BUMJIN INDUSTRIES (the “Company Website”) establishes and discloses the following Privacy Policy in accordance with the Personal Information Protection Act to protect users’ personal information and rights, and to promptly and smoothly handle any grievances related to personal information.

If the Company revises this Privacy Policy, such changes will be announced through a notice on the website (or through individual notification).

○ This Policy shall take effect on February 11, 2026.

1. Purpose of Processing Personal Information

The Company Website processes personal information for the following purposes. The personal information processed will not be used for purposes other than those stated below. If the purpose of use changes, prior consent will be obtained.

A. Handling Product Inquiries
Personal information is processed for the purpose of verifying the applicant’s identity and notifying the results of the inquiry.

B. Provision of Goods or Services
Personal information is processed for the purpose of providing services.

2. Items of Personal Information Processed

The Company Website processes the following personal information items:

A. Product Inquiry Consultation

Required items: Company name, Name, Telephone number, Email address

3. Rights and Obligations of the Data Subject and Methods of Exercise

Users, as data subjects, may exercise the following rights:

A. The data subject may exercise the following rights related to personal information protection at any time with respect to the Company Website:

Request access to personal information

Request correction in case of errors

Request deletion

Request suspension of processing

B. The exercise of rights under Paragraph A may be made in writing, by email, or by fax to the Company Website in accordance with Form No. 8 of the Enforcement Rules of the Personal Information Protection Act, and the Company Website will take prompt action without delay.

C. If the data subject requests correction or deletion of personal information due to errors, the Company Website will not use or provide the relevant personal information until the correction or deletion is completed.

D. The rights under Paragraph A may be exercised through a legal representative or an authorized agent. In this case, a power of attorney in accordance with Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

4. Destruction of Personal Information

In principle, the Company Website will promptly destroy personal information once the purpose of processing has been achieved. The procedures, deadlines, and methods of destruction are as follows:

A. Destruction Procedure
Information entered by users will be transferred to a separate database (or separate documents in the case of paper records) after the purpose has been achieved and stored for three (3) years in accordance with internal policies and relevant laws (in the case of technical support requests), or destroyed immediately (in the case of training applications and online consultations). Personal information transferred to a separate database will not be used for other purposes unless required by law.

B. Destruction Deadline
If the retention period of personal information has expired, the personal information will be destroyed within five (5) days from the date the retention period ends. If the personal information becomes unnecessary due to achievement of the processing purpose, termination of the relevant service, or closure of the business, it will be destroyed within five (5) days from the date it is deemed unnecessary.

C. Destruction Method
Information in electronic file form will be destroyed using technical methods that render the records irrecoverable.

5. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company Website implements the following technical, administrative, and physical measures to ensure security:

A. Regular Internal Audits
Regular internal audits (once a year) are conducted to ensure the stability and security of personal information handling.

B. Minimization and Training of Personnel Handling Personal Information
The Company designates specific personnel to handle personal information and limits access to authorized staff only, thereby minimizing exposure and implementing management measures.

C. Technical Measures Against Hacking, etc.
To prevent leakage or damage of personal information due to hacking or computer viruses, the Company installs security programs, performs periodic updates and inspections, and operates systems in controlled areas with technical and physical monitoring and access restrictions.

D. Access Control for Unauthorized Persons
Access control procedures are established and operated for physical storage locations where personal information is kept.

6. Personal Information Protection Officer and Contact Information

You may report any complaints related to personal information protection arising from the use of the supplier’s services to the Personal Information Protection Officer or the relevant department. The supplier will respond promptly and sufficiently to users’ reports.

Personal Information Protection Officer
Tel: +82-31-677-0033

For reporting or consultation regarding other personal information infringements, please contact the following organizations:

Personal Information Dispute Mediation Committee (www.1336.or.kr
/ 1336)

Korea Information Security Mark Certification Committee (www.eprivacy.or.kr
/ +82-2-580-0533~4)

Supreme Prosecutors’ Office Advanced Crime Investigation Division (http://www.spo.go.kr
/ +82-2-3480-2000)

National Police Agency Cyber Terror Response Center (www.ctrc.go.kr
/ +82-2-392-0330)

7. Protection of Personal Information of Children Under 14

Children under the age of 14 must obtain consent from their legal representative before registering as members.

Legal representatives may request the Company at any time to access, correct, partially delete, or withdraw consent regarding the child’s personal information, and the Company shall take necessary measures without delay in response to such requests.

8. Miscellaneous

This Privacy Policy does not apply to any collection of personal information by websites linked to this site.

Date of Announcement: February 11, 2026

Effective Date: February 11, 2026