The Company processes personal information within the scope of the purposes set forth below, and where the purposes change, the Company takes necessary measures, including obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

The Company processes the following items of personal information without the data subject's consent.

The Company processes the following items of personal information with the data subject's consent.

The Company processes personal information in connection with the following website functions.

This function receives, in a unified manner, inquiries regarding adoption and use of all goorm services (Exelearnce, Devth, education business/event operations, etc.).

• The company/institution type includes "elementary, middle, and high school," but only the institution contact person's information (adult) is collected, and students' personal information is not collected.
• Contacts should not enter personally identifiable information that is not statistical information, such as sample student data.
• Please do not enter resident registration numbers, health information, student personal information, or other sensitive information in the additional inquiry field.

• Even if you do not consent to receive marketing information, you will not be disadvantaged in submitting product inquiries or using the Services.
• You may withdraw your consent to receive marketing information at any time via the unsubscribe link in the email or by contacting customer support (contact@goorm.io). Opt-out requests are reflected within 3 business days from the date of request.

This function allows applicants to submit information through the website form to apply for goorm job postings.

Applicant information submitted through the website form is delivered to the Company's recruiting staff via Amazon Web Services, Inc. ("AWS") email delivery service (Amazon SES), and the information is stored in Amazon S3 located in the Korea region (Seoul, ap-northeast-2). Stored data is processed only within AWS infrastructure in Korea, and no cross-border transfer occurs.

Entrustment notice:

Applicant information is entrusted to Amazon Web Services, Inc. (AWS) and stored/processed in Amazon S3 in the Korea region (Seoul), and no cross-border transfer occurs. Amazon Web Services, Inc. (AWS) is a processor under Article 26 of the Personal Information Protection Act. Applicant information is processed and stored only within Korea, and no transfer overseas occurs even when non-Korean nationals, including EEA residents, apply for jobs.

AWS Privacy Policy: https://aws.amazon.com/privacy/

Scope of processing and access rights:

Applicant information is received and viewed only by staff in the recruiting department via email.

The information is used only to the extent necessary for the recruitment process and is destroyed 6 months after completion of the recruitment process.

Applicant information is encrypted and stored in Amazon S3 in the Korea region (Seoul), and only designated recruiting staff have access rights.

No additional consent-based personal information processing applies to the job application function.

Exelearnce is an integrated service combining the existing EDU (online education platform) and EXP (work productivity management, collaboration, points/rewards).

• When using AI goormee, the content entered by the user and learning context information are transmitted to OpenAI, L.L.C. and processed by the GPT-4o model (see Articles 9 and 10).
• When using the LLM-based test, the content entered by the user is transmitted to OpenAI, L.L.C. (ChatGPT), Anthropic PBC (Claude), and Google LLC (Gemini) and used for LLM capability assessment (see Articles 9 and 10).

• When using the LLM-based test, the content entered by the user is transmitted to OpenAI, L.L.C. (ChatGPT), Anthropic PBC (Claude), and Google LLC (Gemini) and used for LLM capability assessment (see Articles 9 and 10).

• For product adoption/use inquiries, please also refer to Article 2, Section 1 (Product inquiry function). Even if you do not consent to receive marketing information, you will not be disadvantaged in submitting product inquiries or using the Services.

The Company may automatically collect the following information for service operation, security and quality improvement purposes:

• Access IP address, access date and time, service usage records, access logs, cookies
• Records of fraudulent use, browser type, device information (OS/version, screen resolution, etc.), User-Agent
• Error/crash information, performance logs, network information

※ Internet log records and access tracing data among communications confirmation data under Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act are retained for 3 months (see Article 1).

The Company may use cookies and similar technologies to maintain login sessions, configure the user environment, improve service quality, analyze statistics, and enhance security.

Examples of collectable items: cookies, access/use records (visits/clicks/sessions), IP address, User-Agent, OS/browser information, network/error/performance logs, anonymous user identifiers, etc.

Users may refuse or delete cookie storage through browser/device settings, and blocking essential cookies may limit the use of some features such as login.

The Company may collect and process online behavioral information based on the data subject's consent, as follows:

Where online behavioral information is processed through third-party analytics tools, the Company provides prior notice and, where required by law, consent and opt-out methods.

The Company does not provide personal information to third parties without the data subject's consent. However, it may provide personal information where there is a legal basis or where the data subject has consented.

The Company may entrust personal information processing to external processors for smooth service provision, and where it does so, it implements contractual safeguards and management/supervision measures in accordance with Article 26 of the Personal Information Protection Act.

The Company may transfer personal information overseas for the provision and operation of the Services, and in such cases, in accordance with Article 28-8 of the Personal Information Protection Act, it provides notice of the recipient, items transferred, purpose, country, time/method of transfer, retention period, and method of refusal, and obtains consent where required.

If you do not wish your personal information to be transferred overseas, you may refuse to use the relevant function or restrict it via related settings. However, where cross-border transfer is essential for providing the Services, your use of the Services may be limited.

