Privacy Policy

ononc values the privacy of data subjects and complies with the Personal Information Protection Act and other applicable laws. This policy applies to the processing of personal information on the websites operated by ononc. ononc is a one-person business; the privacy officer is identified in Section 12.

1. Personal information we collect - Required for inquiries: name, email address, inquiry details - Optional for inquiries: company/brand name, phone number, estimated budget - Collected automatically while using the service: access IP address, cookies, access date and time, service usage records (pages viewed, time on page, referral source), device and browser information, approximate location

2. Purpose of collection and use - Responding to inquiries and providing quotes - Contact and follow-up to deliver services - Preventing misuse and operating/securing the service - Analyzing website usage statistics and improving the service - Measuring ad performance and serving personalized ads where ads are displayed

3. Retention and use period We destroy personal information without delay once the purpose of collection and use is achieved. (e.g., retained for 2 months after an inquiry is resolved, then destroyed, or until the data subject requests deletion.) Where retention is required by law, we keep it for the applicable period. Automatically collected usage records are retained for up to 14 months from collection, in line with our analytics data-retention setting, and then deleted.

4. Destruction procedure and method - Procedure: personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay (within 5 days of the triggering event) following an internal review. - Method: information stored electronically is permanently erased by technical means that prevent recovery or reproduction; information on paper is shredded or incinerated.

5. Provision to third parties ononc does not provide personal information to third parties without the data subject's consent. (Exceptions apply where based on law or upon a lawful request from an investigative agency.)

6. Consignment of processing To operate the service, ononc consigns the processing of personal information as follows. - Supabase, Inc. — database & authentication (storage of inquiry content and admin account data) - Vercel, Inc. — website hosting & delivery - Google LLC — website usage analytics (Google Analytics) and ad delivery/performance measurement (Google AdSense) ononc relies on each processor's terms of service and data processing terms to keep personal information handled safely, and any change of processor or consigned work will be disclosed through this policy.

7. Overseas transfer of personal information The processors above handle personal information outside Korea. Details of each transfer are as follows. - Supabase, Inc. (United States) — Items: name, email address, phone number, inquiry details / Time and method: transmitted over the network at the time of use / Purpose: database storage and authentication / Retention: until the consignment contract ends - Vercel, Inc. (United States) — Items: access IP address, access date and time, browser information / Time and method: transmitted over the network at the time of use / Purpose: website hosting and delivery / Retention: until the consignment contract ends - Google LLC (United States and the countries where Google data centers are located) — Items: cookie identifiers, access IP address, service usage records, device and browser information / Time and method: transmitted over the network at the time of use / Purpose: usage analytics and ad delivery / Retention: up to 14 months from collection (advertising cookies until each cookie expires) Data subjects may refuse the overseas transfer of their personal information. To do so, block cookie storage using the methods in Section 8 or contact ononc@ononc.com; note that some service features may be limited as a result.

8. Installation and operation of automatic collection devices (cookies), and how to refuse them ononc uses cookies to deliver the service and analyze its use. - Essential cookies: required to provide the service, such as maintaining admin login sessions and storing language preferences. - Analytics cookies: the "_ga" and "_ga_*" cookies set by Google Analytics (GA4), used to analyze visitor numbers and usage patterns statistically; retained for up to 2 years. - Advertising cookies: where Google AdSense ads are displayed on the website, cookies for ad identification and performance measurement (such as "__gads") may be stored.

How to refuse - Turn off the "Analytics & advertising cookies" switch at the bottom of this page: the analytics and advertising scripts will no longer load in this browser, and the analytics/advertising cookies already stored will be deleted. The setting is saved in the browser you are using, so clearing cookies or switching browser or device means setting it again. - You can refuse cookie storage or delete stored cookies in your browser settings. (Chrome: Settings > Privacy and security > Third-party cookies / Safari: Settings > Privacy) - Opt out of Google Analytics: install the opt-out browser add-on at https://tools.google.com/dlpage/gaoptout - Opt out of Google personalized ads: adjust your settings at https://myadcenter.google.com - Blocking essential cookies may prevent some features, such as admin login, from working properly.

9. Collection, use, and refusal of behavioral information - Items collected: website visit history, page view records, clicks and other usage behavior - Method of collection: collected automatically when you visit the website or view a page - Purpose: usage analytics and interest-based personalized advertising - Retention and use period: up to 14 months from collection (advertising cookies until each cookie expires) - How to refuse: use the methods in Section 8, or the personalized-ad opt-out features provided by the advertising provider ononc does not collect behavioral information from users it knows to be children under the age of 14.

10. Rights of data subjects and how to exercise them Data subjects may request to access, correct, delete, or suspend the processing of their personal information at any time. Requests may be sent to ononc@ononc.com, and we will act without delay. Rights may also be exercised through a legal representative or an authorized agent.

11. Measures to ensure the security of personal information - Administrative: personal information is handled solely by the principal, who reviews processing activities regularly - Technical: managing access rights to the personal-information processing system, account authentication and access control, encryption in transit (HTTPS/TLS), retention of access logs - Physical: personal information is stored in the data centers of our cloud providers and is covered by their physical safeguards

12. Privacy officer ononc is run by one person, so under applicable law the principal also serves as the privacy officer. - Privacy officer: Oh Seontaek (Principal) - Contact: ononc@ononc.com Data subjects may direct privacy-related inquiries, complaints, and remedy requests arising from use of the service to the contact above, and ononc will respond and act without delay.

13. Remedies for infringement of rights Data subjects may apply to the following bodies for dispute resolution or consultation regarding privacy infringement. - Personal Information Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr - Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr - Supreme Prosecutors' Office Cybercrime Investigation Division: 1301 (no area code) / www.spo.go.kr - National Police Agency Cyber Bureau: 182 (no area code) / ecrm.police.go.kr Where rights or interests are infringed by a disposition or omission in response to a request under Articles 35, 36, or 37 of the Personal Information Protection Act, an administrative appeal may be filed under the Administrative Appeals Act.

14. Changes to this policy This policy takes effect on its effective date; any additions, deletions, or changes will be announced on the website at least 7 days before they take effect. - Current effective date: 2026-08-12 - Previous effective date: 2026-01-01