**Article 1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those listed below, and where the purpose of use is changed, the Company will take necessary measures, including obtaining separate consent in accordance with Article 18 of PIPA.

• Project Inquiry and Consultation : Identifying inquirers, confirming inquiry content, providing replies, and managing consultation history.
• Job Application Intake : Identifying applicants, reviewing application content, conducting the hiring process, and communicating results.
• Contract Execution and Performance : Concluding service agreements, processing payments and settlements, and issuing tax invoices.

**Article 2. Items of Personal Information Processed

The Company processes the following items of personal information:

• Required (Website Inquiry Form) : Name, email address, purpose of inquiry, inquiry content.
• Optional (Website Inquiry Form) : Budget range.
• Required (Job Application Form) : Name, email address, application content, and information about the posting applied for.
• Automatically Collected : IP address, cookies, browser type, visit date and time.

**Article 3. Processing and Retention Period of Personal Information

The Company processes and retains personal information within the retention and use period prescribed by law or agreed to by the data subject at the time of collection.

• Project inquiry and consultation: 3 years from the date of inquiry.
• Job applications: destroyed without delay once the hiring process concludes, and in any case within 180 days of receipt.
• Contract execution and performance: 5 years from the date of contract termination (Article 64 of the Commercial Act).
• Tax invoices and transaction records: 5 years (Article 85-3 of the Framework Act on National Taxes).
• Website visit records: 3 months (Article 15-2 of the Protection of Communications Secrets Act).

**Article 4. Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only when the data subject has given consent or in cases falling under Articles 17 and 18 of PIPA.

The Company currently does not provide personal information to any third parties.

**Article 5. Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise

• The data subject may exercise the following rights related to personal information protection at any time:
  • Right to request access to personal information
  • Right to request correction in the event of errors
  • Right to request deletion
  • Right to request suspension of processing
• Rights may be exercised in writing, by email, or through similar means, and the Company will take action without delay.
• If a data subject requests correction or deletion of personal information due to errors, the Company will not use or provide such personal information until the correction or deletion is completed.

**Article 6. Procedures and Methods for Destroying Personal Information

• Destruction Procedure : When personal information becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose, the Company destroys such personal information without delay.
• Destruction Methods:
  • Electronic files: Permanently deleted in a manner that prevents recovery or reproduction.
  • Paper documents: Shredded or incinerated.

**Article 7. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of PIPA, the Company implements the following technical, administrative, and physical measures to ensure the security of personal information:

• Administrative Measures : Establishment and implementation of an internal management plan; minimization and training of personnel handling personal information.
• Technical Measures : Access control for personal information processing systems; application of encryption (SSL/TLS); installation and updating of security software.
• Physical Measures : Storage of documents and auxiliary storage media containing personal information in locked facilities.

**Article 8. Installation, Operation, and Refusal of Cookies

The Company uses cookies to provide individually customized services to users. Cookies are small pieces of information sent by the server operating the website to the user's browser, which are stored on the user's hard disk.

• Purpose of Cookie Use : Service improvement through analysis of visit frequency and areas of interest.
• Analytics Tool Used : The Company uses Google Analytics 4, which stores analytics cookies in the user's browser.
• Advertising Use : The Company sets advertising storage and use to denied, and never uses advertising identifiers or ad personalization signals.
• For users accessing from the European Economic Area, the United Kingdom, or Switzerland, no analytics cookies are stored; only aggregated information without identifiers is collected.
• How to Refuse Cookies : Users can choose to allow or block cookies in their browser settings. Refusing cookies does not restrict use of the website:
  • Chrome : Settings → Privacy and Security → Cookies and Other Site Data
  • Safari : Preferences → Privacy
  • Firefox : Settings → Privacy & Security

**Article 9. Entrustment of Personal Information Processing

To provide the service smoothly, the Company entrusts the processing of personal information as follows:

• Vercel Inc. : Website hosting, serverless execution, storage of inquiry data, automated bot prevention.
• Google LLC : Website usage analytics (Google Analytics 4), web font delivery, embedded video playback (when such content is published).
• Resend, Inc. : Delivery of inquiry notification emails.
• BunnyWay d.o.o. : Image and video content delivery (CDN) and video streaming.
• Volentio JSD Limited (jsDelivr) : Web font delivery (open-source CDN).

