Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• Receiving partner inquiries (retail listing, export, B2B partnership, and other inquiries), verifying identity, providing consultation, and responding
• Preliminary contact for negotiating transaction terms and entering into contracts based on the content of the inquiry
• Responding to customer service (CS) inquiries by telephone or email and providing notice of the results

Article 2 (Items of Personal Information Processed)

The Company processes the following items of personal information.

The inquiry form on the Website does not store the information entered on the Company's servers; it is sent to the Company's email address (penefit@penefitglobal.com) through the email program used by the user. The Company collects personal information at the time it receives such email.

Article 3 (Period of Processing and Retention of Personal Information)

① The Company processes and retains personal information within the period of retention and use prescribed by law or the period of retention and use consented to by the data subject at the time of collection.

② The periods of processing and retention of personal information are as follows.

③ Where an inquiry leads to a contract, the relevant personal information is retained until the contractual relationship ends; where a period is prescribed by relevant laws, such period applies.

Article 4 (Provision of Personal Information to Third Parties)

① The Company processes the personal information of data subjects only within the scope specified in Article 1, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or pursuant to special provisions of law.

② The Company does not currently provide personal information to any third party. If provision to a third party becomes necessary in the future, the Company will notify the data subject of the recipient, the purpose of provision, the items provided, and the retention period, and will obtain separate consent.

Article 5 (Entrustment of Personal Information Processing)

① For the smooth handling of personal information, the Company entrusts personal information processing tasks as follows.

② When entering into an entrustment contract, the Company specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the trustee, and liability such as compensation for damages, and supervises whether the trustee processes personal information securely.

③ If the details of the entrusted tasks or the trustee change, the Company will disclose such changes through this Privacy Policy without delay.

Article 6 (Overseas Transfer of Personal Information)

① In accordance with Article 28-8 of the Personal Information Protection Act, the Company transfers personal information overseas as follows, based on the consent of the data subject or on the disclosure of the entrustment of processing and storage.

② Data subjects may refuse the overseas transfer of personal information by contacting the Chief Privacy Officer set out in Article 11. However, because the transfer to Vercel Inc. is essential for accessing the Website, refusing it will restrict use of the Website, and refusing the transfer to Google LLC may restrict inquiries by email. In such case, you may make inquiries by telephone (070-8095-5730).

Article 7 (Procedures and Methods for Destruction of Personal Information)

① The Company destroys personal information without delay when it becomes unnecessary, such as upon expiry of the retention period or achievement of the purpose of processing.

② Where personal information must continue to be preserved under other laws even though the retention period consented to by the data subject has expired or the purpose of processing has been achieved, the relevant personal information is moved to a separate database (DB) or stored in a different location.

③ The procedures and methods of destruction are as follows.

• Destruction procedure: The Company selects personal information for which a reason for destruction has arisen and destroys it with the approval of the Chief Privacy Officer.
• Destruction method: Information in the form of electronic files is deleted using technical methods that make the records irrecoverable, and personal information printed on paper is destroyed by shredding or incineration.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercising Them)

① Data subjects may at any time request the Company to allow access to, correct or delete, or suspend the processing of their personal information, or withdraw their consent.

② The rights under Paragraph 1 may be exercised against the Company in writing, by telephone, by email, or by other means, and the Company will take action without delay.

③ The rights may be exercised through an agent, such as the data subject's legal representative or a person delegated by the data subject. In this case, a power of attorney in accordance with Annexed Form No. 11 of the Notice on Personal Information Processing Methods must be submitted.

④ The rights of data subjects regarding requests for access to and suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑤ With respect to requests for correction and deletion of personal information, deletion may not be requested where such personal information is specified as subject to collection under other laws.

⑥ Upon a request for access, correction or deletion, or suspension of processing in accordance with the rights of data subjects, the Company verifies whether the person making the request is the data subject or a legitimate agent.

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

• Administrative measures: Establishment and implementation of an internal management plan, minimization of employees handling personal information, and regular training
• Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encrypted transmission of personal information (SSL), and installation and updating of security programs
• Physical measures: Access control to computer rooms and data storage locations

Article 10 (Installation, Operation, and Refusal of Devices That Automatically Collect Personal Information)

① The Company does not use cookies.

② To remember the language selected by the user, the Website stores only the language setting value in the local storage (localStorage) of the user's browser. This value is kept only on the user's device, is not transmitted to the Company, and does not contain any information that can identify an individual.

• Item stored: Selected language (e.g., ko, en)
• How to refuse or delete: It can be deleted at any time using the function for deleting browsing history (site data) in your web browser settings.
• Refusing or deleting such storage does not affect use of the Website, but the Website may be displayed in Korean on your next visit.

③ The Company does not use separate web analytics tools such as Google Analytics, and retains Website visit records only within the scope of the hosting server's access logs.

Article 11 (Chief Privacy Officer)

① The Company designates a Chief Privacy Officer as follows, who has overall responsibility for tasks related to personal information processing and handles complaints of and provides remedies for damages to data subjects in connection with personal information processing.

② Data subjects may direct any inquiries, complaints, requests for remedies for damages, and other matters related to personal information protection arising from their use of the Company's services to the Chief Privacy Officer. The Company will respond to and handle such inquiries from data subjects without delay.

Article 12 (Requests for Access to Personal Information)

Data subjects may submit a request for access to personal information under Article 35 of the Personal Information Protection Act to the Chief Privacy Officer set out in Article 11. The Company will endeavor to ensure that such requests for access are processed promptly.

Article 13 (Remedies for Infringement of Rights and Interests)

To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the KISA Personal Information Infringement Report Center, and other bodies. For other reports of and consultations on personal information infringement, please contact the following organizations.

• Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)
• KISA Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
• Korean National Police Agency: (no area code) 182 (ecrm.police.go.kr)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution with respect to a request under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act.

Article 14 (Changes to the Privacy Policy)

① This Privacy Policy applies from October 1, 2026.

② If any content is added, deleted, or modified due to changes in laws, policies, or security technology, the Company will give notice through the Website from 7 days before the changes take effect.

Business Information