Article 1 (Distinction of Data Controller Status)

1. Personal information of members (client companies and their agents)

With respect to personal information of members collected for membership registration and operation of the Service, the Company acts directly as a personal information controller under the Personal Information Protection Act (PIPA) and processes such information in accordance with this policy.

2. Personal information of end users processed by client companies through consultations

With respect to the personal information of end users that is entered, collected, or stored in the Service during the course of a member (client company) providing support to its own customers, the Company acts as a processor (sub-processor) entrusted with processing by the client company. The obligation to provide notice and obtain consent from data subjects regarding the purposes and scope of collection and use of such personal information rests with the client company as the personal information controller. The Company processes such information only within the scope prescribed by the service agreement and personal information processing entrustment agreement (to be concluded separately if required) with the client company.

Article 2 (Items Collected and Retention Period)

The Company collects personal information as follows for the provision of the Service and destroys it without delay after the purpose has been achieved.

※ The Company does not require the collection of sensitive information such as ideology and beliefs, health, or political views. However, data subjects or client companies may enter sensitive information in free-text fields such as support messages or notes, and in such cases, responsibility for the collection and entry of such information rests with the party who entered it.

Article 3 (Purposes of Personal Information Processing)

The Company uses the collected personal information only for the following purposes and, if the purposes change, takes necessary measures such as obtaining separate consent in accordance with applicable laws.

• Membership registration and management, identity verification, service provision and operation
• Supporting client companies' integrated messenger support operations (entrusted processing)
• Fee payment and settlement, transmission of notices, responding to inquiries
• Fraud prevention, service security and stability, dispute response
• Service improvement and development of new features (anonymized/statistical processing where possible)
• Sending marketing and promotional information (only when separate consent has been obtained)

Article 4 (Retention and Use Period of Personal Information)

① The Company retains members' personal information until membership withdrawal or termination of the service agreement, and destroys it without delay thereafter.

② End users' personal information and support data are retained in accordance with the data retention policy under the client company's service agreement and chosen plan. The data is destroyed pursuant to applicable procedures when the retention period elapses, when the client company requests or executes deletion, or when the client company's service agreement is terminated.

③ The personal information of members who have not used the Service for one year or more may be separately isolated or destroyed in accordance with applicable laws.

④ In the following cases, the information is retained for the period prescribed by applicable laws.

• Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
• Access logs: 3 months (Protection of Communications Secrets Act)

Article 5 (Provision of Personal Information to Third Parties)

The Company does not provide users' personal information to third parties beyond the scope specified in this policy. However, the following cases are exceptions.

• When the user has given prior consent
• When there are special provisions in applicable laws, or when an investigative agency requests it under the procedures and methods prescribed by law
• When necessary for the urgent protection of life, physical safety, or property of the data subject or a third party

Article 6 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing as set out below for stable service provision, and supervises the processor to ensure the secure handling of personal information in accordance with applicable laws when executing the entrustment agreement. Any changes in the content of entrusted work or the processor will be notified through this policy.

Article 7 (Cross-Border Transfer of Personal Information)

For cloud infrastructure operation, email delivery, integration with global messengers (WhatsApp, Instagram, Facebook, etc.), personal information may be stored and processed on servers located outside the Republic of Korea, or transmitted to overseas service providers.

※ Global messenger integration functions are activated only when the client company connects and uses the relevant channel. In such cases, the client company bears the responsibility to notify and obtain consent from its own data subjects regarding cross-border transfer.

Article 8 (Destruction of Personal Information)

① When the retention period elapses or the processing purpose is achieved, personal information is destroyed without delay.

② Electronic files are permanently deleted by a method that makes recovery impossible, and printed materials are shredded or incinerated.

③ Information retained pursuant to applicable laws is stored and managed separately from other personal information.

Article 9 (Rights of Data Subjects and Users)

① Members may at any time request access, correction, deletion, or suspension of processing of their personal information, and may directly modify it on the account settings page or delete it by withdrawing membership. Other requests may be submitted in writing or by email to the Personal Information Protection Officer.

② The Company will take action on rights exercise requests within 10 days from the date of receipt, and will notify the requester of the reason and processing schedule if there is a legitimate ground for delay. (PIPA Articles 35–37)

③ If an end user wishes to access, correct, or delete their personal information, they must submit the request to the client company, which is the controller of that personal information. The Company, acting as a processor, will handle such requests in accordance with the client company's instructions; if a data subject submits a request directly to the Company, the Company may forward it to the client company or direct the data subject to contact the client company.

Article 10 (Cookies and Automatically Collected Information)

① The Company uses cookies and session tokens to maintain login sessions and provide the Service. Users may refuse cookie storage through their browser settings; however, some features such as login may be restricted in that case.

② The Company may automatically collect access logs, device/browser information, IP addresses, and similar data for service operation and security purposes, which are used to prevent fraud and provide stable service.

Article 11 (Automated Processing)

The Company may provide automated features such as automatic assignment, automated responses/keyword bots, and automatic translation to improve support efficiency. These features operate according to the client company's settings and do not perform automated sole decision-making that produces legal effects or significant impacts on data subjects.

Users have the right to object to automated decisions or to request an explanation, and may file an objection with the Personal Information Protection Officer.

Article 12 (Personal Information of Children Under 14)

The Service is intended for the support operations of corporations such as businesses and institutions, and does not accept membership registrations from children under 14 years of age. If the Company becomes aware that it has collected personal information from a child under 14 without the consent of a legal guardian, it will destroy such information without delay.

Article 13 (Measures to Ensure the Security of Personal Information)

The Company implements the following security measures in accordance with Article 29 of PIPA.

• Encrypted (bcrypt hash) storage of passwords and other sensitive information
• SSL/TLS encryption of data in transit
• Logical separation of data by organization (tenant) and access control
• Minimization of access privileges, access rights management, and access log recording
• Establishment of an internal management plan and regular audits

Article 14 (Limitation of Liability)

The Company shall not be liable for personal information breaches caused by the user's own negligence (e.g., inadequate management of account or password) or reasons beyond the Company's control, including force majeure such as natural disasters, even where the Company has fulfilled its obligations to implement security measures. Responsibility for the lawful collection and use of end users' personal information rests with the client company as the personal information controller.

Article 15 (Personal Information Protection Officer)

Users may submit inquiries, complaints, or requests for remedies related to personal information protection to the contact below, and the Company will respond and take action promptly.

Article 16 (Remedies for Rights Infringement)

To seek remedy for damages resulting from personal information infringement, you may request consultation from the following agencies.

• Personal Information Infringement Report Center: (no area code) 118 | www.privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 | www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: (no area code) 1301 | www.spo.go.kr
• National Police Agency Cyber Bureau: (no area code) 182 | cyberbureau.police.go.kr

Article 17 (Amendments to the Privacy Policy)

This policy may be revised in accordance with changes in applicable laws or service policies. Any revisions will be announced through the in-Service notice board or this page, along with the effective date and reason for the change. In the case of significant changes, notice will be given at least 7 days before the effective date (or at least 30 days before for changes unfavorable to users).