Synergy Co., Ltd. (the "Company") establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea (PIPA) to protect personal information and to handle related complaints promptly. It applies to personal information processed through the Company website (sngy.io). This English text is a translation for convenience; if it differs from the Korean version, the Korean version prevails. 1. Purposes of processing The Company processes personal information only for the purposes below. If a purpose changes, we will take the steps required by Article 18 of PIPA, such as obtaining separate consent. - Receiving and answering inquiries: reviewing and answering inquiries sent through the website (investment, recruitment, business, other) and keeping a record of the consultation - Website statistics: analysing which pages are visited and how visitors arrive, to improve the website (including per-visitor statistics and which pages led to an inquiry, if you accept analytics cookies) - Keeping the website safe: preventing spam and abuse, responding to security incidents, keeping a record of cookie choices The Company does not use personal information collected on the website to send advertising or marketing messages. 2. Personal information we process A. Processed with your consent - Inquiry form (required): email address, phone number, inquiry title, inquiry message - Inquiry form (optional): attached file and any information in it - If you accept analytics cookies: a randomly generated visitor ID, the page address visited, the previous page address, campaign (UTM) parameters, the names of buttons clicked, device, browser and operating-system type, and, if you send an inquiry, a record that it was sent. Your visit records may then be linked to that inquiry. B. Processed without consent, with the legal basis (PIPA Article 22(3)) - The time an inquiry was received, browser information, and an irreversibly transformed value of the sender's IP address: preventing spam and abuse (Article 15(1)6, legitimate interests). The original IP address is not stored. - Cookie-choice record (a random consent number, the choice made, policy version, language, time of the choice, a transformed value of browser information): proving the choice (Article 15(1)6) - Access logs (IP address, time of access, requested page, browser information): responding to security incidents and preventing unauthorised access (Article 15(1)6) * For visitors who do not accept analytics cookies, visit records (page visited, previous page, campaign parameters, device, browser and operating-system type) are processed only as statistics without any identifier and cannot identify an individual. 3. Retention periods - Inquiries: 3 years from the date received. If you ask us to delete an inquiry earlier, we delete it without delay. - The transformed IP value used against abuse: same period as the inquiry - Analytics records (including the visitor ID if you consented): 13 months from collection; after that only statistics that cannot identify anyone are kept - Cookie-choice records: 2 years from the choice - Access logs: 6 months - Analytics consent is valid for 12 months, after which we ask again. If you decline, we do not ask again for 6 months. 4. Destruction - Procedure: personal information is destroyed without delay once its retention period ends or its purpose is achieved. Where another law requires it to be kept, it is stored separately from other personal information and only for that period. - Method: electronic files are deleted so that they cannot be recovered; paper documents are shredded or incinerated. 5. Provision to third parties The Company does not provide personal information to third parties, except where permitted under Articles 17 and 18 of PIPA, such as when a law specifically requires it. 6. Outsourcing of processing The Company entrusts the following processing to service providers: - Amazon Web Services Korea LLC: operating the website servers and database, storing inquiry attachments, sending inquiry notification emails (Seoul region) - Google LLC: the Company's business email service (receiving and storing inquiry notification emails) Our contracts with these providers require compliance with data-protection law, security measures, limits on sub-processing and liability for damages, and we supervise how they handle personal information. We will update this policy if a provider or the entrusted work changes. 7. Transfer of personal information outside Korea Inquiry notification emails are stored in the Company's business email service, which transfers personal information outside Korea (PIPA Article 28-8(1)3). - Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy contact: https://policies.google.com/privacy) - Countries: the United States and other countries where Google operates data centres - Items: inquiry title, inquiry message, email address, phone number - When and how: when an inquiry is received, by email over an encrypted connection - Purpose and retention: for staff to review and answer the inquiry; kept for the same period as the inquiry (3 years from receipt) - How to refuse and its effect: if you do not want your information transferred outside Korea, please contact us by phone (+82-70-5226-1147) instead of the website form. Using the website form involves this transfer for the notification email. 8. Your rights and how to exercise them - You may at any time ask the Company to access, correct or delete your personal information, to stop processing it, or to withdraw your consent. - Send your request to the Privacy Officer below by email, phone or letter. We will act without delay (within 10 days for access requests). - A legal representative or a person you authorise may also make a request, with a power of attorney. - Deletion cannot be requested for information that another law requires us to collect, and access or suspension may be limited where the law provides. - You can withdraw analytics consent at any time under "Cookie Settings" at the bottom of every page. - The Company website does not collect personal information from children under 14. - If you are outside Korea, you may also have the right to lodge a complaint with the data-protection authority where you live or work. 9. Cookies and similar technologies The Company stores information in your browser that the website needs to work and, if you agree, information used for website statistics. A cookie is a small text file a website stores in your browser; local storage is a similar browser technology. - [Necessary] Cookie choice (sngy_consent, local storage): remembers whether you accepted or declined analytics; kept 12 months if accepted, 6 months if declined. - [Necessary] Language (NEXT_LOCALE, cookie): remembers the language you chose with the KR/EN switch, for 1 year. - [Necessary] Admin login (__Host-sngy_admin, cookie): used only when Company staff sign in to the admin screens, for up to 8 hours. It is never set for visitors. - [Optional] Analytics (sngy_vid, local storage): stored only if you accept analytics; a random visitor ID used to count return visits and how the site is used. Kept for the consent period (12 months) and deleted immediately when you withdraw consent. Analytics is used only if you choose "Accept all" in the notice shown on your first visit or turn analytics on under "Settings". It is not used before you choose, if you choose "Reject all", or if you close the notice. If your browser sends a Global Privacy Control (GPC) signal, we treat it as declining analytics. How to refuse: change your choice at any time under "Cookie Settings" at the bottom of every page, or block cookies and site data in your browser settings (Chrome: Settings > Privacy and security > Third-party cookies; Edge: Settings > Cookies and site permissions; Safari: Settings > Privacy > Block all cookies). Blocking necessary items may stop some features, such as remembering your language. The Company does not collect behavioural information for advertising and does not sell or share personal information. The map on the "Location" page is an embedded Google Maps view (Google LLC); while it is shown, Google may use cookies under its own privacy policy. 10. Security measures The Company protects personal information with the following measures. - Administrative: keeping the number of staff who handle personal information to a minimum; role-based admin accounts - Technical: encrypted connections (HTTPS) across the website; admin passwords stored encrypted, with lock-out after failed sign-ins; records of admin actions; inquiry attachments kept in private storage and encrypted at rest; IP addresses stored only in an irreversibly transformed form - Physical: servers and data are kept in access-controlled cloud data centres (Amazon Web Services Seoul region) 11. Privacy Officer The Company has designated the following Privacy Officer to oversee the processing of personal information and to handle complaints and remedies. - Name: Jung Jin Hyuk - Title: Director - Contact: josh@sngy.io, +82-70-5226-1147 12. Remedies To seek a remedy for an infringement of your personal information, you may apply for mediation or advice to the following Korean bodies. - Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr) - Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr) - Supreme Prosecutors' Office: 1301 (www.spo.go.kr) - Korean National Police Agency: 182 (ecrm.police.go.kr) 13. Changes to this policy This Privacy Policy applies from November 11, 2026. If we add, delete or change anything, we will announce it on the website notice board at least 7 days before it takes effect. - Announced: November 4, 2026 - Effective: November 11, 2026 - Previous privacy policy: July 9, 2024 – November 10, 2026 View