SELLER-NOTE Co.Ltd. (hereinafter referred to as the "Company") establishes and discloses the following privacy policy to protect users' personal information and rights in accordance with the Personal Information Protection Act and to ensure the smooth handling of users' grievances related to personal information. The Company will notify users of any revisions to this privacy policy through website announcements (or individual notifications).

Updated: December 13, 2024 (Effective: December 20, 2024)

Clause 1 (Purpose of Processing Personal Information)

The Company collects, uses, and processes personal information for the following purposes. Personal information is collected within the scope permitted by law through the website, phone, email, written forms, fax, live consultations, or receipt from entrusted companies. The Company will not use personal information for purposes other than those specified below. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with the Personal Information Protection Act of the Republic of Korea.

Clause 2 (Specific Purposes and Items of Personal Information Processed)

The Company collects the following personal information items for the specified purposes:

Category	Collected Items	Purpose
Membership Registration and Management	User name, contact information, email, business representative name, contact information, email, business bank account number, address, fax number	User identity verification and membership management for website and app usage
Handling Complaints (Consultation, Grievances, etc.)	User name, contact information, email, details of the complaint	To handle complaints (consultations, grievances, etc.)
Managing Customer-Related Businesses	Business representative name, contact information, email, address	Registration and management of customer-related businesses (suppliers, customs agents, etc.)
Provision of Goods or Services: Export/Import Transport Services	Exporter/Importer representative name, contact information, email, address, export/import-related documents such as BL, C/I, P/L, personal information of Exporter/Importer, and declarants (name, contact information, email, address)	To provide services such as export/import transportation
Provision of Goods or Services: Fulfillment Services	Sender name, contact information, recipient name, contact information, address	To provide logistics services
Provision of Goods or Services: Overseas Remittance Services	1) For individual business owners: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number) 2) For corporate entities: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number), corporate shareholder and executive information, date of birth (or resident registration number) 3) Recipient information: Recipient representative name, bank account number, contact information, email, address	To provide overseas remittance services
Customer Service Statistics	Name, email, contact information, address	To prepare statistics for improving customer service
Information and Event Notifications	Name, email, contact information	To provide information and notifications about services and events
Automatically Collected Items	Device information (OS details, device identifier, screen size), visit (access log) records, service usage records (including misuse and transaction history)	For security, privacy, safety, misuse prevention, marketing, and personal data retention period management purposes

Clause 3 (Processing and Retention Period of Personal Information)

1. The Company, in principle, destroys users’ personal information without delay when the user withdraws membership from the website or app, or when the purpose of collection and use of personal information has been achieved. However, the Company may retain and process personal information within the period stipulated by relevant laws or the retention period consented to by the user at the time of collection.
2. The specific processing and retention periods for personal information are as follows:

Category	Collected Items	Retention Period
Membership Registration and Management	User name, contact information, email, business representative name, contact information, email, business bank account number, address, fax number	Until membership withdrawal
Handling Complaints (Consultation, Grievances, etc.)	User name, contact information, email, details of the complaint	Until membership withdrawal
Managing Customer-Related Businesses	Business representative name, contact information, email, address	Until membership withdrawal
Provision of Goods or Services: Export/Import Transport Services	Exporter/Importer representative name, contact information, email, address, export/import-related documents such as BL, C/I, P/L, personal information of Exporters/Importers, and declarants (name, contact information, email, address)	Until membership withdrawal or termination of the service contract, unless otherwise specified by relevant laws
Provision of Goods or Services: Fulfillment Services	Sender name, contact information, recipient name, contact information, address	Until membership withdrawal or termination of the service contract, unless otherwise specified by relevant laws
Provision of Goods or Services: Overseas Remittance Services	1) For individual business owners: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number) 2) For corporate entities: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number), corporate shareholder and executive information, date of birth (or resident registration number) 3) Recipient information: Recipient representative name, bank account number, contact information, email, address	Until membership withdrawal or termination of the partnership agreement, unless otherwise specified by relevant laws
Customer Service Statistics	Name, email, contact information, address	Until membership withdrawal
Information and Event Notifications	Name, email, contact information	Until membership withdrawal or withdrawal of consent for receiving such information
Automatically Collected Items	Device information (OS details, device identifier, screen size), visit (access log) records, service usage records (including misuse and transaction history)	Until membership withdrawal or withdrawal of consent for receiving such information

Clause 4 (Provision of Personal Information to Third Parties)

1. The Company processes users' personal information only within the scope specified in this policy and provides it to third parties only in cases falling under Clause 17 of the Personal Information Protection Act of South Korea, such as obtaining the user's consent or under specific legal provisions.
2. The Company provides personal information to third parties with the user's consent as follows:

