Barreleye Inc. (“Barreleye,” “we,” “us,” or “our”) owns and operates its websites, including, without limitation, www.barreleye.co.kr (collectively, the “Websites”). Through the Websites, Barreleye provides various online services and makes information regarding its products and services available to visitors and users of the Websites (“you,” “your,” or “Users”).

Barreleye recognizes the importance of protecting the privacy and personal information of its Users. We are committed to handling personal information responsibly and in accordance with this Privacy Policy (the “Privacy Policy”) and applicable laws and regulations.

This Privacy Policy may be amended from time to time to reflect changes in applicable laws, regulations, regulatory requirements, or Barreleye’s internal policies and business practices. Where required by applicable law, Barreleye will provide notice of any material changes to this Privacy Policy in the manner and within the period prescribed by applicable laws and regulations.

Article 1. Categories of Personal Information Processed

Barreleye may collect and process the following categories of personal information in connection with the Websites, products, services, and related activities:

1. Contact Us Inquiries through the Website

• Name
• Facility or company name
• Email address
• Telephone number
• Country
• City
• Nature and details of the inquiry

2. Join Us and Recruitment Inquiries through the Website

• Name
• Email address
• Telephone number
• Curriculum vitae (CV) or résumé
• Cover letter

3. Provision of Vision Series and/or Intelligent Series Services

Required information may include:

• Name
• Facility or company name
• Email address
• Telephone number
• Country
• City
• Nature and details of the inquiry

4. Product Technical Support

• Email address

5. Product Education and Training Support

• Email address

6. Clinical Research and Product Development

• Pseudonymized medical imaging data
• Associated pseudonymized metadata

7. Information Automatically Generated or Collected During Use of the Websites or Services

• IP address
• Cookie information and other online identifiers
• MAC address, where applicable
• Service usage records
• Access and visit history
• Location information, where applicable

Article 2. Purposes of Processing Personal Information

Barreleye processes personal information only for specified and legitimate purposes. Personal information will not be used for purposes unrelated to those described below unless otherwise permitted by applicable law.

If Barreleye intends to use personal information for a purpose other than the purpose for which it was originally collected, Barreleye will take the measures required under applicable law, including, where necessary, obtaining additional consent in accordance with Article 18 of the Korean Personal Information Protection Act (“PIPA”).

Barreleye processes personal information for the following purposes:

1. Product and General Inquiries through the Website

• To receive, review, manage, and respond to inquiries concerning Barreleye, its products, or its services.

2. Recruitment and Employment Applications

• To receive and evaluate employment applications;
• To administer and manage recruitment and selection procedures;
• To provide information and notices regarding recruitment;
• To communicate with applicants regarding the status or results of the recruitment process; and
• To respond to recruitment-related inquiries.

3. Provision of Vision Series and/or Intelligent Series Services

• To provide, administer, support, and manage the applicable services.

4. Product Technical Support

• To respond to requests for technical assistance and provide technical support relating to Barreleye products.

5. Product Education and Training Support

• To provide product-related education, instruction, training, and related assistance.

6. Clinical Research and Product Development

• To conduct clinical research and to develop, evaluate, validate, test, and improve Barreleye products, technologies, and related models, as permitted by applicable law.

Article 3. Processing and Retention Periods for Personal Information

• General Retention Principle

Barreleye processes and retains personal information only for the period necessary to accomplish the purposes for which the information was collected, for the period agreed to by the relevant User or data subject, or for any longer period required or permitted under applicable laws and regulations.

When the applicable retention period expires or the purpose for processing has been fulfilled, Barreleye will handle the relevant personal information in accordance with applicable legal requirements concerning retention, deletion, or destruction.

• Applicable Retention Periods

Unless a different retention period is required by applicable law, Barreleye generally retains personal information for the following periods:

• Website Product Inquiries: Until the applicable consent is withdrawn or the information is no longer necessary for the relevant purpose.
• Website Job Applications and Recruitment: Two (2) years.
• Vision Series and/or Intelligent Series Services: Until the applicable service has ended or the information is no longer required to provide the service.
• Product Technical Support: Until the applicable consent is withdrawn or the information is no longer necessary for the relevant support purpose.
• Product Education and Training Support: Until the applicable consent is withdrawn or the information is no longer necessary for the relevant education or training purpose.
• Clinical Research and Product Development: Until completion of the development of the applicable model(s), subject to any different retention period required by applicable law, research protocol, or other applicable requirement.
• Additional Use or Provision Without Additional Consent

As a general principle, Barreleye does not use or provide personal information beyond the original purpose of processing without the consent of the data subject, except where such use or provision is permitted or required by applicable law.

