1. Purpose of Processing Personal Information

The Company collects and processes only the minimum amount of personal information necessary for the following purposes. Personal information will not be used for any purpose other than those stated below. If the purpose of use changes, the Company will take the necessary measures, including obtaining separate consent where required under Article 18 of the Personal Information Protection Act.

Corporate Website

Receiving and responding to customer inquiries

Sending company newsletters and informational emails

SmartMDQ

User registration

Service provision and use

Billing and payment processing

SmartAL Trial

User registration

Service provision and use

2. Details of Personal Information Processed and Retention Period

The Company retains and uses personal information for the period prescribed by applicable laws or separately agreed upon by the user. Once the purpose of collection and use has been fulfilled, the Company will promptly destroy the personal information. However, certain information may be retained for a specified period in accordance with applicable laws or the Company's service policies.

Categories of Personal Information Collected

During inquiries and the use of our services, the Company collects the following categories of personal information. The Company does not collect sensitive personal information.

Required Information: Information necessary to provide the essential functions of the service.

Optional Information: Additional information collected to provide more customized services. Users may choose not to provide optional information without affecting their ability to use the service.

Personal Information Collected and Retention Period

Corporate Website

Required Information

Name

Email Address

Optional Information

Telephone Number

Mobile Phone Number

Retention Period

One (1) year

SmartMDQ

Required Information

Name

Organization/Affiliation

Email Address

Optional Information

Job Title

Telephone Number

Mobile Phone Number

Retention Period

Until termination of service use (account withdrawal)

SmartAL Trial

Required Information

Name

Email Address

Optional Information

Contact Number

Mobile Phone Number

Organization/Affiliation

Job Title

Retention Period

Until termination of service use (account withdrawal)

3. Provision of Personal Information to Third Parties

The Company provides personal information to third parties only in cases permitted under Articles 17 and 18 of the Personal Information Protection Act, including where the data subject has provided consent or where otherwise required by law.

Where personal information collected pursuant to Article 18 of the Personal Information Protection Act is provided to a third party for purposes other than the original purpose of collection, the Company discloses the legal basis, purpose, and scope of such provision on its corporate website or the relevant service website.

4. Procedures and Methods for Destruction of Personal Information

As a general rule, the Company promptly destroys personal information once the retention period has expired or the purpose of processing has been fulfilled.

However, where applicable laws require the continued retention of personal information, such information (or personal information files) will be transferred to a separate database (DB) or stored separately from other records.

Destruction Procedures

Unnecessary personal information and personal information files are disposed of under the responsibility of the Chief Privacy Officer in accordance with the Company's internal policies and procedures.

Personal information whose retention period has expired is destroyed without delay.

Destruction Methods

Personal information printed on paper is destroyed by shredding or incineration.

Personal information stored in electronic files is permanently deleted using technical methods that prevent the recovery of the records.

5. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company implements the following technical, administrative, and physical safeguards to protect personal information.

Establishment and Implementation of Internal Management Plans

The Company establishes and implements internal management plans in accordance with the Standards for Measures to Ensure the Security of Personal Information issued by the Personal Information Protection Commission.

Encryption of Personal Information

Personal information is securely stored and managed through encryption and other security measures. Important data is also encrypted during storage and transmission using additional security technologies.

Access Control

The Company restricts access to personal information processing systems by granting, modifying, and revoking access rights as necessary. Firewall systems and other security measures are implemented to prevent unauthorized external access.

Retention of Access Logs

Access logs for personal information processing systems are retained and managed for a minimum of one (1) year.

Installation and Maintenance of Security Programs

Security software is installed and regularly updated and inspected to prevent personal information leakage or damage caused by hacking or computer viruses.

Physical Access Control

The Company operates physical access control procedures for facilities where personal information processing systems are located.

Limitation of Authorized Personnel and Employee Training

Only employees whose duties require access to personal information are authorized to handle such information. These employees receive regular training on the secure handling and management of personal information.

6. Remedies for Infringement of Privacy Rights

Users who require assistance regarding personal information infringement may apply for dispute resolution or consultation through the following organizations.

Personal Information Dispute Mediation Committee

Tel: 1833-6972 (without area code)

Website: https://www.kopico.go.kr

Personal Information Infringement Report Center (KISA)

Tel: 118 (without area code)

Website: https://privacy.kisa.or.kr

Supreme Prosecutors' Office

Tel: 1301 (without area code)

Website: https://spo.go.kr

Korean National Police Agency

Tel: 182 (without area code)

Website: https://ecrm.cyber.go.kr

7. Changes to This Privacy Policy

This Privacy Policy shall become effective on the effective date stated below. If any additions, deletions, or revisions are made due to changes in applicable laws or Company policies, the Company will provide notice through its website at least seven (7) days prior to the effective date of such changes, whenever practicable.

Effective Date: July 7, 2024