Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the purposes set out below. Personal information processed by the Company is not used for any purpose other than those stated below. Where the purpose of use is changed, the Company will take necessary measures, including obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act.

Article 2 (Categories of Personal Information Processed)

The Company processes the following categories of personal information.

1. Information collected through website inquiry forms

The following items are entered directly by the data subject through the inquiry screens on the Company's website (product inquiries, employee grievance reports, reports of ethical management violations, and website correction requests).

• Required: name, email address, subject, content of the inquiry
• Optional: contact number, company name, job title
• Additional items for website correction requests: department name, target page path, position within the screen, current displayed content, requested revision, desired completion date, reference links, and translation-related requests

Information voluntarily entered by the data subject in the inquiry field may itself constitute personal information. Please refrain from entering sensitive information that is not necessary for the purpose of processing.

2. Information generated and collected automatically during use of the service

The following information is recorded automatically when an inquiry is submitted.

• IP address, browser access information (User-Agent), date and time of submission, and the anonymous visitor identifier used for website usage analytics (to let staff review the inquirer's browsing history)

While you browse the website, the following information is collected automatically for usage analytics. This information alone does not identify a specific individual.

• Date and time of access, address and title of pages viewed, dwell time and scroll position per page, and the order of page navigation within the same browser tab
• On-site activity (language switching, clicks on external links, file downloads, e-mail or telephone links, and whether an inquiry was submitted)
• On-screen usage records (the order and duration in which page areas are shown, whether key buttons and cards are shown, where buttons, links and menus are clicked and how links are opened, product type and image selections, slide changes, and video selection, playback, pausing and progress)
• Steps of the product inquiry form (form shown, typing started, submission attempted, the type of input error such as a missing required field together with the field name, and the reason a submission failed). What you type is not collected.
• Traffic source (address of the referring site, campaign parameters) and the display language selected
• Browser type, operating system, device type (PC, mobile or tablet), screen width and browser window width
• Country, region and city of access and network provider (estimated from the IP address)
• A random anonymous visitor identifier (hs-vid) kept in the browser's local storage
• A random tab identifier (hs-tab) kept in session storage, which the browser deletes when the tab is closed

The IP address is used immediately to estimate the region and network provider and to exclude the Company's internal access, and is not stored. For browsers that cannot store the visitor identifier, only a one-way hash of the IP address and browser information combined with a random value that changes daily is used for that day. Visits from browsers signed in to an administrator account and from automated programs such as search robots are not collected.

3. Processing in connection with the operation of social media channels

The Company uses the LinkedIn API to operate its official LinkedIn channel. The information processed in this context is as follows.

• Categories processed: account identifiers used to verify authority to administer the Company channel (member URN and organization URN), access tokens, and identifiers of published posts
• Purpose of processing: publication of posts to the Company's official channel and prevention of duplicate publication
• Method of processing: access tokens and account identifiers are stored in the operating-system secure storage of the Company administrator's business device. Apart from post content and publication history, the Company does not collect or store LinkedIn members' profile information, connection or follower information, messages, or activity history.
• Processing upon disconnection: if the Company disconnects the LinkedIn integration, or a data subject revokes the permissions granted to the Company's application, the access tokens and account identifiers held by the Company are destroyed without delay. Posts already published remain on the Company's official channel in accordance with LinkedIn's policies; a request for their deletion may be made using the contact details in Article 9.

The Company does not use data obtained through the LinkedIn API for advertising targeting, does not sell or transfer it to third parties, and does not use it to train artificial intelligence models.

Article 3 (Processing and Retention Periods)

The Company processes and retains personal information within the retention and use period prescribed by applicable law, or within the retention and use period consented to by the data subject at the time of collection.

Personal information for which the retention period has expired is destroyed without delay in accordance with Article 7.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only where the data subject has consented or where Articles 17 and 18 of the Personal Information Protection Act otherwise permit, such as under specific provisions of law.

The Company does not currently provide personal information of data subjects to any third party.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing tasks as set out below in order to carry out its operations efficiently.

When entering into an entrustment agreement, the Company specifies in the contract or other written form, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing personal information for purposes other than performing the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability including compensation for damages. The Company supervises whether the trustee processes personal information safely.

If the content of the entrusted work or the identity of the trustee changes, the Company will disclose the change through this Privacy Policy without delay.

Article 6 (Transfer of Personal Information Overseas)

The Company transfers personal information overseas as set out below for the operation of its official social media channels.

