Privacy

Valueformer Privacy Policy

Valueformer (hereinafter referred to as the “Company”) complies with relevant laws such as the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Personal Information Protection Act, and establishes and discloses the following privacy policy to protect users’ personal information and to handle related complaints promptly and smoothly.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent will be taken in accordance with Article 18 of the Personal Information Protection Act.

1. Provision of Services and Contract Fulfillment:
   • Software development, consulting service provision, and handling related inquiries
   • Providing service-related notifications and announcements
2. Member Management (if applicable, delete if not)
   • Identity verification and personal identification for membership services
   • Prevention of fraudulent use by bad members and unauthorized use
   • Confirmation of intention to join, restriction on joining and number of sign-ups
   • Retention of records for dispute resolution
   • Handling complaints and civil affairs
   • Delivery of notices
3. Marketing and Advertising:
   • Sending newsletters (if the user has consented)
   • Development of new services (products) and provision of customized services
   • Providing event and advertising information and opportunities to participate
4. Service Usage Analysis and Improvement:
   • Analyzing anonymized website usage behavior using Google Analytics
   • Improving service quality and user experience

Article 2 (Items of Personal Information Processed)

The Company processes the following items of personal information.

1. Items collected when making inquiries:
   • Email address
2. Items collected when subscribing to the newsletter:
   • Email address
3. Information automatically generated/collected during service use (Google Analytics):
   • Anonymized IP address
   • Device information (type of device, operating system, browser type)
   • Page views, clickstream data, session time, referral path
   • Other anonymized usage data collected through cookies and similar tracking technologies

Article 3 (Processing and Retention Period of Personal Information)

1. The Company processes and retains personal information within the period of retention and use of personal information as stipulated by law or agreed upon when collecting personal information from the data subject.
2. The processing and retention periods for each type of personal information are as follows:
   • Inquiry-related information: 3 months after inquiry processing is completed (however, if retention is required by relevant laws, it will be retained for the required period)
   • Newsletter subscription information: Until subscription is canceled or the service is terminated
   • Information collected through Google Analytics: According to each service provider’s policy (Google Analytics: up to 26 months)

Article 4 (Provision of Personal Information to Third Parties)

1. The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only in cases falling under Article 17 and Article 18 of the Personal Information Protection Act, such as with the consent of the data subject or special provisions of the law.
2. The Company provides personal information to third parties as follows:
   • Google Analytics:
     • Recipient: Google
     • Purpose of use: Website usage analysis, service improvement
     • Items provided: Anonymized IP address, device information, page views, clickstream data, session time, referral path, etc.
     • Retention and use period: According to Google’s privacy policy (Google Privacy Policy Link)

Article 5 (Entrustment of Personal Information Processing) The Company does not entrust personal information processing tasks. If entrustment becomes necessary in the future, a consignment contract will be concluded and the details will be disclosed in accordance with relevant laws.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

1. Data subjects may exercise their rights to request access, correction, deletion, and suspension of processing of personal information at any time.
2. The exercise of rights under paragraph 1 may be made to the Company in writing, by e-mail, or by fax in accordance with the form prescribed in the Enforcement Rules of the Personal Information Protection Act, and the Company will take action without delay.
3. If the data subject requests correction or deletion of errors in personal information, the Company will not use or provide the personal information until the correction or deletion is completed.
4. The exercise of rights under paragraph 1 may be made through the data subject’s legal representative or a delegated person. In this case, a power of attorney in the form prescribed in the Enforcement Rules of the Personal Information Protection Act must be submitted.
5. Data subjects must not infringe on the personal information and privacy of themselves or others processed by the Company in violation of relevant laws such as the Personal Information Protection Act.

Article 7 (Destruction of Personal Information)

1. The Company destroys personal information without delay when the retention period has expired or the purpose of processing has been achieved and the personal information is no longer necessary.
2. If personal information must continue to be preserved in accordance with other laws even though the retention period agreed to by the data subject has expired or the purpose of processing has been achieved, the personal information will be stored separately in a different database (DB) or storage location.
3. The procedures and methods for destroying personal information are as follows:
   • Electronic files: Permanently deleted in a way that cannot be restored
   • Paper documents: Shredded or incinerated

Article 8 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.
2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
3. Physical measures: Access control to computer rooms and data storage rooms

Article 9 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

1. The Company uses ‘cookies’ to store and retrieve usage information from time to time to provide users with personalized services.
2. Cookies are small amounts of information sent by the server (http) used to operate the website to the user’s computer browser and may be stored on the user’s PC hard disk.
   • Purpose of using cookies: To provide optimized information to users by identifying the usage patterns, popular search terms, and security connection status of each service and website visited by the user
   • Installation, operation, and refusal of cookies: Users can refuse to store cookies by setting options in the privacy menu of Internet Options at the top of the web browser.
   • If you refuse to store cookies, you may have difficulty using customized services.
3. The Company uses cookies and other tracking technologies through Google Analytics to collect anonymized usage data. Users can refuse such data collection by the following method:

• Google Analytics: https://tools.google.com/dlpage/gaoptout

Article 10 (Personal Information Protection Officer)

1. The Company designates the following person as the person responsible for personal information protection, who is responsible for overall personal information processing and for handling complaints and damage relief related to personal information processing.

   ▶ Personal Information Protection Officer Name: Jiwon Lee Position: CEO Contact: +82-70-7818-7373

2. Data subjects may contact the personal information protection officer and the department in charge for all personal information protection-related inquiries, complaint handling, and damage relief that occur while using the Company’s services (or business). The Company will respond to and handle inquiries from data subjects without delay.

Article 11 (Request for Access to Personal Information) Data subjects may request access to personal information pursuant to Article 35 of the Personal Information Protection Act to the department below. The Company will make efforts to promptly process requests for access to personal information from data subjects.

▶ Department for Receiving and Processing Requests for Access to Personal Information Department Name: Jiwon Lee Person in Charge: CEO Contact: +82-70-7818-7373

Article 12 (Remedies for Infringement of Rights and Interests) Data subjects may contact the following organizations for damage relief, counseling, etc. regarding personal information infringement.

<The following organizations are separate from the Company. If you are not satisfied with the Company’s own personal information complaint handling and damage relief results, or if you need more detailed help, please contact them.>

▶ Personal Information Infringement Report Center (operated by Korea Internet & Security Agency)

• Duties: Report personal information infringement, apply for counseling
• Website: privacy.kisa.or.kr
• Phone: 118 (no area code)
• Address: 3rd floor, Personal Information Infringement Report Center, 9 Jinheung-gil, Naju-si, Jeollanam-do (Bitgaram-dong 301-2), 58324

▶ Personal Information Dispute Mediation Committee

• Duties: Apply for personal information dispute mediation, group dispute mediation (civil resolution)
• Website: www.kopico.go.kr
• Phone: 1833-6972 (no area code)
• Address: 4th floor, Government Seoul Building, 209 Sejong-daero, Jongno-gu, Seoul, 03171

▶ Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (no area code), [email protected] (www.spo.go.kr) ▶ National Police Agency Cyber Bureau: 182 (no area code) (ecrm.cyber.go.kr)

Article 13 (Changes to the Privacy Policy)

1. This privacy policy is effective from April 1, 2025.
2. If there are additions, deletions, or corrections to the contents due to changes in laws or policies, the changes will be notified through notices at least 7 days before the effective date. However, in the case of significant changes to users’ rights, such as the collection and use of personal information or provision to third parties, notice will be given at least 30 days in advance.