When determining whether personal information may be additionally used or provided without obtaining additional consent from the data subject, Barreleye will consider the factors required under applicable law, including:

• Whether the additional use or provision is reasonably related to the original purpose for which the personal information was collected;
• Whether the additional use or provision could reasonably have been anticipated in light of the circumstances surrounding the collection and processing of the personal information and the relevant processing practices;
• Whether the additional use or provision would unfairly prejudice or infringe upon the rights or interests of the data subject; and
• Whether appropriate safeguards have been implemented to protect the personal information, including, where appropriate, pseudonymization, encryption, access controls, or other security measures.

Article 4. Entrustment of Personal Information Processing

In accordance with Article 26 of the Personal Information Protection Act, Barreleye entrusts the processing of Users’ personal information to third-party service providers for the operation of its Websites and related services as follows:

When entering into an agreement with a service provider entrusted with processing personal information, Barreleye will include the matters required under Article 26 of PIPA and other applicable laws. Such agreements may include requirements concerning limitations on processing personal information solely to the extent necessary to perform the entrusted services, implementation of appropriate technical and administrative safeguards, restrictions on further entrustment or subcontracting, Barreleye’s rights of management and supervision, and responsibility for damages or other violations.

Barreleye will appropriately manage and supervise its entrusted service providers to help ensure that personal information is processed securely and in accordance with applicable legal requirements. If there is any material change to the identity of an entrusted service provider or to the scope of the entrusted processing activities, Barreleye will disclose such change through this Privacy Policy or by other means required under applicable law.

Article 5. International Transfers of Personal Information

Barreleye may transfer, store, or otherwise process personal information outside the Republic of Korea where necessary to provide its services, operate its business, or support Users. Information concerning such international transfers is provided below.

Barreleye conducts international transfers of personal information in accordance with PIPA and other applicable laws and implements appropriate measures to protect personal information transferred outside the Republic of Korea.

Where applicable law provides a right to refuse an international transfer, Users may exercise that right by contacting Barreleye’s privacy officer or other designated privacy personnel. If a User validly refuses an international transfer, Barreleye will take reasonable steps to prevent that User’s applicable personal information from being transferred outside Korea.

However, where an international transfer is necessary for the provision or operation of a particular service, refusing the transfer may prevent Barreleye from providing some or all of that service to the User.

Article 6. Destruction of Personal Information

Barreleye will destroy personal information without undue delay when the applicable retention period has expired, the purpose for which the personal information was processed has been fulfilled, or the information is otherwise no longer required, except where continued retention is required or permitted by applicable law.

If Barreleye is required by applicable law or regulation to retain personal information after the expiration of the applicable retention period or after the original processing purpose has been fulfilled, Barreleye will retain the relevant personal information separately from other personal information, such as by transferring it to a separate database or designated storage environment, as appropriate.

Barreleye’s procedures and methods for destroying personal information are as follows:

• Destruction Procedure: Barreleye identifies the personal information or personal information files that are eligible for destruction and destroys them in accordance with its internal procedures, including obtaining approval from the person responsible for personal information protection where required.
• Electronic Records: Personal information maintained electronically will be permanently deleted using technical methods designed to prevent the information from being restored or recovered.
• Paper Records: Documents and other physical records containing personal information will be destroyed using an appropriate secure method, such as shredding or incineration, so that the information cannot reasonably be reconstructed or recovered.

Article 7. Rights and Obligations of Information Subject

1. The data subject may exercise their rights (hereinafter referred to as "exercise of rights") at any time with respect to Barreleye, including the right to access, correct, delete, suspend processing, or withdraw consent.

※ Requests for access, correction, or deletion of personal information regarding children under the age of 14 must be made directly by the child's legal guardian. For data subjects who are minors aged 14 or older, they may exercise their rights regarding their personal information either by themselves or through their legal guardian.

2. An information subject may exercise the rights specified in paragraph (1) above via written documents or e-mail, etc. In such cases, Barreleye will promptly take the required actions.

3. In case of a User requests the correction or deletion of his/her personal information, Barreleye does not use or disclose the relevant personal information to any third party until the correction or deletion is complete.

4. A User may exercise his/her rights through an agent such as his/her legal representative or a person with a mandate. In such cases, the User shall submit a power of attorney as specified in attached Form 11 of Notification on the Methods of Personal Information Processing.

