Article 1 (General Provisions)

KINX Inc. (hereinafter referred to as the Company or KINX) values customer information and makes every effort to effectively manage and protect customer personal information. The Company complies with the Personal Information Protection Act and other relevant laws and regulations concerning personal information protection. The Company has also established and complies with this Privacy Policy, and publishes it on the Company's website (www.kinx.net) so that customers may access it at any time. This Privacy Policy is subject to change due to changes in relevant laws and regulations or internal operational policy. If the Company amends this Privacy Policy, the amendment will be announced without delay through the notices (or individual notices) on the Company's website (www.kinx.net).

Article 2 (Purpose of Collection and Use of Personal Information)

Personal information refers to information about a living individual, such as a real name, that can identify a specific individual who is a member of the Company (including information that, while not sufficient to identify a specific individual by itself, can be easily combined with other information to do so). The personal information collected by the Company is used for the following purposes.
① Processing matters related to the service agreement, including subscription, change, or termination of service, and handling after-sales service (A/S) inquiries
② Settlement and payment of service charges, collection, and identity verification
③ Determining eligibility for charge reductions or exemptions and providing other services
④ Marketing activities, including the introduction of new products, event notifications, customer acquisition and management, statistics on use of the Company's website, sending newsletters, and customer surveys, provided directly by the Company or through business partnerships with third parties
⑤ Delivery of goods, sending of invoices, identity verification of legal representatives, and record retention for dispute resolution
⑥ Verifying applicant information and confirming request details in order to respond to general inquiries and consultations
⑦ Entrustment of work necessary for the performance of contracts, such as service provision, to the entrustees notified in this Privacy Policy

Article 3 (Items of Personal Information Collected and Method of Collection)

The Company collects only the minimum personal information necessary for service subscription, consultation, and service provision, and does not collect personal information that may seriously infringe on customers' human rights, such as race and ethnicity, ideology and creed, place of origin or domicile, political orientation, criminal record, or health status, except where the customer's consent to such collection has been obtained.

① The items of personal information collected by the Company are as follows.

Type	Collection Channel	Collection Items
Membership Registration	On-line	ID, password, name, company name, email address, mobile number, telephone number (IXcloud customers only), gender (IXcloud customers only), date of birth (IXcloud customers only), DI (IXcloud customers only), country information (CDN Pro customers only)
	Off-line	Required items: ID, password, name, company name, email address, business registration number, mobile number (or telephone number) Optional items: address, fax number
Service Use and Other Business Processing	-	Records of service use, payment method information (such as bank account or credit card information), billing and payment records, service suspension history, connection logs, cookies, connection IP, and device information
Consultation, Inquiries, and Event Applications	-	Applicant's name, company name, email address, telephone number, and address (event applications only)
Data Center Access Management	-	Required items: company name, contact person (name), mobile number Optional items: email address

② The Company collects personal information by the following methods.
    a. Personal information provided by the customer through a membership application form, the Company's website, telephone, fax, or similar means for membership registration, telephone or internet consultation, event applications, delivery requests, or provision by partner companies
    b. Information generated during service use or business processing, or collected through collection tools

Article 4 (Method of Consent to Collection and Use of Personal Information)

The Company obtains the customer's consent to the collection of personal information. The Company has established a procedure by which the customer may consent to the contents of Collection and Use of Personal Information, and if the customer clicks the Agree button, the customer is considered to have consented to the collection of personal information. The customer has the right to refuse consent to the collection and use of personal information, and if the customer refuses to consent, the customer's use of the service may be restricted.

Article 5 (Retention and Use Period of Personal Information)

The retention and use period of the customer's personal information is as follows.
① The Company retains and uses the customer's collected personal information only for the period during which the customer uses the service and the period necessary to prepare for dispute resolution (the retention period). However, if there are special provisions under the applicable laws, the information will be retained in accordance with such laws and regulations.
② The retention period refers to the period during which personal information is retained to prepare for disputes such as charge settlement and billing errors. For members, this is one year after termination of the service; for non-members, this is one year after applying for the relevant service. However, if there is unpaid or overpaid billing or an ongoing dispute related to charges, the information will be retained until the dispute is resolved.
③ Retention periods of personal information under relevant laws and regulations

