Privacy Policy

Effective Date: July 7, 2026

TimCore Co., Ltd. (hereinafter "the Company") places great importance on the protection of personal information of customers who use the services provided by the Company (hereinafter "the Services"). In accordance with the Personal Information Protection Act and relevant statutes, the Company establishes and discloses the following Privacy Policy to guide the procedures and standards for the processing and protection of personal information and to promptly and smoothly handle any related grievances.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed shall not be used for any purpose other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act will be implemented.

• [Provision of Goods or Services]: Personal information is processed for the purpose of receiving product inquiries through the website, providing consultation responses, and delivering content and technical materials.

Article 2 (Items of Personal Information Processed)

① The Company processes the personal information items listed in [Table 1] below with the consent of the data subject pursuant to Article 15(1)(1) and Article 22(1)(7) of the Personal Information Protection Act.

② In the course of using internet services, information such as IP addresses, cookies, MAC addresses, service usage records, visit records, and improper usage records may be automatically generated and collected.

③ The Company shall not use collected personal information for purposes other than those stated in advance to customers, nor shall it disclose such information externally.

Article 3 (Processing of Personal Information of Children Under 14)

① If consent is required to process the personal information of a child under the age of 14, the Company shall obtain consent from the child's legal representative.

② When obtaining consent from a legal representative regarding the processing of personal information of a child under 14, the Company may request minimum information such as the legal representative's name and contact information, require the legal representative to indicate consent on the internet site where the consent content is posted, and confirm such indication by sending a notification via mobile text message to the legal representative.

Article 4 (Retention and Use Period of Personal Information)

① The Company processes and retains personal information within the retention and use period stipulated by law or agreed upon at the time of collection from the data subject.

② The retention and use period for each category of personal information is as follows.

Article 5 (Procedure and Method for Destruction of Personal Information)

① The Company shall destroy personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.

② If personal information must continue to be retained under other statutes despite the expiration of the agreed retention period or achievement of the processing purpose, such personal information shall be transferred to a separate database (DB) or stored in a different location.

③ The procedure and method for destruction of personal information are as follows.

• 1. Destruction Procedure: The Company selects personal information for which grounds for destruction have arisen and destroys it with approval from the Company's Personal Information Protection Officer.
• 2. Destruction Method: Personal information recorded and stored in electronic file format is destroyed so that the records cannot be reproduced. Personal information recorded and stored in paper documents is destroyed by shredding or incineration.

Article 6 (Provision of Personal Information to Third Parties)

The Company processes personal information of data subjects only within the scope specified in the purpose of processing, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as consent of the data subject or special provisions of law. Otherwise, the Company does not provide personal information to third parties.

Article 7 (Cross-Border Collection and Transfer of Personal Information)

The Company stores personal information collected from service users overseas as described below. As it is the Company's principle to back up (retain) all data for recovery in case of data loss due to disasters or calamities, refusal of overseas transfer will make it impossible to use the service. If you do not wish to use the service, you may request the destruction (deletion) of existing inquiry records and personal information through the customer support center.

• ① Legal Basis: Article 28-8(1)(3) of the Personal Information Protection Act (entrustment and retention of processing for contract performance)
• ② Entrusted Work: Data storage services
• ③ Personal Information Items Provided: Name, phone number, email
• ④ Transfer Timing and Method: Within 180 days from the time of service use / remote transmission via dedicated network
• ⑤ Destination Country: United States
• ⑥ Recipient: Amazon Web Services (https://aws.amazon.com/)
• ⑦ Purpose of Use: Cross-border data backup (retention) to protect user data from disasters and calamities
• ⑧ Retention and Use Period: Until destruction after completion of inquiry processing (or 1 year)

Article 8 (Measures to Ensure Safety of Personal Information)

The Company takes the following measures to ensure the safety of personal information.

• ① Administrative Measures: Establishment and implementation of internal management plans, operation of dedicated organizations, regular employee training
• ② Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, installation and updating of security programs
• ③ Physical Measures: Access control for computer rooms, data storage rooms, etc.

Article 9 (Possibility of Disclosure of Sensitive Information)

The Company does not collect sensitive personal information that may infringe upon the basic human rights of customers (such as race and ethnicity, ideology and beliefs, place of origin and family register, political tendencies and criminal records, health status and sexual life, etc.), and if collection is unavoidable, it will obtain prior consent from the customer.

Article 10 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

① The Company uses 'cookies' that store usage information and retrieve it from time to time in order to provide individualized services and convenience to users.

② Cookies are small pieces of information sent by the server (http) operating the website to the data subject's browser and stored on the data subject's PC or mobile device.

③ Data subjects may configure cookie settings such as allowing or blocking cookies through their web browser options. However, refusing to store cookies may cause difficulties in using personalized services.

Article 11 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise)

① Data subjects may exercise rights against the Company at any time, including requests to access, correct, delete, suspend processing of, or withdraw consent for personal information, and to refuse or request explanation of automated decisions (hereinafter "exercise of rights").

② Rights may be exercised against the Company in writing, by email, or by fax in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.

③ Rights may also be exercised through a legal representative of the data subject or a duly authorized agent. In this case, a power of attorney pursuant to Attachment Form No. 11 of the Notice on Personal Information Processing Methods must be submitted.

④ The right of a data subject to request access to or suspension of processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑤ Deletion of personal information cannot be requested if such personal information is specified as a collection target under other statutes.

⑥ If consent has been obtained from the data subject regarding the fact that an automated decision is being made, if prior notice has been given through a contract, or if there is a clear statutory provision, refusal of the automated decision is not recognized and only requests for explanation and review are possible.

⑦ The Company verifies whether the person exercising rights is the data subject themselves or a legitimate representative.

⑧ Rights may be exercised with the department below. The Company will endeavor to process the exercise of rights by data subjects promptly.

* Department Receiving and Processing Requests for Access to Personal Information, etc.
[Customer Support Center] Phone: 1551-7222 / Email: contact@timcore.co.kr

Article 12 (Remedies for Infringement of Data Subject Rights)

① Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, etc. to receive relief for infringement of personal information. For other reports and consultations regarding personal information infringement, please contact the following organizations.

• 1. Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)
• 2. Personal Information Infringement Report Center: (no area code) 118 (www.privacy.kisa.or.kr)
• 3. Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
• 4. National Police Agency: (no area code) 182 (www.cyber.go.kr)

② The Company guarantees data subjects' right to self-determination regarding personal information and strives to provide consultation and relief for damages caused by personal information infringement. If you need to make a report or consultation, please contact the department below.

• 1. [Customer Support Center] Phone: 1551-7222 / Email: contact@timcore.co.kr
• 2. [Personal Information Protection Officer] Name: Jung Ho-jeong

Article 13 (Changes to the Privacy Policy)

① The Company will notify customers through the website when there are additions, deletions, or modifications to the Privacy Policy.

② Addendum: This policy is enacted and enforced from July 7, 2026.

This policy is revised and enforced from July 7, 2026.