5. Users must not infringe on their own privacy or the privacy of other people collected by Barreleye by violating the Act on the Protection of Personal Information.

6. The rights of the information subject may be restricted in accordance with Article 35, Paragraph 4 or Article 37, Paragraph 2 of the Personal Information Protection Act.

7. If the personal information is specified as the collection target in other laws, the personal information may not be deleted even if you request the deletion of the personal information.

8. Barreleye verifies whether the person exercising their rights is the data subject or a legitimate representative.

Article 8. Measures for Ensuring Safety of Personal Information

Barreleye has taken the following measures necessary for ensuring safety, in compliance with Article 29 of the Personal Information Protection Act:

• Administrative measures: Establishment/Implementation of internal management plans, regular training of employees, etc.
• Technical measures: Management of access to systems processing personal information, installation of access control systems, encryption of identifiable information, and installation of security programs.
• Physical measures: Access control to computer rooms and data storage rooms

When processing pseudonymized information, Barreleye takes the following additional security measures in accordance with Article 28-4 of the Personal Information Protection Act:

• Storing pseudonymized information and additional information separately (if additional information is unnecessary, additional information will be destroyed)
• Separating access rights to pseudonymized information and additional information

Creating and retaining records related to the management of pseudonymized information, including the purpose of processing pseudonymized information, the items of personal information that have been pseudonymized, the usage history of pseudonymized information, the recipients when provided to a third party, the processing period of pseudonymized information (limited to cases where the processing period is separately determined in accordance with Article 28-4, Paragraph 2 of the Personal Information Protection Act), and other matters deemed necessary by the Personal Information Protection Commission

Article 9. Installation and Operation of Automatic Personal Information Collection Devices

Barreleye uses “cookies” that store and loads user information to give you the best experience on our Website.

Cookies are small pieces of information sent from the Website’s server to the browsers in the User’s computers. Some of them are stored in the User’s hard disk drive.

For more detailed information regarding the types, purposes, and management of cookies used by Barreleye, please refer to our Cookie Policy.

Article 10. Privacy Officers

Barreleye has appointed the following persons as its Personal Information Protection Officer for the coordination of all tasks related to the processing of personal information, addressing information subjects’ complaints regarding the processing of personal information, and providing remedies for damages.

Chief Privacy Officer

• Name: Wonsun (Wendy) Chung
• Department: Legal Counsel, HR & Finance Team
• E-mail: wendy@barreleye.co.kr

Privacy Manager

• Name: HeeYoung Yun
• Department: Deputy Manager, HR & Finance Team
• E-mail: hyyun@barreleye.co.kr

Please contact the Chief Privacy Officer or Privacy Manager for any question, complaint, and remedy related to personal information during the use of Barreleye’s services. Barreleye will promptly respond to and process your inquiry.

Article 11. Request to Access Personal Information

A User may request access to his or her personal information held by Barreleye pursuant to Article 35 of the Personal Information Protection Act. Barreleye will endeavor to process such requests without undue delay.

Department Responsible for Personal Information Access Requests

• Name: HeeYoung Yun
• Department: HR & Finance Team
• E-mail: hyyun@barreleye.co.kr

Article 12. Remedies for Infringement of Rights and Interests

If you wish to report or seek consultation regarding an infringement of your rights or interests relating to personal information, you may contact the following organizations:

• Personal Information Dispute Mediation Committee
• Website: kopico.go.kr
• Tel: 1833-6972 (toll-free)
• Personal Information Infringement Report Center
• Website: privacy.kisa.or.kr
• Tel: 118 (toll-free)
• Cyber Crime Investigation Division of the Supreme Prosecutors’ Office
• Website: spo.go.kr
• Tel: 1301 (toll-free)
• Cyber Crime Investigation Division of the National Police Agency
• Website: cyberbureau.police.go.kr
• Tel: 182 (toll-free)

Article 13. Amendments to the Privacy Policy

Barreleye may amend this Privacy Policy from time to time to reflect changes in applicable laws, regulations, or its services. Any amendments will be announced in advance in accordance with applicable law.

