Privacy Policy

Nexa Labs Inc. (the "Company") complies with the Personal Information Protection Act and other applicable laws, and establishes and discloses this Privacy Policy to process users' personal information lawfully and securely. 1. Personal information we collect - Sign-up (required): email, password, name (nickname) - Seller registration (required): company name, business registration details, settlement account details - During transactions: order and payment records, inquiry and chat history - Collected automatically: access logs, cookies, IP address 2. Purposes of collection and use - Member management: confirming intent to join, identity verification, preventing fraudulent use - Service delivery: brokering transactions, payments and settlement, customer support - Service improvement: usage analytics and quality improvement 3. Retention and use period - Personal information is destroyed without delay when a member withdraws. However, the following records are retained for the periods required by applicable laws. - Records on contracts and withdrawal of offers: 5 years (E-Commerce Act) - Records on payments and the supply of goods or services: 5 years (E-Commerce Act) - Records on consumer complaints and dispute resolution: 3 years (E-Commerce Act) - Access logs: 3 months (Protection of Communications Secrets Act) 4. Provision to third parties The Company does not provide personal information to third parties without the user's prior consent, except where required by law. When a transaction is concluded, the minimum information needed to perform the contract (such as contact details) may be shared with the other party to the transaction. 5. Outsourcing of processing The Company may outsource tasks such as payment processing, identity verification, and infrastructure operation to specialized providers, and manages and supervises them securely in accordance with applicable laws. 6. Your rights Users may view and correct their personal information at any time, and may request deletion by withdrawing their membership. Rights can be exercised through the settings screen or a 1:1 inquiry within the platform. 7. Destruction of personal information Personal information is destroyed without delay once its retention period expires or its processing purpose is achieved. Electronic files are deleted irreversibly, and printed materials are shredded or incinerated. 8. Security measures - Encrypted storage of passwords and other critical data - Minimized access rights and access control - Retention of access logs and prevention of tampering 9. Data protection officer - Name: (to be designated) - Contact: 1:1 inquiry within the platform 10. Duty of notification Any additions, deletions, or amendments to this policy will be announced through platform notices at least 7 days before they take effect. Effective date: July 17, 2026