Privacy Policy

Gridwiz, Inc. (hereinafter the “Company”) complies with the Personal Information Protection Act and other relevant laws to protect the freedom and rights of data subjects, and processes personal information lawfully and securely.

In accordance with Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for processing and protecting personal information, and to handle related complaints promptly and smoothly.

This Privacy Policy applies to personal information processed through the website operated by the Company (https://www.gridwiz.com/).

Article 1 (Purposes of Processing Personal Information)

① The Company processes personal information for the following purposes.

1. Receiving and handling customer inquiries

• Receiving customer and business inquiries submitted through the ‘Contact Us’ page of the website
• Reviewing and responding to inquiries
• Contacting inquirers and notifying them of the results as needed to handle inquiries

2. Operating and managing the website

• Ensuring stable operation and security of the website
• Monitoring website usage and improving service quality
• Preventing abnormal access and fraudulent use

② Inquiries received through the website are viewed and managed directly by the Company’s staff in the administrator system, and the staff respond to and handle those inquiries.

③ The Company does not use collected personal information for any purpose other than those specified above. If a purpose of processing changes, the Company will take the measures required by relevant laws.

Article 2 (Personal Information Processed)

① The Company collects and processes the following personal information through the ‘Contact Us’ page of the website.

Category	Personal information
Required	Name, mobile phone number
Optional	E-mail address
Other information entered	Inquiry type, and any personal information contained in the inquiry and attached files

② The following information may be automatically generated and collected while the website is used.

• IP address
• Access date/time and access logs
• Website usage records
• Cookie information

③ As a rule, the Company does not collect unique identification information, such as resident registration numbers, or sensitive information through the website inquiry function. Data subjects are asked not to include unnecessary personal information in their inquiries or attached files.

Article 3 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the retention and use period prescribed by relevant laws, or within the period notified to or agreed by the data subject when the personal information was collected.

② The processing and retention periods are as follows.

Category	Processing and retention period
Personal information collected through website customer inquiries	1 year from the date the inquiry is received
Website access logs and service usage records	1 year from the date of access

③ The Company retains and manages access records of personal information handlers who access the personal information processing system for at least 1 year in accordance with relevant laws. Where the requirements set out in relevant laws apply, such records are retained and managed for at least 2 years.

④ When personal information becomes unnecessary because the purpose of processing has been achieved or the retention period has expired, the Company destroys it without delay.

⑤ However, where relevant laws require personal information to be kept for a certain period, the Company retains it for the period prescribed by those laws and does not use it for any purpose other than retention.

Article 4 (Provision of Personal Information to Third Parties)

① The Company processes personal information only within the scope of the purposes specified in Article 1, and does not provide it to third parties unless lawful requirements are met, such as the data subject’s consent or a basis under relevant laws.

② When the Company provides personal information to a third party, it will notify the recipient, purpose of provision, items provided, and retention and use period in accordance with relevant laws, and take the necessary measures.

Article 5 (Entrustment of Personal Information Processing)

① The Company entrusts the following work to ensure smooth website operation and personal information processing.

Trustee	Entrusted work
Geoinsoft (거인소프트)	Provision, operation, and maintenance of the website management system

② In accordance with Article 26 of the Personal Information Protection Act, when concluding an entrustment contract, the Company specifies in the contract or other documents matters such as the prohibition of processing personal information for purposes other than the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages. The Company also manages and supervises the trustee to ensure that personal information is processed securely.

③ If the trustee or the entrusted work changes, the Company will disclose the change through this Privacy Policy.

Article 6 (Transfer of Personal Information Overseas)

① The Company does not transfer personal information collected through the website overseas.

② If an overseas transfer becomes necessary in the future, the Company will comply with the requirements and procedures set out in Article 28-8 of the Personal Information Protection Act and other relevant laws, and will inform data subjects of the required matters.

Article 7 (Additional Use and Provision of Personal Information)

① In accordance with Article 15(3) and Article 17(4) of the Personal Information Protection Act, the Company may additionally use or provide personal information without the data subject’s consent within the scope reasonably related to the original purpose of collection.

② In deciding whether to additionally use or provide personal information, the Company comprehensively considers the following.

1. Whether the additional use or provision is related to the original purpose of collection
2. Whether the data subject could foresee the additional use or provision, in light of the circumstances of collection or processing practices
3. Whether the additional use or provision unfairly infringes the interests of the data subject
4. Whether measures necessary to ensure security, such as pseudonymization or encryption, have been taken

③ The Company additionally uses or provides personal information only when the requirements set out in relevant laws are met.

Article 8 (Procedures and Methods for Destroying Personal Information)

① When personal information becomes unnecessary, such as when the retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay.

② The procedures and methods for destruction are as follows.

• Procedure : The Company identifies personal information for which a reason for destruction has arisen and destroys it after obtaining approval from the Personal Information Protection Officer in accordance with internal management procedures.
• Method : Personal information stored as electronic files is deleted securely so that it cannot be recovered or reproduced. Personal information recorded on paper is destroyed by shredding or incineration.

③ Where personal information must continue to be retained under relevant laws, the Company stores it separately from other personal information or manages it in a separate storage space.

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

① Data subjects may exercise the following rights regarding personal information protection against the Company at any time.

1. Request to access personal information
2. Request to correct or delete personal information
3. Request to suspend processing of personal information
4. Withdrawal of consent to the processing of personal information

② Data subjects may exercise their rights in writing, by phone, by e-mail, or by other means, and the Company will take the necessary measures without delay in accordance with relevant laws.

