Archai Electronics Inc. Personal Information Processing Policy (Korea)

Archai Electronics Inc. processes only the minimum personal information needed to answer inquiries sent through its website (www.archai.co.kr), and this policy sets out how it does so and how data subjects can exercise their rights. Because the website runs on cloud services of Cloudflare, Inc. (United States), personal information is transferred to and stored outside Korea; details are in Article 5.

Archai Electronics Inc. (주식회사 아카이전자, the "Company") processes personal information lawfully and manages it securely in compliance with the Personal Information Protection Act (PIPA) and related laws, to protect the freedoms and rights of data subjects. Under Article 30 of PIPA, the Company establishes and publishes this Personal Information Processing Policy to explain its procedures and standards for processing and protecting personal information and to handle related complaints promptly. This policy applies to the Company's website and to inquiries received through it.

Article 1 (Purposes, items, legal bases and retention periods)

(1) The Company processes the minimum personal information needed for the purposes below and does not use it for other purposes. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent under Article 18 of PIPA.

(2) The Company processes the following personal information without the data subject's consent. The Company does not process any personal information on the basis of consent.

(3) If an inquiry leads to a contract, contract-related records are kept for the periods required by law, such as the Commercial Act and tax laws. If an investigation or inquiry into a violation of law is in progress, records are kept until it ends.

(4) Please do not include sensitive information such as health data, unique identification information such as resident registration numbers, or other people's personal information in the project brief. The Company does not process sensitive information or unique identification information.

(5) The website is intended for corporate and institutional customers. The Company does not knowingly collect personal information of children under 14 and will destroy it without delay if it learns that such information has been collected.

Article 2 (Destruction procedure and method)

(1) The Company destroys personal information without delay once it is no longer needed, for example when the retention period has expired or the purpose has been achieved.

(2) If other laws require personal information to be kept, the Company moves it to a separate database or stores it in a different location. No personal information related to website inquiries is currently kept under other laws.

(3) Procedure: inquiries whose retention period has ended are deleted automatically by the system every day. Other personal information for which a reason for destruction has arisen is selected by the Company and destroyed with the approval of its Chief Privacy Officer.

(4) Method:

1. Electronic files in the website database and e-mail accounts are deleted so that they cannot be restored or reproduced. Copies remaining in the database's point-in-time recovery records are automatically overwritten after at most 30 days.
2. Personal information on paper is shredded or incinerated.

Article 3 (Provision to third parties)

(1) The Company processes personal information only within the purposes in Article 1 and provides it to third parties only where Articles 17 and 18 of PIPA allow, for example with the data subject's consent or under a specific provision of law.

(2) The Company does not provide personal information to third parties. It also does not provide personal information collected through the website to its group companies, including the UK company and the affiliate in Kunshan, China. However, the affiliate in Kunshan, China, processes personal information on the Company's behalf as a processor under Article 4, by operating the server on which the Company's internal content-management system runs (outsourcing, not provision to a third party).

Article 4 (Outsourcing of processing)

(1) The Company outsources processing as follows.

(2) Separately from the outsourced work, Cloudflare processes some access information, such as IP addresses and bot-detection signals, under its own privacy policy to secure its network and improve its services.

(3) When concluding outsourcing contracts, the Company sets out in writing, in accordance with Article 26 of PIPA, the prohibition on processing for purposes other than the outsourced work, technical and managerial safeguards, restrictions on sub-outsourcing, supervision of the processor and liability for damages, and supervises whether processors handle personal information securely.

(4) If the outsourced work or a processor changes, the Company will disclose it through this policy without delay.

(5) Outsourcing to Cloudflare and to Yoono Energy Technology (Jiangsu) Co., Ltd. involves overseas transfers; see Article 5. The Company's e-mail data is stored in Korea.

Article 5 (Overseas transfer of personal information)

(1) The Company transfers personal information overseas (outsourced processing and storage) to operate the website, as follows. The information required by Article 28-8(2) of PIPA is set out below.

1. Cloudflare, Inc. (United States)

2. Yoono Energy Technology (Jiangsu) Co., Ltd. (China)

(2) How to refuse the transfer, the procedure and the effect of refusal:

1. If you do not want your inquiry information transferred overseas, you can make your inquiry by telephone (+82-33-731-7778) instead of using the contact form. The Company does not enter telephone inquiries into the website system, so your inquiry will then not be transferred to Cloudflare or to Yoono Energy Technology (Jiangsu) Co., Ltd.
2. The website is delivered only through Cloudflare, so access information is processed overseas whenever you visit it. If you do not want this, you cannot use the website.

Article 6 (Measures to ensure the security of personal information)

The Company takes the following measures to keep personal information secure.

