HEIMDEX Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes:

1. Membership registration and management: verifying intent to join, identity authentication, maintaining membership, preventing misuse.
2. Provision of goods or services: video indexing and analysis, content delivery, customized services, payment and settlement for paid services.
3. Complaint handling: identity verification of complainants, inquiry confirmation, contact for fact-finding, result notification.

Article 2 (Processing and Retention Period)

1. The Company processes and retains personal information within the retention period prescribed by law or consented to by the data subject.
2. The retention period for each category of personal information is as follows:
   • Membership registration and management: until membership withdrawal
   • E-commerce contract, withdrawal, payment, and supply records: 5 years (Act on Consumer Protection in Electronic Commerce)
   • Website access logs: 3 months (Protection of Communications Secrets Act)

Article 3 (Items of Personal Information Processed)

The Company processes the following items of personal information:

1. Required: name, company name, email, password, service usage records, access logs, cookies, IP address.
2. Optional: department, position, phone number, marketing consent status.

Article 4 (Provision to Third Parties)

The Company processes personal information only within the scope specified in Article 1 and provides it to third parties only with the data subject’s consent or where permitted under Articles 17 and 18 of the Personal Information Protection Act.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts the following personal information processing tasks:

• Cloud services (e.g., Amazon Web Services) — infrastructure and data hosting
• Payment processing — service fee payment
• Customer support and email delivery — responding to inquiries and sending notifications

Article 6 (Rights and Obligations of Data Subjects)

Data subjects may at any time request access, correction, deletion, or suspension of their personal information. Requests may be made in writing or by email, and the Company will respond without delay.

Article 7 (Destruction Procedures and Methods)

1. When personal information becomes unnecessary (retention period expiry, purpose fulfilled), it is destroyed without delay.
2. Electronic files are erased using technical methods that prevent recovery; printed documents are shredded or incinerated.

Article 8 (Safety Measures)

The Company takes the following measures to ensure the safety of personal information:

1. Administrative: internal management plan, regular staff training.
2. Technical: access control, log retention, encryption of unique identifiers, security software.
3. Physical: access control to data storage areas.

Article 9 (Data Protection Officer)

The Company designates the following Data Protection Officer:

• Name: Heejo Kang
• Position: CSO
• Contact: heejo.kang@heimdex.co

Article 10 (Changes to the Privacy Policy)

This Privacy Policy takes effect on March 13, 2026.