Privacy Policy.

Preamble

exorenal, Inc. (the "Company") complies with applicable data protection laws, including the Personal Information Protection Act of Korea, and establishes and discloses this Privacy Policy (the "Policy") to protect the personal information of data subjects who use the website operated by the Company at exorenal.com (the "Site").

Article 1 (Data Controller)

1.1 The data controller under this Policy is exorenal, Inc., 101 W Dickman St, Suite 900, Baltimore, MD 21230, USA.

1.2 The Company's R&D lab at 205-15 Gasan Digital 1-ro, Geumcheon-gu, Seoul, Korea may process personal information on behalf of the Company.

Article 2 (Personal Information Processed)

2.1 The Company processes only the following personal information that a data subject provides directly through the contact form on the Site:
(a) Required: name, email address and message;
(b) Optional: organization and inquiry type.

2.2 For operation and security of the Site, the hosting service provider may automatically generate and retain access logs, including IP address, browser type and time of access.

2.3 The Company does not use cookies for advertising or behavioral tracking. The Site stores only the display language selected by the data subject in the data subject's browser.

Article 3 (Purposes of Processing)

3.1 The Company processes personal information only for the following purposes and does not use it for any other purpose:
(a) to confirm and respond to inquiries;
(b) to arrange product demonstrations, materials or meetings requested by the data subject; and
(c) to communicate with the data subject in follow-up to the foregoing.

3.2 The Company does not sell personal information or use it for advertising.

Article 4 (Retention Period)

4.1 The Company destroys personal information without delay once the purpose of processing has been achieved, and in any case does not retain it for more than [three (3) years] from receipt of the inquiry.

4.2 Notwithstanding Section 4.1, where applicable law requires retention, the Company retains the information for the period required by such law.

Article 5 (Destruction)

5.1 The Company destroys personal information without delay when the retention period expires or the purpose of processing is achieved.

5.2 Electronic records are permanently deleted in a manner that prevents recovery, and paper records are shredded or incinerated.

Article 6 (Provision to Third Parties)

The Company does not provide personal information to third parties except with the consent of the data subject or where specifically required by law.

Article 7 (Outsourcing and International Transfer)

7.1 The Company outsources the processing of personal information as follows:
(a) Google LLC (Google Workspace): receipt and storage of email; and
(b) [Hosting service provider]: hosting of the Site and retention of access logs.

7.2 Because the Company operates in the United States and the Republic of Korea, personal information may be processed outside the data subject's country, including in the United States where the processors' facilities are located. The items, purposes and retention period are as set out in Articles 2 through 4.

Article 8 (Rights of Data Subjects)

8.1 A data subject may at any time request access to, correction of, deletion of, or suspension of processing of his or her personal information.

8.2 Requests under Section 8.1 may be made in writing or by email to the contact set out in Article 11. The Company will act on and respond to such requests within the period prescribed by applicable law and in any event within thirty (30) days of receipt.

8.3 The Company may verify that the person making a request is the data subject or a duly authorized representative.

Article 9 (Security Measures)

The Company limits access to personal information to the minimum personnel necessary and takes measures necessary to ensure its security, including encryption in transit (HTTPS) and account security controls.

Article 10 (Children)

The Site is not directed at children under the age of fourteen (14), and the Company does not knowingly collect personal information from children.

Article 11 (Privacy Officer)

The Company designates the following Privacy Officer to oversee the processing of personal information and to handle related inquiries and complaints:
Name and title: [Name / Title]
Contact: info@exorenal.com

Article 12 (Remedies)

Data subjects in Korea may apply to the following bodies for dispute resolution or counseling regarding infringement of personal information:
(a) Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr);
(b) Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr);
(c) Supreme Prosecutors' Office: 1301 (www.spo.go.kr); and
(d) Korean National Police Agency: 182 (ecrm.police.go.kr).

Article 13 (Amendments)

If the Company amends this Policy, it will post notice of the amendment on the Site at least seven (7) days before the amendment takes effect.

Addendum

This Policy takes effect on [Effective date].
Revision history: established [Effective date].