Privacy Policy

D&D Co., Ltd. (the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of Korea, in order to protect the personal data of data subjects and to handle related grievances promptly and smoothly. Article 1 (Purposes of Processing) The Company processes personal data for the following purposes and does not use it for any other purpose. Where the purpose of use changes, the Company will take the necessary measures, including obtaining separate consent under Article 18 of the Personal Information Protection Act. 1. Receiving and responding to enquiries and orders: receiving enquiries about products and technical documents and order requests, verifying the person and the request, contacting and replying, consultation and notification of outcomes. 2. Service operation and improvement: improving service quality through website usage analytics, and identifying and responding to service errors and failures. Article 2 (Processing and Retention Periods) (1) The Company processes and retains personal data within the retention and use period required by law or consented to by the data subject. (2) The processing and retention periods are as follows. 1. Receiving and responding to enquiries and orders: three years from the date of receipt. Where an investigation for a violation of the relevant laws is under way, until that investigation concludes. 2. Where retention is required by the relevant laws, for the period specified in those laws. Article 3 (Provision to Third Parties) The Company processes personal data only within the scope specified in Article 1, and does not provide it to third parties except with the consent of the data subject or where Articles 17 and 18 of the Personal Information Protection Act apply, such as under a specific provision of law. Article 4 (Outsourcing of Processing) (1) For the smooth provision of the service, the Company outsources personal data processing as follows. 1. Vercel Inc. - Outsourced work: website hosting and operation, server-side processing of enquiries and orders, collection of visitor and page performance statistics - Location of server processing: Republic of Korea (Seoul) - Retention and use period: until the outsourcing agreement ends 2. Supabase, Inc. - Outsourced work: database and file storage for products, technical documents, enquiries and orders - Location of data storage: Republic of Korea (Seoul) - Retention and use period: until the outsourcing agreement ends 3. Google LLC - Outsourced work: website usage analytics, sending notification emails for enquiries and orders - Retention and use period: until the outsourcing agreement ends (2) When entering into an outsourcing agreement, the Company specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing personal data beyond the purpose of the outsourced work, technical and administrative safeguards, supervision of the trustee, liability including damages, and other matters, and supervises whether the trustee processes personal data safely. (3) Where the content of the outsourced work or the trustee changes, the Company will disclose the change through this Policy without delay. Article 5 (Overseas Transfer of Personal Data) (1) In connection with the outsourcing described in Article 4, the Company transfers personal data overseas as follows. 1. Vercel Inc. - Contact of the recipient: https://vercel.com/legal/privacy-policy - Destination country: United States - Time and method of transfer: transmitted over the information and communications network at the time of service use - Items transferred: access IP address, browser and device information, pages visited, page performance metrics - Purpose of use by the recipient: aggregation and analysis of visitor and page performance statistics - Retention and use period: until the outsourcing agreement ends 2. Google LLC - Contact of the recipient: https://policies.google.com/privacy - Destination country: United States - Time and method of transfer: transmitted over the information and communications network at the time of service use and when an enquiry or order is submitted - Items transferred: (usage analytics) access IP address, cookies, access date and time, browser and device information, service usage records / (notification email) name, phone number, email address, content of the enquiry or order - Purpose of use by the recipient: website usage analytics, sending notification emails for enquiries and orders - Retention and use period: until the outsourcing agreement ends 3. Functional Software, Inc. (Sentry) - Contact of the recipient: https://sentry.io/privacy/ - Destination country: United States - Time and method of transfer: transmitted over the information and communications network when a service error occurs - Items transferred: access IP address, browser and device information, request information at the time of the error - Purpose of use by the recipient: collection and analysis of service error information and incident response - Retention and use period: until the outsourcing agreement ends (2) Personal data you enter when submitting an enquiry or order is processed on servers in the Republic of Korea (Seoul) region and stored in a database located in the Republic of Korea (Seoul) operated by Supabase, Inc. as described in Article 4(1)2, and therefore does not constitute an overseas transfer. (3) Under Article 28-8(1) of the Personal Information Protection Act, a data subject may refuse the overseas transfer of their personal data. Please send any such refusal to the privacy officer named in Article 11. Note, however, that the transfers above are essential to providing the website; if you refuse, your access to the website and use of the enquiry and order functions may be restricted. Article 6 (Rights and Duties of Data Subjects and Legal Representatives, and How to Exercise Them) (1) A data subject may at any time request access to, correction of, deletion of, or suspension of the processing of their personal data. (2) The rights under paragraph (1) may be exercised in writing, by telephone, by