Thoth (hereinafter referred to as “the Company”) establishes and publicly announces the following personal information processing guidelines in accordance with Article 30 of the Personal Information Protection Act, to protect the personal information of the information subject and to handle related complaints swiftly and smoothly.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed will not be used for any purposes other than the following, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• 1. To provide responses to customer inquiries on the website and manage the current status.

Article 2 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the retention and use period specified by law or the period agreed upon when collecting personal information from the information subject

② The processing and retention period are as follows:

• 1. 1. Within one year from the date of receipt of customer inquiries on the website.

Article 3 (Provision of Personal Information to Third Parties) No relevant information

Article 4 (Outsourcing of Personal Information Processing) No relevant information

Article 5 (Rights, Obligations, and Methods of Exercising Information Subject Rights)

① The information subject may exercise the following personal information protection rights against the Company at any time:

• 1. Request to view personal information
• 2. Request for correction if there are errors
• 3. Request for deletion
• 4. Request to stop processing

② Rights under paragraph 1 may be exercised in writing, by phone, or by email to the Company, and the Company will take prompt action in response.

③ If the information subject requests correction or deletion of personal information due to errors, the Company will not use or provide the personal information until the correction or deletion is completed.

④ Rights under paragraph 1 may also be exercised through a legal representative or a person authorized by the information subject. In this case, a power of attorney in accordance with the Personal Information Protection Act Enforcement Rule, Form No. 11, must be submitted.

⑤ The information subject must not infringe upon the personal information or privacy of themselves or others while violating relevant laws, including the Personal Information Protection Act.