Theori GDPR Policy

Effective Date: August 4, 2026 (Ver. 1.0)

This policy supplements Theori's Privacy Policy and provides additional rights and information for data subjects residing in the European Union (EU) and European Economic Area (EEA) under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

Where this policy conflicts with the Privacy Policy, this policy takes precedence for EU/EEA data subjects.

1. GDPR Overview

1.1 What Is the GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679, fully applicable since May 25, 2018) is the EU's comprehensive data protection law governing the processing of personal data of individuals within the European Union and European Economic Area.

1.2 Why the GDPR Applies to Theori

Theori, Inc. ("Theori," "we," "us," or "our") and its Korean affiliate Theori Korea do not have an establishment in the EU/EEA. However, under GDPR Art. 3(2), the GDPR applies when either of the following conditions is met. We satisfy both.

(a) Offering Goods or Services to EU Residents (Art. 3(2)(a))

We offer the following services directly to EU/EEA residents:

Per Recital 23, mere accessibility of a website does not trigger GDPR applicability. However, actively marketing to EU enterprises, providing English-language B2B services, and accepting job applications from EU residents are objective indicators of an "intention to offer" services to EU residents.

Note on Dreamhack (https://dreamhack.io): Dreamhack is a global cybersecurity education and CTF competition platform that is not specifically targeted at EU/EEA residents. While the platform is accessible worldwide with an English interface, it does not intentionally target EU residents as its primary audience. Nonetheless, EU/EEA residents who use Dreamhack are afforded the protections described in this policy.

(b) Monitoring the Behavior of EU Residents (Art. 3(2)(b))

We monitor the online behavior of EU/EEA residents through the following tools:

Per Recital 24, tracking individuals on the internet to create profiles or analyze behavioral patterns constitutes "monitoring."

1.3 Scope of the GDPR

Material Scope (Art. 2)

The GDPR applies to the processing of personal data wholly or partly by automated means and to the processing by non-automated means of personal data that forms part of, or is intended to form part of, a filing system.

The following activities fall within the material scope:

• Automated processing of registration, payment, and service usage data through online services
• Automated collection of behavioral data through web analytics tools (GA4, PostHog)
• Structured management of customer information through CRM systems (HubSpot, Salesforce)

Territorial Scope (Art. 3)

Theori is therefore subject to the extraterritorial application of the EU GDPR and UK GDPR under Art. 3(2)(a) and Art. 3(2)(b) and must appoint both an EU representative and a UK representative under EU GDPR Art. 27 and UK GDPR Art. 27.

UK GDPR: The UK Data Protection Act 2018 (incorporating the UK GDPR) applies to Theori's processing of personal data of UK residents on the same basis as described above. References to "GDPR" in this policy include the UK GDPR where applicable, and references to "EU/EEA" include the United Kingdom.

2. Controller and Processor Information

2.1 Controller (Art. 4(7))

The controller determines the purposes and means of processing personal data. The processing covered by this policy—directed at EU/EEA and UK residents through Theori's overseas business (Xint, aprism, ChainLight, the Theori corporate website) and overseas recruitment—is operated by the U.S. entity Theori, Inc. Accordingly, the controller under the EU GDPR and UK GDPR is Theori, Inc.

Controller: Theori, Inc.

2.2 Group Controller Structure (Theori Korea / Theori, Inc.)

The Theori group operates on a market-based structure of independent controllers. Each entity acts as an independent controller determining the purposes and means of processing for the market it operates, and there is no processing that the two entities jointly determine with respect to EU/UK data subjects.