③ When a request for correction or deletion is received, the Company will not use or provide the personal information concerned until the correction or deletion is completed, unless an exception applies under relevant laws.

④ When a request to suspend processing or withdraw consent is received, the Company will take the necessary measures in accordance with relevant laws. However, if there are grounds under the law to restrict or refuse the request, the Company will inform the data subject of those grounds.

⑤ Rights may also be exercised through an agent, such as the data subject’s legal representative or a person authorized by the data subject. Where necessary, the Company may request documents proving legitimate authority, such as a power of attorney.

⑥ The Company may verify whether the requester is the data subject or a legitimate agent, to the extent necessary to handle the request.

⑦ Data subjects must not infringe their own or others’ personal information or privacy processed by the Company in violation of relevant laws.

Article 10 (Measures to Ensure the Security of Personal Information)

To prevent loss, theft, leakage, forgery, alteration, or damage of personal information, the Company implements the following managerial, technical, and physical safeguards in accordance with Article 29 of the Personal Information Protection Act and other relevant laws.

1. Managerial measures

• Operating an internal management system for the secure processing of personal information
• Managing and restricting access rights of staff handling personal information
• Supervising personal information handlers and providing personal information protection training

2. Technical measures

• Restricting and controlling access to the personal information processing system
• Protective measures, such as encryption, for the secure storage and transmission of personal information
• Retaining, managing, and reviewing access records of the personal information processing system
• Preventing malicious programs and managing system security
• Managing security vulnerabilities of the personal information processing system and taking necessary security measures

3. Physical measures

• Controlling access to places where personal information is stored
• Securely managing storage facilities and related equipment

Article 11 (Installation, Operation, and Rejection of Automatic Personal Information Collection Devices)

① The Company uses cookies to ensure stable operation of the website and to improve the service environment.

② Cookies are small pieces of information that the website server sends to the user’s web browser, and may be stored on the user’s computer or mobile device.

③ The Company uses cookies for the following purposes.

1. Ensuring normal operation and security of the website
2. Analyzing website access and usage
3. Improving service quality and the user environment

④ Data subjects may allow or block the storage of cookies through their web browser settings.

• Chrome : Settings → Privacy and security → Cookie settings
• Microsoft Edge : Settings → Cookies and site permissions → Cookie settings
• Safari : Settings → Privacy → Cookie settings

⑤ If you refuse to store cookies, the use of some website features may be restricted.

⑥ If the Company collects and processes users’ online activity information using external analytics tools or similar means, it will provide separate notice in accordance with relevant laws and its actual processing practices.

Article 12 (Personal Information Protection Officer and Requests for Access)

① The Company has designated the following Personal Information Protection Officer, who is responsible for overall personal information processing and for handling complaints and remedies for damages of data subjects.

Personal Information Protection Officer
Name	Junwoo Ryu
Title	President
Phone	+82-2-529-9851

② Data subjects may contact the Personal Information Protection Officer regarding any inquiries, requests for access, complaints, or remedies for damages related to personal information that arise while using the Company’s website.

③ The Company will respond to inquiries and requests to exercise rights without delay and take the necessary measures in accordance with relevant laws.

Article 13 (Remedies for Infringement of Rights and Interests)

① Data subjects may contact the following organizations to report, seek remedies, obtain consultation, or request dispute mediation regarding personal information infringement.

Organization	Phone	Website
Personal Information Infringement Report Center (Korea Internet & Security Agency)	118 (no area code)	https://privacy.kisa.or.kr
Personal Information Dispute Mediation Committee	1833-6972	https://www.kopico.go.kr
Supreme Prosecutors’ Office	1301 (no area code)	https://www.spo.go.kr
Korean National Police Agency Cyber Crime Reporting System	182 (no area code)	https://ecrm.police.go.kr

② The above organizations are independent of the Company, and data subjects may apply to them for consultation or remedies regarding personal information infringement.

Article 14 (Scope of Application and Amendment of this Privacy Policy)

① This Privacy Policy applies to the website operated by the Company. The processing of personal information on external websites linked from the Company’s website is governed by the privacy policies of those websites.

② The Company may amend this Privacy Policy in response to amendments to relevant laws or changes in its personal information processing practices.

③ When this Privacy Policy is amended, the Company will disclose the changes and the effective date on its website. Changes that significantly affect the rights of data subjects will be notified by appropriate means in accordance with relevant laws.

④ The Company keeps previous versions of this Privacy Policy available for data subjects to review.

Addenda

Article 1 (Effective Date)

This Privacy Policy takes effect on November 10, 2026.

Article 2 (Basis of Amendment)

This Privacy Policy has been amended to reflect the personal information protection laws in force as of November 10, 2026, and the following standards and guidelines.

• Personal Information Protection Act (effective September 11, 2026)
• Enforcement Decree of the Personal Information Protection Act (effective November 10, 2026)
• Personal Information Protection Commission, Guidelines for Preparing Privacy Policies (published April 23, 2026)
• Standards for Measures to Ensure the Security of Personal Information (effective July 1, 2026)
• Personal Information Protection Commission, Guide to the Standards for Measures to Ensure the Security of Personal Information (published November 5, 2026)

Article 3 (Revision History)

Version	Effective date
Previous Privacy Policy	2022 version
Amended Privacy Policy	November 10, 2026