Privacy Policy

1. Categories of Personal Information Collected, Purpose of Use, and Retention Period

• 1.1 Categories of Personal Information and Purpose of Use

  We collect and process the following personal information in connection with the provision of our Services, and use it for the purposes described below.

  We retain your personal information for the period to which you consented at the time of collection, or for such other period as may be required by applicabletion laws and regulations

  ※ As a general rule, once the purpose of using your personal information has been fulfilled (e.g., upon account deletion or upon your request for erasure), the information will be deleted without undue delay.

  Category	Personal Information Collected	Purpose of Use	Retention Period	Notes
  Information Provided	- ID, first and last name, mobile phone number, email address	- Service provision, website operation and improvement, response to inquiries	- During the Service provision period ※ However, in the case of IDs, due to the nature of the company’s Caidentia solution, they are not deleted (“deleterased”) in order to retain historical data.	- Directly provided by the user
  Information Generated	- Service usage records: access logs, IP address, usage history, usage time - PC environment information: operating system and version, browser version - Mobile device information: device identifier, device operating system	- Server issue diagnostics, website management, Service quality improvement	- 1 year from the date of collection	- Automatically collected during Service use

  [Table 1] Personal Information Collected, Purpose and Retention Period

  However, in cases where we are legally obligated, we may be required to retain your personal information for a longer period than the retention period described above. In such cases, we will continue to retain your personal information for the duration required by applicable laws and regulations. In addition, if there are any pending payments related to the use of the Service, we will retain your personal information until such payments are fully settled.

• 1.2. Your Options

  You may choose not to provide certain types of personal information. In some cases, refusal to provide such information may limit your access to and use of certain parts of the Service. Such limitations may be further explained at the time when consent for the provision of specific Services is requested.

2. Sharing of Personal Information

We do not share your personal information with third parties except as provided in this Privacy Policy below or required by applicable laws and regulations.

• 2.1 Affiliates

  We may share your personal information with our global subsidiaries and affiliates who will use it only for the purposes described in this Privacy Policy.

• 2.2 Business Partners

  We may contract other business partners, including but not limited to, providers, vendors or contractors (collectively, the “Business Partners”) to carry out certain tasks (“Functions”) on our behalf of us and in accordance with our instructions. The Business Partners are granted access to your personal information necessary to perform their assigned Functions as shown below.

  Business Partners	Functions	Duration of Processing and Retention
  Microsoft	System operation and maintenance	- Until the completion or termination of the Function; or - For the period as required by the applicable laws and Microsoft Products and Services Data Protection Addendum(DPA)

• 2.3. Disclosure of Personal Information as Required by Law

  We may disclose your personal information in response to a legal request, such as a court order, subpoena, or request from a law enforcement agency, regulatory body, or other authorized authority. To the extent possible and permitted by law, we will use commercially reasonable efforts to notify you of such disclosure.

• 2.4. Disclosure of Personal Information in the Event of a Corporate Transaction

  In the event that we undergo transactions that involve transfer of a part or all of our businesses (and assets), such as a merger, acquisition, or sale, your personal information may be transferred to the relevant parties involved in such transactions. Unless you have given us your consent to do otherwise, your personal information that has been collected or processed by us or our Business Partners will continue to be subject to the terms and conditions of this Privacy Policy, and we will require the acquiring party to comply with the same level of protection for your personal information as outlined in this Privacy Policy.

3. Destruction of Personal Information

Upon expiration of the personal information retention period as specified in Section 1 of this Privacy Policy, we will destroy your personal information in compliance with the applicable security requirements.

4. Cross-border Transfer of Personal Information

Your personal information may be processed in and transferred to countries other than your country of residence. While we are located in the Republic of Korea, your personal information may be stored in or accessed from multiple countries (i) where we have our facilities; or (ii) in which we engage Business Partners.

We will take reasonable steps to ensure that such processing and transfer are carried out in accordance with this Privacy Policy and in compliance with applicable Data Privacy Laws. This includes using appropriate safeguards to protect your personal information.

If your personal information is accessed and processed in a jurisdiction other than where you reside, it may be subject to the laws of that jurisdiction, including those that permit or require disclosure of your personal information to government agencies, courts, or law enforcement authorities.

5. Exercise of Your Rights

We are committed to ensuring that you are aware of and can exercise your rights regarding your personal information. Subject to the circumstances, conditions and exceptions set out in applicable Data Privacy Laws, you are entitled to exercise your rights shown below by contacting us via the contact information specified in Section 910 of this Privacy Policy.

