IAAN Co., Ltd. (“Company”) has established and disclosed the following privacy policy to protect the personal information of data subjects and to handle related complaints quickly and smoothly in accordance with Article 30 of the Personal Information Protection Act.

1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes. Personal information will not be used for purposes other than those specified below. If the purpose of use changes, the Company will implement necessary measures, including obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• 1) Personal Identification
• 2) Product Inquiry
• 3) Complaint Handling and Customer Service
• 4) Notification of announcements

2. Retention and Processing Period of Personal Information

The Company retains personal information for up to three months after fulfilling the collection and usage purpose, after which it is destroyed. If the information subject withdraws consent, it will be immediately destroyed.
However, if preservation is required by relevant laws and regulations, the Company retains it for the period specified below:

Relevant Law	Content	Retention Period
Act on Consumer Protection in E-commerce	Records of contracts or cancellations	5 years
	Records of payment and goods supply	5 years
	Consumer complaints or dispute handling	3 years
	Records of display and advertisement	6 months
	Records of compensation and overpayment	5 years
Specific Financial Information Act	Identity verification records	5 years
Communications Privacy Protection Act	Login records	3 months
Basic National Tax Act	Records related to taxes and dues	5 years

3. Rights and Obligations of Information Subjects and Legal Representatives

Data subjects, as the subjects of personal information, may exercise the following rights:

1) Data subjects may exercise the following personal information protection rights against the Company at any time:

• ① Request access to personal information
• ② Request correction of errors
• ③ Request deletion
• ④ Request suspension of processing

2) The exercise of rights under 1) may be requested in writing or via e-mail according to Form 8 of the Personal Information Protection Act Enforcement Regulations. The Company will act promptly on such requests.

3) If the data subject requests correction or deletion of personal information due to an error, the Company will not use or provide the personal information until the correction or deletion is completed.

4) The rights under 1) may be exercised by the data subject’s legal representative or delegated person. In this case, a power of attorney in the format provided in Form 11 of the Personal Information Protection Act Enforcement Regulations must be submitted.

4. Items of Personal Information Processed

The Company processes the following personal information:

1) Customer Inquiries

• - Required : Inquiry type, name (or company name), contact details, inquiry details, service usage records, IP address

2) Partnership Inquiries

• - Required : Name, inquiry details, service usage records, IP address
• - Optional : Contact details, organization/company name

5. Destruction of Personal Information

When personal information becomes unnecessary due to the expiration of the retention period or the achievement of processing purposes, the Company disposes of the personal information without delay.

1) Disposal procedure : The Company selects the personal information that requires disposal and obtains approval from the personal information protection officer to dispose of it.

2) Disposal method : For electronically stored information, a technical method is used that makes the records unrecoverable. Printed personal information is shredded or incinerated.

6. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative, and physical measures to ensure the security of personal information:

1) Administrative Measures : Development and implementation of an internal management plan, regular employee training, etc.

2) Technical Measures : Management of access rights to the database, installation of access control systems, installation of security programs

3) Physical Measures : Access control of areas such as vulnerability analysis rooms

7. Disclosure of Personal Information

In principle, the Company does not disclose users’ personal information externally. However, the following cases are exceptions:

1) When necessary for product delivery, installation, or A/S services (name, mobile number, installation address)

2) When users have given prior consent

8. Outsourcing of Collected Personal Information

The Company does not entrust information to any external party other than the contracted delivery, installation, or A/S company without the user’s consent. In the event such a need arises, the Company will inform users of the recipient of the information and the entrusted work and obtain consent if required.

9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company does not entrust information to external companies outside contracted delivery, installation, and after-sales service companies. If such a need arises in the future, the user will be notified, and consent will be obtained where required.

10. Personal Information Protection Officer

1) The Company has designated the following person as the personal information protection officer, responsible for handling complaints and remedying any damages related to personal information processing:

• ① Data Protection Officer:
  • Name : Seong Jeonghyun
  • Email : sales1@iaan.co.kr
  • Contact : +82-2-571-2344
• ② Personal Information Protection Department
  • Department : Business Support Management Team
  • Contact : +82-2-571-2344
  ※ The department responsible for the right to request access to personal information.

2) Data subjects may contact the personal information protection officer for inquiries, complaints, or damages related to personal information protection arising from the Company’s services. The Company will respond and address such inquiries without delay.

11. Methods of Relief for Infringement of Rights

The following organizations are independent from the Company. Please contact them if you are not satisfied with the Company’s handling of complaints or need further assistance.

· Personal Information Infringement Report Center (KISA)

• - Scope of Work : Report personal information infringement, request consultation
• - Website : privacy.kisa.or.kr
• - Phone : 118 (without area code)
• - Address : 9 Jinheung-gil, Naju-si, Jeollanam-do, Korea

· Personal Information Dispute Mediation Committee

• - Scope of Work : Apply for personal information dispute mediation, group dispute mediation (civil resolution)
• - Website : kopico.go.kr
• - Phone : 1833-6972 (without area code)
• - Address : 12th Floor, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul

· Supreme Prosecutors’ Office Cybercrime Investigation Division

• - Website : spo.go.kr
• - Contact : 1301 (without area code)

· National Police Agency Cybercrime Investigation Division

• - Website : cyberbureau.police.go.kr
• - Contact : 182 (without area code)

12. Changes to the Privacy Policy

This Privacy Policy takes effect on its effective date, and any changes to this policy will be announced on our website seven days prior to implementation.

Effective Date of Privacy Policy: October 14, 2024