Privacy Policy

CTNS Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea (PIPA) and related laws to protect the freedom and rights of data subjects, and processes personal information lawfully and manages it securely. In accordance with Article 30 of PIPA, the Company establishes and discloses this privacy policy to inform data subjects of the procedures and standards for processing personal information and to handle related grievances promptly.

This policy applies to the following services operated by the Company.

• Company website — www.myctns.com
• Celly, the battery pack design service — celly.myctns.com

The Company’s services are intended for business customers, and the Company does not collect personal information from children under the age of 14.

The Company processes personal information for the following purposes. Personal information is not used beyond these purposes; if a purpose changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of PIPA.

The Company website can be used without creating an account; personal information is collected only when an inquiry is submitted. All items are entered directly by the data subject.

AI chat conversations are not stored on the Company’s servers; content organized during the chat is received only when the user transfers it to the inquiry form and submits it. However, chat content is transmitted to Google LLC to generate AI responses (see Article 7).

Design specification data is not in itself personal information, but as it is managed in combination with a member account or inquirer contact details, it is covered by this policy.

IP address, access timestamps and logs, and browser/device information may be generated and collected automatically while using the services. Where advertising or analytics tools are used, advertising click identifiers (GCLID, fbclid, etc.) and traffic source (UTM) information may be collected only with the data subject’s consent (see Articles 11 and 12).

The Company processes and retains personal information within the retention period required by law or agreed to at the time of collection.

The Company processes personal information only within the scope specified in Article 2 and provides it to third parties only where Article 17 or 18 of PIPA applies, such as with the data subject’s consent or under specific legal provisions.

The Company does not currently provide personal information to any third party. Processing outsourcing and cross-border transfers are described in Articles 6 and 7.

The Company outsources the following processing tasks for smooth handling of personal information.

Retention under outsourcing lasts until the outsourcing contract ends or the retention period in Article 4 expires. When concluding outsourcing contracts, the Company specifies, per Article 26 of PIPA, prohibitions on processing beyond the outsourced purpose, technical and administrative safeguards, restrictions on sub-outsourcing, supervision of the processor, and liability for damages, and supervises whether the processor handles personal information securely.

If the outsourced tasks or processors change, the Company will disclose the change through this privacy policy without delay.

To use cloud infrastructure essential to providing the services (processing outsourcing and storage), the Company transfers personal information abroad as follows under Article 28-8(1)3 of PIPA and discloses this through this policy.

Where advertising and analytics tools (Google Analytics, Google Ads, Meta advertising) are used, behavioral data may be transferred abroad as follows, only if the data subject consents via the cookie consent banner described in Article 11. No advertising or analytics data is transferred before consent.

Data subjects may refuse cross-border transfers. You may use the inquiry form or email instead of the AI chat, and transfers for advertising and analytics do not occur without consent. However, refusing transfers essential to service infrastructure (hosting, database) may limit your use of the services. Refusal requests may be made to the contact in Article 13.

The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or fulfillment of the processing purpose.

If personal information must be preserved under other laws despite the expiration of the agreed retention period or fulfillment of the purpose, it is moved to a separate database or stored in a separate location.

• Electronic files — deleted using technical methods that make the records unrecoverable
• Paper records — shredded or incinerated

Data subjects may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
5. Withdraw consent

Rights may be exercised in writing or by email (see the contact in Article 13), and the Company will act without delay. If a data subject requests correction or deletion of an error, the Company will not use or provide the personal information concerned until the correction or deletion is completed.

Rights may be exercised through an agent, such as a legal representative or an authorized person. In that case, a power of attorney in the form prescribed by the Notification on Personal Information Processing Methods (Annex Form No. 11) must be submitted.

The Company does not make fully automated decisions that materially affect the rights or obligations of data subjects. Celly’s AI design output is used only as reference material for consultation and quotation.

The Company takes the following measures to keep personal information secure.

• Administrative — establishing and implementing an internal management plan, minimizing the number of staff handling personal information, and regular training
• Access control — granting access to personal information only to designated staff, with differentiated permissions
• Encryption in transit — HTTPS is applied across all services to protect information in transit
• Password protection — Celly member passwords are stored using irreversible one-way encryption (hashing) and cannot be read even by staff
• Physical — relying on the physical access controls of internationally certified cloud data centers

The cookies the Company currently sets and operates directly are as follows.

When you play YouTube videos embedded on the website, Google (YouTube) may set cookies, which are governed by Google’s privacy policy.

Cookies for analytics or advertising will be introduced only with prior consent via a cookie consent banner, and are not set before the data subject consents. Consent can be changed or withdrawn at any time.

You can allow or block cookies through your web browser settings (e.g., Chrome — Settings → Privacy and security → Cookies). Blocking functional cookies may limit some features, such as language preference and login.

The Company does not currently collect or use behavioral data for personalized advertising. If advertising and analytics tools are introduced, they will operate as follows, and data will be collected only if the data subject consents via the cookie consent banner in Article 11.

Data subjects can refuse the collection of behavioral data or block personalized advertising as follows.

• Refuse or withdraw advertising consent at any time in the cookie consent banner
• Turn off Google ad personalization — https://myadcenter.google.com
• Block cookies in your browser settings (see Article 11)

The Company designates the following privacy officer to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects. Requests for access to personal information are also received and handled by the contact below.

Data subjects may direct all privacy-related inquiries, complaints, and requests for remedies arising from the use of the Company’s services to the privacy officer. The Company will respond and act without delay.

Data subjects may apply to the following Korean institutions for dispute resolution or counseling regarding personal information infringement.

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35 (access), 36 (correction/deletion), or 37 (suspension of processing) of PIPA may file an administrative appeal under the Administrative Appeals Act.

This privacy policy applies from August 29, 2026. If content is added, deleted, or amended, the Company will give notice on the website at least 7 days before the change takes effect (30 days for changes materially affecting data subjects’ rights).

• Announced: August 29, 2026
• Effective: August 29, 2026
• Version: v1.0