Privacy Policy

CANCO Co., Ltd. (the “Company”) establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act to protect data subjects' personal data and to handle related grievances promptly and smoothly. This policy applies to the Company website (canco.co.kr).

Article 1 Purposes of processing personal data

The Company processes personal data for the following purposes and does not use it for any other purpose. If the purpose changes, the Company will take necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Responding to inquiries: Reviewing and answering inquiries about products, services, quotes and technical support, and replying with consultation results
2. Partner (distributor and reseller) recruitment: Reviewing applications and contacting applicants for consultation and contract review
3. Job applications: Verifying applicants, reviewing for hiring and notifying results
4. CANCO News comments: Verifying commenters, editing and deleting one's own comments, preventing misuse
5. Website operation: Ensuring service stability, visit statistics, preventing unauthorized access

Article 2 Personal data processed and collection methods

The Company does not collect unique identifiers such as resident registration numbers or sensitive information through the website.

Article 3 Retention and use period

The Company destroys personal data without delay once the purpose of processing is achieved, except that it is retained for the periods below.

Article 4 Provision to third parties

The Company processes personal data only within the purposes in Article 1 and provides it to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law. Personal data collected through the website is currently not provided to any third party.

Article 5 Outsourcing of personal data processing

The Company outsources personal data processing as follows for smooth business operations.

When outsourcing, the Company specifies necessary terms in the contract to ensure personal data is managed securely, and manages and supervises the contractor. Any change in outsourced tasks or contractors will be disclosed through this policy.

When social login is used, login authentication is handled by Google LLC and NAVER Corp. under their respective privacy policies, and the Company processes only the information received as the authentication result.

Article 6 Processing of customers' recording data

Call recordings, transcripts and analysis data processed in the Company's recording services such as EduRecording and Manggo are managed by the customer (school, institution or business) that adopted the service as the personal data controller, and the Company processes them as a processor under the service contract and personal data processing outsourcing agreement signed with the customer. The purposes, retention period and access for such data follow each customer's privacy policy and contract.

Article 7 Destruction procedures and methods

1. Destruction procedure: Personal data whose retention period has expired or whose purpose has been achieved is destroyed without delay. Data that must be retained by law is stored separately.
2. Destruction method: Electronic files are permanently deleted in an unrecoverable manner, and paper documents are shredded or incinerated.

Article 8 Rights and obligations of data subjects and how to exercise them

1. Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal data, and may withdraw consent.
2. Rights may be exercised in writing, by phone or by email ([email protected]), and the Company will act without delay.
3. Rights may also be exercised through a legal representative or authorized person, in which case a power of attorney must be submitted.
4. Deletion cannot be requested for personal data specified as subject to collection by other laws, and requests to suspend processing may be refused as permitted by law.

Article 9 Security measures for personal data

1. Administrative measures: Minimizing personal data handlers, establishing internal management standards and conducting regular inspections
2. Technical measures: HTTPS (SSL/TLS) encrypted communication, one-way encrypted storage of comment passwords, access rights management, security software
3. Physical measures: Access control for servers and data storage locations

Article 10 Installation, operation and refusal of cookies

The Company uses cookies to remember display settings such as “Don't show again today” and to keep you logged in. You can refuse cookies in your browser settings (e.g. Chrome — Settings › Privacy and security › Cookies and other site data); if you do, some features may be limited.

Article 11 Chief Privacy Officer

For privacy inquiries, complaints or remedies for damages, contact us at the details above and we will respond and act without delay.

Article 12 Remedies for infringement of rights

To seek remedies for personal data infringement, you may apply for dispute resolution or consultation with the following organizations.

• Personal Information Dispute Mediation Committee: (no area code) 1833-6972 · www.kopico.go.kr
• Personal Information Infringement Report Center: (no area code) 118 · privacy.kisa.or.kr
• Supreme Prosecutors' Office: (no area code) 1301 · www.spo.go.kr
• Korean National Police Agency: (no area code) 182 · ecrm.police.go.kr

Article 13 Changes to the Privacy Policy

This Privacy Policy applies from October 4, 2026. Any additions, deletions or modifications will be announced on the website at least 7 days before they take effect.