[Privacy Policy] CellBion Co., Ltd. (hereinafter the "Company") values the personal information of its users and safely manages it in compliance with relevant laws, including the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Protection of Communications Secrets Act, and the Telecommunications Business Act.

The Company's Privacy Policy covers the following:

1. Personal information collected and how it is collected
The Company collects the following personal information for IR inquiries, board operation, and consultation purposes.
- Name, mobile phone number, email address, etc.

In addition, the following information may be automatically generated and collected during the use of the service or business processing.
- Browser type and OS, visit records (IP address, access time), cookies

The Company may request additional optional information for better service. However, users are not required to provide optional information if they do not wish to. In addition, additional information may be requested for the use of certain services that require it. In this case as well, the information provided will not be used for any purpose other than the use of the relevant service and the purposes stated in advance.

2. Purpose of collecting and using personal information
The purpose of collecting personal information is to secure smooth communication channels and provide quality, customized service. "Personal information" refers to information that can identify an individual, such as name and resident registration number, and includes information that, when combined, can identify an individual, such as name and address, as well as member information including ID and password used to identify members. Members' personal information is not disclosed without their prior consent, and the Company uses collected personal information for the following purposes.
- Handling inquiries or complaints, delivering notices, preventing and sanctioning actions that interfere with the smooth operation of the service (including account theft and fraudulent use), identifying access frequency, and compiling statistics on members' use of the service.

3. Consent to the collection of personal information
The Company obtains consent from members for the collection of their personal information.
By selecting [I agree to the collection and use of personal information] and clicking the [Submit] button in connection with an inquiry, you are deemed to have consented to the collection and use of your personal information.
Users may refuse to consent to the collection of the minimum necessary information (name, email, phone number, etc.), in which case the use of related services may be restricted.

4. Sharing and provision of collected personal information
The Company uses users' personal information within the scope specified in this Privacy Policy and, in principle, does not use it beyond that scope or share it with third parties without users' prior consent.

However, the following cases are exceptions.
- Where the user has agreed in advance to disclosure
- Where requested by a court, dispute mediation body, investigative agency, or other legal entity in connection with a dispute or investigation
- Where required by law, i.e., where a relevant government agency requests it through lawful procedures under applicable laws
- Where used for business-related contact with members

5. Outsourcing of personal information handling
The Company outsources personal information handling as follows for smooth business operations, and specifies matters necessary to ensure personal information is safely managed under outsourcing agreements in accordance with relevant laws.

6. Period of processing and retention of personal information
Personal information is processed and retained within the retention/use period consented to at the time of collection, and is, in principle, destroyed without delay once the purpose of processing has been achieved.

7. Procedures and methods for destroying personal information
Personal information is, in principle, destroyed without delay once the purpose of processing has been achieved. The Company's procedures and methods for destroying personal information are as follows.

a. Destruction procedure
- Information entered by a data subject is transferred to a separate DB (or, in the case of paper, a separate filing cabinet) after its purpose has been achieved, stored for a certain period in accordance with internal policy and applicable laws (see "6. Period of processing and retention of personal information"), and then destroyed.
- Such personal information is not used for any purpose other than retention, except as required by law.

b. Destruction method
- Personal information printed on paper is destroyed by shredding or incineration.
- Personal information stored in electronic file form is deleted using technical methods that prevent the records from being reproduced.

8. Rights and obligations of data subjects and how to exercise them
Users may at any time view or modify their registered personal information and may also request deletion or suspension of processing. If you wish to request deletion or suspension of processing, please contact the Personal Information Protection Officer in writing, by phone, or by email, and we will take action without delay.

9. Measures to ensure the security of personal information
The Company takes the following protective measures to ensure security so that personal information is not lost, stolen, leaked, altered, or damaged while being processed.

a. Password encryption
Passwords set while using the Web and App are encrypted for storage and management and are known only to the user; personal information can only be checked or changed by the user who knows the password.

b. Countermeasures against hacking, etc.
The Company does its best to prevent personal information from being leaked or damaged due to hacking or computer viruses. To prepare for potential damage to personal information, we regularly back up data, use the latest anti-virus software to prevent users' personal information or data from being leaked or damaged, and use encrypted communications to safely transmit personal information over the network. We also control unauthorized external access using an intrusion prevention system and make every possible technical effort to secure the system.

c. Operation of a dedicated personal information protection organization
Through an in-house dedicated personal information protection organization, the Company checks compliance with this Privacy Policy and works to promptly correct any issues found. However, the Company is not liable for damages arising from the user's own negligence or from incidents outside the Company's control, provided the Company has fulfilled its personal information protection obligations.

10. Reporting and dispute resolution related to personal information
If you need to report a personal information infringement or need consultation, please contact the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center. In addition, if you have suffered financial or emotional damage due to a personal information infringement, you may apply for damage relief to the Personal Information Dispute Mediation Committee.

Personal Information Infringement Report Center
- Tel: +82-02-405-5114 / 1336 (without area code)
- URL: http://www.cyberprivacy.or.kr
- Email: privacy@kisa.or.kr
Effective date: January 1, 2026