• 5.1 Right to Access

  You have the right to know whether we process your personal information, and if we do, to request access to that information. You can also request a copy of your personal information that we hold.

• 5.2 Right to Rectification/Correction

  You have the right to request rectification of any inaccurate information if you have reason to believe we have inaccurate information about you.

• 5.3 Right to Delete

  You have the right to request the deletion of your personal information. We will promptly delete such personal information upon your request, unless otherwise required by applicable laws and regulations.

• 5.4 Right to Withdraw Consent

  You have the right to withdraw your consent to the collection and use of your personal information in our possession or under our control at any time. We will process your request within a reasonable timeframe, and thereafter, subject to the terms and conditions of this Privacy Policy, we will refrain from collecting, using and/or disclosing your personal information.

• 5.5 Right to Restrict Processing

  You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when the information is inaccurate, the processing is unlawful, or you have objected to the processing.

• 5.6 Right to Object to Processing

  You have the right to object to the processing of your personal information. If you object, we will stop processing your information unless we have compelling legitimate grounds to continue processing or where it is needed for the establishment, exercise, or defense of legal claims.

• 5.7 Right to Data Portability

  You have the right to request that we transfer your personal information to another organization, or directly to you, in a structured, commonly used, and machine-readable format, where the processing is based on your consent or for the performance of a contract.

• 5.8 Right to Non-discrimination

  We will not discriminate against you for exercising any of the rights specified in this Privacy Policy.

6. Personal Information of Minors

We are committed to protecting the privacy of minors. We do not knowingly collect, use, or disclose personal information from minors under the age of 18 without the explicit consent of a parent or guardian. If we become aware that we have inadvertently collected personal information from a minor without consent, we will take steps to delete it as soon as possible.

7. Ensuring Security of Personal Information

We maintain and ensure that adequate administrative, technical, and physical safeguards are implemented, and all systems undergo regular inspections at least once a year.

8. Cookies

Cookies are small informational text files which are downloaded to your computer or other devices through your web browser when you visit a website and enable the website to recognize the accessing device (the “Cookies”). From time to time without further notice, we may use Cookies to improve Services.

The types of cookies that we use are as follow:

• a) Strictly necessary cookies – these cookies are essential to maintain your access to the website;
• b) Functional cookies – these help us to optimize the website, for instance, to collect statistics and save your preferences.

You may choose to: i) allow all Cookies; ii) verify each time any Cookies are saved; or iii) refuse to save any Cookies at all. Please note that your refusal to save any Cookies may restrict your use of certain features/parts of the Services.

9. Chief Privacy Officer and Contact Information

We have appointed a Chief Privacy Officer who is responsible for overseeing the processing of personal information and addressing any concerns or requests you may have.

If you have any questions or wish to make a request regarding our privacy practices or the processing of your personal information, please don’t hesitate to contact us using the information below.

• - Chief Privacy Officer: Director of Digital & IT Strategy Group
• - Phone: +82-2-6121-8762
• - E-mail: pi.emro@emro.co.kr

10. Changes

We may update this Privacy Policy from time to time to reflect changes in our business, technology, or legal requirements. We encourage you to review this Privacy Policy regularly to stay informed about our privacy practices and any changes we may make. This Privacy Policy was last updated on October 31, 2025. You can access previous versions by clicking [here].

11. Jurisdiction-Specific Information

Below, you will find additional information about the collection, processing, and use of personal information for individuals residing in certain jurisdictions. Please review the section that applies to your country of residence for more details.

• 1) Brazil

  Exercise of Your Rights

  Subject to the applicable law, in addition to your rights under Section 5, you have the right to the following:

  • - Right to anonymization, blocking, or deletion of unnecessary, excessive, or data processed in violation of the provisions of the LGPD (Lei Geral de Proteçãcao de Dados) which is Brazilian General Data Protection Law;
  • - Right to obtain complete information on the public and private entities with which we shared your personal information;
  • - Right to be informed of implications of not providing consent and the consequences of refusal; and
  • - Right to request a review of decisions taken solely based on automated processing of your personal information that affect your interests, including decisions intended to define your personal, professional, consumer and credit profile or aspects of your personality.

• 2) European Economic Area (EEA) or the UK

  Cross-border transfer from the EEA

  For cross-border transfers of personal data from the European Economic Area ("EEA") or the UK, we implement such measures as are necessary to ensure we provide appropriate safeguards for the transferred data, including through the use of Standard Contractual Clauses or another lawful transfer data transfer mechanism.

  Legitimate grounds for processing and use

  We process personal data based on the purposes specified above and on several legitimate grounds, including the individual's consent, the necessity of processing for the performance of a contract, compliance with legal obligations, and our legitimate interests, in accordance with applicable laws and regulations.