In accordance with Article 26 of PIPA, entrustment contracts specify the prohibition of processing personal information beyond the purpose of the entrusted work, technical and administrative safeguards, restrictions on re-entrustment, supervision of the processor, and liability including damages. Any change to the entrusted work or to the processors will be disclosed through this Privacy Policy.

**Article 10. Overseas Transfer of Personal Information

Pursuant to Article 28-8(1)3 of PIPA, the Company transfers personal information overseas (entrustment and storage) to the extent necessary to perform its contracts and to enhance the convenience of data subjects, and discloses the matters set out in Article 28-8(2) as follows:

Vercel Inc.

• Items transferred : Fields submitted through the inquiry and job application forms, IP address, browser information.
• Country, timing, and method : United States / at the time the user accesses the website or submits a form / transmission over encrypted communication (HTTPS).
• Purpose of use : Website hosting, serverless execution, storage of inquiry data, automated bot prevention.
• Retention and use period : Same as the retention periods in Article 3.
• Contact : https://vercel.com/legal/privacy-policy

Google LLC

• Items transferred : Online identifiers set through cookies, IP address, browser information, page view records.
• Country, timing, and method : United States / at the time the user accesses the website / transmission over encrypted communication (HTTPS).
• Purpose of use : Website usage analytics, web font delivery, embedded video playback (when such content is published).
• Retention and use period : 14 months from collection.
• Contact : https://policies.google.com/privacy

Resend, Inc.

• Items transferred : Name, email address, inquiry or application content.
• Country, timing, and method : United States / at the time the user submits a form / transmission over encrypted communication (HTTPS).
• Purpose of use : Delivery of inquiry notification emails.
• Retention and use period : Until the purpose of delivery is achieved.
• Contact : https://resend.com/legal/privacy-policy

BunnyWay d.o.o.

• Items transferred : IP address, browser information.
• Country, timing, and method : Slovenia / at the time the user requests an image or video / transmission over encrypted communication (HTTPS).
• Purpose of use : Image and video content delivery and video streaming.
• Retention and use period : Until the purpose of delivery is achieved.
• Contact : https://bunny.net/privacy

Volentio JSD Limited (jsDelivr)

• Items transferred : IP address, browser information.
• Country, timing, and method : United Kingdom / at the time the user opens a page (web font request) / transmission over encrypted communication (HTTPS).
• Purpose of use : Korean web font delivery (open-source CDN).
• Retention and use period : Until the purpose of delivery is achieved.
• Contact : https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net

How to refuse the transfer, and the effect of refusal

Data subjects may request refusal of overseas transfer at hypt@hypt.design. However, because these transfers are essential to operating the website and responding to inquiries, refusal may restrict use of the website or submission of inquiries. Transfers for analytics purposes (Google LLC) may be refused individually by blocking cookies in the browser as described in Article 8, without any restriction on use of the website.

**Article 11. Personal Information Protection Officer

The Company designates the following Personal Information Protection Officer to oversee personal information processing and to handle complaints and remedies related to personal information processing:

• Name : Sangnyeon Kim
• Position : CEO
• Contact : +82-2-332-3477 / hypt@hypt.design

**Article 12. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation with the following organizations to seek remedies for personal information infringement:

• Personal Information Dispute Mediation Committee : 1833-6972 / kopico.go.kr
• Personal Information Infringement Report Center : 118 / privacy.kisa.or.kr
• Cyber Investigation Division, Supreme Prosecutors' Office : 1301 / spo.go.kr
• Cyber Investigation Bureau, National Police Agency : 182 / ecrm.cyber.go.kr

**Article 13. Changes to the Privacy Policy

This Privacy Policy is effective as of August 31, 2026. Previous versions of the Privacy Policy can be reviewed below.

**Company Information

• Company Name : HYPT Inc. (Korean legal name: (주)하잎트)
• Representative : Sangnyeon Kim
• Business Registration Number : 203-81-43529
• Address : #C-417, 128 Beobwon-ro, Songpa-gu, Seoul 05854, Republic of Korea
• Phone : +82-2-332-3477
• Email : hypt@hypt.design