CMES Privacy Policy
Effective Date: December 16th, 2025

CMES Inc. (“Company,” “CMES,” “we,” or “us”) is committed to protecting your personal information and complying with applicable laws, including the Personal Information Protection Act of the Republic of Korea (“PIPA”) and relevant international standards. This Privacy Policy explains how we collect, use, store, process, and protect your personal information, and how you may exercise your rights.

This Privacy Policy is publicly available on the main page of our website to ensure that users may access and review it at any time. The Policy may be updated in accordance with changes in relevant laws or the Company’s internal requirements, and version changes will be disclosed on this page.

Article 1. Purposes of Processing Personal Information

We process personal information for the following purposes. Personal information will not be used for purposes other than those listed below, and if we intend to change the purpose of processing, we will obtain separate consent in accordance with Article 18 of PIPA or take other legally required measures.

1. Website Inquiry Management: To process website inquiry submissions, verify identity when necessary, prevent fraudulent use, provide notifications, and handle customer requests or complaints.
2. Handling Customer Complaints (Civil Petition Processing): To verify the identity of the complainant, check the complaint details, contact customers during fact-finding procedures, and notify them of the results.
3. Provision of Goods or Services: To provide requested services, deliver materials, send contracts or quotations, and verify the identity of individuals in connection with customer support.
4. Marketing and Advertising: To develop or improve services, provide tailored information, send event invitations or advertising communications (only with prior consent), identify demographic attributes, analyze service usage, and generate statistical information.

Article 2. Personal Information Retention Period

1. We retain and process personal information only within the period permitted by law or for which you have given consent. The retention periods for each processing purpose are as follows:
- Handling Customer Complaints
- Retention Period: 3 years from the date of consent
- Legal Basis: Customer consent
- Provision of Goods or Services
- Retention Period: Up to 5 years from the date of consent
- Note: CMES does not process credit card or bank account information through the website. If any financial information is collected offline for corporate transactions, such information is retained only as required under applicable laws.
- Legal Basis: Customer consent
- Marketing and Advertising (Optional Consent)
- Required Items: Name, email, contact information, company name, job title/position, inquiry route
- Optional Items: Industry, solutions of interest
- Retention Period: Until the user withdraws marketing consent
- Withdrawal: Users may withdraw consent at any time by replying to a marketing email or by contacting us.

2. Data Retained Under Related Laws (Regardless of Consent)
Article 3. Provision of Personal Information to Third Parties

1. We do not provide personal information to third parties without your consent, except where permitted or required by law.
2. Personal information may be provided without consent in the following cases:
- Where necessary for billing or payment settlement
- For statistical, academic, or market research purposes, where information is provided in an anonymized, non-identifiable format
- Where required under specific legislation including PIPA, the Communications Privacy Protection Act, the Framework Act on National Taxes, the Real Name Financial Transactions Act, the Credit Information Use and Protection Act, the Criminal Procedure Act, or other applicable laws
3. In cases where information is provided without consent in accordance with law, only the minimum necessary information will be provided.

Article 4. Outsourcing and Cross-Border Transfers of Personal Information

1. To provide stable services and operational efficiency, CMES outsources certain processing tasks and stores personal information via external service providers, both domestic and overseas. Personal information may be stored on or transferred to servers managed by such service providers.

2. List of Service Providers
3. Management Measures
We supervise all service providers to ensure they process personal information only for the outsourced purpose and comply with security requirements.
4. Cross-Border Transfer (GDPR-Compliant Notice)
If you are located in the EEA or the UK, personal information may be transferred to countries such as the Republic of Korea, which may have different data protection laws.
CMES ensures an adequate level of protection by:
- Relying on the European Commission’s adequacy decision for the Republic of Korea; or
- Using Standard Contractual Clauses (SCCs) or other legally recognized safeguards for international transfers.
Users may object to cross-border transfers; however, doing so may limit our ability to provide certain services (such as responding to inquiries).

Article 5. Destruction of Personal Information

We destroy personal information without delay (within 5 business days) once the purpose of collection is achieved or the retention period expires, except where retention is required by law.

1. Destruction Procedure: Personal information is reviewed under the supervision of the Privacy Officer and securely deleted.
2. Destruction Method: Electronic files are permanently deleted using non-recoverable technical methods, and hard copies are shredded or incinerated.

Article 6. User Rights and How to Exercise Them

1. Users may exercise rights regarding their personal information at any time, unless restricted by law, and we will respond without undue delay.
2. If a user requests correction or deletion, the relevant information will not be used or provided until the request is completed.
3. User Rights include:
- Request access to personal information
- Request correction or deletion
- Request suspension of processing
- Inquire about records of use or provision
- (EEA/UK users) Additional GDPR rights:
ㆍRight to object to processing or direct marketing
ㆍRight to restrict processing
ㆍRight to data portability
ㆍRight to lodge a complaint with a supervisory authority
ㆍRight to withdraw consent at any time
4. How to Exercise Rights: Users may contact us via email, phone, or written request. Upon verifying identity, we will take prompt action.
- Privacy Contact:
- Management & Operations Division
- Tel: +82-2-1800-8647 (ext. 2)
- Email: ga@cmesrobotics.ai

Article 7. Measures to Ensure the Security of Personal Information

We take the following technical, administrative, and physical measures to ensure security, as required by Article 29 of PIPA.

1. Administrative Measures
- Minimizing the number of personnel handling personal information
- Conducting regular employee training
- Establishing and managing internal security policies
2. Technical Measures
- Access control systems and security software
- Encryption of personal information
3. Physical Measures
- Controlled access to information storage areas
- Locking devices and access restrictions

Article 8. Cookies and Automated Data Collection Tools

1. Cookies
- We use cookies to improve website functionality and user experience. Cookies do not contain information that directly identifies an individual.
Users may refuse or delete cookies at any time; however, some services requiring login or session maintenance may not function properly.
Cookie settings may be adjusted through your browser:
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies → Block
- Chrome: See guide (https://support.google.com/chrome/answer/95647)
- Safari: See guide (https://support.apple.com/105082)
2. GA(Google Analytics)
1. We use Google Analytics (GA4) to analyze website usage. Only anonymized or non-identifiable information is collected for statistical purposes.
Users may opt out of Google Analytics via:
https://tools.google.com/dlpage/gaoptout
2. GDPR Notice (EU/UK Users)
Analytics cookies require explicit consent under EU/UK law.
You may accept or decline analytics cookies through your browser settings or cookie management tools.

Article 9. Privacy Officer and Contact Information

To protect personal information and handle inquiries or complaints, CMES designates the following Privacy Officer:

1. Privacy Officer:
- Head of Management & Operations Division
- CMES Inc.
- Email: ga@cmesrobotics.ai
- Tel: +82-2-1800-8647 (ext. 2)

Article 10. Remedies for Rights Infringement

Users may contact CMES for questions or concerns.
Additionally, the following authorities provide consultation or complaint-handling services regarding personal data issues:

1. Personal Information Infringement Report Center (https://privacy.kisa.or.kr / 118) 2. Supreme Prosecutors’ Office Cyber Bureau (https://spo.go.kr / 1301) 3. National Police Agency Cyber Bureau (https://ecrm.cyber.go.kr / 182) 4. Personal Information Dispute Mediation Committee (https://www.kopico.go.kr / 1833-6972)

Article 11. Amendments to This Privacy Policy

We will notify users of additions, deletions, or modifications to this Privacy Policy through website announcements before the changes take effect.