• Domestic Korean services and Korean recruitment are handled independently by Theori Korea through separate systems in Korea and fall outside the scope of this policy (EU/UK GDPR).
• For data subjects in the EEA and the UK who use Dreamhack, Theori Korea is the controller, and this GDPR Policy applies to them in the same way. The appointment of our EU/UK representative (Euverify) under Section 4 was entered into by Theori, Inc. but covers both group entities, including Theori Korea; the Art. 27 appointment therefore applies to Theori Korea as well.
• Centralized security and data-protection functions: Theori's security and data-protection functions (including the DPO) are centralized in Korea. Accordingly, EU/UK personal data of the controller (Theori, Inc.) may be processed within the group by Theori's Korea-based Information Security Team, which acts on the controller's instructions. An intra-group data processing and transfer agreement applies between the two entities, reflecting the requirements of GDPR Art. 28 (purpose and duration of processing, confidentiality, security measures, control of sub-processors, cooperation with audits, and return or deletion of data on termination).
• Where transfers of personal data between the entities are necessary, they are carried out under the lawful transfer mechanisms set out in Section 9 (International Transfers). Transfers to Korea rely on the EU adequacy decision. Theori, Inc. is directly subject to the GDPR under Art. 3(2) and is therefore outside the scope of the current Standard Contractual Clauses; our intra-group data processing and transfer agreement and the safeguards in this policy apply instead (see Section 9.2).
• Single point of contact for data subjects: EU/UK data subjects may use privacy@theori.io as a single intake channel and may also contact the EU/UK representatives (Section 4).

2.3 Processor (Art. 4(8))

A processor processes personal data on behalf of the controller. For our B2B SaaS services, the roles between Theori and our customers are defined as follows:

B2B SaaS Role Allocation

Note: For personal data related to service operations—such as account information, billing, and customer support—Theori acts as the controller. The processor role applies only to data provided by the customer for analysis.

DPA (Data Processing Addendum) Requirements

Under GDPR Art. 28(3), processing by a processor must be governed by a written contract (DPA). We enter into DPAs with our B2B SaaS customers that include the following terms:

If you are a customer with an EU/EEA establishment, you may need to enter into a DPA with us to fulfill your own GDPR obligations. We provide a standard DPA template. Contact privacy@theori.io to request a copy.

3. Data Protection Officer (DPO)

3.1 DPO Appointment (Art. 37–39)

Under GDPR Art. 37, DPO appointment is mandatory for: (1) public authorities, (2) organizations engaged in large-scale regular and systematic monitoring, and (3) organizations processing special categories of data at scale. While Theori may not currently meet the mandatory appointment criteria, we have voluntarily appointed a DPO to strengthen our data protection governance and build trust with data subjects. The DPO concurrently heads our information security function. We have therefore documented a case-by-case conflict-of-interest assessment under GDPR Art. 38(6), applying the standard in CJEU Case C-453/21: decisions that determine the purposes and means of security-related processing are taken by the Information Security Team's operational leads rather than by the DPO, who acts in an advisory and monitoring capacity. The DPO reports directly to top management and cannot be dismissed or penalized for performing DPO tasks (Art. 38(3)).

3.2 DPO Responsibilities (Art. 39)

The DPO performs the following duties under GDPR Art. 39:

1. Informing and advising — Providing information and advice to the controller, processor, and their employees on GDPR obligations.
2. Monitoring compliance — Monitoring GDPR compliance through internal policies, staff training, and audits.
3. DPIA advisory — Advising on Data Protection Impact Assessments (Art. 35).
4. Supervisory authority liaison — Serving as the contact point for the supervisory authority.
5. Data subject contact point — Serving as the point of contact for data subjects wishing to exercise their GDPR rights (Art. 38(4)).

Data subjects may contact the DPO at any time regarding any matter related to the processing of their personal data or the exercise of their rights under the GDPR.

4. EU and UK Representatives (Art. 27)

4.1 Obligation to Appoint a Representative

Under EU GDPR Art. 27(1) and UK GDPR Art. 27, a controller or processor that falls within Art. 3(2)—that is, one without an establishment in the EU/UK but processing personal data of EU/UK residents—must designate a representative in writing in the EU and in the UK respectively.

Because Theori, Inc., as controller, is subject to the EU GDPR and UK GDPR under Art. 3(2)(a) and (b), we are required to appoint both an EU representative and a UK representative under Art. 27.

4.2 Current Status

EU & UK Representative Designation Status

Theori, Inc. has appointed Euverify as its EU and UK representatives under EU GDPR Art. 27 and UK GDPR Art. 27 (appointment effective July 29, 2026). EU/EEA data subjects and supervisory authorities may contact the EU representative; UK data subjects and the ICO may contact the UK representative. We also operate privacy@theori.io as a single intake channel.