• Privacy Policy Version: R00
• Effective Date: September 1, 2026
• Previous versions of this Privacy Policy are available below:
• September 1, 2026 – Current : Privacy Policy R00

Operational and Management Policy for Fixed Visual Information Processing Devices

1. Basis and Purpose of Installation

Barreleye Inc. (hereinafter referred to as “Barreleye”) installs and operates fixed visual information processing devices in accordance with Article 25, Paragraph 1 of the Personal Information Protection Act for the following purposes:

• Ensuring facility safety and security, facility management, and fire prevention
• Preventing crime and ensuring the safety of employees and visitors

2. Number of Devices, Installation Locations, and Recording Areas

The number, installation locations, and recording areas of the fixed visual information processing devices operated by Barreleye are as follows:

3. Personal Visual Information Protection Officer and Manager

To protect personal visual information and appropriately handle inquiries and complaints relating to such information, Barreleye designates a Personal Visual Information Protection Officer and a Manager as follows:

4. Recording Hours, Retention Period, Storage Location, and Processing of Personal Visual Information

Processing Method: Barreleye records and manages matters relating to the use of personal visual information for purposes other than those originally specified, disclosure or provision to third parties, destruction, and requests for access. Upon expiration of the applicable retention period, personal visual information is permanently deleted using methods that prevent restoration or recovery. Any information maintained in printed form will be destroyed by shredding or incineration.

5. Outsourcing of Installation and Management of Fixed Visual Information Processing Devices

Barreleye outsources the installation and management of its fixed visual information processing devices as set forth below. Barreleye incorporates appropriate requirements into the relevant outsourcing agreement in accordance with applicable laws and regulations to ensure that personal information is securely managed by the service provider.

• Service Provider:S-1
• Contact: 1588-3112

6. Method and Location for Accessing Personal Visual Information

Method of Access: A data subject may access personal visual information by contacting the CPO in advance and visiting Barreleye. To request access to or confirmation of the existence of personal visual information, the data subject must complete the applicable Request for Access/Confirmation of Existence of Personal Visual Information and submit it to the responsible department.

Location for Access: Barreleye Business Support Office

7. Requests by Data Subjects for Access, Confirmation, or Deletion

A data subject may request access to, confirmation of the existence of, or deletion of personal visual information from the operator of the fixed visual information processing devices at any time. Such requests are limited to personal visual information in which the requesting data subject appears.

To make such a request, the data subject must submit a request to the CPO using the Request Form for Access, etc. by Data Subject [Form No. 2 of Barreleye’s Personal Information Protection Regulations].

Upon receiving a request for access to, confirmation of the existence of, or deletion of personal visual information, Barreleye will take the necessary measures without undue delay. Barreleye may require appropriate identification, such as a resident registration card, driver’s license, or passport, to verify that the requesting individual is the data subject or a duly authorized representative.

Notwithstanding the foregoing, Barreleye may refuse a request for access to or other action concerning personal visual information where permitted under Article 35, Paragraph 4 of the Personal Information Protection Act, including in any of the circumstances specified below. If Barreleye refuses such a request, it will notify the data subject in writing or by other appropriate means of the reason for the refusal within 10 days.

A request for access or other action concerning personal visual information may be denied in any of the following circumstances:

• A. Where access is prohibited or restricted by applicable laws or regulations.
• B. Where granting access may pose a risk of harm to another person’s life or physical safety, or may unjustly infringe upon another person’s property or other rights and interests.
• C. Where granting access may materially interfere with a criminal investigation, the conduct or maintenance of a prosecution, or judicial proceedings.
• D. Where the relevant personal visual information has already been destroyed following the expiration of the applicable retention period.
• E. Where there are other legitimate grounds for denying the data subject’s request for access or other action.

8. Measures to Ensure the Security of Personal Visual Information

Barreleye implements appropriate administrative, technical, and physical safeguards to protect personal visual information against loss, theft, unauthorized disclosure, alteration, or damage, including the following:

• Establishing and implementing an internal management plan for the secure processing of personal visual information.
• Implementing access controls and restricting access privileges to personal visual information.
• Applying appropriate technical measures to ensure the secure storage and transmission of personal visual information.
• Maintaining records relating to the processing of personal visual information and implementing measures to prevent the falsification or alteration of such records. Such records may include the date and time the personal visual information was created and, where the information is accessed, the purpose of access, the identity of the person accessing the information, and the date and time of access.
• Providing secure storage facilities or installing appropriate locking mechanisms to physically protect personal visual information.

9. Self-Audit of the Installation and Operation of Fixed Visual Information Processing Devices.

Barreleye conducts a self-audit at least once annually to assess compliance with this Policy and the proper installation, operation, and management of its fixed visual information processing devices.

10. Effective Date

This Operational and Management Policy for Fixed Visual Information Processing Devices shall take effect on September 1, 2026.