We Understand Your Challenges and
Find the Right Solution.

ONDA Global Logis (hereinafter referred to as the "Company") handles and securely manages personal information in accordance with the Personal Information Protection Act and applicable laws and regulations for the protection of the freedom and rights of information subjects. The Company shall inform the information subject of the procedures and standards for the processing and protection of personal information in accordance with Article 30 of the Personal Information Protection Act, and establish and disclose the personal information processing policy as follows to promptly and smoothly handle related grievances.

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes: The personal information processed shall not be used for any purpose other than the following purposes, and if the purpose of use is changed, the necessary measures shall be implemented in accordance with Article 18 of the Personal Information Protection Act.

1. Handling transportation and logistics consultations and quote requests; reviewing inquiries, conducting consultations, providing quotes and service proposals, and managing consultation records
2. Contract execution and service delivery: identifying contracting parties and their designated contacts; receiving transportation orders; arranging dispatch, transportation, and delivery; billing and settling charges; issuing tax invoices; and communicating as necessary to fulfill contracts.
3. Handling complaints and grievances: verifying the complainant’s identity and the details of the complaint; contacting the customer to investigate the facts; and notifying them of the outcome.
4. Improve the service and analyze the usage status of the homepage operating the homepage, improve the service quality, prevent security and fraudulent use
5. Providing marketing and advertising information Providing advertising information such as company and service news, promotions, events, etc. However, it will only be processed if the data subject separately agrees.

2. Items of personal information processed, purpose of processing, and period of retention and use

The Company processes the minimum personal information necessary to provide the service as follows.

Category	Processing Purpose	Processing Items	Retention/Use Period
Transportation and logistics consultation and quote requests	Reviewing inquiries, conducting consultations, providing quotes, and managing consultation records	Required: Company Name, Contact Person Name, Contact, Email, Inquiry Selection: Information voluntarily entered by the user, such as department name, job title, origin, destination, cargo type, quantity, etc.	3 years after contact was processed
To verify contracting parties and contacts, accept transportation requests, perform dispatch, transportation and delivery, issue invoices, settle charges, and communicate as required to perform contracts	Execution of contracts, request for transportation, dispatch, transportation, transportation, billing, settlement, issuance of tax invoices	Business name, business registration number, business address, representative name, contact name, department/title, phone number, email address, pickup and delivery addresses, names and contact details of persons responsible at pickup and delivery locations, and transportation-related information	5 years after the end of the contract or the period in accordance with the relevant laws and regulations
To verify complainants, review complaints, communicate for investigation, and provide results.	Authentication, handling of complaints, notification of results	Name, contact, email, complaint, and related records	3 years after the completion of the complaint
Receive marketing information	Provide advertising information such as services, promotions, and events	Company name, contact person, contact information, email	Until the withdrawal of consent or the purpose of use is achieved
Use the homepage	Analyze usage statistics, improve our services, and prevent security and fraud	IP address, cookies, date and time of access, history, browser and device information, service usage history	3 months from the date of collection

The data subject may disagree with the collection and use of the selected items, and even if they disagree with the selected items, there is no limit to the receipt of basic inquiries. However, if there is insufficient information for consultation, such as transportation conditions, it may be difficult to provide an accurate estimate or guide to the service.

3. Processing and retention period of personal information

The Company shall process and retain personal information within the period of retention and use of personal information in accordance with the law or when collecting personal information from the information subject within the period of consent. However, if it is necessary to preserve it in accordance with relevant laws and regulations, it shall be kept separately for the relevant period.

Retention Target	Retention period	Legal Basis
Records related to contracts or withdrawal of subscriptions, etc.	5 years	Act on Consumer Protection in Electronic Commerce, etc.
Records related to the payment and supply of goods, etc.	5 years	Act on Consumer Protection in Electronic Commerce, etc.
Records related to consumer complaints or disputes	3 years	Act on Consumer Protection in Electronic Commerce, etc.
Records of displays and advertisements	6 months	Act on Consumer Protection in Electronic Commerce, etc.
Telecommunications confirmation data such as date and time of telecommunications, start and end time, subscriber number, etc.	3 months	Protection of Communications Secrets Act
Books and documents relating to transactions prescribed by the Tax Code	5 years	Related laws such as the "Framework Act on National Taxes" and "Corporate Tax Act"

※ If the Company's actual services do not constitute an e-commerce transaction or do not process such records, the relevant items may not apply.

4. Provision of Personal Information to Third Parties

The Company shall process the personal information of the information subject only to the extent specified in Article 1, and in principle, it shall not provide the personal information to a third party without the consent of the information subject. However, in cases falling under Articles 17 and 18 of the Personal Information Protection Act, personal information may be provided.

In order to perform transportation services, if the information of the person in charge of the loading and unloading area is provided to the carrier or owner-driver performing the actual transportation, the company shall inform the following in advance and obtain the necessary consent.

Recipient	Purpose of provision	Items to be provided	Retention/Use Period
The carrier or owner-driver performing the transportation service	Contact for dispatching, loading, unloading, transportation and delivery	Pickup and delivery addresses; names and contact details of persons responsible at the pickup and delivery locations; and the minimum information required for transportation	Until transportation work is completed. However, if there is a retention obligation under the relevant laws and regulations, until the end of that period.