  Contact Information

  When reaching out to us, kindly specify the country and/or state where you reside.

  We are dedicated to collaborating with you to resolve any privacy-related concerns or complaints fairly. Should you feel that we have not been able to address your issue effectively, and you are based in the European Economic Area (EEA) or the UK, you retain the right to file a complaint with the relevant supervisory authority.

• 3) India

  Definition and interpretation of personal information.

  In this Privacy Policy, 'personal information' shall be read as 'personal data'.

  Exercise of Your Rights

  Subject to the applicable law, in addition to your rights under Section 5, you have the right to the following:

  • - request a summary of: (a) your personal data processed by us; (b)the processing activities undertaken with respect to your personal data; and (c) the identities of all data fiduciaries and data processors with whom your personal data has been shared; and
  • - nominate another individual to exercise your rights under this Privacy Policy in the event of your death or incapacity.

  Contact Information

  You may raise grievances regarding our processing of your personal data. We will respond within the timeframes specified under the Digital Personal Data Protection Act (the "DPDPA"). If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India.

• 4) United States of America

  Sharing of Personal Information

  The categories of third parties with whom we disclose personal information in the last twelve (12) months prior to the date of this Privacy Policy may include the following:

  • - Affiliates
    We may share your personal information with our global subsidiaries and affiliates who will use it only for the purposes described in this Privacy Policy.
  • - Business Partners
    We may contract other business partners, including but not limited to, providers, vendors or contractors (collectively, the “Business Partners”) to carry out certain tasks (“Functions”) on our behalf of us and in accordance with our instructions.

  Exercise of Your Rights

  Subject to the applicable law, in addition to your rights under Section 5, you have the right to the following:

  • - Right to opt-out of Sale of your personal information.
    Certain state privacy laws require us to identify, for the 12-month period prior to the date of this Privacy Policy, what information we may have “sold” or “shared” about you. This right is therefore applicable to the extent that we are engaging in a “sale” of your personal information. For the 12-month period prior to the date of this Privacy Policy, we have not sold any personal information of you, so we do not offer an opt-out of “Sale”.
  • - Right to limit use and disclosure of sensitive personal information – we do not collect your sensitive personal information.
  • - Right to opt-out of targeted advertising – we do not use your personal information for targeted advertising.
  • - Right to opt-out of profiling – we do not use your personal information for profiling.

  Notice For California Residents Only:

  This notice contains additional provisions that apply solely to California residents and uses terms that are defined in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CPRA”).

  Personal Information Collected

  We may have collected in the 12-month period prior to the date of this Privacy Policy the categories of personal information about you as set forth in Section 1 of this Privacy Policy. We may use such categories of personal information for the business purposes described in this Privacy Policy.

  Sources

  During the 12-month period prior to the date of this Privacy Policy, we may have obtained personal information about you from various sources, including:

  • • You;
  • • Your devices;
  • • Our affiliates and subsidiaries;
  • • Our business partners;
  • • Our marketing partners;
  • • Our vendors; and
  • • Your employer.

  Disclosure of Personal Information for a Business Purpose

  During the 12-month period prior to the date of this Privacy Policy, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

  • • Identifiers: affiliates and subsidiaries, joint marketing partners, business partners,
  • • Device Information: affiliates and subsidiaries, and business partners
  • • Network Activity: affiliates and subsidiaries, business partners,

  CPRA Privacy Rights

  To exercise your rights set forth in this Privacy Policy, please contact us at the contact information provided above.

• 5) Vietnam

  Right to Delete

  For clarity, we will delete your personal information within 72 hours upon receiving your request.”

  Exercise of Your Rights

  Subject to the applicable law, in addition to your rights under Section 5, you have the right to the following:

  • • Right to be informed
    You have the right to be informed of your personal information processing, unless otherwise provided for by law.
  • • Right to obtain personal information
    You have the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to provide you with your personal information, unless otherwise provided for by law.
  • • Right to file complaints, accusations and lawsuits
    You have the right to file complaints, accusations, and lawsuits as prescribed by law.
  • • Right to claim damages
    You have the right to claim damages as prescribed by law when there are violations against regulations on the protection of your personal information, unless otherwise agreed upon by parties or unless otherwise prescribed by law.
  • • Right to self-protection
    You have the right to self-protection according to regulations in the Civil Code, other relevant laws and the Decree 13/2023/ND-CP, or request competent agencies and organizations to implement civil right protection methods according to regulations of the Civil Code.