Effective date: 2026-08-24. This is the Privacy Policy of EIPGRID Inc. The Korean version is the authoritative text; the English version is provided for convenience, and in case of any discrepancy the Korean version prevails.

EIPGRID Inc. and its affiliated companies (“EIPGRID”, “we” or “us”) provide this Privacy Policy (the “Policy”) to describe our practices regarding the information we collect, use and share when you interact with our website at www.eipgrid.com (the “Site”) and with our email and telephone communications (together with the Site, the “Services”). EIPGRID provides AI-based energy data analytics (PowerSight), automated energy cost optimization (EnergySaver and EnergySaver Edge) and flexibility services such as demand response and virtual power plant (VPP) operation.

This Policy is established and disclosed in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea in order to protect the personal information of visitors and to handle related concerns promptly and effectively. By using the Services, you consent to the collection and use of information as described in this Policy.

1. When This Privacy Policy Applies

This Policy applies to the Site, to emails we send, and to information we collect when you contact us by email or telephone. It does not apply to EIPGRID’s products or services (including PowerSight, EnergySaver and EIPGRID’s flexibility services), which are governed by their own agreements and privacy terms, nor to third-party websites or services that may link to or from the Site. Please review the privacy policies of those websites and services directly to understand their privacy practices.

2. Personal Information We Collect and How We Collect It

In this Policy, “personal information” means information relating to a living individual that identifies, or can reasonably be combined with other information to identify, that individual.

The Site is an informational website. It does not offer user accounts, logins, purchases or payments. On the Site, we collect personal information only when you voluntarily submit it to us through the following methods:

• Inquiry form: name, company or organization, email address, telephone number (optional) and the content of your inquiry. The inquiry form is operated on the Site itself; what you enter is transmitted to us by email through Amazon Web Services (Amazon SES) and is not stored on the Site. The form uses Cloudflare Turnstile to prevent automated abuse. We ask for your consent to the collection and use of this information before you submit.
• Email or telephone: your name, contact details and any other information you choose to provide when you contact us at contact@eipgrid.com or +82-2-3430-1210.
• Business relationship: where you become or express interest in becoming a client of EIPGRID, we may additionally collect business information such as your job title, employer and business contact details, and information about your energy facilities relevant to the requested service.

Information collected automatically: When you visit the Site, our hosting and content delivery providers may automatically record technical information generated in the course of serving the Site, such as your IP address, browser type and version, operating system, referring URL, pages visited and time of visit, in standard server logs used for security and operational purposes. If you accept analytics and marketing cookies, Google Analytics, Google Ads and LinkedIn additionally collect usage data as described in Section 6.

We do not collect payment information, precise geolocation data or sensitive personal information through the Site.

3. Purposes of Use

We use the personal information we collect for the following purposes:

• To respond to your inquiries and fulfill your requests;
• To establish, administer and develop our business relationship with you and the organization you represent, including preparing proposals and providing information about our products and services;
• To send you information or newsletters you have requested or agreed to receive;
• To operate, secure and improve the Site;
• With your consent, to analyze how the Site is used and to measure and improve the effectiveness of our marketing (see Section 6);
• To detect, investigate and prevent activities that may violate our policies or be fraudulent or illegal, and to comply with legal obligations.

4. Retention and Use Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected. Inquiry data is retained until your inquiry has been handled and the purpose of collection has been fulfilled, and is then destroyed without delay. Where a longer retention period is required by applicable laws (for example, the Act on the Consumer Protection in Electronic Commerce or the Protection of Communications Secrets Act), we retain the relevant information for the period required by those laws and for no other purpose. Information relating to an ongoing business relationship is retained for the duration of that relationship and any period thereafter required by law or by the applicable agreement.

Statutory retention periods that may apply are as follows:

• Records on contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce, Article 6)
• Records on payment and supply of goods or services: 5 years (Act on the Consumer Protection in Electronic Commerce, Article 6)
• Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, Article 6)
• Records on labeling and advertising: 6 months (Act on the Consumer Protection in Electronic Commerce, Article 6)
• Website access logs and connection records: 3 months (Protection of Communications Secrets Act, Article 15-2)
• Books and supporting documents relating to transactions: 5 years (Framework Act on National Taxes, Article 85-3; Value-Added Tax Act, Article 71)

5. Provision to Third Parties and Outsourcing of Processing

We do not sell personal information. Analytics and marketing tags (Google, LinkedIn) receive usage data only with your consent, as described in Section 6. Otherwise we disclose personal information only in the following circumstances.

Service providers (outsourced processing): We entrust certain processing to service providers that act on our behalf and are bound to process personal information only as instructed by us and in accordance with applicable law, including:

• Google LLC: email services (Google Workspace, where inquiry emails are received); web analytics (Google Analytics 4) and advertising measurement (Google Ads) via Google Tag Manager, subject to your consent.
• LinkedIn Corporation: conversion measurement and audience insights (LinkedIn Insight Tag), subject to your consent.
• Hosting and content delivery providers, such as Cloudflare, Inc. and Amazon Web Services, Inc.: hosting of the Site and delivery of Site content, including images served from our content delivery network; operation of the inquiry form endpoint and bot protection (Cloudflare Turnstile); and transmission of inquiry emails (Amazon SES).
• Professional advisers, such as legal, accounting and audit firms, where necessary for the operation of our business.

In limited circumstances a service provider (for example, Google when you use the inquiry form) collects data directly from you, in which case its own privacy policy also applies.

Authorities and legally authorized recipients: We may disclose personal information to third parties in order to comply with a legal obligation; when we believe the law requires it; at the request of governmental authorities conducting an investigation; to verify or enforce our Terms of Use or other applicable policies; to respond to an emergency; or otherwise to protect the rights, property, safety or security of EIPGRID, users of the Services or others.