5. Entrustment of personal information processing tasks

The company may entrust the processing of personal information to the outside in order to provide a smooth service. When concluding a consignment contract, other than for the purpose of performing consignment work in accordance with Article 26 of the Personal Information Protection Act, matters related to prohibiting the processing of personal information, technical and administrative protection measures, limitation of reassignment, trustee management and supervision, and liability for damages, etc. shall be specified in the contract, and the trustee shall supervise the safe handling of personal information.

If the contents of the entrusted work or the trustee is changed, the company will disclose it through this privacy policy without delay.

6. International Transfers of Personal Information

In principle, the Company does not transfer personal information outside of the country. However, if personal information is transferred abroad using overseas cloud, analysis, and email services, the items of personal information transferred in accordance with Article 28-8 of the Personal Information Protection Act, the country, time, and method of transfer, the recipient of the transfer, the purpose of use, the period of retention and use, and the method of rejecting the transfer shall be separately announced and the necessary measures shall be implemented.

7. Destruction Procedures and Methods

When personal information becomes unnecessary, such as when the retention period of personal information has elapsed or the purpose of processing has been achieved, the company destroys the personal information without delay.

1. The destruction procedure
   Select the personal information that caused the destruction and destroy it with the approval of the personal information protection officer of the company. Personal information that is required by applicable laws and regulations to be retained continuously will be kept separate from other personal information.
2. Destruction Method
   Electronic files are deleted in a secure way that prevents recovery or playback, and paper documents are shredded or incinerated and destroyed with a shredder.

8. Rights and duties of the information subject and his/her legal representative and how to exercise them

1. The data subject may at any time request the Company to access, correct or delete personal information, suspend processing, and withdraw consent.
2. The exercise of rights can be done in writing, by e-mail, or by telephone, and the company will take action against it without delay.
3. Data subjects may exercise their rights through legal representatives or persons authorized to do so. In this case, you may be required to submit a power of attorney as determined by applicable law.
4. If the correction or deletion of personal information is requested, the company will not use or provide the personal information until the correction or deletion is completed.
5. Requests to delete and stop processing personal information may be limited in accordance with relevant laws and regulations.
6. Data subjects should exercise their rights without prejudice to the privacy and privacy of others.

Exercise of rights can be received through the department in charge of Article 12 below.

9. Processing of Personal Information by Children Under the Age of 14

The Company's services are primarily aimed at operators and adults and do not knowingly collect personal information from children under the age of 14. If it is necessary to process the personal information of children under the age of 14, we will implement necessary protective measures, such as obtaining the consent of the legal representative in accordance with relevant laws and regulations.

10. Installation, Operation and Rejection of Automated Personal Information Collection Device

The Company may use cookies to provide you with individual services and amenities. A cookie is a small amount of information that a website sends to a user's browser, which may be stored on the user's device.

You can allow or block the storage of cookies through your web browser settings. If you refuse to store cookies, you may experience difficulties using some personalized services.

• Chrome: Settings → Privacy & Security → Third-Party Cookies
• Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
• Safari: Settings → Privacy → Cookie blocking settings

11. Measures to ensure the safety of personal information

The Company takes the following measures to ensure the safety of personal information.

1. Management measures: establishment and implementation of internal management plan, minimization of personal information handlers and regular training
2. Technical measures: management of access rights to the personal information processing system, access control, storage and inspection of access records, encryption of important personal information, installation and renewal of security programs
3. Physical measures: Access control of personal information storage places such as computer rooms and data storage rooms

12. Personal information protection officer and reception and processing department of requests for access

The Company oversees the affairs related to the processing of personal information and designates the personal information protection officer and the responsible department as follows for the handling of complaints and remedies for damage caused by the information subject.

Role	Content
Chief Privacy Officer	Name: Kim Tae-young Job Title: CEO
Privacy Office	Phone: 02-6954-0203 Email: ondagl1111@gmail.com Fax: 070-8277-0803

The data subject may request all privacy-related inquiries, complaint handling, damage relief, and requests for access to personal information incurred while using the Company's services to the above contact information. The Company will respond to and process inquiries from information subjects without delay.

13. Remedies for infringement of personal information

If a data subject needs to report or discuss about a data breach, they can contact the following organizations: The following organizations are separate from the Company and are available if you are dissatisfied with the Company's personal data complaint handling or damage relief results, or if you require further assistance.

• Privacy Infringement Reporting Center: 118 without area code / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 / kopico.go.kr
• Supreme Prosecutor's Office: 1301 without area code / spo.go.kr
• National Police Agency: 182 without area code / ecrm.police.go.kr

14. Changes to the Privacy Policy

This Privacy Policy is effective January 1, 2026. If the contents are added, deleted or modified according to the laws and policies or changes in the processing status of the company's personal information, it will be notified through the notice on the website at least 7 days before the effective date. Provide at least 30 days' notice of any changes that materially affect the data subject's rights.

• Date of Notification: January 1, 2026
• Effective Date: January 1, 2026