This is an English translation provided for convenience. In the event of any discrepancy, the Korean version prevails.

In accordance with Article 30 of the Personal Information Protection Act, CommerceOne Corp. (the "Mall") establishes and discloses this Privacy Policy to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

Article 1 (Purposes of Processing Personal Information)

The Mall processes personal information for the following purposes and does not use it for any other purpose. If the purpose of use changes, the Mall will take necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Website membership registration and management
   Personal information is processed to confirm the intention to register, identify and authenticate members for membership services, maintain and manage membership, prevent fraudulent use of services, send various notices and handle grievances.
2. Provision of goods or services
   Personal information is processed to deliver goods, provide services, send contracts and invoices, provide content and customized services, verify identity and age, process payments and settlements, and collect debts.
3. Handling of grievances
   Personal information is processed to verify the identity of complainants, confirm complaints, contact and notify for fact-finding, and notify of the results.
4. Marketing and advertising
   Personal information is processed to develop new services (products) and provide customized services, provide event and advertising information and opportunities to participate, provide services and display advertisements based on demographic characteristics, check the effectiveness of services, identify access frequency, and compile statistics on members' use of services.

Article 2 (Processing and Retention Period of Personal Information)

1. The Mall processes and retains personal information within the retention and use period prescribed by law or agreed to by the data subject at the time of collection.
2. The processing and retention period for each item of personal information is as follows.
3. Website membership registration and management: until membership withdrawal. However, in the following cases, until the end of the relevant reason
4. If an investigation or inquiry for violation of relevant laws is in progress, until the end of the investigation or inquiry
5. If claims and obligations arising from use of the website remain, until they are settled
6. Provision of goods or services: until the supply of goods or services and payment and settlement are completed. However, in the following cases, until the end of the relevant period
7. Records of transactions, such as labeling and advertising, contract details and performance, under the Act on the Consumer Protection in Electronic Commerce
   - Records of labeling and advertising: 6 months
   - Records of contracts or withdrawal of offers, payment, and supply of goods: 5 years
   - Records of consumer complaints or dispute handling: 3 years
8. Retention of communication confirmation data under the Protection of Communications Secrets Act: 3 months
9. Records of electronic financial transactions under the Electronic Financial Transactions Act: 5 years

Article 3 (Items of Personal Information Processed)

The Mall processes the following items of personal information.

1. Website membership registration and management
2. Required: name, login ID, password, mobile phone number, e-mail
3. Optional: date of birth, address
4. Provision of goods or services (orders and delivery)
5. Required: name, mobile phone number, delivery address, payment information (information depending on the payment method, such as credit card number or account information)
6. In the course of using internet services, IP addresses, cookies, visit dates and times, service usage records, records of improper use and the like may be automatically generated and collected.

Article 4 (Processing of Personal Information for Artificial Intelligence (AI) Services)

1. The Mall processes personal information as follows to provide AI-based services such as personalized product recommendations and product information summaries (the "AI Services").
2. Purpose: to analyze users' purchase history, search and browsing history, wishlisted products and the like in order to recommend personalized products, and to provide summaries of product details
3. Items: purchase history, product browsing and search records, wishlist information, AI chat consultation conversations
4. Retention and use period: until the purpose of providing the service is achieved or membership is withdrawn (however, if retention is required under relevant laws, until the end of that period)
5. If an automated decision that significantly affects a user's rights or obligations is made through the AI Services, the user may refuse the decision or request an explanation of it from the Mall under Article 37-2 of the Personal Information Protection Act, and the Mall takes necessary measures at the user's request unless there is a justifiable reason not to.
6. The Mall indicates on the service screen that the recommendation and summary results provided by the AI Services are generated automatically by artificial intelligence, and does not guarantee their accuracy.
7. If, in the course of providing the AI Services, the Mall provides users' personal information to, or entrusts its processing to, third parties such as external AI model developers, it separately notifies users of that fact, the recipient, the purpose and the items, and obtains their consent.

Article 5 (Provision of Personal Information to Third Parties)

1. The Mall processes data subjects' personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law.
2. The Mall provides personal information to third parties for the delivery of goods as follows.

