Dear valued users, this is Bonanza Lab Co., Ltd.
In accordance with Article 30 of the Personal Information Protection Act (PIPA) and Article 31 of its Enforcement Decree, the Company will amend and implement its Privacy Policy as described below. This notice is provided seven days before the effective date so that data subjects may review the changes in advance.
1. Publication and effective dates
The amended Privacy Policy is published on September 3, 2026 and takes effect on September 10, 2026. The current Privacy Policy remains in force until the effective date.
2. Services covered
The amended Privacy Policy applies commonly to the Company website (bonanzalab.io) and the Partner Portal (portal.dayfin.co).
3. Key changes
Scope of application: (before) applied to the Dayfin Partners Portal only → (after) states that the Policy applies commonly to the Company website and the Partner Portal, and distinguishes the processing carried out by each service.
Processing activities: (before) license application processing, application status lookup, and grievance handling → (after) adds the receipt of and response to website inquiries, and sets out the purpose, items, retention period, and legal basis for each activity separately.
Legal basis: (before) applicant information on the Portal was described as based on the conclusion and performance of a contract (Article 15(1)4) and, where applicable, the consent of the data subject → (after) refined to the legitimate interests of the personal information controller (Article 15(1)6), with the balancing of interests stated; website inquiries are divided into required items (Article 15(1)4) and optional items (consent).
Retention and use periods: (before) grievance handling records were described only as retained in accordance with internal standards, and no retention period was stated for access logs → (after) grievance handling records are specified as three years under the Enforcement Decree of the Framework Act on Consumers, and the retention period for access logs is stated as one year.
Entrustment of processing: (before) stated that no personal information was entrusted → (after) identifies the trustees: Portal infrastructure (Oracle Korea Ltd., OCI Korea region), website hosting (Lovable Labs Incorporated, with SUPABASE PTE. LTD. as sub-processor), and notification email delivery (Plus Five Five, Inc. / Resend).
Overseas transfer: (before) stated that no personal information was transferred overseas → (after) discloses the transfer of website inquiry information to the United States (Lovable/Supabase, Oregon region) and Japan (Resend, Tokyo region), together with the items, purpose, retention period, and the rights of data subjects, and states that Portal information is stored only in Korea (OCI Korea region) and is not transferred overseas.
Rights of data subjects: (before) only the types of rights and how to request them → (after) adds the ten-day action period, the prescribed form for exercise by an agent, the grounds on which rights may be restricted, and the identity verification procedure.
Automated decisions: (before) not addressed → (after) newly states that the Company does not make automated decisions and that Portal applications are reviewed based on the judgment of Company personnel.
Security measures: (before) described at an outline level → (after) specifies measures such as limits on authentication attempts, retention of access records for at least one year, and encryption of transmission channels (TLS).
Personal Information Protection Officer: (before) the officer and the responsible department were stated together, with the email address support@dayfin.co → (after) the officer (name, position, contact) and the responsible department (Service Operations Team) are stated separately, and the email address is changed to contact@bonanza-lab.co.kr.
Amendment procedure: (before) stated only that changes would be announced within the services → (after) adds the advance notice period (seven days, or thirty days for material changes), how to view previous versions, and a revision history.
This amendment reflects the processing the Company already carries out and supplements the matters required by law. It does not expand the items of personal information collected or the retention periods.
4. How to read the full amended text
The full text of the amended Privacy Policy is available from the Privacy Policy link in the website footer, and the same text is published on the Partner Portal. After the effective date, the current (pre-amendment) Privacy Policy remains available from the previous versions list at the top of the Privacy Policy page.
5. Contact
If you have any questions or comments regarding the amendment, please contact us. Personal Information Protection Officer: Jinsook Choi, Director / Department: Service Operations Team / Telephone: +82-2-2632-7774 / Email: contact@bonanza-lab.co.kr
We remain committed to protecting the personal information of our data subjects.
September 3, 2026, Bonanza Lab Co., Ltd.
[Updated September 10, 2026] This amended Privacy Policy took effect on September 10, 2026.