Category	Recipient	Provided Personal Information Items	Purpose of Use by the Recipient	Retention and Usage Period of the Recipient
Provision of Goods or Services: Overseas Remittance Services	U Fintech Hub Inc.	1) For individual business owners: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number) 2) For corporate entities: Representative name, address, unique identification number (or resident registration number), bank account number, (if acting through an agent) agent name, address, unique identification number (or resident registration number), corporate shareholder and executive information, date of birth(or resident registration number) 3) Recipient information: Recipient representative name, bank account number, contact information, email, address	To provide overseas remittance services	Until membership withdrawal or termination of the partnership agreement, unless otherwise specified by relevant laws

3. The Company may use, disclose, or transfer personal information to third parties in compliance with applicable laws under the following circumstances:
   • When required by applicable laws, including those outside the user’s country of residence
   • In response to requests from investigative authorities based on legal procedures and methods stipulated by law
   • Upon requests from public or government institutions, including those outside the user’s country of residence, for purposes of national security and/or law enforcement
   • In cases of restructuring, mergers, acquisitions, joint ventures, transfers, or other dispositions of all or part of the Company’s business, assets, or shares (including those related to bankruptcy or similar proceedings)

Clause 5 (Exceptions to the Provision of Personal Information to Third Parties)

The Company provides users' personal information to partner companies only within the scope and methods specified in Clauses 1 and 2 of this Privacy Policy. Personal information is not used for purposes other than service-related purposes, nor is it provided to other parties or companies. However, there are exceptions where personal information may be provided without the user's prior consent, as outlined below:

• When the user has previously disclosed their personal information (e.g., through posting, commenting, etc.)
• When required by applicable laws or in response to requests from investigative authorities for investigative purposes

Clause 6 (Delegation of Personal Information Processing)

1. The Company delegates portions of its service-related tasks to external contractors to ensure efficient service delivery. The Company establishes and supervises necessary measures to ensure that the entrusted parties process personal information securely in compliance with the Personal Information Protection Act.
2. Personal information will not be provided to subcontractors unless the user is utilizing services related to the delegated tasks.

Category	Purpose and Scope of Tasks	Retention and Use Period	Subcontractor
Payment Processing Service	Tasks related to payment processing (e.g., virtual account setup)	Until membership withdrawal or upon termination of the outsourcing contract	Hecto Financial Corp.
Provision of Goods or Services: Import/Export Transportation Services	Tasks related to import/export transportation	Until membership withdrawal or upon termination of the outsourcing contract	List of Partners
Provision of Goods or Services: Import/Export Transportation Services	Customs-related tasks for import/export transportation	Until membership withdrawal, contract termination, or deletion of customs broker registration	List of Partners
Provision of Goods or Services: Fulfillment and Shipping Services	Logistics tasks, including transport and delivery	Until membership withdrawal or upon termination of the outsourcing contract	List of Partners
Web Server Information Processing Service	Hosting and management tasks related to web server operations	Until membership withdrawal or upon termination of the outsourcing contract	Amazon Web Services Korea LLC

Clause 7 (Overseas Transfer of Collected Personal Information)

The Company provides personal information to third parties overseas as outlined below and may process users' personal information on servers located outside the user’s country of residence.

1. List of Receiving Parties and Contact Information:
   List of Partners

2. Timing and Method of Transfer:
   At the time of using related services provided on the website, personal information is transmitted via network.

3. Personal Information Transferred:
   Among the items collected under Clause 2, the category titled “Provision of Goods or Services: Export/Import Transport Services.”

4. Purpose of Use by the Receiving Party:
   Personal information is transferred to external entities to perform necessary tasks for providing the services listed under Clause 2. The Company ensures that the receiving parties do not violate applicable data protection laws through proper oversight and management.

5. Retention and Use Period of the Receiving Party:
   Personal information is retained until membership withdrawal or the termination of the relevant contract. Subsequently, the information is promptly destroyed unless retention is mandated by law, in which case it is preserved for the legally specified period.

6. Right to Refuse Consent and Potential Consequences:
   Users have the right to refuse the collection of their personal information. However, refusal may result in restricted access to services.

Clause 8 (Rights and Obligations of Data Subjects and Exercise Methods)

1. Data subjects may exercise the following rights related to personal information protection with the Company at any time:

   • Request access to personal information
   • Request correction of errors, if any
   • Request deletion of personal information
   • Request suspension of processing

2. The rights outlined in Paragraph 1 can be exercised through written requests, phone calls, emails, facsimiles (FAX), or other methods. The Company must respond promptly. If the data subject requests correction or deletion of errors in their personal information, the Company will cease using or providing the information until the correction or deletion is complete.