For personal information of data subjects subject to the GDPR (EEA, etc.) that is transferred overseas, the Company applies valid transfer mechanisms such as Standard Contractual Clauses (SCCs).

When processing personal information in connection with generative AI, the Company strengthens purpose specification, data minimization, safeguards, and governance with reference to guidelines issued by supervisory authorities including the Personal Information Protection Commission of Korea.

The Company may process pseudonymized information for statistical purposes, service improvement, and quality enhancement pursuant to Article 28-2 of the Personal Information Protection Act.

• Where personal information becomes unnecessary due to expiration of the retention period or achievement of the processing purpose, the Company destroys it without delay.
• Where continued retention is required by law, the relevant personal information is stored separately in a separate DB and is not used for purposes other than those permitted by law.

Destruction methods

• Electronic files: permanently deleted in a manner that makes recovery or restoration impossible
• Paper documents: shredded or incinerated

The Company implements the following protective measures in accordance with Article 29 of the Personal Information Protection Act, Article 30 of its Enforcement Decree, and the Personal Information Protection Commission's Notice on Security Measures for Personal Information:

• Administrative measures: establishment and implementation of internal management plans, minimization of access rights, regular training, self-inspections, management/supervision of processors
• Technical measures: access control / permission management, retention of access logs and prevention of tampering, encryption (in transit / at rest), security programs, vulnerability checks, intrusion prevention and detection
• Physical measures: access control to server rooms / storage rooms, locking devices, separate storage of critical data

Data subjects may exercise the following rights at any time:

• Request access to personal information
• Request correction where errors exist
• Request deletion (may be limited where there are legitimate grounds such as statutory retention obligations)
• Request suspension of processing
• Withdraw consent (including consent to optional items)
• Exercise rights under the Personal Information Protection Act, including the right to object to or request an explanation of automated decisions

• Via in-service settings menu (where provided)
• By written request, email, phone, or customer support

Contact

• Address: 9F, PDC A-dong, 242 Pangyoro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Phone: 031-600-8586
• Email: contact@goorm.io

The Company will generally take action and notify the result within 10 days of receiving a request. However, the period may be extended within the limits permitted by law.

A legal representative or authorized agent may exercise rights by submitting a power of attorney and supporting documents in accordance with Form No. 11 of the Enforcement Rule of the Personal Information Protection Act.

The Company, in principle, does not provide services to children under 14 years of age and does not intend to directly collect or use personal information of children under 14.

• The Company, in principle, does not collect date of birth or other age-verification information during service provision.
• Because the Company does not have a system that automatically and uniformly determines users' ages, it is difficult to identify a user's age in advance.
• Although "elementary, middle, and high school" is included as a company/institution type in the product inquiry function, only institution contact information (adults) is collected, and students' personal information is not collected.

• The Services may be used by educational institutions (schools, etc.) and teachers who create and assign student accounts.
• Where an educational institution or teacher provides students' personal information to the Company or causes the Company to process such information, the institution/teacher must secure a lawful basis for processing in accordance with applicable laws (including, where necessary, consent from a legal representative).
• The Company may require this through contracts, terms of use, or operational guidelines.

• Where an educational institution uses the Company's Services to create and manage student accounts, this constitutes entrustment of personal information processing, and the Company, as a processor, is subject to Article 26(8) and Article 22-2 of the Personal Information Protection Act. Accordingly, the provisions regarding the protection of children's personal information also apply to the Company.
• The educational institution, as the personal information controller, must primarily obtain consent from the student (or legal representative) or otherwise secure a lawful basis for collecting and using children's personal information. The educational institution may also entrust consent collection to the Company.
• If the educational institution entrusts student personal information to the Company without lawful consent, the Company may also bear responsibility as a processor. In such cases, the Company will request confirmation of the lawful basis from the educational institution and may restrict the relevant account if necessary.

• If the Company becomes aware, through inquiry, report, authority request, or internal verification, that a particular user is a child under 14 or that personal information of a child under 14 is being provided or processed, the Company may request confirmation of the lawful basis.
• If confirmation is difficult or required measures are not taken, the Company will restrict use of the relevant account (suspension/blocking) and delete the relevant personal information (or separate it and destroy it later), or take other necessary measures.

• Legal representatives may exercise rights such as access, correction, deletion, and suspension of processing with respect to the child's personal information.
• The procedure for exercising rights follows Article 14 of this Privacy Policy.
• For educational institution administrator accounts, confirmation via the educational institution may be required for smooth processing.

The Company designates the following person(s) to oversee matters related to personal information processing and to handle inquiries, complaints, and requests for relief from data subjects.

Chief Privacy Officer (CPO)

Personal Information Protection Department

Data subjects may seek consultation or dispute resolution from the following organizations in relation to personal information infringement:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (without area code) (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (without area code) (www.spo.go.kr)
• National Police Agency: 182 (without area code) (ecrm.cyber.go.kr)