Legal Basis	Retention Period	Retained Information
Commercial Act	10 years	Personal information contained in important documents concerning commercial books and business operations
	5 years	Personal information contained in vouchers or similar accounting documents
Framework Act on National Taxes	5 years	Books and evidentiary documents concerning transactions, such as name, Resident Registration Number, phone number, billing address, and payment history
Protection of Communications Secrets Act	12 months	Subscriber data required for the provision of communication confirmation data, such as the date and time of telecommunication, start/end times of telecommunication, the other party's subscriber number, and location-tracking data of the connected device
	3 months	Log records, IP addresses, and other data required for the provision of communication confirmation data
Act on Consumer Protection in Electronic Commerce, Etc.	5 years	Records concerning contracts or withdrawal of subscription, etc.
	5 years	Records concerning payment and supply of goods, etc.
	3 years	Records concerning consumer complaints or dispute resolution
	6 months	Records concerning displays and advertisements
Act on the Use and Protection of Credit Information	3 years	Records concerning the collection, processing, and use of credit information

Article 6 (Procedures and Methods for Destruction of Personal Information)

In principle, the Company destroys personal information without delay once the purpose of its collection and use has been achieved. The procedures and methods of destruction are as follows.
① Destruction Procedures
    a. In principle, information provided by the customer is stored for a certain period in accordance with the reasons for retention under Article 5 (Retention and Use Period of Personal Information), internal policy, and relevant laws and regulations, after the purpose of its collection and use has been achieved, and is then destroyed.
    b. Subject of destruction: personal information of customers for which the period of use and retention, and the retention period under relevant laws and regulations, have expired
② Methods of Destruction
    a. Personal information stored in the form of electronic files, such as in a database, is deleted using technical methods that render it unrecoverable.
    b. Personal information printed or recorded on paper is destroyed by shredding or incineration.

Article 7 (Provision of Personal Information to Third Parties)

Except where the customer has consented or as provided by relevant laws and regulations, the Company does not, under any circumstances, use the customer's personal information or provide it to third parties beyond the scope notified in Article 2 (Purpose of Collection and Use of Personal Information). However, in the following cases, personal information may be provided without the customer's consent in accordance with relevant laws and regulations.
① Where necessary for the settlement of charges arising from the provision of the service
② Where personal information necessary for the performance of a contract concerning the provision of the service, and it is remarkably difficult to obtain ordinary consent for economic or technical reasons
③ Where requested by a relevant government agency for investigative purposes in accordance with relevant laws and regulations
④ Where there are special provisions under relevant laws and regulations, in which case the information is provided in accordance with the lawful procedures prescribed by such laws

Article 8 (Entrustment of Personal Information Processing)

The Company entrusts the processing of personal information to outside parties for purposes such as membership registration, service use agreements, provision of after-sales service and related work, and other customer convenience and management.

Entrustee	Entrusted Work	Retention and Use Period of Personal Information
LG Uplus Corp.	Text message sending service for mobile phones	Until termination of the customer's contract or the entrustment agreement, whichever is later
Toss Payments Co., Ltd.	Payment Gateway Services
Hyosung FMS Inc.	Automatic transfer (CMS) of service charges
Korea Credit Information Co., Ltd.	Debt collection
NICE Information Service Co., Ltd.	Real-name verification / identity authentication upon membership registration for service use
Hostway IDC Inc.	IDC monitoring and control services
Stibee Inc.	Sending of emails

Article 9 (Rights of Users and Legal Representatives, and Method of Exercise)

① Due to the nature of its business, the Company does not enter into contracts with children under the age of 14 and does not collect personal information of children under the age of 14.
② Customers may, at any time, view their own personal information and the status of its provision to third parties, and may request correction of errors, and the Company will take necessary measures without delay. In addition, if a request for error correction is made, the Company will not use the relevant information until the correction is complete. If incorrect personal information has already been provided to a third party, the Company will notify the third party of the results of the correction without delay so that the correction can be made. To view or correct errors in personal information using the internet, the customer may sign in to the Company's website (www.kinx.net) with the customer's ID and password and make changes to personal information in the Account Information menu. However, where a separate change application form is prescribed depending on the type of service, the customer may complete the form in writing and submit it by fax.
③ The customer may withdraw, at any time, consent previously given to the collection, use, and provision of personal information at the time of service subscription. Withdrawal may be made in writing, or by email to the personal information manager (privacy@kinx.net), in accordance with the Company's designated form, and the Company will verify the customer's identity and take action without delay.

