UNASTELLA

Article 1 (General Provisions)

“Personal information” means information relating to a living individual that can identify a specific individual by means of name, email address, telephone number, or similar information (including information that, even if it alone cannot identify a specific individual, can readily be combined with other information to do so).
“Data subject” means an individual who is identifiable by the processed information and who is the subject of such information, including visitors to and inquirers through the Company’s website.
Through this Privacy Policy, the Company informs data subjects of the purposes and methods by which the personal information they provide is processed, and of the measures taken for the protection of personal information.

Article 1 (General Provisions)

“Personal information” means information relating to a living individual that can identify a specific individual by means of name, email address, telephone number, or similar information (including information that, even if it alone cannot identify a specific individual, can readily be combined with other information to do so).
“Data subject” means an individual who is identifiable by the processed information and who is the subject of such information, including visitors to and inquirers through the Company’s website.
Through this Privacy Policy, the Company informs data subjects of the purposes and methods by which the personal information they provide is processed, and of the measures taken for the protection of personal information.

Article 2 (Items, Purposes, and Retention/Use Period of Personal Information Collected and Used)

The Company does not process sensitive information that may significantly infringe upon a data subject’s privacy, or unique identifying information assigned to distinguish individuals, without a legal basis or the data subject’s consent. In particular, resident registration numbers are not processed except in cases falling under each subparagraph of Article 24-2(1) (Restrictions on Processing of Resident Registration Numbers) of the Personal Information Protection Act.

The Company collects the following personal information for the purpose of responding to inquiries made through the Contact section of its website:

Article 2 (Items, Purposes, and Retention/Use Period of Personal Information Collected and Used)

The Company does not process sensitive information that may significantly infringe upon a data subject’s privacy, or unique identifying information assigned to distinguish individuals, without a legal basis or the data subject’s consent. In particular, resident registration numbers are not processed except in cases falling under each subparagraph of Article 24-2(1) (Restrictions on Processing of Resident Registration Numbers) of the Personal Information Protection Act.

The Company collects the following personal information for the purpose of responding to inquiries made through the Contact section of its website:

Data subjects may refuse to consent to the collection and use of their personal information; however, in such case, the use of related services, including replies to inquiries, may be restricted.

This website does not require any membership registration procedure and collects only the minimum personal information necessary for the provision of services.

Data subjects may refuse to consent to the collection and use of their personal information; however, in such case, the use of related services, including replies to inquiries, may be restricted.

This website does not require any membership registration procedure and collects only the minimum personal information necessary for the provision of services.

Article 3 (Handling of Personal Information Whose Retention Period Has Expired)

Personal information of data subjects shall be destroyed without delay once the purposes of its collection and use have been achieved. However, where retention for a certain period is required by applicable laws, such information shall be retained only for the period set forth below, and where additional retention is necessary, only the minimum necessary information shall be retained for the minimum necessary period through a separate consent procedure.

Article 3 (Handling of Personal Information Whose Retention Period Has Expired)

Personal information of data subjects shall be destroyed without delay once the purposes of its collection and use have been achieved. However, where retention for a certain period is required by applicable laws, such information shall be retained only for the period set forth below, and where additional retention is necessary, only the minimum necessary information shall be retained for the minimum necessary period through a separate consent procedure.

Article 4 (Procedure and Method of Destruction of Personal Information)
1) Procedure of Destruction
When the purpose of processing the collected personal information has been achieved or its retention period has expired, the Company shall destroy such information without delay, except where retention is required by the data subject’s consent or applicable laws.

2) Method of Destruction
Personal information stored in electronic file form shall be deleted using technical methods that prevent the records from being reproduced, and personal information printed on paper shall be destroyed by shredding or incineration.

Article 4 (Procedure and Method of Destruction of Personal Information)
1) Procedure of Destruction
When the purpose of processing the collected personal information has been achieved or its retention period has expired, the Company shall destroy such information without delay, except where retention is required by the data subject’s consent or applicable laws.

2) Method of Destruction
Personal information stored in electronic file form shall be deleted using technical methods that prevent the records from being reproduced, and personal information printed on paper shall be destroyed by shredding or incineration.

