Sunapse Co., Ltd. (hereinafter referred to as the “Company”) establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act to protect users’ personal information and rights, and to smoothly handle any grievances related to personal information. If the Company revises this Privacy Policy, it will notify users through website announcements or individual notices.

This Policy shall take effect as of January 2, 2025.

Article 1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes. The processed personal information will not be used for purposes other than those stated below, and prior consent will be obtained if the purpose of use is changed.

1. Provision of Goods or Services

Personal information is processed for purposes such as service provision, contract delivery, quotation provision, customized services, payment and settlement, and debt collection.

2. Marketing and Advertising

Personal information is processed for purposes such as developing new services (products), providing customized services, delivering promotional information and event participation opportunities, providing services and advertisements based on demographic characteristics, verifying service effectiveness, analyzing access frequency, and compiling statistics on service usage. In such cases, the Company complies with applicable laws, including obtaining separate consent when required.

3. Handling Complaints

Personal information is processed for purposes such as verifying the identity of complainants, confirming complaint details, contacting and notifying for fact-finding, and informing users of the results.

Article 2. Status of Personal Information Files

1. File name: Sunapse Personal Information File

2. Items collected: Email address, inquiry content, name, job title, department, company name, service usage records, access logs, cookies, IP address

3. Method of collection: Inquiry form on the Company website

4. Basis for retention: Handling customer inquiries

5. Retention period: 5 years

6. Relevant laws:

   • Personal Information Protection Act

   • Act on Consumer Protection in Electronic Commerce

   • Act on Promotion of Information and Communications Network Utilization and Information Protection

   
   

Article 3. Retention and Processing Period of Personal Information

① The Company processes and retains personal information within the period stipulated by applicable laws or agreed upon at the time of collection.

② The retention periods are as follows:

Provision of Goods or Services : Until completion of service provision, payment, and settlement. However, if applicable, information is retained for the following periods in accordance with relevant laws:

Records related to transactions, including labeling and advertising, contract details, and contract performance, in accordance with the Act on Consumer Protection in Electronic Commerce, etc.

1. Records related to display and advertising: 6 months

   1. Records related to contracts, withdrawal of subscription, payment, and supply of goods: 5 years

   2. Records related to consumer complaints or dispute resolution: 3 years

2. Communication Secrets Protection Act

   1. Internet logs and access records: 3 months

3. Value-Added Tax Act

   1. Tax invoices and transaction records: 5 years

Article 4. Provision of Personal Information to Third Parties

① The Company processes personal information only within the scope specified in Article 1 and provides it to third parties only with the user’s consent or as permitted under Article 17 of the Personal Information Protection Act.

※ Exceptions: apply where prior consent has been obtained or where provision is required under other applicable laws.

Article 5. Outsourcing of Personal Information Processing

① The Company may outsource personal information processing tasks to ensure efficient operations.

② When entering into outsourcing agreements, the Company specifies matters such as prohibition of processing beyond the purpose, security measures, restrictions on re-outsourcing, supervision of contractors, and liability for damages, in accordance with Article 26 of the Personal Information Protection Act.

③ Any changes to outsourced tasks or contractors will be disclosed without delay through this Privacy Policy.

④ The Company may transfer personal information overseas in accordance with Article 28-8 of the Personal Information Protection Act.

※ Users may refuse overseas transfer by contacting customer support; however, this may limit the provision of certain services.

Article 6. Rights and Obligations of Data Subjects and Methods of Exercise

① Data subjects may withdraw consent, request access, correction, or deletion of personal information, and request suspension of processing at any time.

② Requests may be made in writing, by email, or by fax pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act.

③Requests may be made by a legal representative or authorized agent upon submission of a power of attorney.

④ Access and suspension requests may be restricted under Articles 35(5) and 37(2) of the Act.

⑤ Deletion may be restricted where retention is required by other laws.

⑥ The Company verifies the identity and authority of requesters.

Article 7. Items of Personal Information Collected

The Company collects and processes the following categories of personal information.

1. Inquiry Form

   • Required: Email address, name, job title, company name

   • Optional: Encrypted unique identification information (CI), inquiry content

2. Marketing and Advertising

   • Required: Name, job title, email address, company name

   • Optional: None

3. Automatically Collected Information

   • IP address, cookies, MAC address, service usage records, visit records, abnormal usage records

Article 8. Destruction of Personal Information

① Personal information is destroyed without delay once the retention period expires or the purpose is achieved.

② If retention is required by law, information is stored separately.

③ Destruction procedures:

1. Electronic files: Irreversibly deleted using low-level formatting

2. Paper documents: Shredded or incinerated

Article 9. Measures to Ensure Security of Personal Information

The Company implements technical, administrative, and physical measures in accordance with Article 29 of the Personal Information Protection Act, including:

① Regular internal audits (quarterly)

② Minimization and training of personnel handling personal information

③ Establishment and implementation of internal management plans

④ Security programs and access control systems

⑤ Encryption of personal information

⑥ Storage and prevention of tampering with access logs

⑦ Restricted access to databases

⑧ Secure storage of documents

⑨ Controlled access to physical storage areas

Article 10. Cookies and Automatic Collection Devices

① The Company uses cookies to provide personalized services.

② Cookies are small text files stored on users’ devices.

• Purpose: To analyze service usage, preferences, and security status

• Users may refuse cookies through browser settings; refusal may limit certain services.

Article 11. Personal Information Protection Officer

① The Company appoints a Chief Privacy Officer as set forth below, who is responsible for overseeing matters related to the processing of personal information and for handling data subjects’ complaints and remedies related to personal information protection.

※ Chief Privacy Officer

• Name: Junhyuk Son

• Title: CEO

• Contact: sunpase.m@sunapse.kr

  ※ You will be connected to the department responsible for personal information protection.

  
  

※ Privacy Manager

• Name: Dongwon Kim

• Contact: sunpase.m@sunapse.kr

  
  

② Data subjects may contact the Company’s Chief Privacy Officer or the responsible department regarding any inquiries, complaints, or requests for remedies related to personal information protection arising from the use of the Company’s services (or business). The Company will respond to and process such inquiries without delay.

Article 12. Remedies for Infringement of Rights

Users may contact the following institutions for dispute resolution:

[The institutions listed below are independent from the Company. If you are not satisfied with the Company’s internal handling of personal information complaints or remedies, or if you require further assistance, you may contact the following organizations.]

▶ Personal Information Infringement Report Center (KISA)

Scope of services: Reporting personal information infringement and requesting consultations

Website : privacy.kisa.or.kr

Phone : (within Korea, no area code required) 118

Address: Personal Information Infringement Report Center, 3F, 9 Jinheung-gil, Naju-si, Jeollanam-do, 58324, Republic of Korea

▶ Personal Information Dispute Mediation Committee

Scope of services: Application for personal information dispute mediation and collective dispute mediation (civil resolution)

Website : www.kopico.go.kr

Phone : (within Korea, no area code required) 1833-6972

Government Complex Seoul, 4F, 209 Sejong-daero, Jongno-gu, Seoul, 03171, Republic of Korea

▶ Supreme Prosecutors’ Office Cyber Crime Division : +81 2-3480-3573 (www.spo.go.kr)

▶ National Police Agency Cyber Crime Reporting System : (within Korea, no area code required) 182 (ecrm.cyber.go.kr)

Article 13. Changes to This Privacy Policy

① This Privacy Policy is effective as of January 2, 2025, and any changes will be announced on the website.

Effective Date: January 2, 2025