The Company processes the personal information of data subjects for the following purposes. Personal information currently being processed shall not be used for any purpose other than the purposes described herein. If the purpose of use is changed, the Company will carry out the required measures, including obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.

The Company collects the following personal information from data subjects when they register for membership or use the Services.

2.1 General Personal Information

2.2 Protection of Children’s Personal Information

• Residents of Korea: We do not collect personal information from children under the age of 14.
• EU Residents: We do not collect personal information from children under the age of 16.
• Residents of other countries: We do not collect personal information from children under the age of 13 to 15.

2.3 Collection and Use of Marketing Information (Optional)

The Company processes personal information only when the data subjects have provided optional consent and for the purpose of delivering information for marketing purposes, including news about new products, feature updates, event and seminar notices, and promotional or advertising communications.

To provide more relevant content, the Company performs only basic segmentation based on factors such as job functions, the industry sector, and the subscription type. In doing so, the Company does not use sensitive information and does not engage in automated decision-making that has a material impact on legal or contractual rights, or on the use of the services.

Data subjects may withdraw their consent to the processing of personal information for marketing purposes and to segmentation classification at any time.

[Collected Items] Names, email addresses, mobile phone numbers, company names, and other items provided by the data subjects at the time consent is given

[Purpose of Processing] New product and update notifications, invitations to events and seminars, the provision of promotional and advertising information, and basic segment classification based on customer interests

[Retention Period] Upon the withdrawal of consent

[Withdrawal Method] Submit a request via the “unsubscribe” option at the bottom of our emails, the withdrawal page on our website, or by emailing security@tibero.com
Consent is entirely voluntary, and refusal to provide consent will not result in any disadvantages in the use of our services.

2.4 De-identification and Retention of Technical Support Records

The Company will delete, without delay, any information that can identify an individual—such as names, contact details, email addresses, and account information—contained in records created during technical support processes (including trouble ticket handling and inquiry support) once the inquiry has been completed, and in any event immediately upon a member’s withdrawal from the service.

However, de-identified technical information accumulated during the technical support process, such as troubleshooting procedures, system configuration information, settings values, error analysis records, and recurrence-prevention guidance, is separately maintained and managed for use as part of the Company’s technical assets (Knowledge Base), and no retention period limitation applies to such information.

De-identified information does not constitute personal information under the Personal Information Protection Act, the GDPR, or other applicable laws and regulations, and is strictly managed so that it cannot be re-identified under any circumstances.

The Company shall process personal information solely within the scope set forth in “1. Purposes of Processing Personal Information” and shall disclose personal information to third parties only when the user has given consent or when such disclosure is permitted under Articles 17 and 18 of the Personal Information Protection Act.

To ensure the smooth provision of services, the Company provides personal information only to the minimum extent necessary and only in the following cases, with the consent of the data subject.

To facilitate the provision of its services, the Company entrusts the processing of personal data to external specialized service providers as set forth below. If you do not use the services connected to the functions delegated to the contractor, your personal information will not be transferred to the service provider.

Where the processing of personal information is outsourced, the Company clearly specifies, in order to ensure the security of personal information, compliance with privacy-related instructions, confidentiality obligations regarding personal information, restrictions on disclosure to third parties, allocation of responsibility in the event of an incident, the outsourcing period, and the return or destruction of personal information upon completion of processing, and we supervise the service provider to ensure that personal information is handled securely.

4.1 Personal Information Entrusted Within the Country

4.2 Personal Information Entrusted to Overseas Service Providers

In connection with the use of solutions within certain services for service delivery, the outsourcing of personal information processing to overseas locations may occur. For the outsourcing of personal information processing necessary to provide the Services, the data subject may refuse to consent to, or withdraw consent for, the transfer of such personal information outside the country. However, if consent is refused, access to the relevant services for which such overseas outsourcing is essential (for example, blog registration/activity, TechNet access, GTS access, and online education services such as course enrollment, participation, examinations, and certificate issuance) may be restricted.

The Company transfers personal information pursuant to Article 46 of the GDPR through the following appropriate safeguards:

• Execution of Standard Contractual Clauses (SCC) approved by the EU Commission
• Data encryption (transmission and storage)
• Strict access control
• Periodic security assessments
  - Data subjects may request additional information regarding the foregoing mechanisms and safeguards by contacting security@tibero.com.

