The Company processes personal information for the following purposes. Personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• Handling complaints or inquiries: Consultation on product/technology and purchase inquiries
• Provision of goods or services: Service provision, content provision, customized service provision
• Use for marketing and advertising: Development of new services (products) and provision of customized services, verification of service validity, measurement of access frequency, provision of events and promotional information, and statistics
• Recruitment operations: Conducting hiring processes and smooth communication with applicants

A. Items of Personal Information Processed

In addition, activity records such as IP, access URL, cookies, device information, visit time, and service usage records may be generated and collected during service use.

B. Processing and Retention Period of Personal Information

A. The Company entrusts personal information processing as follows for smooth service provision.

B. When entering into entrustment contracts, the Company specifies matters concerning prohibition of personal information processing outside the purpose of entrusted work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of entrusted companies, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises entrusted companies to ensure they do not violate personal information protection laws.

The Company transfers (stores) personal information overseas as follows for stable service provision. If you do not wish to have your personal information transferred overseas, you may refuse the international transfer through the Company's Personal Information Protection Officer and relevant department.

• Article 28-8(1)1 of the Personal Information Protection Act (Consent of data subject)
• Article 28-8(1)3 of the Personal Information Protection Act (Processing entrustment/storage for contract performance)

A. The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has expired or the processing purpose has been achieved.

B. If personal information must be retained in accordance with other laws despite the expiration of the retention period consented to by the data subject or achievement of the processing purpose, such personal information will be moved to a separate database (DB) or stored in a different location.

C. The procedures and methods for destroying personal information are as follows:

• Destruction procedure: The Company selects personal information for which destruction reasons have arisen and destroys the personal information with approval from GenON's Personal Information Protection Officer.
• Destruction method: Personal information in electronic file format is destroyed using technical methods that make records unrecoverable.

A. Data subjects may exercise rights such as requesting access, correction, deletion, and suspension of processing of personal information from the Company at any time.

B. The exercise of rights under paragraph 1 may be made to the Company in writing, by email, or by facsimile (FAX) in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and GenON will take action without delay.

C. The exercise of rights under paragraph 1 may be made through a legal representative of the data subject or an authorized agent. In this case, a power of attorney in the form of Attachment 11 of the "Notice on Personal Information Processing Methods (No. 2020-7)" must be submitted.

D. Requests for access to and suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.

E. Requests for correction and deletion of personal information cannot be made if such personal information is specified as a collection target under other laws.

F. The Company verifies whether the person making requests for access, correction, deletion, or suspension of processing is the data subject or a legitimate representative.

The Company takes the following measures to ensure the safety of personal information:

A. Establishment and implementation of internal management plan: An internal management plan has been established and implemented for safe processing of personal information.

B. Access restrictions to personal information: Necessary measures are taken to control access to personal information through granting, changing, and canceling access rights to database systems that process personal information, and intrusion prevention systems are used to control unauthorized external access.

C. Access control for unauthorized persons: Physical storage locations for personal information are separately maintained with established and operated access control procedures.

A. The Company uses Google Analytics, a web log analysis tool provided by Google, in accordance with Article 15(1)1 (consent) of the Personal Information Protection Act.

Through this tool, service user information is collected, and only non-identifiable information that cannot identify individual users is collected. Nevertheless, users may refuse use through tool-specific settings.

• Google Analytics: Installation of blocking browser add-on (https://tools.google.com/dlpage/gaoptout) or Cookie settings below

B. The Company uses 'cookies' to store and retrieve usage information to provide personalized services to users.

Cookies are small pieces of information sent by the server (https) operating the website to the user's computer browser and may be stored on the hard disk of the user's PC computer.

• Purpose of cookie use: Used to provide optimized information to users by identifying visit and usage patterns for each service and website visited, popular search terms, secure access status, etc.
• Cookie installation, operation, and rejection: Cookie storage can be rejected through the Tools > Internet Options > Privacy menu options at the top of the web browser.
• Refusing cookie storage may cause difficulties in using personalized services.

A. The Company designates the following Personal Information Protection Officer to be responsible for overall personal information processing and to handle complaints and remedy damages related to personal information processing of data subjects.

B. Data subjects may make requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will make efforts to process data subjects' personal information access requests promptly.

C. Data subjects may inquire about all matters related to personal information protection, complaints, and damage relief arising from use of the Company's services (or business) to the Personal Information Protection Officer and relevant department. The Company will respond and process data subjects' inquiries without delay.

A. Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency Personal Information Infringement Report Center, etc. to receive relief from personal information infringement. For other personal information infringement reports and consultations, please contact the following organizations:

• Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)
• National Police Agency: (without area code) 182 (cyberbureau.police.go.kr)

B. Persons whose rights or interests have been infringed by dispositions or omissions by the heads of public institutions in response to requests under Articles 35 (Access to Personal Information), 36 (Correction and Deletion of Personal Information), and 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file administrative appeals as prescribed by the Administrative Appeals Act.

• For details on administrative appeals, please refer to the Central Administrative Appeals Commission website (www.simpan.go.kr).

The Company processes personal information as follows for providing AI model inference API services.

A. Information Collected

B. Purpose of Data Use

• Providing and improving API inference services
• Service performance monitoring and incident response
• Billing calculation and payment processing
• Abuse prevention and security maintenance
• Legal compliance

C. No Training on Your Data Policy

The Company does NOT use prompts or generated results received through the API for training, fine-tuning, or improving AI models. Your data is used solely to provide the inference service you requested.

D. Data Retention Period

E. Data Security

• All API communications are encrypted with TLS 1.3
• Stored data is encrypted with AES-256
• Only authorized personnel can access the data
• Operated in security-certified data centers in South Korea

F. Immediate Deletion Request: Customers may request immediate deletion of their API request/response data at any time. Please contact the Personal Information Protection Officer for deletion requests.

G. Zero-Logging Option: Zero-logging options that do not log any request/response content can be provided to enterprise customers upon request.

A. This Privacy Policy is effective from January 10, 2025.

B. Previous Privacy Policies can be viewed at the link below.

• Effective until 2025.11.09 (Click)