Effective Date: November 12, 2025

Emro Co., Ltd. (hereinafter referred to as the "Company") collects, retains, and processes all personal information handled through its homepage in accordance with the Personal Information Protection Act and relevant laws or with the consent of the data subject. The Company has established the following Privacy Policy to protect the personal information and rights of data subjects and to handle related grievances promptly and smoothly. Matters regarding the processing of personal information by each service are posted on the respective service homepage operated by the Company so that data subjects may easily review them.

Article 1 【Purpose of Collection, Items, and Method of Collection of Personal Information】
① The Company does not provide membership registration or login functions and processes personal information only for the following purposes. If the purpose of use changes, the Company will obtain separate consent from the data subject.
② The Company homepage collects and processes the following items of personal information.

Purpose of Collection	Items Collected	Collection Method
Investment and Consultation Inquiries	Required: Name, Mobile Number, Affiliation, Email	Collected when the data subject directly enters information after providing consent to personal information collection
Service and Consultation Inquiries	Required: Name, Position, Company, Region, Email, Mobile Number
Marketing and Promotional Communications	Required: Name, Email, Mobile Number, Affiliation (Company) Optional: Position, Region	Collected upon the data subject’s consent for purposes such as Emro solution announcements, event and seminar invitations, newsletters, promotional emails, and prize delivery

Article 2 【Provision of Personal Information to Third Parties】
① As a general rule, the Company does not use personal information beyond the scope notified in the previous Article nor provide it to third parties without the consent of the data subject, except as required by relevant laws. However, where provision to consignees in Article 3 is necessary for smooth service delivery, the Company will notify the data subject of matters required by law and obtain consent.
② Personal information may be provided where required by law or upon a legitimate request from investigative agencies in accordance with due legal procedures.

Article 3 【Outsourcing of Personal Information Processing】
① For smooth service operation, user convenience, and marketing activities (including newsletters, solution announcements, and event invitations), the Company may outsource the processing of personal information to specialized external service providers.
② When outsourcing personal information processing, the Company ensures through contractual agreements that service providers strictly comply with personal information protection instructions, confidentiality obligations, and prohibition of provision to third parties without the consent of the data subject.
③ The consignees entrusted with personal information processing and the scope of their work are as follows.

Consignee	Outsourced Service	Retention and Use Period
Addcon, Ppurio	SMS/LMS Delivery	Until deletion is requested by the data subject or the outsourcing contract is terminated
Google Forms, Moaform	Online Survey Form Service
Stibee	Subscription and Email Distribution Service

Article 4 【Processing and Retention Period of Personal Information】
① The Company homepage processes and retains personal information within the scope based on applicable laws or the consent obtained from the data subject.
② The processing and retention periods for each type of personal information are as follows.

Data Type	Items Collected	Collection Method	Collection Purpose	Retention Period
Investment and Consultation Inquiry Information	Required: Name, Mobile Number, Affiliation, Email	Consent of the data subject	Investment and Consultation Inquiries	Until deletion is requested by the data subject or the statutory retention period under relevant laws
Service and Consultation Inquiry Information	Required: Name, Position, Company, Region, Email, Mobile Number		Service and Consultation Inquiries
Marketing-related Information	Required: Name, Email, Mobile Number, Affiliation (Company) Optional: Position, Region		Marketing activities such as Emro solution announcements, newsletters, event invitations, and prize delivery	Until deletion is requested by the data subject or consent is withdrawn

Article 5 【Destruction of Personal Information】
① The Company homepage promptly destroys personal information when it becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose. However, this shall not apply where retention is required by other laws.
② The procedures and methods for destruction of personal information are as follows.
a. Destruction Procedure: When personal information becomes unnecessary due to fulfillment of the processing purpose, expiration of the retention period, termination of the relevant service, or closure of business, the Company destroys the personal information without delay from the date it is deemed unnecessary.
b. Destruction Method: Personal information recorded and stored in electronic file format is permanently deleted so that it cannot be restored. Personal information recorded on paper is shredded or incinerated.

Article 6 【Rights of Data Subjects and Legal Representatives and Methods of Exercise】
① Data subjects may exercise the following rights related to personal information protection at any time with respect to the Company homepage.
a. Request for access to personal information
b. Request for correction in case of errors
c. Request for deletion
d. Request for suspension of processing
② Data subjects may exercise the rights set forth above through written documents, telephone, email, or fax in accordance with Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.
③ If a data subject requests correction or deletion of personal information due to errors, the Company homepage will not use or provide such personal information until the correction or deletion is completed.
④ The rights under Paragraph 1 may be exercised through a legal representative or an authorized agent. In this case, a power of attorney for personal information processing must be submitted.
⑤ The right to request access to personal information and suspension of processing may be restricted pursuant to Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.
⑥ If personal information is specified as a collection target under other laws, the data subject may not request its deletion.
⑦ When a data subject exercises the rights to request access, correction, deletion, or suspension of processing, the Company verifies whether the requester is the data subject or a legitimate representative.
⑧ The Company guarantees the data subject’s right to self-determination regarding personal information and strives to provide consultation and remedies for damages caused by personal information infringement. If reporting or consultation is required, please contact the department below.

Department	Contact	Email
Digital & IT Strategy Group	02-785-9848	pi.emro@emro.co.kr

⑨ Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Privacy Infringement Center, the Supreme Prosecutors' Office, or the National Police Agency.