Where personal information becomes unnecessary, including upon the lapse of the Company’s retention period or the completion of the processing purpose, the Company shall promptly delete or otherwise destroy the applicable personal information. If personal data must continue to be retained under applicable laws and regulations even after the retention period consented to by the data subject has expired, or if the purpose of the processing has been achieved, such personal information shall be transferred to a separate database (DB) or stored in a different location and retained accordingly. The procedures and methods for destroying personal information are as follows:

5.1 Destruction Procedures

The Company shall promptly destroy personal information once the retention and use period has expired.

5.2 Method of Destruction

The Company shall destroy personal information recorded and stored in the form of electronic files in a manner that renders the records unrecoverable. Personal information recorded and stored in paper documents shall be destroyed by shredding or incineration.

5.3 Retention of Personal Information Pursuant to Applicable Korean Laws and Regulations

The Company respects the privacy rights of data subjects worldwide and ensures those rights are protected in accordance with the laws of each country and region.

6.1 Rights of Residents of the Republic of Korea (Personal Information Protection Act)

Data subjects may exercise the following rights:

• a) Right to request access to personal information
• b) Right to request correction in the event of errors, etc.
• c) Right to request deletion
• d) Right to request suspension of processing
• e) Right to withdraw consent

6.2 Rights of Residents of the European Union (GDPR)

In addition to the rights set forth above, residents of the EU may also exercise the following rights:

• a) Right of Access
  • Access to a copy of personal information and the disclosure of processing information
• b) Right to Rectification
  • Rectification of inaccurate personal information
• c) Right to Erasure ('Right to be Forgotten')
  • Complete deletion of personal information under certain conditions
• d) Right to Restriction
  • Restriction of processing in certain circumstances
• e) Right to Data Portability
  • Obtain personal information in a structured, machine-readable format
  • Direct request for transmission to another controller
• f) Right to Object
  • Objection to processing based on legitimate interests
  • Unconditional right to object to processing for direct marketing purposes
• g) Right to object to automated decision-making and profiling
  • Right to object to decisions based solely on automated processing
  • Request for human intervention and expression of one’s own views
• h) Right to lodge a complaint with a supervisory authority
  • Right to file a complaint with the data protection supervisory authority (DPA) in the relevant country
  • Right to seek judicial remedy

6.3 Rights of U.S. Residents

6.3.1 California Residents (CCPA/CPRA)

California residents may exercise the following rights:

• a) Right to Know
  • Categories and specific details of the personal information collected
  • Sources of collection, purposes of processing, and third parties with whom the information has been shared
• b) Right to Delete
  • Deletion of personal information collected, except where a legal exception applies
• c) Right to Opt-Out of Sale/Sharing
  • Refusal of sale or sharing personal information
  • The Company does not currently sell or share personal information.
• d) Right to Limit the Use of Sensitive PI
  • Restriction of the use and disclosure of sensitive personal information to required purposes only
• e) Right to Correct
  • Correction of inaccurate personal information
• f) Right to Portability
  • Provision of personal information in a portable format
• g) Right to Non-Discrimination
  • Prohibition of discriminatory treatment due to the exercise of rights

6.3.2 Other U.S. Residents

Residents of states where privacy laws are in effect, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA), may exercise similar rights under the laws of their respective states.

6.4 Rights of Residents of Japan (Act on the Protection of Personal Information - APPI)

Residents of Japan may exercise the following rights:

• a) Right to Request Notice of the Purpose of Use
  • Request for a notice of the purpose for which personal information is used
• b) Disclosure
  • Request for disclosure (access) to personal information in our possession
• c) Right to Request Correction, etc.
  • Correction, addition, or deletion of inaccurate information
• d) Right to Request Suspension of Use, etc.
  • Request for suspension of use or deletion during improper acquisition or use
  • Request for suspension of use in the event of use beyond the intended purpose or improper third-party provision
• e) Right to Request Suspension of Disclosure to Third Parties
  • Request to suspend provision to third parties
• f) Right to Request Disclosure of Records of Third-Party Provision
  • Request for the disclosure of records of third-party provision records

6.5 Rights of Residents of Other Countries

Residents of countries not specified above may exercise rights under the personal information protection laws of their country or region of residence. The Company adheres to the personal information protection laws of the relevant jurisdictions and, when a data subject submits a request to exercise such rights, will respond in accordance with the applicable legal requirements.

The principal rights generally include the following:

• Access to and inspection of personal information
• Correction of inaccurate information
• The deletion or destruction of personal information
• The restriction or suspension of personal information processing
• The withdrawal of consent

The specific rights available and the manner in which they may be exercised may vary depending on the laws of the relevant country. Accordingly, please contact the Company when exercising any such rights.

