ENKI WhiteHat (hereinafter "the Company") establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act to protect personal information of data subjects and promptly address related grievances.

In this policy, "processing" of personal information refers to collection, generation, linkage, integration, recording, storage, retention, processing, editing, search, output, correction, recovery, use, provision, disclosure, destruction, and other similar actions.

1. Processing Purpose, Retention and Use Period of Personal Information

The Company processes personal information of data subjects as follows and retains it within retention periods under relevant laws or periods notified to and agreed upon by data subjects. Once the processing purpose is achieved or the retention period expires, it is destroyed without delay.

A. Online Inquiries and Consultations, Inquiry Guidance, and Service Improvement

• Category: Mandatory

• Purpose of Collection and Use: Handling online inquiries and follow-up management to provide Company services/products

• Items Collected and Used: Company name, name, contact details, email address, inquiry details

• Retention and Use Period: Up to 2 years after achieving the purpose of use

• Legal Basis: Article 15 (1) 4 of the Personal Information Protection Act (Performance of a Contract)

B. Provision of Promotional and Marketing Information

• Category: Optional

• Purpose of Collection and Use: Providing marketing information, publishing security materials, providing updates on products, services, and events

• Items Collected and Used: Company name, name, contact details, email address

• Retention and Use Period: Until withdrawal of consent (unsubscription) or completion of marketing information services

• Legal Basis: Article 15 (1) 1 of the Personal Information Protection Act (Consent of Data Subject)

C. Newsletter Distribution

• Category: Optional

• Purpose of Collection and Use: Distributing newsletters containing Company news and information

• Items Collected and Used: Company name, name, contact details, email address

• Retention and Use Period: Until withdrawal of consent (unsubscription) or completion of newsletter services

• Legal Basis: Article 15 (1) 1 of the Personal Information Protection Act (Consent of Data Subject), Article 50 (1) of the Information and Communications Network Act (Consent to Receive Promotional Information)

2. Collection of Personal Information

The Company collects personal information of data subjects through the following methods.

• When a data subject directly enters information and agrees to its collection on the Contact page of the ENKI WhiteHat website (https://www.enki.co.kr)

• When a data subject directly provides information during inquiries via representative contact channels

3. Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of retention periods or fulfillment of processing purposes.

After confirming the personal information to be destroyed and whether statutory retention is required, it is processed under Company destruction procedures; personal information required to be retained by other laws is stored separately.

• Electronic files: Permanently deleted using technical methods so that they cannot be recovered or reproduced

• Hard-copy documents: Shredded or incinerated

4. Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties except with separate consent from data subjects or as permitted by relevant laws, such as the Personal Information Protection Act.

If an obligation to provide arises exceptionally under relevant laws, the Company interprets such laws strictly and strives to minimize infringement on users' privacy.

5. Entrustment of Personal Information Processing

In principle, the Company does not provide or entrust personal information externally without prior consent or notice to users.

When entrusting part of necessary tasks to external contractors for service provision, the Company notifies data subjects through this Privacy Policy and on-file contact details, and stipulates necessary matters and manages and supervises contractors to ensure safe processing.

6. Rights of Data Subjects and Legal Representatives and How to Exercise Them

Data subjects may request access, correction/deletion, suspension of processing, and withdrawal of consent regarding their personal information from the Company.

Rights can be exercised through the designated department (Phone: 02-402-1337) listed under "8. Data Protection Officer and Remedies for Infringement" below. The Company receives requests, verifies whether the applicant is the individual or a lawful representative, and processes them within periods and procedures prescribed by relevant laws before notifying results.

Rights may also be exercised through legal representatives or authorized agents, and the Company may request materials to verify authority of representation.

If the exercise of rights is restricted pursuant to relevant laws, reasons and appeal procedures will be notified.

Consent to receive marketing information and newsletters may also be withdrawn through the designated contact above (Phone: 02-402-1337).

7. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information.

• Administrative measures: Establishing and executing internal management plans, regular privacy training for employees

• Technical measures: Access authority management for personal information processing systems or computers storing personal information, password setup, installation and operation of security programs, encryption of files containing personal information

• Physical measures: Locking mechanisms and access control for places where personal information is stored/archived

8. Data Protection Officer and Remedies for Infringement

A. Data Protection Officer and Contact Department

The Company designates a Data Protection Officer and a responsible department as follows to oversee personal information processing tasks and address complaints and relief for data subjects.

• Data Protection Officer: Chunbae Jang

• Personal Information Manager: Siyoung Park

• Department for Rights Exercise and Infringement Reporting/Handling: Information Security Team

• Representative Contact: 02-402-1337

Data subjects may submit privacy-related inquiries, complaints, infringement reports, and requests for access, correction, deletion, suspension of processing, and withdrawal of consent to the designated department above. The Company will verify receipt and guide necessary actions and processing outcomes.

B. Notice in Case of Personal Information Breaches

When becoming aware of personal information breaches, the Company notifies data subjects of the following without delay in accordance with relevant laws and takes actions to minimize damage. If subject to statutory reporting, reports are filed with competent authorities.

1. Items of personal information breached

2. Time and circumstances of the breach

3. Specific information on measures data subjects can take to minimize damage

4. Company counteractions and grievance relief procedures

5. Responsible department and contact details for reporting damages

6. Legal rights and exercise methods for affected data subjects, including claims for damages/statutory damages and dispute mediation

7. Other matters necessary for data subject protection under relevant laws

Methods for minimizing damage and Company counteractions are detailed according to actual incident specifics. If reasons specified by law apply, such as unknown contact details of data subjects, alternative notification methods under laws are applied.

C. External Grievance Relief and Exercise of Rights

Data subjects may consult the following institutions for consultation, reporting, or dispute mediation regarding personal information infringements.

• Privacy Infringement Report Center: 118 (without area code) / privacy.kisa.or.kr

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr

Data subjects may claim damages under Article 39 or statutory damages under Article 39-2 of the Personal Information Protection Act, or apply for dispute mediation under Article 43, if statutory requirements are met.

Damage reports and compensation negotiations with the Company may be requested via the designated department above. Dispute mediation may be filed with the Personal Information Dispute Mediation Committee, and judicial claims for damages may proceed by filing a civil lawsuit in a competent court.

9. Amendments to Privacy Policy

This Privacy Policy is effective as of November 3, 2026.

When amending this Privacy Policy, the Company will announce changes and effective dates on the website and make previous policies available for review. Separate consent will be obtained in accordance with relevant laws where required.

• Previous Privacy Policy: Enacted June 27, 2024 — [Link to Previous Policy]

<End>