Affiliates and business transfers: EIPGRID may share personal information with its subsidiaries and affiliates for business and operational purposes. In the event of a merger, acquisition, sale of all or part of our assets or similar business transition (including during any related due diligence), personal information may be among the assets transferred, subject to applicable law.

Other than as described above, we provide personal information to third parties only with your separate consent or where otherwise permitted by applicable law.

6. Cookies, Analytics and Marketing Tags

The Site stores your language preference (English or Korean) in your browser’s local storage so that the Site is displayed in your chosen language on your next visit. This value is not personal information, is not transmitted to us and is not used to identify or track you.

With your consent, the Site uses Google Tag Manager to load the following analytics and marketing tags, which set cookies or similar identifiers in your browser:

• Google Analytics 4 (Google LLC): measures visits, pages viewed, traffic sources, approximate location (based on a truncated IP address) and interactions such as clicks on inquiry buttons, in order to understand how the Site is used and to improve it. Data is retained in Google Analytics for up to 14 months.
• Google Ads (Google LLC): conversion measurement and remarketing, so that we can measure the effectiveness of our advertising and show relevant advertisements on Google services to visitors of the Site.
• LinkedIn Insight Tag (LinkedIn Corporation): conversion measurement, website audience insights and retargeting on LinkedIn.

These tags are not loaded until you click “Accept” in the cookie banner. If you click “Decline”, or make no choice, no analytics or marketing cookies are set; your choice is stored in your browser (acceptance for 180 days, refusal for 7 days) and you can change it at any time by clearing your browser’s site data, after which the banner will be shown again. You can also opt out through your browser settings, the Google Analytics opt-out add-on, Google Ads Settings and LinkedIn guest controls. The Site does not respond to browser “Do Not Track” signals; please use the cookie banner instead. The processing of data by Google and LinkedIn is governed by their respective privacy policies.

Third-party services linked from the Site (such as Google Forms) may set their own cookies when you use them, subject to their own privacy policies.

7. Your Rights and How to Exercise Them

As a data subject, you (or your legal representative) may exercise the following rights with respect to your personal information at any time:

• Access: to request access to the personal information we hold about you and information about how it is processed;
• Correction and deletion: to request that inaccurate or incomplete personal information be corrected, or that your personal information be deleted;
• Suspension of processing: to request that we suspend processing of your personal information;
• Withdrawal of consent: to withdraw any consent you have given, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, please contact us at contact@eipgrid.com (or by post or telephone using the contact details in Section 12). We will respond without delay and within the period required by applicable law. For everyone’s protection, we may ask you to provide information sufficient to verify your identity (for example, by confirming your request from the email address you used to contact us) and, if you act on behalf of another person, evidence of your authority. We use verification information only for the purpose of verification. In certain cases we may be required or permitted by law to refuse or limit a request (for example, where retention is required by law); if so, we will explain the reason in our response. Individuals in other jurisdictions may have additional rights under the laws applicable to them, which we will honor to the extent required.

Marketing communications: If you no longer wish to receive emails from us, you may click the unsubscribe link in any such email or contact us using the contact details below, and we will promptly remove you from our mailing list.

8. Destruction of Personal Information

When personal information is no longer needed because the retention period has expired or the purpose of processing has been achieved, we destroy it without delay. Where information must be preserved under applicable law, it is separated from other personal information and stored only for the period required. Personal information stored in electronic form is deleted using methods that prevent the records from being restored or reproduced; personal information recorded on paper is shredded or incinerated.

9. Security Measures

We take the following measures to protect personal information:

• Administrative measures: limiting access to personal information to the minimum number of personnel who need it, and training those personnel on data protection;
• Technical measures: access controls and authentication for systems that process personal information, encryption of data in transit (e.g., TLS), and use of reputable cloud providers with security certifications;
• Physical measures: control of access to offices and storage locations where personal information is kept.

Please note, however, that no method of data storage or transmission is guaranteed to be completely secure. While we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us.

10. International Transfers

EIPGRID is located in the Republic of Korea. Personal information you provide may be processed and stored on cloud infrastructure operated by the service providers listed in Section 5 (such as Google, Cloudflare and Amazon Web Services), which may be located in the Republic of Korea or other countries. Where personal information is transferred outside the Republic of Korea, we implement the safeguards required by applicable law, including the Personal Information Protection Act, such as contractual data protection obligations on the recipient. If you use the Services from outside the Republic of Korea, you understand that your personal information may be processed in the Republic of Korea, whose data protection laws may differ from those of your country.

11. Privacy Officer and Remedies

We have designated a Privacy Officer responsible for overseeing the processing of personal information and handling complaints and requests from data subjects:

Privacy Officer: Jeombae Park (CTO)
Email: contact@eipgrid.com
Telephone: +82-2-3430-1210

If you believe your privacy rights have been infringed, you may also seek advice or remedies from the following organizations in the Republic of Korea:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118 (no area code)
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Supreme Prosecutors’ Office, Cyber Investigation Division: 1301
• Korean National Police Agency, Cyber Investigation Bureau: 182

12. Contact Us

If you have questions or comments about our use of your information or about this Policy, please contact:

EIPGRID Inc.
15 Teheran-ro 10-gil, Gangnam-gu,
Seoul 06234, Republic of Korea
Email: contact@eipgrid.com
Telephone: +82-2-3430-1210

13. Changes to This Policy

We may amend this Policy from time to time to reflect changes in law, in our Services or in our processing practices. Any changes will be announced on the Site together with the effective date of the revised Policy, and, where the change is material, at least seven (7) days before it takes effect (or such longer period as applicable law requires). Your continued use of the Services after the effective date of a revised Policy constitutes your acceptance of the revised Policy.