A data subject may refuse the overseas transfer of personal information. Where the transfer is refused, use of the relevant service may be restricted.

Article 7 (Procedure and Method of Destruction)

The Company destroys personal information without delay once it is no longer necessary, such as upon expiry of the retention period or achievement of the purpose of processing.

Where personal information must continue to be retained under other statutes notwithstanding the expiry of the consented retention period or the achievement of the purpose of processing, the Company transfers such personal information to a separate database or stores it in a different location.

Destruction procedure: the Company identifies the personal information for which grounds for destruction have arisen and destroys it with the approval of the Chief Privacy Officer.

• Information in electronic file format: permanently deleted by a method that renders recovery and reproduction impossible
• Personal information printed on paper: shredded or incinerated

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

A data subject may exercise the following personal information protection rights against the Company at any time.

1. Request access to personal information
2. Request correction of any errors
3. Request deletion
4. Request suspension of processing

These rights may be exercised in writing, by email or by other means, and the Company will act on such requests without delay.

Where a data subject requests correction or deletion of erroneous personal information, the Company will not use or provide the personal information concerned until the correction or deletion is completed.

These rights may be exercised through a legal representative or an authorised agent. In such a case, a power of attorney in the form prescribed in Annex Form No. 11 of the Public Notice on Methods of Processing Personal Information must be submitted.

Requests for access to personal information and for suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

Article 9 (Chief Privacy Officer)

The Company has designated the following Chief Privacy Officer, who has overall responsibility for personal information processing and for handling data subjects' complaints and providing remedies in relation to personal information processing.

Data subjects may direct any inquiries, complaints or requests for remedy relating to personal information protection arising from their use of the Company's services to the Chief Privacy Officer or the responsible department. The Company will respond to and handle such inquiries without delay.

Article 10 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: establishment and implementation of an internal management plan, and regular training for personnel who handle personal information
2. Technical measures: management of access rights to the personal information processing system, operation of administrator authentication procedures, encrypted storage of authentication credentials such as access tokens, and installation and updating of security programs
3. Physical measures: access control for systems and storage areas containing personal information

Article 11 (Installation and Operation of Automatic Collection Devices, and Refusal Thereof)

The Company uses cookies and browser storage (local storage and session storage), which store and retrieve information about data subjects from time to time.

• Purpose of cookies: maintaining administrator login sessions
• Purpose of browser storage: storing display preferences such as language and theme, keeping the anonymous visitor identifier (hs-vid) for website usage analytics, keeping the analytics opt-out setting (hs-analytics-optout), and keeping the tab identifier (hs-tab) that links page navigation within the same tab (kept in session storage and deleted when the tab is closed)
• The anonymous visitor identifier is a random value and is not combined with personal information such as name or contact details. Only when a data subject submits an inquiry is it linked to that inquiry so that staff can review the pages viewed before the inquiry.
• How to refuse: you may refuse or delete cookies and browser storage through your browser settings, or select the 'Opt out of usage analytics' button below to stop analytics collection in this browser immediately and delete the stored visitor and tab identifiers.

Even if you refuse cookies and local storage, you can still browse the website and submit inquiries normally. Browser settings can be found under Settings > Privacy (or Cookies and site data) in each browser.

Article 12 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or counselling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency Personal Information Infringement Report Centre, and other bodies in order to obtain relief from infringement of personal information rights. For other reports of, or counselling on, personal information infringement, please contact the organisations below.

A person whose rights or interests have been infringed by a disposition or omission by the head of a public institution in response to a request under Article 35 (access to personal information), Article 36 (correction or deletion of personal information) or Article 37 (suspension of processing of personal information) of the Personal Information Protection Act may request an administrative appeal as prescribed by the Administrative Appeals Act.

Article 13 (Changes to This Privacy Policy)

This Privacy Policy applies from its effective date. Where there are additions, deletions or corrections arising from changes in applicable law or Company policy, the Company will give notice through the announcements section of its website at least seven days before the changes take effect.

• August 20, 2026: initial enactment
• September 28, 2026: added website usage analytics items, purposes and retention period, and the use of and opt-out from browser local storage (Articles 1, 2, 3 and 11)
• October 19, 2026: added on-screen usage records (page areas and key buttons shown and clicked, product image and video use, and product inquiry form steps) and the tab identifier (Articles 1, 2, 3 and 11)