If you are located in the EU or the UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative below.

EU Representative (Art. 27, EU GDPR)

UK Representative (Art. 27, UK GDPR)

Submitting a DSAR or other GDPR request

You can submit a Data Subject Access Request (DSAR), an erasure request, or any other GDPR request directly through our representative's secure portal. The same page confirms our appointed representative. Requests submitted there are logged and tracked, and we respond within the time limits set out in Section 7.2.

4.3 Role of the Representatives

Under Art. 27(4), each representative acts in addition to, or instead of, the controller or processor with respect to:

• Serving as the contact point for the supervisory authority (EU supervisory authorities and the UK ICO)
• Receiving inquiries and rights requests from data subjects
• Maintaining records of processing activities under Art. 30

4.4 Exemption Review

We have assessed the exemption grounds under Art. 27(2):

Conclusion: No exemption applies. Theori has appointed EU and UK representatives (Euverify) in accordance with its Art. 27 obligation.

5. Legal Bases for Processing (Art. 6(1))

5.1 Overview of Lawful Bases

GDPR Art. 6(1) establishes six legal bases for the lawful processing of personal data. Every processing activity must rely on at least one of these bases.

Note: Bases (d) vital interests and (e) public task do not apply to Theori's services. The sections below describe the four legal bases we rely on.

5.2 (a) Consent — Art. 6(1)(a)

Definition and Requirements

Consent is defined in Art. 4(11). For consent to be valid under the GDPR, it must satisfy all four of the following requirements:

Consent-Based Processing by Service

Withdrawal of consent: You may withdraw your consent at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5.3 (b) Contract — Art. 6(1)(b)

Definition

This basis applies when processing is necessary to perform a contract with the data subject or to take pre-contractual steps at the data subject's request.

Contract-Based Processing by Service

5.4 (c) Legal Obligation — Art. 6(1)(c)

Definition

This basis applies when processing is necessary to comply with a legal obligation under EU or Member State law. Theori's Korean affiliate, Theori Korea, is subject to retention obligations under Korean law, which apply primarily to its domestic Korean services as set out below. (For the treatment of third-country legal obligations under the GDPR, see the note below.)

Legal basis for third-country statutory obligations: "Legal obligation" under GDPR Art. 6(1)(c) covers only obligations arising under EU or Member State law. Retention obligations under Korean law therefore do not themselves constitute an Art. 6(1)(c) basis; where such processing falls within the scope of the GDPR, we rely on Art. 6(1)(f) legitimate interests (compliance with applicable law in order to handle disputes and preserve legal claims), and we assess the balance against data subjects' rights in Section 5.6 (Legitimate Interest Assessment). The tables below list the statutory obligations applicable in each jurisdiction.

Republic of Korea (Theori Korea) — Korean domestic services; Art. 6(1)(f) where the GDPR applies

For detailed Korean-law retention periods, see Privacy Policy Section 8.

EU/EEA (GDPR Direct Application)

For international data transfer safeguards (SCCs, UK Addendum, Swiss Addendum), see DPA Annex 2.

5.5 (f) Legitimate Interests — Art. 6(1)(f)

Definition

This basis applies when processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the data subject's interests, fundamental rights, and freedoms (particularly where the data subject is a child).

Reliance on this basis requires a Legitimate Interest Assessment (LIA)—a three-part balancing test.

Legitimate Interest-Based Processing by Service

5.6 Legitimate Interest Assessment (LIA) Summary

We have conducted a three-part balancing test (Purpose Test, Necessity Test, Balancing Test) for each processing activity relying on Art. 6(1)(f). The table below summarizes the results. Full LIA documentation is maintained internally and is available upon request to the DPO (privacy@theori.io).

5.7 Comprehensive Legal Basis Mapping

The table below maps each of Theori's major processing activities to the applicable GDPR legal basis.

6. Data Subject Rights (Art. 12–22)

The GDPR grants data subjects extensive control over their personal data. We respect all of the rights listed below and respond to data subject requests transparently and promptly.

