Privacy Policy

ZensLab Corp. (the “Company”) complies with the Personal Information Protection Act of the Republic of Korea and related laws, and establishes and publishes this Privacy Policy to process data subjects’ personal information lawfully and manage it safely.

Article 1 (Purposes of Processing, Items Collected and Retention Period)

The Company processes the minimum personal information necessary for the following purposes. If a purpose changes, the Company takes the required measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Article 2 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and does not provide it to third parties except with the data subject’s consent or where Articles 17 and 18 of the Personal Information Protection Act apply, such as special provisions of law.

Article 3 (Outsourcing of Processing and Cross-Border Transfer)

To provide services smoothly, the Company outsources personal information processing as follows, and stipulates and supervises data protection matters in outsourcing contracts pursuant to Article 26 of the Personal Information Protection Act.

Where a cross-border transfer occurs, the Company discloses through this Policy or separately notifies the items transferred, destination country, date/method of transfer, recipient information, purpose of use and retention period, in accordance with Article 28-8 of the Personal Information Protection Act.

Article 4 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

1. Data subjects may at any time request the Company to access, correct, delete or suspend processing of their personal information, and may withdraw consent
2. Rights may be exercised in writing or by email (sales@zenslab.kr), and the Company will act without delay
3. Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted

Article 5 (Procedures and Methods of Destruction)

1. When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay
2. Electronic files are deleted using technical methods that make recovery or regeneration impossible; paper documents are shredded or incinerated

Article 6 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures pursuant to Article 29 of the Personal Information Protection Act.

• Administrative measures: establishing and implementing an internal management plan, minimizing and training personnel handling personal information
• Technical measures: encryption of personal information in transit (TLS), access rights management, retention of access records
• Physical measures: access control to data storage locations

Article 7 (Installation, Operation and Refusal of Automatic Collection Devices such as Cookies)

The Company’s website uses only the minimum cookies essential to service provision and does not use tracking cookies for advertising purposes. If web analytics tools are introduced, this Article will be revised to disclose the items collected and how to refuse. Data subjects may refuse cookie storage through their browser settings.

Article 8 (Privacy Officer)

Data subjects who need to report or consult on a personal information infringement may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code) or the Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972).

Article 9 (Changes to the Privacy Policy)

This Privacy Policy applies from the effective date. Where content is added, deleted or amended due to changes in laws, policies or the Company’s internal policies, notice will be given through the website announcements at least 7 days before the changes take effect.