OriginX Inc. ("OriginX") takes the protection of participants' personal information in ORIGIN SEOUL 2026 seriously and complies with the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection of the Republic of Korea. This Privacy Policy outlines the purposes for collecting personal information, how it is used, and the measures taken to protect it. Please review the following carefully before deciding whether to provide your consent.

1. Purpose of Collection and Use of Personal Information

All information provided by users will be used solely for the following purposes and will not be used for any other purpose.

• Collected by: OriginX Inc. (주식회사 오리진엑스)

• Purpose of collection and use: Management of ORIGIN SEOUL 2026 participants, event operations, ticket issuance and verification, payment processing, delivery of event-related notices, distribution of newsletters, and provision of other promotional materials.

• Items of personal information collected:

  • Required: Name, email address, payment information (card details, account information, etc.)

  • Optional: Nationality, organization, position, country of residence, phone number

  • Automatically collected: IP address, cookies, access logs, service usage records

• Retention and use period: One (1) year after the event ends. However, where retention is required under the Act on Consumer Protection in Electronic Commerce or other applicable laws, OriginX shall retain member information for the period specified by such laws.

2. Rights of Users and Their Effects

• Right to refuse consent: Users have the right to refuse to provide personal information. However, in such cases, participation in ORIGIN SEOUL 2026 and related activities may be restricted.

• Right to withdraw consent: Users may withdraw their consent to the provision of personal information at any time after providing it. However, withdrawal may result in not receiving important event updates or restrictions on event participation.

• Right to access, correction, and deletion: Users may request access to, correction of, or deletion of their personal information at any time, and OriginX shall process such requests without delay.

3. Provision of Personal Information to Third Parties

OriginX processes users' personal information only within the scope specified in this policy and shall not process information beyond its original scope or provide it to third parties without the user's prior consent, except in the following case.

• Recipient: TossPayments Inc. (주식회사 토스페이먼츠)

• Purpose of provision: Payment processing, refund processing, and resolution of payment-related disputes

• Items of personal information provided: Name, email address, payment information (card details, account information, etc.)

• Retention and use period: Five (5) years after payment completion (mandatory retention period under the Act on Consumer Protection in Electronic Commerce)

4. Rights of Users Regarding Third-Party Provision

• Right to refuse consent: Users may refuse consent to third-party provision. However, in such cases, payment will not be possible, which may restrict event participation.

• Effect of withdrawing consent: Withdrawal of consent may result in restrictions on payment processing and refund processing.

5. Outsourcing of Personal Information Processing

OriginX outsources certain personal information processing tasks to external specialized companies for the smooth provision of services, as follows.

• TossPayments Inc:

  Payment processing and refunds

• Vercel Inc. / Framer B.V.

  Website hosting and operation

• Amazon Web Services Korea

  Cloud infrastructure operation

In accordance with Article 26 of the Personal Information Protection Act, OriginX specifies in contracts the prohibition of processing personal information for purposes other than the outsourced work, technical and administrative protection measures, restrictions on re-outsourcing, supervision of outsourced parties, and liability for damages. OriginX also supervises whether outsourced parties handle personal information securely.

6. Measures to Ensure the Security of Personal Information

OriginX implements the following measures to ensure the security of users' personal information.

• Administrative measures: Establishment and implementation of internal management plans, minimization of personnel handling personal information, and regular training.

• Technical measures: Access rights management for personal information processing systems, installation of access control systems, encryption of personal information, and installation of security programs.

• Physical measures: Access control to data storage rooms and other sensitive locations.

7. Personal Information Protection Officer

OriginX has designated the following Personal Information Protection Officer to protect users' personal information and address related complaints.

• Personal Information Protection Officer: Ryan Lee (이정욱)

• Affiliation: OriginX Inc.

• Email: privacy@originseoulbtc.com

8. Remedies for Infringement of Rights

Users may contact the following organizations for reporting or consulting on personal information infringement.

• Korea Internet & Security Agency Privacy Center (privacy.kisa.or.kr / 118)

• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)

• Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr / 1301)

• National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

9. Changes to the Privacy Policy

This Privacy Policy takes effect on May 31, 2026. Any additions, deletions, or amendments due to changes in laws or policies will be announced on the website at least seven (7) days before the effective date of such changes.