Article 5 (Provision of Personal Information to Third Parties)
The Company uses personal information only within the scope notified in Article 2, and does not use such information beyond that scope or provide or disclose it to any third party. The following cases shall, however, constitute exceptions:

Where separate consent has been obtained from the data subject;
Where there are special provisions in other laws, or where it is unavoidable to comply with legal obligations;
Where an investigative agency makes a request in accordance with the procedures and methods prescribed by law for the purpose of investigation;
Where the data subject or his/her legal representative is unable to express his/her intention or prior consent cannot be obtained due to unknown address or other reasons, and it is deemed manifestly necessary for the urgent benefit of the life, body, or property of the data subject or a third party.

Article 5 (Provision of Personal Information to Third Parties)
The Company uses personal information only within the scope notified in Article 2, and does not use such information beyond that scope or provide or disclose it to any third party. The following cases shall, however, constitute exceptions:

Where separate consent has been obtained from the data subject;
Where there are special provisions in other laws, or where it is unavoidable to comply with legal obligations;
Where an investigative agency makes a request in accordance with the procedures and methods prescribed by law for the purpose of investigation;
Where the data subject or his/her legal representative is unable to express his/her intention or prior consent cannot be obtained due to unknown address or other reasons, and it is deemed manifestly necessary for the urgent benefit of the life, body, or property of the data subject or a third party.

Article 6 (Outsourcing of Personal Information Processing)

For the smooth operation of its website, the Company outsources part of its personal information processing activities to external specialized providers as follows:
Outsourced Service Provider: [To be specified]
Scope of Outsourced Work: Storage and management of data submitted through the Contact form
Items of Personal Information Outsourced: Items listed in Article 2
When outsourcing personal information processing, the Company clearly stipulates matters such as the prohibition of processing personal information outside the purpose of the outsourced work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely.
Any change in the content of the outsourced work or the trustee shall be disclosed through this Privacy Policy without delay.
Outsourced personal information shall be destroyed without delay once the purposes of its collection and use have been achieved.

Article 6 (Outsourcing of Personal Information Processing)

For the smooth operation of its website, the Company outsources part of its personal information processing activities to external specialized providers as follows:
Outsourced Service Provider: [To be specified]
Scope of Outsourced Work: Storage and management of data submitted through the Contact form
Items of Personal Information Outsourced: Items listed in Article 2
When outsourcing personal information processing, the Company clearly stipulates matters such as the prohibition of processing personal information outside the purpose of the outsourced work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely.
Any change in the content of the outsourced work or the trustee shall be disclosed through this Privacy Policy without delay.
Outsourced personal information shall be destroyed without delay once the purposes of its collection and use have been achieved.

Article 7 (Rights and Obligations of Data Subjects and Methods of Exercise)

Rights and Obligations of Data Subjects
Data subjects may, at any time, request access to, correction or deletion of, and suspension of processing of their personal information held by the Company. However, the Company may refuse or restrict such requests in any of the following cases:

Where there are special provisions in laws or where it is unavoidable to comply with legal obligations;
Where there is a risk of harm to the life or body of another person, or of unreasonable infringement upon the property or other interests of another person;
Where it is difficult to perform the contract, such as where the services agreed upon with the data subject cannot be provided without processing the personal information, and the data subject has not clearly expressed his/her intention to terminate such contract.

Method and Procedure for Exercising Rights
1. A data subject who wishes to request access to his/her personal information may contact the Personal Information Protection Officer set forth in Article 10 by email or other means, and the Company shall take measures without delay.
2. The Company shall take such measures within ten (10) days unless there are justifiable reasons otherwise, and where there are grounds for refusal or restriction, shall inform the data subject of such grounds and the method of objection.
3. Where a data subject requests access to his/her personal information, the Company may verify the identity of the data subject through identification documents or similar means.

Article 7 (Rights and Obligations of Data Subjects and Methods of Exercise)

Rights and Obligations of Data Subjects
Data subjects may, at any time, request access to, correction or deletion of, and suspension of processing of their personal information held by the Company. However, the Company may refuse or restrict such requests in any of the following cases:

Where there are special provisions in laws or where it is unavoidable to comply with legal obligations;
Where there is a risk of harm to the life or body of another person, or of unreasonable infringement upon the property or other interests of another person;
Where it is difficult to perform the contract, such as where the services agreed upon with the data subject cannot be provided without processing the personal information, and the data subject has not clearly expressed his/her intention to terminate such contract.