General principle (Art. 12): We provide all information related to the exercise of data subject rights in a concise, transparent, intelligible, and easily accessible form, using clear and plain language.

6.1 Right to Be Informed — Art. 13, 14

Data subjects have the right to receive information when their personal data is collected and processed.

(a) Data Collected Directly from the Data Subject (Art. 13)

When we collect personal data directly from the data subject, we provide the following information at the time of collection:

(b) Data Not Collected Directly from the Data Subject (Art. 14)

When we collect personal data indirectly from a third party (e.g., Git commit metadata in Xint Code), we provide the following in addition to the Art. 13 disclosures:

Timing of disclosure: For indirect collection, we provide this information within a reasonable period (no later than one month) after obtaining the data or at the point of first contact with the data subject, whichever is earlier.

6.2 Right of Access — Art. 15

Data subjects have the right to obtain confirmation as to whether we process their personal data. If we do, they may access that data and the following related information:

Information Provided upon Access Request

1. Purposes of processing — The specific purposes for which personal data is processed
2. Categories of personal data — The types of personal data being collected and processed
3. Recipients or categories of recipients — To whom the data has been or will be disclosed (particularly recipients in third countries or international organizations)
4. Retention period — The envisaged retention period or, where not possible, the criteria used to determine it
5. Rights to rectification, erasure, restriction, and objection
6. Right to lodge a complaint with a supervisory authority
7. Source of the data — Where the data was not collected directly from the data subject
8. Automated decision-making (including profiling) — Where applicable, meaningful information about the logic involved, significance, and envisaged consequences

Copy of Personal Data

• We provide one copy free of charge.
• For additional copies, we may charge a reasonable fee based on administrative costs.
• When the request is made electronically, we provide the data in a commonly used electronic format (e.g., CSV, JSON, PDF) unless otherwise requested.

Limitation: Where the right of access would adversely affect the rights and freedoms of others (including trade secrets and intellectual property), we may adjust the scope of disclosure with appropriate balancing considerations.

6.3 Right to Rectification — Art. 16

Data subjects have the right to obtain the rectification of inaccurate personal data without undue delay. They may also request the completion of incomplete personal data, including by providing a supplementary statement.

6.4 Right to Erasure ("Right to Be Forgotten") — Art. 17

Data subjects have the right to request erasure of their personal data when any of the following grounds apply, and we will erase the data without undue delay.

Grounds for Erasure

1. The data is no longer necessary for the purpose for which it was collected or processed
2. The data subject withdraws consent (where consent was the legal basis) and no other legal basis applies
3. The data subject objects under Art. 21(1) and there are no overriding legitimate grounds for processing
4. The data subject objects to direct marketing processing under Art. 21(2)
5. The data has been unlawfully processed
6. Erasure is required to comply with a legal obligation under EU or Member State law
7. The data was collected in relation to information society services offered to a child under Art. 8(1)

Exceptions to Erasure

We may continue processing despite an erasure request where necessary for:

• Exercising the right of freedom of expression and information
• Compliance with a legal obligation under EU or Member State law (e.g., transaction records required by the E-Commerce Act)
• Reasons of public interest in public health (Art. 9(2)(h), (i) and Art. 9(3))
• Archiving, scientific or historical research, or statistical purposes in the public interest (Art. 89(1)), where erasure would render impossible or seriously impair the achievement of processing objectives
• The establishment, exercise, or defense of legal claims

Notification to recipients: Where we have made the personal data public, we take reasonable steps to inform other controllers processing that data of the erasure request, to the extent technically feasible.

6.5 Right to Restriction of Processing — Art. 18

Data subjects may request restriction of processing in any of the following circumstances:

Conditions for Restriction

Effect of Restriction

• Restricted personal data may only be processed—apart from storage—with the data subject's consent, or for legal claims, protection of others' rights, or important reasons of EU/Member State public interest.
• We notify the data subject before lifting any restriction.

