SONBOM Inc. (hereinafter referred to as the "Company") values your personal information and complies with the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Through this Privacy Policy, the Company informs you of how the personal information you provide is used and what measures are taken to protect it.

If the Company revises this Privacy Policy, it will notify you through a website notice (or individual notice).

This policy is effective from May 1, 2026.

1. Personal Information Collected

The Company collects the following personal information for consultations and related purposes.

Online Inquiry
- Items collected: name, contact information, email, inquiry details, etc.

2. Purpose of Collection and Use of Personal Information

The Company uses collected personal information for the following purposes.
Fulfillment of contracts related to service provision and handling inquiries and responses related to services

3. Retention and Use Period of Personal Information

In principle, personal information is destroyed without delay once the purpose of collection and use has been achieved. However, if retention is required under applicable laws, the Company retains the information for the period specified below.

Items Retained and Basis for Retention of Payment Records

• - Records on contracts or withdrawal of subscription: 3 years
• - Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
• - Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
• - Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce, etc.)

4. Procedure and Method of Destruction of Personal Information

In principle, the Company destroys personal information without delay once the purpose of collection and use has been achieved. The procedure and method are as follows.

Destruction Procedure
Information entered by users for membership registration or similar purposes is transferred to a separate database (or stored in a separate filing system in the case of paper records) after the purpose is achieved, and is destroyed after being stored for a certain period in accordance with internal policies and other relevant laws (see Retention and Use Period).
Personal information transferred to a separate database is not used for any purpose other than retention unless required by law.

Destruction Method
Personal information stored in electronic file format is deleted using technical methods that prevent the records from being reproduced.

5. Provision of Personal Information

In principle, the Company does not provide users' personal information to external parties. However, exceptions apply in the following cases.
When users have given prior consent, when required by law, or when requested by investigative authorities in accordance with procedures and methods prescribed by law for investigative purposes

6. Hosting and Maintenance

For service operation, the Company entrusts the following tasks to external specialists.

• - Entrusted party: ThreeAny AI&C Inc.
• - Entrusted tasks: website and system management (hosting / maintenance)

7. Rights of Users and Legal Representatives and How to Exercise Them

Users may view or correct their registered personal information at any time and may request cancellation of membership.
To view or correct personal information, use "Change Personal Information" (or "Edit Member Information," etc.). To cancel membership (withdraw consent), click "Withdraw Membership" and complete the identity verification process to access, correct, or withdraw directly.
You may also contact the Privacy Officer in writing, by phone, or by email, and the Company will take action without delay.
If you request correction of inaccurate personal information, the Company will not use or provide that information until the correction is completed.
If inaccurate personal information has already been provided to a third party, the Company will notify the third party of the correction result without delay so that the correction can be made.
Personal information deleted or destroyed at the user's request is handled in accordance with "Retention and Use Period of Personal Information Collected by the Company," and is processed so that it cannot be viewed or used for any other purpose.
For children under the age of 14, the legal representative has the right to view or correct the child's personal information and to withdraw consent for collection.

8. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company uses "cookies" and similar technologies that store and retrieve your information from time to time. A cookie is a very small text file sent by the server operating the website to your browser and stored on your computer's hard disk.

The Company uses cookies for the following purposes.

Purpose of Using Cookies
To analyze visit frequency and duration for members and non-members, identify user preferences and interests, track browsing patterns, measure participation in events and number of visits, and provide targeted marketing and personalized services. You have the option to allow or refuse cookie installation.
Therefore, you may set your web browser options to allow all cookies, confirm each time a cookie is stored, or refuse all cookies.

How to Refuse Cookie Settings
To refuse cookie settings, select options in your web browser to allow all cookies, confirm each time a cookie is stored, or refuse all cookies.

How to Configure Settings
Example (Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy
Please note that refusing cookie installation may cause difficulties in using certain services.

9. Privacy Complaint Service

To protect customers' personal information and handle privacy-related complaints, the Company designates the relevant department and Privacy Officer as follows.

For reports or consultations regarding other personal information infringements, you may contact the following organizations.

• - Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code)
• - Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301 without area code)
• - Korean National Police Agency Cyber Bureau (police.go.kr / 182 without area code)