6.6 How to Exercise Your Rights

You may exercise your rights through the following methods:

Submission Method:

• Email: security@tibero.com
• Phone: 031-8018-1749 (Weekdays 09:00-18:00, Korea time)
• Mail address: Tmax Soft Tower, 45 Jeongjail-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• online request form: https://www.tmaxtibero.com/service/inquiryWrite.do

Required Documents:

• A copy of a government-issued identification document for identity verification
• If requested by an authorized representative: Power of attorney and a copy of the representative’s identification document
  (Korea: Annex Form No. 11 to the Enforcement Rules of the Personal Information Protection Act)

Processing Deadline:

• Korea: Within 10 days after the request is received (may be extended by an additional 10 days where unavoidable circumstances exist)
• EU (GDPR): Within 1 month after the request is received (may be extended by up to 2 further months where the matter is complex)
• U.S. (CCPA): Within 45 days of receiving the request (with a possible 45-day extension if necessary)
• Japan: Promptly, typically within 2 weeks
• Other countries: Within a reasonable period under the applicable laws of the relevant country

The Company shall take action on the request without undue delay, notify you of the outcome through the method you requested (such as in writing, by email, or by fax).

6.7 Grounds for Limiting the Exercise of Rights

In the following cases, the exercise of rights may be restricted or denied:

• Where a specific provision of law exists, or where compliance with a statutory or regulatory obligation is required
• Where there is a risk of harming another person's life or body
• Where there is a risk of unjustly infringing another person’s property and rights
• Where it is necessary to perform a contract, and the data subject has not expressly stated an intention to terminate the contract
• Where the request is clearly unfounded or excessive
• Where it relates to ongoing legal proceedings
• Where it is necessary in the public interest.

If the exercise of rights is restricted, the Company shall inform the data subject of the grounds for such a limitation, and the data subject may object to the decision.

6.8 Fees

In principle, the exercise of rights is free of charge.
However, a reasonable fee may be charged in the following cases:

• Where the request is clearly unfounded or excessive
• Where the same information is requested repeatedly
• Where additional copies are requested (with the first copy provided at no charge).

The Company will inform you in advance of any fees, including the fee amounts and the reasons they are being charged.

6.9 Automated Decision-Making and Profiling

The Company does not currently engage in automated decision-making that produces legal effects concerning data subjects or similarly significantly affects data subjects.

Current Scope of Automated Processing:

• Email marketing: Basic recipient group classification (e.g.: industry, job title, areas of interest)
• Website analytics: Anonymized statistical analysis
• Customer Support: Automatic classification by inquiry type (final processing is performed by the designated representative)

Such processing does not give rise to any legal effects concerning individuals and does not amount to profiling for the purpose of assessing an individual’s personal characteristics.

Recruitment Process:

• AI-based automated resume screening is not used
• All applications are reviewed directly by a hiring representative
• Final employment decisions are always made by a human

Rights of EU Residents (GDPR Article 22):
If we introduce automated decision-making that produces legal effects in the future, EU residents will have the following rights:

• The right not to be subject to automated decision-making
• The right to request human intervention
• The right to express one’s views
• The right to request an explanation of a decision
• The right to object to the decision and seek reassessment

In the event of implementing automated decision-making:
Should we deploy a new automated decision-making system, we will notify you clearly in advance, and where necessary, secure your prior consent.

Contact: security@tibero.com / 031-8018-1749

7.1 Information Collected Automatically

For the purpose of improving service convenience for data subjects, the Company collects behavioral information through the browser type, operating system, access logs (including IP address and access timestamp), cookies, and other similar means.

7.2 Provisions on the Collection and Use of Cookies

Cookies are small pieces of information transmitted by a website to a customer’s web browser (for example, Internet Explorer).

• 1) Purpose of Using Cookies
  • Cookies are used to save the data subject’s preferred settings and related preferences, helping deliver a faster web environment and supporting service enhancements for a more convenient user experience. This allows data subjects to use the services with greater ease.
• 2) Cookie Installation, Operation, and Refusal
  • Data subjects have the right to choose whether to allow cookies to be installed, and may refuse the storage of, or delete, such cookies at any time.
• 3) How to Refuse Cookie Settings
  • : Data subjects have the right to choose whether to allow cookies to be installed. Accordingly, by adjusting the settings in their web browser, they may permit all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies. However, if the data subject refuses the installation of cookies, the provision of certain services may be limited or may become difficult.

