Content Bridge Co., Ltd. (hereinafter referred to as the “Company”) installs and operates video surveillance devices in compliance with the Personal Information Protection Act, and through this policy, informs how such video information is used and managed by the Company.

1. Basis and Purpose of Installation of Video Surveillance Devices

Pursuant to Article 25, Paragraph 1 of the Personal Information Protection Act, the Company installs and operates video surveillance devices for the following purposes:

•   - Safety of employees and facilities, including fire prevention
•   - Crime prevention and cooperation with investigative agencies

2. Number, Location, and Scope of Video Surveillance Devices

Location	Installation Area	Coverage	Number of Devices
Headquarters	Main entrance of the office	Office entrance and server room entrance	1
Server room	Server room entrance and interior	Server room entrance and interior	1

• *As of April 2025

3. Personal Video Information Protection Officer

The Company’s Chief Privacy Officer (CPO) concurrently serves as the Personal Video Information Protection Officer.

4. Responsible Department and Authorized Personnel

Department in charge: Information Security Team, Content Bridge Co., Ltd. Authorized personnel: Designated staff members of the Information Security Team

5. Recording Time, Retention Period, Storage Location, and Processing Method

Recording time: 24 hours

Retention period: 60 days from the date of recording

Storage location: Inside the headquarters of Content Bridge Co., Ltd.

Processing method: Usage, provision to third parties, disposal, and access requests of personal video information are recorded and managed. Upon expiration of the retention period, the data is permanently deleted using an irreversible method.

6. Outsourcing of Installation and Management of Video Surveillance Devices

The Company outsources the installation and management of video surveillance devices to KT Telecop Co., Ltd. In accordance with relevant laws, the Company specifies necessary matters in the outsourcing contract to ensure the safe management of personal video information.

7. Method and Location for Accessing Personal Video Information

Method: If you wish to access personal video information, you must contact the managing department in advance and visit the Company. Access location & contact: Information Security Team, Content Bridge Co., Ltd. (Tel: +82-2-562-0694)

8. Measures Regarding Requests for Viewing Personal Video Information

You may request to view, confirm, or delete your personal video information. However, such requests are limited to personal video information clearly related to you and necessary to protect your urgent interests such as life, body, or property.

The Company will take necessary actions without delay when such a request is made. However, access may be denied in the following cases:

•   - If it significantly hinders a criminal investigation, prosecution, or trial
•   - If the retention period has expired and the information has been deleted
•   - If the request poses a serious risk of infringing another person’s privacy
•   - If there is another legitimate reason to reject the request

For reports or consultations regarding personal information infringement, you may contact the following organizations:
  - Personal Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
  - Information Protection Certification Committee: www.eprivacy.or.kr / 1899-4134
  - Supreme Prosecutors’ Office Cybercrime Investigation Division: www.spo.go.kr / 1301 (without area code)
  - Police Cyber Terror Response Center: www.cyber.go.kr / 182 (without area code)

9. Security Measures for Video Information

The Company strictly prohibits arbitrary collection of video information beyond the stated purpose or the use of audio recording functions. Access to stored video data is restricted to authorized personnel only and is managed in a controlled area.

The Company treats recorded video information as confidential or higher, prohibiting unauthorized viewing, playback, or external release. Any access, third-party provision, or deletion requests are logged and managed. Upon expiration of the retention period, the data is irreversibly deleted.

10. Notification of Changes to the Operation and Management Policy

This policy was enacted on April 11, 2025. Any additions, deletions, or changes resulting from updates in laws, policies, or security technologies will be announced on the Company’s website at least 7 days prior to enforcement.

Date of Announcement: April 11, 2025

Effective Date: April 11, 2025