6.6 Right to Data Portability — Art. 20

Data subjects have the right to receive their personal data in a portable format when all of the following conditions are met:

Requirements

1. Processing is based on consent (Art. 6(1)(a) or Art. 9(2)(a)) or contract performance (Art. 6(1)(b))
2. Processing is carried out by automated means

Scope of Portability

Portability by Service

Limitation: Exercising the right to portability does not affect the right to erasure (Art. 17). This right does not apply where it would adversely affect the rights and freedoms of others.

6.7 Right to Object — Art. 21

(a) Objection to Legitimate Interest-Based Processing (Art. 21(1))

Data subjects have the right to object at any time, on grounds relating to their particular situation, to processing based on legitimate interests (Art. 6(1)(f)) or public interest (Art. 6(1)(e)), including profiling.

• We will stop processing the personal data upon objection.
• However, we may continue processing if we demonstrate compelling legitimate grounds that override the data subject's interests, rights, and freedoms, or if processing is necessary for the establishment, exercise, or defense of legal claims.

(b) Objection to Direct Marketing (Art. 21(2)–(3))

Where a data subject objects to processing for direct marketing purposes, we immediately stop processing for that purpose. This right is absolute—we cannot override it by asserting legitimate grounds.

Disclosure obligation: We clearly present the right to object to data subjects at the point of first contact, separately from other information.

6.8 Rights Related to Automated Decision-Making — Art. 22

Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.

Theori's Current Status

We do not currently engage in automated decision-making (ADM) that produces legal effects or similarly significant effects on data subjects.

If we introduce automated decision-making in the future, we will comply with GDPR Art. 22(1)–(4) by providing prior notice to data subjects and guaranteeing their right to obtain human intervention, express their point of view, and contest the decision.

Profiling Disclosure (Art. 4(4))

Although Theori does not engage in ADM under Art. 22, the following tools involve profiling as defined in Art. 4(4) (automated processing of personal data to evaluate certain personal aspects):

These profiling activities do not produce legal effects or similarly significant effects on data subjects. Data subjects may exercise their right to object to profiling under Art. 21(1) by contacting privacy@theori.io.

7. How to Exercise Your Rights

7.1 Request Channels

You may submit a rights request through any of the following channels:

To help us respond promptly, please include the specific right you wish to exercise, the details of your request, and your contact information.

7.2 Response Timeline

7.3 Fees

• Exercising your rights is free of charge as a general rule.

• However, we may charge a reasonable fee based on administrative costs or refuse to act if a request is:

  • Manifestly unfounded
  • Excessive (particularly if repetitive)

• The burden of demonstrating that a request is manifestly unfounded or excessive lies with Theori.

7.4 Identity Verification

We verify the identity of individuals submitting rights requests through the following procedures:

Data minimization: Information collected solely for identity verification is destroyed without delay after verification and is not used for any other purpose.

7.5 Right to Lodge a Complaint with a Supervisory Authority

If you are dissatisfied with how we process your personal data, you have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement (Art. 77).

For a full list of EEA supervisory authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

8. Children's Personal Data

8.1 General Principle

We do not direct our services to children under 16 years of age and do not knowingly collect personal data from children under 16.

Under GDPR Art. 8(1), the age of consent for information society services is 16 by default, though Member States may lower it to 13. We apply the strictest standard of 16 years.

8.2 Age Requirements by Service

8.3 Actions When Children's Data Is Discovered

If we become aware that we have collected personal data from a child under 16, we take the following actions without undue delay:

1. Immediately delete the personal data.
2. Notify the child or their holder of parental responsibility of the deletion.
3. Request deletion from any third parties to whom the data was disclosed.

8.4 Parental Consent

Where processing of a child's personal data under 16 is unavoidable, we obtain consent from the holder of parental responsibility and make reasonable efforts to verify that consent was given or authorized by the holder of parental responsibility (Art. 8(2)).

9. International Data Transfers

Theori may transfer personal data collected in the EU/EEA to countries outside the EEA to deliver our global services. For all international transfers, we apply appropriate safeguards under GDPR Chapter V (Art. 44–49) to ensure that data subjects' personal data receives a level of protection essentially equivalent to that within the EU/EEA.