7.3 How to Refuse Cookie Collection

Web Browsers

• Chrome : Select the ‘⋮’ icon in the upper-right corner of the web browser > New Incognito Window (keyboard shortcut: Ctrl+Shift+N)
• Edge : Select the ‘…’ menu in the upper-right corner of the web browser > New InPrivate window (keyboard shortcut: Ctrl+Shift+N)
• Safari : In the top menu, select “File” > “New Private Window” (keyboard shortcut: Command+Shift+N)

* In addition, other major internet browsers, such as Firefox and Opera, also provide options to clear cookies.
* The steps for declining cookie collection may vary by web browser version.

Mobile Browsers

• Chrome : Select the ‘…’ icon in the bottom-right corner of the mobile browser > New Incognito Tab
• Edge : Select the ‘≡’ icon at the bottom right of the mobile browser > New InPrivate tab
• Safari : Select the “Tab” icon in the lower right corner of the mobile browser > Privacy tab > Done
• Samsung Internet: Select ‘☰ or three dots’ in the bottom right of the mobile browser > Settings > Site and Downloads > Site Permissions > Cookies

* Please note that the procedures for declining cookie collection may differ by mobile browser version.

When handling the personal information of data subjects, the Company establishes the following technical, organizational, and physical measures to ensure security and to prevent personal information from being lost, stolen, leaked, modified, or compromised.

8.1 Administrative Measures

The formulation and enforcement of internal management policies, the designation of individuals authorized to handle personal information, the restriction of access to personal information to the minimum necessary personnel, and the provision of personal information protection training

8.2 Technical Safeguards

Management of access rights to personal information processing systems; access controls; the encryption of sensitive information such as passwords; the use of encrypted communication channels for the transmission and reception of data over the Internet; and the installation of security software, and other similar measures

8.3 Physical measures

Access controls for server rooms, records storage rooms, and similar facilities

8.4 Response to Personal Information Breach Incidents

The Company shall respond promptly to any personal information breach incidents in accordance with the applicable laws and regulations.

Breach Incident Notification:

• Notification to supervisory authorities:
  • Korea: Within 24 hours of breach detection (mandatory if more than 1,000 individuals are affected)
  • EU: Within 72 hours of breach detection
• Notice to data subjects:
  • Where there is a risk to rights and freedoms, notices shall be provided without undue delay
  • Notice content: Scope of the breach, incident background, response measures, procedures for relief and remediation, and contact information
  • Notice methods: Email, SMS, written notice, website announcement
• Exceptions to notice:
  • Where the data cannot be identified due to protective measures such as encryption
  • Where post-incident remedial measures have been taken to eliminate the risk

Inquiries regarding security incidents: security@tibero.com / 031-8018-1749

To protect the personal information of data subjects and to address complaints concerning personal information, the Company has appointed the department and privacy officer identified below.

• Global Chief Privacy Officer (CPO)

  • Name

    Jaeik Song

  • Affiliation

    Corporate Management Division

  • Contact Information

    031)8018-1749

  • Email

    security@tibero.com

• EU Data Protection Officer (DPO) Inquiry

  • Name

    Jaeik Song (also serving as CPO)

  • Affiliation

    Corporate Management Division

  • Contact Information

    031)8018-1749

  • Email

    security@tibero.com

• Contact Details by Responsible Department: Website / TechNet

  • Affiliation

    IT/Infrastructure Team

  • Contact Person

    Woo Kim

  • Contact Information

    031)8018-1749

  • Email

    woo_kim2@tibero.com

• Blog

  • Affiliation

    Marketing Team

  • Contact Person

    Saetbyeol Won

  • Contact Information

    031)8018-1572

  • Email

    tibero_mkt@tibero.com

• GTS

  • Affiliation

    Product Planning Team

  • Contact Person

    Hyojeong Shin

  • Email

    hyojung_shin2@tibero.com

You may report any privacy-related complaints arising from your use of the Company’s services to the Chief Privacy Officer or the designated department. The Company will provide prompt and comprehensive responses to any such reports.

If you have questions about reporting or seeking consultations concerning any other personal data infringement, you may contact the agencies below to explore available relief options.

• Personal Information Dispute Mediation Committee

  • Website

    www.kopico.go.kr

  • Contact Information

    1833-6972 (no area code required)

• Privacy Infringement Reporting Center

  • Website

    privacy.kisa.or.kr

  • Contact Information

    118 (no area code required)

• Cyber Investigation Division, Forensic Science Department, Supreme Prosecutors' Office

  • Website

    www.spo.go.kr

  • Contact Information

    1301 (no area code required)

• Cyber Safety Bureau, National Police Agency

  • Website

    ecrm.cyber.go.kr

  • Contact Information

    182 (no area code required)

This Privacy Policy shall be effective as of May 15, 2026. The prior Privacy Policy is available below.