Article 10 (Installation and Operation of Automatic Personal Information Collection Devices, and the Right to Refuse)

The Company operates cookies, which are used as necessary to locate and store information for the operation of the Company's website. A cookie is a small text file sent by the server used to operate the Company's website to the customer's web browser, and is stored on the customer's computer hard disk. The customer may determine whether to allow or refuse the collection of information through cookies by adjusting the security settings of the customer's web browser.
① Purpose of Using Cookies
To analyze the frequency of access, visit times, and number of visits by members and non-members.
② The customer has the option to decide whether to install cookies. The customer may adjust the level of information collection through cookies by setting the relevant options in the customer's web browser.
    a. In the web browser's Tools menu, select Internet Options → Security → Custom Level to set the level of information collection through cookies.
    b. Through the menu described above, the customer may choose to be prompted each time a cookie is stored, or may refuse the storage of all cookies. However, if the customer refuses to install cookies, there may be difficulties in using the service.

Article 11 (Measures to Ensure the Safety of Personal Information)

The Company has established the following technical and administrative measures to ensure the safety of customers' personal information so that it is not lost, stolen, leaked, altered, or damaged.
① Technical Measures
    a. Personal information is protected by passwords, and important data is protected through separate security functions, such as encrypting files and transmission data or using file lock functions.
    b. To prevent the leakage of customers' personal information due to hacking or similar causes, the Company installs its systems in areas where access from outside is controlled.
② Administrative Measures
    a. The Company minimizes the number of persons who may process customers' personal information, manages access authority, and provides training to ensure compliance with relevant laws and policies. The persons who process customers' personal information are as follows.
      (i) Persons who directly or indirectly deal with customers in the performance of marketing duties
      (ii) The Chief Privacy Officer and the Privacy Protection Manager, and other persons in charge of personal information management and protection
      (iii) Other persons for whom the processing of personal information is unavoidable in the course of their duties
    b. The Company has new employees sign a pledge of information protection at the time of hiring in order to prevent the leakage of information (including personal information) by employees.
    c. The handover of duties among personal information handlers is carried out thoroughly under maintained security, and responsibility for personal information protection is clearly defined both during and after employment.
    d. The Company designates its computer rooms and electrical rooms as controlled areas and restricts access to them.
    e. When collecting or providing information related to payment, such as a customer's bank account or credit card number, for the conclusion or performance of a service use agreement, the Company takes measures necessary to verify that the person providing such information is the customer.
    f. The Company is not responsible for matters arising from a customer's own error or from the inherent risks of the internet. The customer is responsible for managing and is liable for the customer's own ID and password in order to protect the customer's personal information.
    g. If personal information is lost, leaked, altered, or damaged due to a mistake by an internal manager or a technical management accident, the Company will immediately notify the customer of the fact and take appropriate measures.

Article 12 (Chief Privacy Officer and Handling of Customer Opinions and Complaints)

Customers who have any opinions, complaints, or other inquiries regarding personal information protection may send their opinions by email to the Chief Privacy Officer or the person in charge listed below, and the Company will promptly receive and address such matters and inform the customer of the results.
① Chief Privacy Officer and Person in Charge
    a. Chief Privacy Officer: Lee Seong-gyu
    b. Privacy Protection Manager: Chae Jeong-won
    c. Phone Number: 02-526-0900
    d. Email: privacy@kinx.net
② For reports of or consultations regarding infringement of personal information, please contact the following institutions.
    a. Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (without area code)
    b. Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972 (without area code)
    c. Supreme Prosecutors' Office: www.spo.go.kr / 1301 (without area code)
    d. Cyber Investigation Bureau, National Police Agency: ecrm.cyber.go.kr / 182 (without area code)

Article 13 (Notification of This Privacy Policy)

In the event of any addition, deletion, or amendment to the contents of this Privacy Policy, the Company will provide notice through the Notices section of its website no later than 7 days before the effective date of the change.

< Addendum >

Article 1 (Enforcement Date)
① This Privacy Policy was amended on January 24, 2014, and took effect on January 31, 2014.
② This Privacy Policy was amended on October 17, 2016, and took effect on October 24, 2016.
③ This Privacy Policy was amended on February 14, 2017, and took effect on February 21, 2017.
④ This Privacy Policy was amended on March 15, 2017, and took effect on March 22, 2017.
⑤ This Privacy Policy was amended on January 11, 2018, and took effect on January 18, 2018.
⑥ This Privacy Policy was amended on February 28, 2018, and took effect on March 7, 2018.
⑦ This Privacy Policy was amended on August 24, 2018, and took effect on August 31, 2018.
⑧ This Privacy Policy was amended on October 13, 2022, and took effect on October 20, 2022.
⑨ This Privacy Policy was amended on September 10, 2024, and took effect on September 17, 2024.
⑩ This Privacy Policy was amended on August 6, 2025, and took effect on August 13, 2025.
⑪ This Privacy Policy was amended on September 9, 2026, and took effect on September 16, 2026.