XSLAB Inc. complies with the 「Personal Information Protection Act」 and related laws to protect the freedom and rights of data subjects, lawfully processing personal information and managing it safely. Accordingly, in accordance with Article 30 of the 「Personal Information Protection Act」, we establish and disclose the following personal information processing policy to inform data subjects of the procedures and standards regarding personal information processing and to handle related grievances promptly and smoothly.

Purpose of Processing Personal Information

XSLAB Inc. processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use is changed, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the 「Personal Information Protection Act」.

1. Membership Registration and Management
   Personal information is processed for the purposes of confirming intent to join, identification and authentication for providing member services, maintenance and management of membership status, prevention of fraudulent service use, verification of legal representative's consent when processing personal information of children under 14, various notices and notifications, and grievance handling.
2. Provision of Goods or Services
   Personal information is processed for the purposes of delivering goods, providing services, sending contracts and invoices, providing content, providing customized services, personal identification, age verification, payment and settlement of fees, and debt collection.

Processing and Retention Period of Personal Information

XSLAB Inc. processes and retains personal information within the personal information retention and use period stipulated by law or the period agreed upon when collecting personal information from the data subject.

1. Website Membership Registration and Management: Until withdrawal from the business/organization website
   However, in the following cases, until the end of the corresponding reason
   1) If an investigation or inquiry is underway due to a violation of relevant laws, until the end of said investigation or inquiry
   2) If claims or debts remain from website use, until the settlement of said claims and debts
   3) In case of , until
2. Provision of Goods or Services: Until the completion of goods/service supply and fee payment/settlement
   However, in the following cases, until the end of the corresponding period
   1) Records on transactions such as display, advertising, contract details, and fulfillment in accordance with the 「Act on Consumer Protection in Electronic Commerce, etc.」
   - Records on display and advertising: 6 months - Records on contracts, subscription withdrawal, payment, and supply of goods: 5 years - Records on consumer complaints or dispute resolution: 3 years
   2) Storage of communication fact confirmation data in accordance with the 「Protection of Communications Secrets Act」
   - Subscriber telecommunication date/time, start/end time, counterpart subscriber number, frequency of use, location tracking data of the originating base station: 1 year - Computer communication, internet log records, access point tracking data: 3 months
   3) :

Personal Information Items Processed

XSLAB Inc. processes the following personal information items.

1. Website Membership Registration and Management
   • Required items: Name, date of birth, address, phone number, email address
   • Optional items:

Matters Concerning the Processing of Personal Information of Children Under 14 Years of Age

XSLAB Inc. obtains the consent of a legal representative when collecting personal information from children under 14 years of age and collects the minimum personal information necessary to perform the relevant service.

1. • Required items: Legal representative's name, relationship, contact information
2. In addition, if collecting a child's personal information for promotional purposes related to XSLAB Inc.'s , separate consent is obtained from the legal representative.
3. When XSLAB Inc. collects personal information from a child under 14, it may request minimum information from the child, such as the legal representative's name and contact information, and confirms whether the lawful legal representative has consented using one of the following methods:
   • A method of having the legal representative indicate consent on an internet site posting the consent details and notifying the legal representative via mobile phone text message that the consent indication has been confirmed by the personal information processor.
   • A method of having the legal representative indicate consent on an internet site posting the consent details and receiving the legal representative's credit card, debit card, etc., information.
   • A method of having the legal representative indicate consent on an internet site posting the consent details and verifying the legal representative's identity through mobile phone authentication, etc.
   • A method of issuing a written document with the consent details directly to the legal representative or delivering it via site notice, and having the legal representative sign and submit it.
   • A method of sending an email with the consent details and receiving an email from the legal representative indicating their consent.
   • A method of informing the legal representative of the consent details via telephone and obtaining consent, or guiding them to a method where they can check the consent details (such as an internet address) and obtaining consent.
   • Other methods equivalent to the above to inform the legal representative of the consent details and confirm their expression of consent.
section

Provision of Personal Information to Third Parties

1. XSLAB Inc. processes the data subject's personal information only within the scope specified in the purpose of processing personal information, and provides personal information to third parties only in cases corresponding to Articles 17 and 18 of the 「Personal Information Protection Act」, such as the data subject's consent or special provisions in the law, and does not provide the data subject's personal information to third parties otherwise.
2. XSLAB Inc. obtains the data subject's consent for smooth service provision and provides only the minimum necessary scope in the following cases:
   - During events: Recipient: Shipping company, VoraMall, Credit card company, Purpose of provision: Business partnership, Retention and use period: During the transaction period
   - When registering for and using BlueShift: Gyurinet Co., Ltd. (a subsidiary of XSLAB)
3. XSLAB Inc. may provide personal information to relevant agencies without the data subject's consent in case of emergency situations such as disasters, infectious diseases, events causing imminent danger to life or body, or imminent property loss, as follows:
   • Prevention and management of infectious diseases (Infectious Disease Control and Prevention Act, Korea Disease Control and Prevention Agency or nationwide cities, provinces): Name, address, and phone number
   • Disaster response (Disaster and Safety Management Act): Name, address, and phone number

Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

1. We operate "cookies," etc., that frequently store and retrieve your information. A cookie is a very small text file sent by the server used to operate the website to your browser and stored on your computer's hard disk. We use cookies for the following purposes:
   o Purpose of using cookies, etc.
   1. To provide targeted marketing and personalized services by analyzing access frequency and visit times of members and non-members, identifying user preferences and interests, tracking traces, and understanding participation levels in various events and visit frequencies.
   2. You have the option to install cookies. Therefore, you can allow all cookies, confirm each time a cookie is saved, or refuse to save all cookies by setting options in your web browser.
   o How to refuse cookie settings
   1. As a method to refuse cookie settings, you can allow all cookies, confirm each time a cookie is saved, or refuse to save all cookies by selecting options in your web browser.
   2. Example of setting method (for Internet Explorer): Tools > Internet Options > Privacy at the top of the web browser.
   3. However, if you refuse to install cookies, there may be difficulties in providing services.

Matters Concerning the Procedure and Method of Personal Information Destruction

1. XSLAB Inc. destroys the personal information without delay when it becomes unnecessary, such as upon the expiration of the retention period or achievement of the processing purpose.
2. If personal information must be retained according to other laws despite the expiration of the retention period agreed upon by the data subject or the achievement of the processing purpose, the personal information is transferred to a separate database (DB) or stored in a different location.
3. The procedure and method for destroying personal information are as follows:
   1. Destruction procedure: We select the personal information for which a destruction reason has occurred and destroy it after receiving approval from our personal information protection officer.
   2. Destruction method: We destroy personal information recorded and stored in electronic file format in a way that prevents record playback, and personal information recorded and stored on paper documents is shredded or incinerated.

Rights, Obligations, and Exercise Methods of Data Subjects and Legal Representatives

1. The data subject may exercise rights such as requesting access, correction, deletion, or suspension of processing of personal information from the Company at any time.
2. Rights can be exercised by sending a written document, email, or fax (FAX) to the Company in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the 「Personal Information Protection Act」, and the Company will take action without delay.
3. Rights may also be exercised through an agent, such as the data subject's legal representative or a person delegated by the data subject. In this case, you must submit a power of attorney according to Form 11 of the "Notice on Personal Information Processing Methods (No. 2020-7)."
a
4. Requests for access to and suspension of processing of personal information may be restricted under Article 35, Paragraph 4 and Article 37, Paragraph 2 of the 「Personal Information Protection Act」.
5. Requests for correction and deletion of personal information cannot be made if the personal information is specified as a collection target in other laws.
6. The Company verifies whether the person making the request for access, correction, deletion, or suspension of processing according to the data subject's rights is the data subject or a legitimate agent.

Criteria for Judgment on Additional Use or Provision

1. XSLAB Inc. may additionally use or provide personal information without the data subject's consent in accordance with Article 15, Paragraph 3 and Article 17, Paragraph 4 of the 「Personal Information Protection Act」, in consideration of matters under Article 14-2 of the Enforcement Decree of the 「Personal Information Protection Act」.
   - Items: Name, Email, Purpose of use: Sending XSLAB-related information, Retention period: Destroyed upon achieving the purpose

Personal Information Protection Officer and Department for Requesting Access to Personal Information

1. XSLAB Inc. has designated a personal information protection officer as follows to take overall responsibility for personal information processing tasks and to handle data subject complaints and provide remedy for damages related to personal information processing.
   ‣ Personal Information Protection Officer
   Name: Myunghwan Yoo
   Position: CEO
   Contact: 02-6952-9974
2. Data subjects may contact the personal information protection officer and the responsible department regarding all personal information protection-related inquiries, complaint handling, and damage remedy that arise while using the services (or business) of XSLAB Inc. The Company will respond to and process data subjects' inquiries without delay.



Remedies for Infringement of Rights and Interests

1. Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the KISA Personal Information Infringement Report Center, etc., to receive remedy for personal information infringement. For other reports and consultations on personal information infringement, please contact the following agencies:
   1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
   2. KISA Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
   3. Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)
   4. National Police Agency: (without area code) 182 (ecrm.cyber.go.kr)
2. XSLAB Inc. guarantees the data subject's right to self-determination of personal information and strives for consultation and damage remedy due to personal information infringement. If you need to report or consult, please contact 02-6952-9974.
3. A person whose rights or interests have been infringed by a disposition or omission made by the head of a public institution in response to a request under the provisions of Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the 「Personal Information Protection Act」 may file for an administrative appeal as prescribed by the Administrative Appeals Act.
   ‣ Central Administrative Appeals Commission: (without area code) 110 (www.simpan.go.kr)