1. Managerial measures: the Company has an internal management plan for personal information, checks its implementation at least once a year and trains the staff who process personal information at least once a year. The staff who may process inquiries are kept to the minimum needed for the work and are designated by the administrators of the website management system; the Chief Privacy Officer supervises their processing of personal information.
2. Technical measures: the internal content-management system in which inquiries are reviewed can be reached only from the Company's internal network or its managed private network; access is limited to employees who need it for their work and is possible only after AetherAccess authentication (personal account and one-time code). All communication with the website is encrypted with HTTPS, and under the data processing terms of the processor Cloudflare, disks storing personal information are encrypted. No external analytics or advertising programs are installed on the website. Each view, change, export and deletion of an inquiry is recorded with the account, the date and time and the IP address (access records); access records are kept for at least one year and reviewed regularly.
3. Physical measures: website data is kept under the physical security controls of the processor's data centres. Exported files and printouts containing inquiry information are kept only on access-controlled storage or in locked places.

Article 7 (Installation, operation and refusal of devices that automatically collect personal information)

(1) A cookie is a small piece of information that a website's server sends to the user's browser; it is stored on the user's computer or mobile device and sent back to the server when the user visits the website. The website uses the following cookies.

(2) When the home page is opened, the Company uses the country of access determined by Cloudflare from the IP address to show the Korean or English page. Nothing is stored on the device in this process, and the Company does not separately store the country, although Cloudflare's runtime logs (Article 1) may briefly record request details. A language chosen in the language menu takes precedence.

(3) You can refuse or delete cookies in your browser settings:

• Chrome: "⋮" at the top right > New Incognito window (Ctrl+Shift+N), or delete cookies and site data in Settings
• Edge: "…" at the top right > New InPrivate window (Ctrl+Shift+N), or delete cookies and site data in Settings
• Safari (mobile): device Settings > Apps > Safari > Advanced > Block All Cookies
• Samsung Internet: "Tabs" icon at the bottom > Turn on Secret mode > Start

(4) If you refuse or delete the language cookie, the website is shown in the default language for your country of access. If you block the security cookie, you may not be able to continue past a security check when one is shown.

(5) The Company does not collect behavioural information for targeted advertising or similar purposes and does not allow third parties to collect behavioural information on its website.

Article 8 (Rights and obligations of data subjects and legal representatives, and how to exercise them)

(1) Data subjects may at any time ask the Company for access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent where personal information is processed on the basis of consent.

(2) Rights may be exercised in writing, by telephone, by e-mail or by other means through the contact point in Article 11. The Company will take the necessary action and inform you of the result within 10 days of receiving the request.

(3) Rights may also be exercised through a representative, such as a legal representative or a person authorised by the data subject. In that case, a power of attorney in the form of Annex Form 11 of the Notice on Methods of Processing Personal Information must be submitted.

(4) Requests for access and for suspension of processing may be restricted under Article 35(4) and Article 37(2) of PIPA, and deletion cannot be requested for personal information that other laws specify must be collected.

(5) The Company verifies that the person making a request is the data subject or a legitimate representative.

(6) Data subjects must enter their own personal information accurately and must not enter other people's personal information.

Article 9 (Automated decisions)

In handling website inquiries, the Company does not make decisions that significantly affect a data subject's rights or obligations by processing personal information with a fully automated system, including a system using artificial intelligence (Article 37-2 of PIPA). Even if an automated security function blocks a suspicious request, you can contact us by telephone or other means.

Article 10 (Chief Privacy Officer)

(1) The Company has designated a Chief Privacy Officer, who is responsible overall for the processing of personal information and for handling data subjects' complaints and remedies.

• Chief Privacy Officer: BAI HAO, CEO
• Contact: telephone +82-10-9268-8896, e-mail h.bai@archai.co.kr

(2) Data subjects may contact the Chief Privacy Officer with any privacy questions, complaints or requests for remedies arising from use of the website. The Company will reply and act without delay.

Article 11 (Where to make access requests and other requests)

Data subjects may make requests for access under Article 35 of PIPA and other requests to exercise their rights as follows. The Chief Privacy Officer receives and handles them directly.

• Received and handled by: BAI HAO, Chief Privacy Officer
• Address: Room 710, 7th floor, 643 Dongtan-daero, Dongtan-gu, Hwaseong-si, Gyeonggi-do 18468, Republic of Korea
• Contact: telephone +82-10-9268-8896 or +82-33-731-7778, e-mail h.bai@archai.co.kr

Article 12 (Remedies for infringement of rights)

Data subjects may apply to the following bodies for dispute resolution, counselling or other remedies for infringement of personal information rights.

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
3. Korean National Police Agency: 182 (ecrm.police.go.kr)

Article 13 (Changes to this policy)

(1) This policy applies from 18 October 2026.

(2) Change history

(3) This is the first version of this policy. When it is amended, previous versions and the period during which each applied will be published on this page, and major changes will be explained with a comparison of the old and new text.

This is a translation; the Korean text prevails.