• 1. “Personal information” means information relating to a living individual that can identify the individual by name, resident registration number, images, etc. (including information that cannot identify a specific individual by itself but can easily be combined with other information to identify the individual).
• 2. “Processing of personal information” means the collection, generation, linkage, integration, recording, storage, retention, processing, editing, retrieval, output, correction, restoration, use, provision, disclosure, destruction, or other similar acts.
• 3. The Company discloses this Policy through its website so that users can easily access it. When the Policy is amended due to changes in relevant laws or internal regulations, the Company will notify users through the website (or individually, if necessary).

• 1. When users use the website, the Company processes only the minimum necessary personal information. If additional information is required, the Company will collect it with separate consent.

• 2. In addition to the personal information specified in the preceding paragraph, the Company also collects personal information as follows.

• 1. The Company processes personal information only for the retention period specified in Article 2, and immediately deletes it once the period expires.
• 2. However, notwithstanding the foregoing, if applicable laws require the retention of personal information for a certain period, the Company will retain the information for such period.

• 1. The Company provides personal information to third parties only where the data subject’s consent has been obtained, or where the case falls under Article 17 or Article 18 of the Personal Information Protection Act (e.g., special provisions of laws). Except in such cases, the Company does not provide the data subject’s personal information to third parties.
• 2. In the event of an emergency—such as a disaster, infectious disease, an incident/accident causing imminent risk to life or body, or imminent loss of property—the Company may provide personal information to relevant authorities without the customer’s consent. In such cases, the Company provides only the minimum personal information necessary pursuant to the applicable legal grounds, and does not provide it for purposes other than the intended purpose.

• 1. The Company outsources personal information processing tasks to external specialized service providers to ensure smooth service provision.
• 2. When outsourcing, contracts stipulate prohibition of processing beyond the purpose of entrusted tasks, technical and managerial protective measures, prohibition of re-outsourcing, liability for damages, etc., and such contracts are retained in writing or electronically.
• 3. Only the minimum necessary personal information is outsourced, and the Company supervises entrusted parties to ensure safe processing.

• 1. A user has the right to inspect or correct the record of consent regarding the collection, use, and provision of personal information, and has the right to request the correction or deletion of errors in personal information. The exercise of such rights may be made through the Personal Information Protection Officer by means of writing, telephone, email, etc., and may also be made through the user’s legal representative or an agent who has been delegated authority.
• 2. When an agent visits and requests inspection or verification, the Company may require submission of a power of attorney confirming that proper delegation has been received, along with the agent’s identification card, in order to accurately verify whether the person is a legitimate agent, and the requested matters will be processed without delay.
• 3. The right to request inspection of personal information and the suspension of its processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
• 4. Where other laws specify that such personal information is subject to collection, deletion of that personal information cannot be requested.

• 1. When the purpose of collection and use of collected personal information has been achieved, or when the retention period has expired, the Company destroys the relevant personal information without delay.
• 2. Even if the retention period of personal information agreed to by the user has expired or the purpose of processing has been achieved, if other laws require continued preservation of personal information, such information shall be preserved separately in a different storage location.
• 3. The procedures and methods of destruction of personal information are as follows.
  1) Destruction procedure: Personal information for which grounds for destruction have arisen is selected, and unless other laws require the preservation of personal information, it is destroyed without delay.
  2) Destruction method: Personal information recorded and stored in electronic file format is destroyed by using technical methods so that the records cannot be reproduced, and personal information recorded and stored on paper documents is destroyed by shredding with a shredder or incineration.

• In processing users’ personal information, the Company takes the following technical and managerial measures to ensure security so that personal information is not lost, stolen, leaked, altered, or damaged.

• 1. The Company uses “cookies,” which store and retrieve usage information from time to time.
• 1. A cookie is a small amount of information that the server used to operate the system sends to the user’s computer browser, and may also be stored on the hard disk of the users’ PC computer.
  1) Purpose of use of cookies: Visit records, usage analysis, preparation of statistics, customized advertising, verification of secure connection status, error analysis, prevention of fraudulent use
  2) Permission and blocking of cookies

• 1. In order to protect personal information and handle complaints related to personal information, the Company designates the Personal Information Protection Officer as follows.

• 2. The data subject may contact the Personal Information Protection Officer and the responsible department regarding all matters related to inquiries, complaint handling, and remedy of damages concerning personal information arising in the course of using the Company’s services (or business). The Company will respond to and handle the inquiries of the data subject without delay.

If you need to report or consult regarding infringement of personal information, you may contact the institutions below for assistance.

• 1. Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 without area code)
• 2. Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972 without area code)
• 3. Supreme Prosecutors’ Office (www.spo.go.kr, 1301 without area code)
• 4. National Police Agency (ecrm.cyber.go.kr, 182 without area code)

The Company’s website may include links to other websites. The Company’s Privacy Policy applies only to services provided on the Company’s website, and when clicking on a link to another website, please check the privacy policy of that website.

• 1. The Privacy Policy may be changed in accordance with laws or the Company’s policies, and when additions, deletions, or modifications are made, the Company will provide notice of the changes and reasons through the website.
• 2. This Privacy Policy shall take effect from [17] [11] [2025], and when additions, deletions, or modifications are made due to changes in laws/policies or security technologies, the Company will provide notice of the changed Privacy Policy through the website, etc.