Method and Procedure for Exercising Rights
1. A data subject who wishes to request access to his/her personal information may contact the Personal Information Protection Officer set forth in Article 10 by email or other means, and the Company shall take measures without delay.
2. The Company shall take such measures within ten (10) days unless there are justifiable reasons otherwise, and where there are grounds for refusal or restriction, shall inform the data subject of such grounds and the method of objection.
3. Where a data subject requests access to his/her personal information, the Company may verify the identity of the data subject through identification documents or similar means.

Article 8 (Withdrawal of Consent to Collection, Use, and Provision of Personal Information)
Every data subject may withdraw his/her consent to the collection, use, or provision of personal information at any time. Upon receiving a withdrawal request via email or other means addressed to the Personal Information Protection Officer set forth in Article 10, the Company shall immediately take necessary measures such as the deletion of personal information. The Company shall notify the data subject without delay once such withdrawal and destruction measures have been taken.

Article 9 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information:

1. Technical Measures

1) Implementation of access authorization management and access control measures, including restricting access rights to personal information to the minimum number of personnel;

2) Encrypted storage and transmission of personal information, installation of security programs, and periodic updates thereof;

3) Operation of security solutions against external intrusions such as hacking.

2. Administrative Measures

1) Regular training of personnel handling personal information;

2) Conducting handovers of duties of personal information handlers in a secure manner, and managing and supervising compliance with personal information protection laws upon onboarding and offboarding;

3) Establishment of internal management plans and conducting of self-inspections.

3. Physical Measures
1) Implementation of physical access control measures over the spaces in which personal information processing systems are installed.

Article 9 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information:

1. Technical Measures

1) Implementation of access authorization management and access control measures, including restricting access rights to personal information to the minimum number of personnel;

2) Encrypted storage and transmission of personal information, installation of security programs, and periodic updates thereof;

3) Operation of security solutions against external intrusions such as hacking.

2. Administrative Measures

1) Regular training of personnel handling personal information;

2) Conducting handovers of duties of personal information handlers in a secure manner, and managing and supervising compliance with personal information protection laws upon onboarding and offboarding;

3) Establishment of internal management plans and conducting of self-inspections.

3. Physical Measures
1) Implementation of physical access control measures over the spaces in which personal information processing systems are installed.

Article 10 (Personal Information Protection Officer and Grievance Handling Services)
In order to protect the personal information of data subjects and to handle complaints relating to personal information, the Company has designated a Personal Information Protection Officer as follows:

Personal Information Protection Officer
1. Name: JaeHong Park
2. Position: CEO
3. Email: contact@unastella.com
4. Phone: +82 70-4015-3696

For reports or consultations regarding other personal information infringements, data subjects may contact the following organizations:

Personal Information Dispute Mediation Committee: 1833-6972 (no area code required) (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (no area code required) (privacy.kisa.or.kr)
Supreme Prosecutors’ Office, Cyber Investigation Division: 1301 (no area code required) (www.spo.go.kr)
National Police Agency, Cyber Crime Report System: 182 (no area code required) (ecrm.police.go.kr)

Article 10 (Personal Information Protection Officer and Grievance Handling Services)
In order to protect the personal information of data subjects and to handle complaints relating to personal information, the Company has designated a Personal Information Protection Officer as follows:

Personal Information Protection Officer
1. Name: JaeHong Park
2. Position: CEO
3. Email: contact@unastella.com
4. Phone: +82 70-4015-3696

For reports or consultations regarding other personal information infringements, data subjects may contact the following organizations:

Personal Information Dispute Mediation Committee: 1833-6972 (no area code required) (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (no area code required) (privacy.kisa.or.kr)
Supreme Prosecutors’ Office, Cyber Investigation Division: 1301 (no area code required) (www.spo.go.kr)
National Police Agency, Cyber Crime Report System: 182 (no area code required) (ecrm.police.go.kr)

Article 11 (Changes to the Privacy Policy)

Any addition, deletion, or modification of the contents of this Privacy Policy shall be announced through the notice section of the Unastella website prior to the effective date of such changes.

Article 11 (Changes to the Privacy Policy)
Any addition, deletion, or modification of the contents of this Privacy Policy shall be announced through the notice section of the Unastella website prior to the effective date of such changes.

Effective Date: April 20, 2026