Privacy Policy

Hanco Lab (hereinafter referred to as the "Company") complies with personal information protection regulations under relevant laws, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and the Personal Information Protection Act, and is committed to protecting your personal information.

Through this Privacy Policy (hereinafter referred to as this "Document"), the Company informs you of the purposes and methods by which the personal information you provide is used, as well as the measures taken to protect your personal information.

Article 1 (Items and Methods of Personal Information Collection)

1. The Company collects the following minimum personal information for the purposes of consultation, quotation, service provision, and contract fulfillment.

   • General Collection Items: Customer name (or identifiable nickname; corporate name for legal entities), contact information (phone number or other contactable messenger ID), and email address

   • Methods of Collection: Email, 1:1 messenger, or customer service (CS) channels operated by the Company, etc.

2. The Company may limitedly collect the customer's financial API and system integration information if necessary to provide the services, solutions, and products offered by the Company. However, to comprehensively comply with the Financial Investment Services and Capital Markets Act, the Company applies strictly separated API information collection policies depending on the type of service provided.

   • A. Custom Automated Trading Development Solutions (Limited Collection)
     The Company may be limitedly provided with API information (such as API Keys and Secret Keys) for global exchanges, securities firms, and brokers, access rights for cloud servers (such as authentication codes), and login information (ID, PW, etc.) with the customer's prior consent. This is strictly limited to the purposes of "development, testing, and debugging" to develop the software and verify that the order logic operates correctly in the customer's actual server environment. This is not intended to act as an agent for asset management or engage in discretionary investment business under the Financial Investment Services and Capital Markets Act, but is a one-time delegation of authority solely for building IT systems and verifying errors within the customer's environment. Upon completion of the initial software setup and operational verification, the relevant information is permanently destroyed from the Company's database and local PCs. The Company does not separately store the customer's financial access keys or arbitrarily view financial information.

   • B. Software as a Service (SaaS) Solutions such as OptiView (Complete Blockade of Collection)
     Software as a Service (SaaS) solutions, such as OptiView, are independent information and communication tools that provide only calculation results and statistical indicators based on generalized mathematical and statistical models. Therefore, in connection with the provision of this service, the Company does not under any circumstances collect, store, or request any financial authorization information that can access actual trade execution and assets, such as the customer's exchange API Keys. The final system integration and trade execution are carried out entirely within the customer's independent environment and under the customer's own control.

Article 2 (Purposes of Collection and Use of Personal Information)

The Company utilizes the collected personal information for the following purposes:

• Fulfillment of Contracts and Settlement Related to Service Provision: Software development and testing in simulated and actual environments, provision of Software as a Service (SaaS) solutions, establishment of server infrastructure, dispatching of invoices, and issuance of tax invoices, etc.

• Customer Management: Identity verification regarding service usage, handling of inquiries and complaints, delivery of notices, and providing customer service (CS) responses during the free maintenance period, etc.

​

Article 3 (Retention and Use Period of Personal Information)

The Company permanently destroys personal information without delay once the purposes of collection and use have been achieved. However, if retention is required pursuant to the provisions of relevant laws (such as the Act on Consumer Protection in Electronic Commerce, etc.), the Company may retain customer information for a certain period prescribed by such relevant laws as follows:

• Records on Contracts or Withdrawal of Subscription, etc.: 5 years
• Records on Payment and Supply of Goods, etc.: 5 years
• Records on Consumer Complaints or Dispute Resolution: 3 years

Article 4 (Procedures and Methods for Destruction of Personal Information)

The Company destroys personal information without delay once the purposes of processing have been achieved. The procedures and methods for destruction are as follows:

• Destruction Procedure: Personal information that has achieved its purpose is transferred to a separate database (in the case of paper, a separate filing cabinet) and stored for a certain period in accordance with internal policies and other information protection grounds under relevant laws (refer to Retention and Use Period) before being destroyed.

• Destruction Method: Personal information stored in the form of electronic files is deleted using technical methods that render the records un-reproducible, and personal information printed on paper is destroyed by shredding with a shredder or by incineration.

Article 5 (Provision to Third Parties and Entrustment of Personal Information)

The Company processes the customer's personal information only within the scope specified in Article 1, and does not process it beyond the original scope or provide it to third parties without the customer's prior consent. However, exceptions are made in cases aimed at complying with relevant laws, or when there is a request from an investigative agency for investigative purposes in accordance with the procedures and methods prescribed by laws.

Article 6 (Rights of the Data Subject and Methods of Exercise)

1. Customers may at any time request to view or modify their registered personal information, and may request the complete deletion of the relevant personal information.

2. If a request for the correction of an error in personal information is made, the Company will not use or provide the personal information containing the error until the correction is completed.

Article 7 (Chief Privacy Officer and Responsible Department)

To protect customers' personal information and handle complaints related to personal information, the Company has designated a Chief Privacy Officer as follows:

• Name of Officer: Jimin CHEON

• Affiliation / Position: CEO, Hanco Lab

• Email: contact@hancolab.com

[Addendum] This 'Privacy Policy' shall take effect on March 23, 2026.

If you need to report or seek consultation regarding any infringement of personal information, please contact the following competent authorities in the Republic of Korea (South Korea):

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972 (1833-6972 within South Korea)

• Personal Information Infringement Report Center: privacy.kisa.or.kr / +82-118 (118 within South Korea)