to a disposition or omission by the head of a public institution may file an administrative appeal under the Administrative Appeals Act.
• Central Administrative Appeals Committee: 110 (www.simpan.go.kr)

11. Changes to the Privacy Policy

This Privacy Policy is effective as of July 28, 2025. The contents of this policy may be changed due to amendments in laws, policies, or security technologies. In the event of any additions, deletions, or modifications, we will announce the reasons and details of such changes on the svt.bibigo.com website.
You can review previous versions of the Privacy Policy below.

12. Additional information regarding data processing within the scope of the EU-GDPR

a. Scope of processing of personal data

In principle, we only collect and use personal data of the users of our homepage to the extent that this is necessary to provide a functional website, our content and services. In principle, the collection and use of personal data from our users only takes place with their consent. An exception to this principle applies in cases in which processing of the data is permitted by legal regulations or obtaining prior consent is not possible for actual reasons.

b. Legal basis for processing personal data:

• Article 6 paragraph 1 sentence 1 lit. a GDPR upon obtaining the consent of the data subject.
• Art. 6 (1) sentence 1 lit. b GDPR for processing that serves to fulfill a contract to which the data subject is a party. Processing operations that are required to carry out pre-contractual measures are also included here.
• Article 6 paragraph 1 sentence 1 lit. c GDPR for processing that is necessary to fulfill a legal obligation.
• Art. 6 (1) sentence 1 lit. d GDPR if vital interests of the data subject or another natural person require the processing of personal data.
• Art. 6 (1) sentence 1 lit. f GDPR if the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and fundamental freedoms of the person concerned do not outweigh the first-mentioned interest. In order to be able to base the processing of personal data on a legitimate interest, an examination is carried out in coordination with the data protection officer for each relevant process, whereby the following three conditions must be met:
  1) The person responsible for processing the personal data or a third party has a legitimate interest in the data processing.
  2) The processing is necessary to protect the legitimate interest.
  3) Interests or fundamental rights and freedoms of the data subject that require the protection of personal data do not prevail.

c. General information on the use of cookies:

We use cookies on our website. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system. If you call up a website, a cookie can be stored on your operating system. This contains a characteristic character string that enables the browser to be clearly identified when the website is called up again.We use cookies to make our website more user-friendly. Some elements of our website require that the browser can be identified even after a page change.
Germany/TDDDG:
The legal basis for the storage of cookies, device identifiers and similar tracking technologies or for the storage of information in the end user’s terminal equipment and access to this information is the European ePrivacy Directive in conjunction with the in conjunction with the Telecommunications and Telemedia Data Protection Act (TDDDG).
Please note that the legal bases for the processing of the personal data collected in this context result from the GDPR (Art. 6 Para. 1 S.1 GDPR). The relevant legal basis for the processing of personal data in each specific case can be found below under the respective cookie or the respective processing itself.
The primary legal basis for the storage of information in the terminal device of the end user – and therefore in particular for the storage of cookies – is your consent, § 25 Para. 1 S.1 TTDPA. Consent is given when you visit our website – although of course it does not have to be given – and can be revoked at any time in the cookie settings.
Pursuant to § 25 Para. 2 No. 2 TTDPA, consent is not required if the storage of information in the end user’s terminal equipment or access to information already stored in the end user’s terminal equipment is absolutely necessary so that the provider of a telemedia service can receive a expressly requested telemedia service. You can see in the cookie settings which cookies are to be classified as absolutely necessary (often also referred to as 'technically necessary cookies'), therefore fall under the exception regulation of § 25 Para. 2 TTDPA and therefore do not require consent.
GDPR:
When using cookies, the following data is stored and transmitted:
Online identifiers (including cookie identifiers), internet protocol addresses and device identifiers, customer-assigned identifiers
The legal basis for the processing of personal data using cookies is Art. 6 para. 1 s. 1 lit. f GDPR. The purpose of using technically necessary cookies is to simplify the use of our website.
Cookies are stored on the user’s computer and transmitted to our site. As a user, you therefore have control over the use of cookies. You can restrict or deactivate the transmission of cookies by making changes in the settings of your Internet browser. Stored cookies can also be deleted there. Please note that you may no longer be able to use all the functions of our website if you deactivate cookies.
The legal basis for the processing of personal data using cookies for analysis and advertising purposes is Article 6 (1) sentence 1 lit. a GDPR if the user has given their consent.

