AITRICS Co., Ltd. (hereinafter referred to as the “Company”) establishes and discloses this Privacy Policy to protect the personal information of data subjects and to ensure that complaints regarding personal information are handled promptly and effectively in accordance with Article 30 of the Personal Information Protection Act.

1. Purpose of Processing Personal Informatio

The Company processes personal information for the following purposes. Personal information will not be used for any purpose other than those listed below. If the purpose of use changes, the Company will obtain prior consent from the data subject or take other necessary actions in accordance with Article 18 of the Personal Information Protection Act.

• ① Providing services related to product inquiries
• ② Proceeding with and managing recruitment inquiries and applications

2. Categories of Personal Information Processed and Retention Period

The Company collects and processes personal information with the consent of the data subject under Article 15(1)(1) and Article 22(1)(7) of the Personal Information Protection Act.

Categories of Information	Purpose of Use	Retention Period	Collection Method
(Mandatory) Name, Affiliation (hospital/company), Contact Information, Email Address	Product inquiries	1 year from the date of collection	Website
(Optional) Region	Product inquiries	1 year from the date of collection	Website
(Mandatory) Name, Contact Information, Email Address, Education, Work Experience, Licenses and Certifications, Awards, Military Service	Recruitment inquiries and applications	Immediately destroyed after the recruitment process is completed	Website
(Optional) Photo, Gender, Address	Recruitment inquiries and applications	Immediately destroyed after the recruitment process is completed	Website

① Records of consumer complaints or dispute resolution related to product inquiries are retained for 3 years.

☞ Legal Basis : Article 6(1)(4) of the Enforcement Decree of the Consumer Protection Act in Electronic Commerce, etc.

② Personal information of employees hired through recruitment is retained for 3 years from the date of resignation.

☞ Legal Basis : Article 42 of the Labor Standards Act

3. Procedures and Methods of Personal Information Destruction

① The Company promptly destroys personal information that has become unnecessary, such as when the retention period has expired or the processing purpose has been achieved.

② If personal information must be preserved due to other laws even after the retention period consented to by the data subject has expired or the processing purpose has been achieved, such information is transferred to a separate database (DB) or stored in a different location.

③ The Company identifies personal information to be destroyed and destroys it with the approval of the Personal Information Protection Officer.

④ Personal information recorded and stored in electronic files is destroyed in a manner that makes the records irretrievable, while paper documents are shredded or incinerated.

4. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information:

• ① Administrative Measures: Development and implementation of an internal management plan and regular employee training.
• ② Technical Measures: Access control for personal information, encryption, and installation of security programs.
• ③ Physical Measures: Access control to computer rooms, data storage rooms, and other key facilities.

5. Use of Automatic Data Collection Devices and Opt-Out Options

① The Company uses cookies to store and retrieve user information for personalized services.

② Cookies are small amounts of information sent by the website's server to the user’s browser and stored on the user’s PC or mobile device.

③ Users can allow or block cookies by configuring their browser settings. However, refusing to save cookies may limit the use of personalized services.

▶ Cookie Settings by Browser:

• Chrome : Browser settings > Privacy and Security > Clear browsing data

• Edge : Browser settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allowing/Blocking Cookies on Mobile Browsers

• Chrome : Mobile browser settings > Privacy and security > Clear browsing data

• Safari : Mobile device settings > Safari > Advanced > Block all cookies

• Samsung Internet : Mobile browser settings > Browsing history > Clear browsing data

6. Rights of Data Subjects and Legal Representatives

① Data subjects may exercise the following rights concerning their personal information: access, correction, deletion, suspension of processing, withdrawal of consent, objection to automated decisions, or requesting an explanation.

② Requests for the above can be made via written, email, or fax communication in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. The Company will respond without delay.

③ The right to access and suspend processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act.

④ Requests for deletion cannot be made if personal information is required by law.

⑤ The Company verifies the identity of the requesting individual or their legitimate representative when processing such requests.

▶ Department for Receiving and Processing Requests for Access to Personal Information

• Department: Sales & Marketing, HR & GA Teams

• Contact Information: 02-569-5507 / sm@aitrics.com, career@aitrics.com

7. Personal Information Protection Officer

The company takes overall responsibility for tasks related to personal information processing and has designated the following Personal Information Protection Officer to handle complaints and provide remedies concerning personal information processing.

▶ Personal Information Protection Officer

• Name : Park Jung-ho

• Title : Chief Information Security Officer

• Contact Information : 02-569-5507 / pjh@aitrics.com

Data subjects may contact the Personal Information Protection Officer and the responsible department regarding any inquiries, complaints, or remedies related to personal information protection arising from the use of the company’s services. The company will respond to and handle such inquiries without delay.

8. Remedies for Infringement of Rights

Data subjects may contact the institutions below for remedies or consultations regarding personal information violations. These institutions are independent of the company. If you are not satisfied with the company’s internal handling of complaints or remedies related to personal information, or if you require further assistance, please reach out to these institutions.

• • Personal Information Infringement Report Center : privacy.kisa.or.kr / 118
• • Personal Information Dispute Mediation Committee : www.kopico.go.kr / 1833-6972
• • Prosecutor's Office : www.spo.go.kr / 1301
• • Police Cybercrime Investigation : ecrm.cyber.go.kr / 182

9. Operation and Management of Fixed Video Surveillance Systems

The company has installed and operates fixed video surveillance systems as outlined below.

① Purpose of Installation: Facility safety and fire prevention.

② Number of installations, installation locations, and coverage area

Number Installed	Installation Location & Coverage
2	Office entrance and internal facilities

③ Person in charge of management and authorized access.

Category	Name	Department	Position	Contact
Management Responsible	Bang Jun	HR&GA	Manager	02-569-5507

④ Recording Time, Retention Period, Storage Location, and Processing Method of Personal Video Information

Recording Time	Retention Period	Storage Location
24hours	30 days from the recording date	ADT Caps Cloud Server

10. Changes to the Privacy Policy

① This policy is effective as of December 1, 2024. Changes to the policy due to legal, policy, or security updates will be announced on the website.

② Previous versions of the Privacy Policy can be found at the following link:

- 2021.01.01 ~ 2024.11.30 (Link)