Article 6 (Entrustment of Personal Information Processing)

1. The Mall entrusts personal information processing tasks as follows for smooth handling of personal information.

   Trustee	Entrusted tasks
   (Payment service provider)	Electronic payment processing such as credit card and account transfer
   (Delivery company)	Delivery of goods
   (SMS and notification service provider)	Sending order and delivery text messages and notifications

2. When concluding an entrustment contract, the Mall specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters regarding the prohibition of processing personal information for purposes other than the entrusted tasks, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely.
3. If the entrusted tasks or the trustee change, the Mall will disclose the change through this Privacy Policy without delay.

Article 7 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

1. Data subjects may at any time exercise rights against the Mall, such as requesting access to, correction, deletion or suspension of processing of their personal information.
2. Rights under Paragraph 1 may be exercised against the Mall in writing, by e-mail, by facsimile (FAX) or the like in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Mall will take action without delay.
3. Rights under Paragraph 1 may be exercised through an agent, such as the data subject's legal representative or a person delegated by the data subject. In this case, a power of attorney in the form of Annex 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
4. Requests for access to and suspension of processing of personal information may be restricted under Article 35, Paragraph 5 and Article 37, Paragraph 2 of the Personal Information Protection Act.
5. Correction or deletion of personal information may not be requested if other laws specify that the personal information is subject to collection.
6. When a data subject requests access, correction, deletion or suspension of processing, the Mall verifies whether the requester is the data subject or a legitimate agent.

Article 8 (Destruction of Personal Information)

1. When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Mall destroys it without delay.
2. If personal information must continue to be retained under other laws even though the retention period agreed to by the data subject has expired or the processing purpose has been achieved, the Mall moves the personal information to a separate database (DB) or stores it in a different location.
3. The procedure and method of destruction are as follows.
4. Destruction procedure
   The Mall selects the personal information for which a reason for destruction has arisen and destroys it with the approval of the Mall's Chief Privacy Officer.
5. Destruction method
   Personal information recorded and stored in electronic file form is destroyed using methods such as low-level formatting so that the records cannot be reproduced, and personal information recorded and stored on paper is destroyed by shredding or incineration.

Article 9 (Measures to Ensure the Security of Personal Information)

The Mall takes the following measures to ensure the security of personal information.

1. Managerial measures: establishing and implementing an internal management plan, regular staff training, etc.
2. Technical measures: managing access rights to personal information processing systems, installing access control systems, encrypting unique identification information, installing security programs
3. Physical measures: access control for computer rooms, data storage rooms, etc.

Article 10 (Installation, Operation and Refusal of Automatic Personal Information Collection Devices)

1. The Mall uses "cookies," which store usage information and retrieve it from time to time, to provide users with individually customized services.
2. Cookies are small pieces of information that the server (http) used to operate a website sends to the user's computer browser, and they may be stored on the hard disk of the user's PC.
3. Purpose of cookies: used to provide users with optimized information by identifying their visits to and usage patterns of each service and website, popular search terms, whether a secure connection is used, etc.
4. Installation, operation and refusal of cookies: users may refuse to store cookies through the option settings in the browser menu (e.g., Tools > Internet Options > Privacy).
5. If you refuse to store cookies, you may have difficulty using customized services.

Article 11 (Chief Privacy Officer)

1. The Mall designates a Chief Privacy Officer as follows to take overall responsibility for personal information processing and to handle data subjects' complaints and remedies related to personal information processing.

1. Data subjects may direct all inquiries, complaints and requests for remedies related to personal information protection arising from use of the Mall's services to the Chief Privacy Officer and the responsible department. The Mall will respond to and handle data subjects' inquiries without delay.

Article 12 (Department Receiving and Handling Requests for Access to Personal Information)

Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Mall will endeavor to process data subjects' requests for access promptly.

Article 13 (Remedies for Infringement of Data Subjects' Rights)

To obtain relief from infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center and the like. For other reports of and consultation on personal information infringement, please contact the agencies below.

1. Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
4. Korean National Police Agency: (no area code) 182 (ecrm.cyber.go.kr)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution regarding a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information) or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act.

Central Administrative Appeals Commission: (no area code) 110 (www.simpan.go.kr)

Article 14 (Operation and Management of Video Information Processing Devices)

The Mall does not install or operate video information processing devices for the safety of its warehouses and workplaces. (Separate notice will be given if they are installed and operated.)

Article 15 (Changes to the Privacy Policy)

This Privacy Policy applies from its effective date. If there are additions, deletions or corrections due to changes in laws or policy, notice will be given through announcements from 7 days before the changes take effect.

Announced: July 21, 2026
Effective: July 21, 2026