9.1 Transfers Based on an Adequacy Decision (Art. 45)

The European Commission may adopt an adequacy decision recognizing that a specific country ensures an adequate level of data protection. Transfers to countries covered by an adequacy decision do not require additional safeguards.

Republic of Korea — Adequacy Decision

• Decision: Commission Implementing Decision (EU) 2022/254 (adopted December 17, 2021)
• Significance: The European Commission recognized that the Republic of Korea provides a level of data protection essentially equivalent to that of the EU GDPR through its Personal Information Protection Act ("PIPA," 개인정보보호법) and related laws.
• Effect: Transfers from the EU/EEA to the Republic of Korea are permitted under GDPR Art. 45 without additional safeguards. Accordingly, data transfers to Theori Korea are lawfully carried out under the adequacy decision.

Republic of Korea — UK Adequacy Regulations

• Basis: Data Protection (Adequacy) (Republic of Korea) Regulations 2022 (in force 19 December 2022)
• Significance: This was the UK's first adequacy regulation following its withdrawal from the EU, and its scope is broader than the EU adequacy decision in that it also covers transfers of credit information.
• Effect: Transfers from the UK to the Republic of Korea are permitted under UK GDPR Art. 45A (formerly Art. 45; restructured by the Data (Use and Access) Act 2025 s.85 and Schedule 7, in force 5 February 2026) without additional safeguards.

Note: Adequacy decisions and regulations are reviewed periodically by the European Commission and the UK government respectively. We continuously monitor their validity.

9.2 Transfers Based on Standard Contractual Clauses (SCCs) (Art. 46)

For transfers to countries without an adequacy decision (e.g., the United States), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision (EU) 2021/914).

Transfers subject to the UK GDPR: EU SCCs cannot be used as-is for transfers governed by UK law. Where a Chapter V transfer from the UK to a country without UK adequacy regulations occurs, we enter into the ICO-approved UK Addendum to the EU SCCs. Its operative terms are set out in advance in DPA Annex 2, Part 2 and take effect when the Customer accepts the DPA. Because Theori, Inc. is not certified under the DPF, we do not rely on the UK Extension to the DPF.

In addition to SCCs, we conduct Transfer Impact Assessments (TIAs) to evaluate the legal environment of the destination country and determine whether supplementary measures are needed. As explained below, SCCs cannot be used for transfers to Theori, Inc.; for transfers to our US-based sub-processors we rely on SCCs, and several of those sub-processors are certified under the EU-U.S. Data Privacy Framework (DPF), providing additional protection. Theori, Inc. is not currently DPF-certified.

Key Sub-processors Receiving International Transfers

What counts as a "transfer". Where an EU/EEA data subject provides personal data directly to Theori, Inc. — for example by signing up for a service or contacting or applying to us directly — this is not a "transfer" within the meaning of Chapter V of the GDPR, following EDPB Guidelines 05/2021; the GDPR applies directly to that processing under Art. 3(2).

For routes that do constitute a Chapter V transfer (an exporter in the EU to an importer in a third country), the safeguards below apply. However, the current Standard Contractual Clauses (Implementing Decision (EU) 2021/914) cannot be used for an importer whose processing falls within the scope of the GDPR under Art. 3(2) (see recital (7) of that Decision). We will adopt the European Commission's Standard Contractual Clauses for that scenario as soon as they are published. In the meantime, the technical and organisational safeguards set out in this policy and in our intra-group data processing and transfer agreement continue to apply.

The table below lists the key sub-processors to which we transfer personal data collected in the EU/EEA. We apply the EU Standard Contractual Clauses to U.S. sub-processors whose receipt constitutes a Chapter V transfer. As explained above, Theori, Inc. is directly subject to the GDPR under Art. 3(2) and is therefore outside the scope of the current SCCs; our intra-group data processing and transfer agreement and the technical and organisational safeguards in this policy apply instead.

9.3 Other International Transfers

• Typeform SL is incorporated in Barcelona, Spain, but Standard plan data is processed and stored in the United States (AWS Virginia). We apply SCCs accordingly.
• Paperform Pty Ltd is an Australian company, but data is stored on servers in the United States (AWS). The United States is not currently covered by an EU adequacy decision, so we apply SCCs to ensure appropriate safeguards.

