Performance Wearable Exosuit H-FIT

Hurotics Inc. (hereinafter referred to as the "Company") establishes and discloses the following personal information processing guidelines to protect the personal information of data subjects and handle related grievances promptly and smoothly in accordance with Article 30 of the Personal Information Protection Act.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. 1. Providing responses to customer inquiries on the website and managing their status

Article 2 (Processing and Retention Period of Personal Information)

1. 1. The Company processes and retains personal information within the period of retention and use of personal information stipulated by law or within the period of retention and use of personal information agreed upon when collecting personal information from the data subject.
2. 2. The processing and retention periods are as follows:

   - Within 3 years from the date of receipt of website customer inquiries
   

Article 3 (Provision of Personal Information to Third Parties)

1. The Company uses personal information within the pre-notified scope and does not disclose personal information externally without the prior consent of the data subject beyond this scope. However, the following cases are exceptions:
   - When the data subject has given prior consent
   - When required by law or when there is a request from investigative agencies according to procedures and methods prescribed by law for investigation purposes

Article 4 (Outsourcing of Personal Information Processing)

1. In principle, we do not outsource the processing of personal information without the user's consent. However, the Company may outsource personal information management to other companies within a limited scope for smooth and enhanced customer service. When entering into outsourcing contracts, we will notify through notices and privacy policy regarding the outsourcing party, outsourcing work content, outsourcing period, contract details (compliance with personal information protection laws, prohibition of third-party provision of personal information and liability), and safe management of personal information, and obtain prior consent when necessary.

Article 5 (Rights and Obligations of Data Subjects and How to Exercise Them)

1. 1. Data subjects may exercise the following personal information protection rights against the Company at any time:

   - Request to view personal information
   - Request for correction in case of errors
   - Request for deletion
   - Request to stop processing

2. 2. Rights under Paragraph 1 may be exercised through written document, telephone, or email to the Company, and the Company will take action without delay.
3. 3. When the data subject requests correction or deletion of errors in personal information, the Company will not use or provide such personal information until the correction or deletion is completed.
4. 4. The rights under Paragraph 1 may be exercised through a legal representative or an agent who has received delegation. In this case, a power of attorney according to Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
5. 5. The data subject must not violate the personal information and privacy of themselves or others being processed by the Company in violation of the Personal Information Protection Act and other related laws.

Article 6 (Personal Information Items Being Processed) The Company processes the following personal information items:

1. 1. Providing responses to customer inquiries on the website and managing their status

   - Required items: Name, Contact information (phone number, email address), Company name

2. 2. The following personal information items may be automatically generated and collected during internet service use:

   - IP address, cookies, MAC address, service usage records, visit records, malicious use records, etc.

Article 7 (Destruction of Personal Information)

1. 1. The Company destroys personal information without delay when it becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose
2. 2. The procedures and methods for destroying personal information are as follows:

   - Destruction procedure
   The Company selects personal information for which destruction reasons have occurred and destroys it with the approval of the Company's personal information protection officer.
   - Destruction method
   Personal information printed on paper is destroyed by shredding or incineration. Personal information stored in electronic file format is deleted using technical methods that prevent recovery of the records.

Article 8 (Measures to Ensure Safety of Personal Information)

1. The Company takes the following measures to ensure the safety of personal information:
2. 1. Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.
3. 2. Technical measures: Management of access rights to personal information processing systems

Article 9 (Installation, Operation and Rejection of Automatic Personal Information Collection Devices)

1. 1. The Company uses 'cookies' that store and frequently retrieve usage information to provide individualized customized services to users.
2. 2. Cookies are small pieces of information sent by the server (http) operating the website to users' computer browsers and may be stored on users' PC hard drives.
3. 3. Purpose of using cookies: They are used to provide optimized information to users by understanding visit and usage patterns, popular search terms, secure access status, etc. for each service and website visited by users.
4. 4. Installation, operation and rejection of cookies: You can reject cookie storage through option settings in the Tools > Internet Options > Privacy menu at the top of your web browser.
5. 5. If you reject cookie storage, you may have difficulty using customized services.

Article 10 (Remedies for Rights Infringement)

1. Data subjects may inquire about remedies and consultation regarding personal information infringement at the following institutions. (The following institutions are separate from the Company, and if you are not satisfied with the Company's own personal information complaint handling and damage relief results or need more detailed help, please contact them)
2. 1. Personal Information Infringement Report Center (operated by Korea Internet & Security Agency)

   - Jurisdiction: Report of personal information infringement, consultation requests
   - Website: privacy.kisa.or.kr
   - Phone: (No area code) 118
   - Address: Personal Information Infringement Report Center, 3rd Floor, 9 Jinheung-gil, Naju-si, Jeollanam-do (301-2 Bitgaram-dong) 58324
3. 2. Personal Information Dispute Mediation Committee
   

   - Jurisdiction: Personal information dispute mediation application, collective dispute mediation (civil resolution)
   - Website: www.kopico.go.kr
   - Phone: (No area code) 1833-6972
   - Address: 12th Floor, Seoul Government Complex, 209 Sejong-daero, Jongno-gu, Seoul 03171
4. 3. Supreme Prosecutors' Office Cybercrime Investigation Division: 02-3480-3573 (www.spo.go.kr)
5. 4. National Police Agency Cyber Security Bureau: 182 (cyberbureau.police.go.kr)

Article 11 (Changes to Privacy Policy)

1. This privacy policy will be effective from December 19, 2025.

Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Article 48 (Prohibition of Network Intrusion, etc.)

1. 1. No one shall intrude into an information and communications network without legitimate access rights or beyond permitted access rights.
2. 2. No one shall transmit or distribute malicious programs (hereinafter referred to as "malicious programs") that can damage, destroy, alter, forge information and communications systems, data or programs, or interfere with their operation without justifiable reasons.
3. 3. No one shall cause disruption to information and communications networks by sending large amounts of signals or data, or by causing the processing of illegitimate commands, with the purpose of interfering with the stable operation of information and communications networks.

Article 65 (Penalties)

1. 1. Any person who falls under any of the following subparagraphs shall be punished by imprisonment for not more than 5 years or by a fine not exceeding 50 million won.
2. 2. An attempt to commit the crimes under paragraph (1) 9 shall be punished.