DATUMO complies with the "Personal Information Protection Act" and relevant laws in Korea to protect the rights and freedoms of data subjects. We process personal information lawfully and manage it securely. In accordance with Article 30 of the "Personal Information Protection Act" in Korea, we establish and disclose this privacy policy to guide data subjects through the procedures and standards related to personal information processing and to handle related complaints promptly and smoothly.

Article 1 (Items and Retention/Use Periods by Purpose of Personal Information Processing)

1. DATUMO processes personal information for the following purposes, and the personal information items and retention/use periods for each purpose are as follows:

   a) Data Collection / Sponsorship Program / Inquiries and Consultations about Open Datasets

   • Items: Name, company/organization name, phone number, email address, source of inquiry, inquiry content
   • Retention/Use Period: For 3 years after inquiry receipt; immediately upon request for destruction by the data subject

   b) Marketing Information Transmission (Optional)

   • Items: Name, company/organization name, phone number, email address
   • Retention/Use Period: For 3 years after inquiry receipt; immediately upon request for destruction by the data subject

2. Personal information being processed will not be used for purposes other than those stated above. If the purpose of use changes, necessary actions, such as obtaining separate consent under Article 18 of the "Personal Information Protection Act," will be taken.

Article 2 (Provision of Personal Information to Third Parties)

1. DATUMO processes the personal information of data subjects within the scope specified for each purpose of personal information processing. Except for cases under Article 17 and Article 18 of the "Personal Information Protection Act," which require data subject consent or special legal provisions, personal information will not be provided to third parties.

Article 3 (Third Party Involvement in Personal Information Processing)

1. DATUMO involves third parties in the following personal information handling tasks for smooth operation:

| Task | Involvement of | Tasks involving third parties | | --- | --- | --- | | Cloud Storage | Google LLC | Data storage via Google Drive | | Service Usage Statistics | Google LLC | Statistical analysis via Google Analytics | | Customer Inquiry Consultation | Channel Corp. | Receipt and consultation of customer inquiries via ChannelTalk |

1. When entering into arrangements involving third parties, DATUMO specifies matters regarding the prohibition of personal information handling beyond the scope of the purpose of involvement, technical/managerial protection measures, restrictions on further involvement by third parties, management/supervision of subcontractors, and liability for damages in documents, contracts, etc., in accordance with Article 26 of the "Personal Information Protection Act." DATUMO also monitors whether subcontractors handle personal information safely.
2. Any changes to the content of third-party involvement or subcontractors will be promptly disclosed through this privacy policy.

Article 4 (Destruction of Personal Information)

1. When personal information becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose, DATUMO will promptly destroy the relevant personal information.
2. Even if the retention period agreed upon with the data subject has expired or the processing purpose has been achieved, if personal information must continue to be retained according to other laws, the personal information will be transferred to a separate database or retained in a different location.
3. The procedure and method of personal information destruction are as follows:
   1. Destruction Procedure DATUMO selects personal information for destruction when the reasons for destruction arise and obtains approval from DATUMO's personal information protection manager.
   2. Destruction Method Personal information stored in electronic file format will be destroyed to prevent reconstruction. Personal information recorded/stored on paper will be shredded or incinerated.

Article 5 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercising Rights)

1. Data subjects may at any time exercise their rights to access, correct, delete, or request processing cessation from DATUMO.
2. The exercise of rights may be conducted in writing, by email, facsimile transmission (FAX), or other means as provided under Article 41(1) of the "Personal Information Protection Act" Enforcement Decree. DATUMO will promptly respond to such requests.
3. Rights may also be exercised through a legal representative or an authorized proxy. In such cases, a power of attorney, following the form provided in Attachment 11 of the "Guidelines on Personal Information Processing Methods (No. 2020-7)," must be submitted.
4. DATUMO does not provide services to users under the age of 14, and therefore does not process personal information of users under the age of 14.