d.Your rights / rights of the data subject

Right of providing information/Right of access by the data subject: You have the right to receive information from us as the person responsible as to whether and which personal data relating to you is processed by us, as well as further information in accordance with the legal requirements of Art. 15 GDPR.
Right to Rectification: If the personal data processed by us and relating to you is incorrect or incomplete, you have the right to have it corrected and/or completed. The correction will be made immediately.
Right to Restriction: You have the right to restrict the processing of your personal data in accordance with the statutory provisions (Art. 18 GDPR).
Right to Erasure: If the reasons set out in Art. 17 GDPR apply, you can demand that the personal data concerning you be deleted immediately. We would like to point out that the right to erasure does not exist if the processing is necessary for one of the exceptional circumstances mentioned in Art. 17 Para. 3 GDPR.
Right to information: If you have asserted the right to rectification, erasure or restriction of processing, we are obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves to be the case as impossible or involves a disproportionate effort. You also have the right to be informed about these recipients.
Right to data portability: According to the GDPR, you also have the right to receive the personal data provided to us in a structured, common and machine-readable format or to request its transmission to another person responsible.
Right to revoke the declaration of consent under data protection law: You have the right to revoke your declaration of consent under data protection law at any time. We would like to point out that the revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation.
Right to object: Furthermore, you have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data, which is based on Article 6 (1) sentence 1 lit. e or f GDPR.
Automated individual decision-making including profiling: According to the EU General Data Protection Regulation, you also have the right not to be subject to a decision based solely on automated processing – including profiling – which has legal effect on you or significantly affects you in a similar way.
Right to lodge a complaint with a supervisory authority: Finally, if you are of the opinion that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged violation.

e. EU-US Trans-Atlantic Data Privacy Framework

Within the framework of the so-called 'Data Privacy Framework' (DPF), the EU Com-mission has also recognized the level of data protection for certain companies from the U.S. as safe within the framework of the adequacy decision of 10.07.2023. The list of certified companies as well as further information on the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/s/participant-search.

f. Data transfer outside the EU

The GDPR guarantees an equally high level of data protection within the European Union. When selecting our service providers, we therefore rely on European partners whenever possible if your personal data is to be processed. Only in exceptional cases will we have data processed outside the European Union as part of the use of third-party services. We only allow your data to be processed in a third country if the special requirements of Art. 44 et seq. GDPR are met. This means that the processing of your data may only take place on the basis of special guarantees, such as the determination of a level of data protection officially recognized by the EU Commission or compliance with officially recognized special contractual obligations, the so-called 'standard data protection clauses'.

g. Data processing under the Swiss DPA

In principle, the use of our website is subject to the legal regulations of the GDPR. Insofar as you also visit our website from Switzerland and insofar as the related data processing also affects you as a Swiss citizen, these data protection provisions also apply to you under the Swiss Federal Data Protection Act ('Swiss DPA' as amended on 01 September 2023), analogously to the GDPR.
In principle, the Swiss DPA does not provide for the naming of a legal basis. In this respect, we only process your data from Switzerland if the processing is lawful, is carried out in good faith and is proportionate in accordance with Art. 6 para. 1 and 2 of the Swiss DPA. Furthermore, your data will only be collected by us for a specific purpose that is recognizable to the data subject and will only be processed in such a way that it is compatible with these purposes in accordance with Art. 6 para. 3 of the Swiss Data Protection Act.
In this context, please also note that although certain terms are formulated differently under the GDPR, they have the same legal meaning as under the Swiss DPA. For example, the GDPR terms 'processing' of 'personal data' as well as 'legitimate interest' and 'special categories of data' used in this Privacy Notice correspond to terms 'processing' of 'personal data', 'overriding interest' and 'personal data requiring special protection' used in the Swiss DPA.
The data subject rights set out here pursuant to Art. 12 et seq. GDPR can be asserted by data subjects from Switzerland in analogy to the regulations pursuant to Art. 25 et seq. of the Swiss DPA.

h. Electronic contact

If you would like to contact us, there is a contact form available on our homepage, which you can use to contact us electronically. The data entered in the input mask will be transmitted to us and saved. These dates are: First name, last name, email address, country (optional), your message, subject of your request.
At the time the message is sent, the following data is also stored: The IP address of the user, date and time of contact
It is also possible to contact us via the email address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.
Your data will not be passed on to third parties in this context, the data will only be used to process the communication.
The legal basis for processing the contact request and its processing is generally Article 6 Paragraph 1 S.1 lit. b GDPR.
If further personal data is processed during the sending process, this only serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
Your data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is over when it can be inferred from the circumstances that the facts in question have been finally clarified.
The additional personal data collected during the sending process will be deleted after a period of 8 weeks at the latest.

i. Content Delivery Network (CDN)

This site uses content delivery networks to deliver popular online libraries and web fonts. Access then takes place directly to the servers of the operator, so that data such as the calling IP address, referrer, browser information, etc. are collected there.
The legal basis for this is our legitimate interest pursuant to Article 6 Paragraph 1 Sentence 1 lit.
You can prevent CDNs from collecting and processing your data by disabling the execution of script code in your browser or by installing a script blocker in your browser (you can find one at www.noscript.net, for example).

j. Google Web Fonts

Based on our legitimate interests in accordance with Article 6 Paragraph 1 Clause 1 Letter f GDPR, we integrate the fonts ('Google Web Fonts') from the provider Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. The aim is to optimize and run our website economically. We host the fonts from our own servers so that no data is transmitted to Google.
The provider’s data protection declaration can be found at: https://www.google.com/policies/privacy

k. Web analytics