3. The rights outlined in Paragraph 1 may also be exercised by a legal representative of the data subject or a delegated person. In such cases, a power of attorney must be submitted, as prescribed in Form 11 of the Enforcement Rules of the Personal Information Protection Act.

4. Data subjects shall not violate applicable laws, including the South Korean Personal Information Protection Act, by infringing upon the personal information or privacy of themselves or others in relation to the Company's handling of such information.

5. Requests for access to or suspension of processing of personal information may be restricted under Articles 35(5) and 37(2) of the South Korean Personal Information Protection Act.

6. Requests for correction or deletion of personal information cannot be made if other laws specify that the personal information must be collected.

7. When the Company receives requests for access, correction, deletion, or suspension of processing under the rights of data subjects, it verifies whether the requester is the data subject or a legitimate representative.

Clause 9 (Destruction of Personal Information)

1. The Company will promptly destroy personal information once its retention period has expired, or its processing purpose has been achieved, making the information no longer necessary.

2. If the retention period for personal information agreed upon by the data subject has expired, or the processing purpose has been achieved, but preservation of the personal information is required by other laws, the Company will transfer the information to a separate database (DB) or store it in a different location.

3. The procedures, timelines, and methods for the destruction of personal information are as follows:

   • Destruction Procedures
     Information entered by users will either be stored for a certain period based on internal policies and relevant laws or destroyed immediately upon achieving its purpose.

   • Destruction Timelines

     • If the retention period for personal information has expired: Within five (5) days from the expiration date.
     • If personal information becomes unnecessary (e.g., upon achieving its processing purpose, service discontinuation, or business termination): Within five (5) days from the date it is deemed unnecessary.

   • Destruction Methods

     • Personal information in electronic file format will be permanently deleted using technical methods that prevent its recovery.
     • Personal information printed on paper will be shredded or incinerated.

Clause 10 (Installation and Operation of Automatic Personal Information Collection Devices (Cookies) and How to Reject Them)

1. The Company uses cookies and other similar technologies to provide customized services to members.

2. A cookie is a small text file sent by the server operating the website to the user's browser, which may be stored on the user's computer's hard disk. The Company uses cookies to analyze access frequency, visit duration, track member preferences and interests, monitor participation in various events, and count the number of visits for targeted marketing.

3. Members have the option to accept or reject the installation of cookies. By adjusting the settings in their mobile application or web browser, members can either allow cookies or reject the storage of all cookies. However, rejecting cookies may make it difficult to use services that require login.

4. How to Reject Cookies: Members can reject cookies by selecting options in their mobile application or web browser to either allow all cookies, request confirmation each time a cookie is saved, or reject the storage of all cookies.

Clause 11 (Collection and Transmission of Behavioral Information)

When a data subject visits the Company’s website, their behavioral information may be automatically collected and transmitted to web analytics tool providers, such as Google, through web log analysis tools.

Clause 12 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information:

1. Administrative Measures

   • Establishment and implementation of internal management plans
   • Regular staff training on data protection

2. Technical Measures

   • Access control management for personal information processing systems
   • Installation of access control systems
   • Encryption of unique identifiers and sensitive data
   • Implementation of security programs

3. Physical Measures

   • Access control for data centers and document storage facilities

Clause 13 (Personal Information Protection Officer, etc.)

The Company has designated the following Personal Information Protection Officer and department to oversee and take responsibility for personal information processing. They handle inquiries, complaints, and remedies related to the processing of personal information.

1. Personal Information Protection Officer

   • Name: Jongha Kim
   • Position: CTO
   • Contact: +82 2 6956 7218, jongha.kim@ship-da.com

2. Personal Information Protection Manager

   • Name: Jinkyu Park
   • Position: Team Leader
   • Contact: +82 2 6956 7218, innfi@ship-da.com

For any inquiries, complaints, consultations, or remedies regarding personal information protection that arise during the use of the Company's services (or business), you may contact the Personal Information Protection Officer or Manager. The Company will respond and handle your inquiries promptly and without delay.

Clause 14 (Remedies for Infringement of Data Subject’s Rights)

Data subjects may seek resolution of disputes or consultation regarding personal information infringement by contacting the Personal Information Dispute Mediation Committee or the Personal Information Infringement Reporting Center under the Korea Internet & Security Agency (KISA). For additional inquiries or reports of personal information infringement, you may contact the following institutions:

1. Personal Information Dispute Mediation Committee www.kopico.go.kr

2. Personal Information Infringement Reporting Center privacy.kisa.or.kr

3. Supreme Prosecutors' Office www.spo.go.kr

4. Cyber Bureau of the National Police Agency ecrm.cyber.go.kr

You can check the history of changes to the Privacy Policy below:

• n/a