9.4 Requesting a Copy of SCCs

Data subjects may request a copy of the Standard Contractual Clauses (SCCs) that we have entered into with our sub-processors. Trade secrets and confidential information may be appropriately redacted.

How to request:

• Email: privacy@theori.io
• Mail: 9F, 14 Teheran-ro 4-gil, Gangnam-gu, Seoul 06232, Republic of Korea — Theori Information Security Team
• Response time: Within 30 days of receiving the request

10. Cookies and Tracking Technologies

10.1 Legal Basis

We use cookies and similar tracking technologies in accordance with the EU ePrivacy Directive (Directive 2002/58/EC, Art. 5(3)). Cookies other than those strictly necessary for service delivery are placed only after obtaining the data subject's prior opt-in consent, managed through our consent management platform.

10.2 Cookie Categories

We classify our cookies into the following four categories:

For detailed information about cookie categories, third-party service providers, and consent management, see our Cookie Policy.

10.3 Consent Management

• Opt-in principle: We place cookies other than strictly necessary cookies only after obtaining prior consent.
• Opt-out: You may withdraw cookie consent at any time. After withdrawal, the relevant cookies are no longer placed.
• Consent Management Platform (CMP): Theori uses Cookiebot (Usercentrics A/S) as its Consent Management Platform, which complies with the ePrivacy Directive, GDPR, and applicable Member State laws. The Cookiebot consent banner is displayed automatically upon first visit to the services where it is deployed and allows you to accept or reject non-essential cookies by category (analytics, marketing, functional). Cookiebot is deployed on every service that uses advertising or analytics cookies; you may also delete cookies in your browser to have the consent banner reappear, or manage cookies through your browser settings.

10.4 Managing Cookies through Browser Settings

You can refuse the storage of cookies or delete existing cookies through your web browser settings.

Note: Disabling cookies may prevent certain service features—such as login and shopping carts—from functioning properly.

11. Data Protection Impact Assessment (DPIA)

11.1 Legal Requirements

Under GDPR Art. 35, where processing is likely to result in a high risk to the rights and freedoms of data subjects, a Data Protection Impact Assessment (DPIA) must be carried out before processing begins.

A DPIA is mandatory for the following types of processing (Art. 35(3)):

• (a) Systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing, including profiling, that produces legal effects or similarly significant effects
• (b) Large-scale processing of special categories of data (Art. 9(1)) or criminal conviction and offense data (Art. 10)
• (c) Systematic monitoring of a publicly accessible area on a large scale

11.2 Theori's DPIA Candidates

We are evaluating the need for DPIAs for the following processing activities:

11.3 DPIA Methodology

We reference the CNIL PIA (Privacy Impact Assessment) tool when conducting DPIAs and include the following elements required by GDPR Art. 35(7):

Art. 35(7) DPIA Required Components:

1. Systematic description of processing operations

   • Processing purposes, legal basis (including legitimate interests)
   • Description of envisaged processing operations and data flows

2. Necessity and proportionality assessment

   • Determining whether collection and processing are necessary relative to the stated purposes
   • Compliance with the data minimization principle

3. Risk assessment for data subjects' rights and freedoms

   • Evaluating the source, nature, specificity, and severity of risks
   • Analyzing potential impacts on data subjects

4. Risk mitigation measures

   • Safeguards, security mechanisms, and technical and organizational measures to mitigate risks
   • Mechanisms to demonstrate protection of data subjects' rights

Reference: The CNIL PIA tool is available free of charge at https://www.cnil.fr/en/privacy-impact-assessment-pia and provides a systematic methodology for conducting DPIAs.

11.4 Prior Consultation

If a DPIA indicates that processing would result in a high risk that cannot be mitigated through safeguards, we will request prior consultation with the competent supervisory authority under GDPR Art. 36.

12. Personal Data Breach Notification

12.1 Notification to Supervisory Authority (Art. 33)

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach.