Personal Information Dispute Mediation Committee	(without area code) 1833-6972	http://www.kopico.go.kr
KISA Privacy Infringement Center	(without area code) 118	http://privacy.kisa.or.kr
Supreme Prosecutors' Office	(without area code) 1301	http://www.spo.go.kr
National Police Agency	(without area code) 182	https://ecrm.police.go.kr

Article 7 【Installation, Operation, and Refusal of Automatic Collection Devices】
① During the use of the Company homepage, personal information may be collected through automatically generated information such as cookies and IP addresses. Cookies are temporary files automatically created when accessing a website and stored on the data subject’s device.
② The Company homepage uses cookies for the following purposes, and data subjects have the right to choose whether to allow or refuse the storage of cookies by setting options in their web browser.
a. Purpose of Cookie Use: Cookies are used to ensure smooth use of services without the need to repeatedly enter ID and password when using services that require login. Cookies are also used to analyze service usage patterns, participation in events, and to provide customized marketing services.
b. How to Refuse Cookie Settings: Data subjects may allow all cookies or refuse the storage of cookies through the options in their web browser. However, refusing cookie storage may result in difficulties in using customized services.

Category	Setting Method
Allow/Block Cookies in Web Browser	- Chrome: Browser Settings → Privacy and Security → Clear Browsing Data - Edge: Browser Settings → Cookies and Site Permissions → Manage and Delete Cookies and Site Data
Allow/Block Cookies in Mobile Browser	- Chrome: Mobile Browser Settings → Privacy and Security → Clear Browsing Data - Safari: Mobile Device Settings → Safari → Advanced → Block All Cookies - Samsung Internet: Mobile Browser Settings → Browsing History → Delete Browsing Data

Article 8 【Processing of Behavioral Information and Refusal】
① In the course of using the Company homepage, the Company processes non-identifiable behavioral information through cookies and automatic collection tools to provide optimized customized services, benefits, and online personalized advertising.
② The Company homepage collects behavioral information as follows.

Collection Items	Collection Method	Collection Purpose	Retention and Use Period
Records of website visits, usage records such as searches and clicks (page views, scrolls, click events), device-related information (browser type and version, operating system, device type, screen resolution, language settings, device category), location information (country and city based on IP), referral information (referral channel, referral URL, search keywords), cookie identification information	Automatically collected through web analytics tools, cookies, and user activity tracking scripts	Analysis of user behavior patterns, website performance improvement, content optimization, and delivery of personalized advertisements	Until deletion is requested by the data subject or as required by relevant laws

③ The Company homepage provides behavioral information as follows.

Recipient	Provided Items	Purpose of Use by Recipient	Retention and Use Period
Google Analytics (Google LLC)	Website visit records, usage records such as searches and clicks (page views, scroll, click events), device-related information (browser type and version, operating system, device type, screen resolution, language settings), location information (IP-based country and city), referral information (referral channel, referral URL, search keywords)	User behavior analysis, measurement of advertising effectiveness, and provision of customized advertising	Until deletion is requested by the data subject or as required by relevant laws

④ The Company homepage collects only the minimum necessary behavioral information required to provide optimized personalized services and advertisements and does not collect sensitive behavioral information that may infringe on an individual’s rights or privacy.
⑤ Data subjects may block or allow personalized advertising by changing cookie settings in their web browser.
[Table. How to block/allow personalized advertising via browser settings]

Category	Setting Method	Purpose of Use	Retention Period
Chrome	① Delete cookies: Chrome ‘⋮’ → Settings → Privacy and Security → Clear browsing data ② Block third-party cookies: Settings → Privacy and Security → Third-party cookies → Block ③ Block all cookies: Open ‘New Incognito Window’	User behavior analysis, advertising effectiveness measurement, customized advertising	Until deletion request or statutory retention period
Edge	① Delete cookies: Edge ‘…’ → Settings → Cookies and Site Permissions → Manage and Delete ② Block third-party cookies: Settings → Privacy, Search, and Services → Tracking Prevention ③ Block all cookies: Open ‘New InPrivate Window’

Article 9 【Privacy Officer】
※ The following includes compliance matters when processing personal video information within the scope of personal information protection management. Matters related to use beyond the intended purpose, provision to third parties, destruction, and requests for access are recorded and managed, and permanently deleted in a manner that prevents restoration upon expiration of the retention period (printed materials are shredded or incinerated).
For inquiries, complaints, or remedies related to personal information protection, you may contact the department below, and the Company will respond without delay.

Department	Contact	Email
Digital & IT Strategy Group	02-785-9848	pi.emro@emro.co.kr

Article 10 【Requests for Access to Personal Information】
Data subjects may request access to personal information pursuant to Article 35 of the Personal Information Protection Act through the department below. The Company will make every effort to process such requests promptly.

Department	Contact	Email
Digital & IT Strategy Group	02-785-9848	pi.emro@emro.co.kr

Article 11 【Measures to Ensure the Security of Personal Information】
The Company takes the following measures to ensure the security of personal information.
a. Establishment and implementation of internal management plans in accordance with the “Standards for Measures to Ensure the Security of Personal Information” announced by the Personal Information Protection Commission.
b. Restriction of access to personal information by granting, modifying, and revoking access rights to personal information processing systems and preventing unauthorized external access through intrusion prevention systems.
c. Retention and prevention of falsification or alteration of access logs by storing and managing records of access to personal information processing systems for at least two years.
d. Encryption of personal information to ensure secure storage and transmission, with additional security functions applied to important data.
e. Installation, regular inspection, and updates of security programs to prevent leakage or damage caused by hacking or computer viruses.
f. Physical access control procedures for locations where personal information processing systems are stored.

Article 12 【Revisions to the Privacy Policy】
If there are any additions, deletions, or modifications to this Privacy Policy, notice will be provided on the Company homepage at least seven days in advance. In the event of a security incident such as hacking or computer viruses, the Company will immediately notify all affected data subjects.