email and similar means, and the Company will act on them without delay. (3) Where a data subject requests correction or deletion on grounds of an error in their personal data, the Company will not use or provide that personal data until the correction or deletion is complete. (4) These rights may be exercised through a legal representative of the data subject or a duly authorised agent. Article 7 (Categories of Personal Data Processed) 1. When submitting an enquiry or order (entered directly by the data subject) - Required: name; at least one of a phone number or an email address; the content of the enquiry or order - Optional: company name 2. Items generated and collected automatically in the course of using the service - Access IP address, cookies, access date and time, browser and device information, service usage records (for website usage analysis) - Referral source: the address of the referring site (domain only), the first page visited, and campaign tags — stored together with the enquiry Article 8 (Destruction of Personal Data) (1) The Company destroys personal data without delay once it is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved. (2) Procedure and method: information held as electronic files is deleted so that it cannot be recovered or reproduced; paper documents are shredded or incinerated. Article 9 (Measures to Secure Personal Data) The Company takes the following measures to secure personal data. 1. Administrative: establishing and implementing an internal management plan, minimising the number of staff with access, and training them. 2. Technical: managing access rights to the personal data processing system, access control, and encryption in transit. 3. Physical: access control for areas where records are stored. Article 10 (Installation and Operation of Automatic Data Collection Devices, and Refusal) (1) The Company uses cookies and other devices that automatically collect personal data, for website usage analytics and service quality improvement. A cookie is a small piece of information that a website server sends to a user's browser and that is stored on the user's device. (2) The automatic collection tools used by the Company are as follows. 1. Google Analytics (Google LLC) - Purpose: analysing traffic sources and page-level usage to improve the service - Items collected: access IP address, cookies, access date and time, browser and device information, pages visited and service usage records - Retention and use period: from the date of collection, 2 months for event data and 14 months for user data (per the Google Analytics data retention setting) 2. Vercel Analytics and Speed Insights (Vercel Inc.) - Purpose: counting visitors and measuring page load performance - Items collected: access IP address, browser and device information, pages visited, page performance metrics - Retention and use period: up to 12 months from the date of collection (3) The Company does not use information collected by these tools for personalised advertising and does not provide it to third parties for advertising purposes. (4) A data subject may refuse the storage of cookies and automatic collection by the following means. Note that refusing cookie storage may restrict the use of some services. 1. Allowing or blocking cookies in your web browser - Chrome: Settings > Privacy and security > Third-party cookies - Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data - Safari: Settings > Privacy > Block all cookies - Firefox: Settings > Privacy & Security > Cookies and Site Data 2. Deleting cookies already stored - Use the "Clear browsing data" or "Delete cookies and site data" menu in your browser. 3. Using private browsing - Cookies are not stored on your device when you use a Chrome Incognito window, an Edge InPrivate window, a Safari Private window or a Firefox Private window. 4. Opting out of Google Analytics - Installing the opt-out browser add-on provided by Google blocks collection by Google Analytics. (https://tools.google.com/dlpage/gaoptout) Article 11 (Privacy Officer) (1) The Company designates the following privacy officer to take overall responsibility for personal data processing and to handle complaints and remedies for data subjects in relation to that processing. ▶ Privacy Officer - Name: Hyoyong Lee - Position: Chief Executive Officer - Contact: +82-31-983-6243, sales@idnd.com (2) Data subjects may direct any personal data enquiry, complaint or request for remedy arising from use of the Company's services to the privacy officer, and the Company will respond and act without delay. Article 12 (Requests for Access to Personal Data) A data subject may submit a request for access to personal data under Article 35 of the Personal Information Protection Act to the department below, and the Company will endeavour to handle it promptly. ▶ Department receiving and handling access requests - Department: Sales Team - Contact: +82-31-983-6243, sales@idnd.com Article 13 (Remedies for Infringement of Rights) Data subjects may contact the following bodies regarding remedies and consultation for personal data infringement. 1. Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회): +82-1833-6972 (www.kopico.go.kr) 2. Privacy Infringement Report Centre (개인정보침해신고센터): +82-118 (privacy.kisa.or.kr) 3. Supreme Prosecutors' Office (대검찰청): +82-1301 (www.spo.go.kr) 4. Korean National Police Agency (경찰청): +82-182 (ecrm.police.go.kr) Article 14 (Effective Date and Amendment of this Privacy Policy) (1) This Privacy Policy takes effect on 19 August 2026. (2) Where content is added, deleted or changed, the Company will give notice through the website before the effective date. (3) The revision history is as follows. 1. 16 July 2026 — established and effective 2. 11 August 2026 — amended and effective (disclosure of processing trustees and overseas transfers; expanded guidance on automatic collection devices) 3. 19 August 2026 — amended and effective (Article 7 corrected to match the actual enquiry form — at least one of phone or email required, company name optional)