If notification within 72 hours is not feasible, we will provide the reasons for the delay.

Notification content (Art. 33(3)):

• The nature of the personal data breach, including the categories and approximate number of data subjects affected
• The name and contact details of the DPO
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach

12.2 Notification to Data Subjects (Art. 34)

Where a personal data breach is likely to result in a high risk to data subjects' rights and freedoms, we will notify the affected data subjects without undue delay.

However, individual notification to data subjects may be waived under the following conditions (Art. 34(3)):

• The breached data was protected by appropriate technical measures (e.g., encryption) rendering it unintelligible to unauthorized persons
• Subsequent measures have been taken that ensure the high risk is no longer likely to materialize
• Individual notification would involve disproportionate effort, in which case a public communication of equivalent effectiveness is made instead

12.3 Incident Response Process

We maintain an Incident Response Plan for systematic breach response. Key steps include:

1. Detection and initial response — Breach detection through security monitoring systems and initial containment measures
2. Impact assessment — Evaluating the scope, type of data, number of data subjects, and risk level
3. Supervisory authority notification — Notification within 72 hours to the competent supervisory authority
4. Data subject notification — Notification to data subjects without undue delay when high risk is identified
5. Root cause analysis and prevention — Root cause analysis and implementation of corrective and preventive measures
6. Record retention — Retaining records of all breach incidents, including facts, effects, and remedial actions taken (Art. 33(5))

Breach reporting contacts:

• Email: security@theori.io / privacy@theori.io
• Phone: +82-70-8864-1337

13. Filing Complaints with Supervisory Authorities

13.1 Right to Lodge a Complaint (Art. 77)

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or the Member State where the alleged infringement occurred.

13.2 Supervisory Authority Contact Information

A complete list of EU/EEA supervisory authorities and their contact details is available on the European Data Protection Board (EDPB) website:

• EDPB Members: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

13.3 Theori DPO Contact

Before filing a complaint with a supervisory authority, we encourage you to contact our DPO first so we can work to resolve your concern promptly.

• Name: Kenny Kwansoon Park (박관순)
• Title: Chief Information Security Officer (CISO / CPO / DPO)
• Email: privacy@theori.io
• Phone: +82-70-8864-1337
• Address: 9F, 14 Teheran-ro 4-gil, Gangnam-gu, Seoul 06232, Theori Korea

14. Theori's Commitment to GDPR Compliance

Theori is committed to complying with the GDPR and all applicable data protection laws. To this end:

• DPO appointment: We are not subject to mandatory designation under GDPR Art. 37, but have voluntarily appointed a Data Protection Officer (see Section 3.1).
• Regular audits: We conduct periodic internal audits of our personal data processing activities.
• Employee training: We provide regular GDPR and data protection training to all employees.
• Records of processing: We maintain Records of Processing Activities (ROPA) as required by Art. 30.
• Privacy by Design: We embed data protection into the design phase of our services in accordance with Art. 25.

15. Policy Changes

15.1 Advance Notice

When we update this GDPR Policy, we will provide at least 7 days' advance notice through website notifications.

15.2 Material Changes

For changes that materially affect data subjects' rights, we may request renewed consent:

• Changes to the categories of personal data collected
• Changes to or additions of processing purposes
• Material changes to international transfer destinations or sub-processors
• Changes to data subject rights exercise procedures

Change Log

Data Protection Officer (DPO) Contact

Language

This policy is published in Korean and English. The Korean version is the authoritative text for disclosures required by the Korean Personal Information Protection Act and for data subjects in the Republic of Korea; the English version is the authoritative text for data subjects in the EEA, the United Kingdom and other jurisdictions. We maintain both versions in substantive alignment. If you identify any discrepancy, please contact privacy@theori.io and we will correct it without delay. Neither version limits any right guaranteed to you by applicable law, and where the versions differ, the version more favorable to the data subject applies.

Supplementary Provisions

This GDPR Supplemental Policy v1.0 takes effect on the date shown at the top of this document.

All previous privacy policies can be found on our consolidated Previous Versions page:

• View Previous Privacy Policies