This page outlines the Privacy Policy of 42dot Inc. (the “Company”). It explains how the Company protects the personal information and rights of data subjects, and how it addresses related inquiries or complaints, in accordance with the Personal Information Protection Act and other applicable laws. The Policy applies only to personal information collected through this website, including for recruitment and visitor registration for premises access.

Information We Collect

Required: Name, mobile phone number, email address; Optional: Sensitive information included in a job applicants’ resume, Other miscellaneous details listed on the resume

Why We Process Personal Information

Recruitment process management, application outcome, reference checks, candidate communication, and rolling recruitment

Retention Period

Personal information of job candidates: 3 years from application date Employment verification documents: 3 years from resignation

Use of Data Processing Service Providers

Data processors: Specter Co., Ltd.,

Grepp Co., Ltd., Reference Check Korea Co.,

Ltd., Ashby, Inc.

Third-Party Disclosure

None

Grievance Mechanism

Department: People & Operations
Contact: Yoo Jae-hyuk
Email: jobs@42dot.ai

Refer to the full Privacy Policy for more details.

The Company collects personal information through user input on its official website (https://42dot.ai, https://42dot.ai/career). Certain information may also be collected via printed documents or email, depending on the circumstances.

• • Domestic Outsourcing

  Purpose ,Data Processor ,Service Provided

  Purpose	Data Processor	Service Provided
  Recruitment	Specter Co., Ltd.	Talent verification
  Recruitment	Grepp Co., Ltd.	Coding tests
  Recruitment	Reference Check Korea Co., Ltd.	Reference checks

• • Overseas Outsourcing

  Legal Basis, Recipient (Contact), Country, Data Transfer, Items Transferred, Purpose, Retention Period

  Legal Basis	Recipient (Contact)	Country	Data Transfer	Items Transferred	Purpose	Retention Period
  Personal Information Protection Act, Article 28-8	Ashby, Inc. (security@ashbyhq.com)	USA	Transferred via platform during the recruitment process	Name, phone, email, resume	Recruitment process support	3 years or upon deletion request

  If you do not consent to the overseas transfer of your personal information, you may contact the Personal Data Protection Officer to request an opt-out. However, please note that opting out may limit your ability to participate in the recruitment process.

• • Destruction Procedures
  • Once the purpose of data collection is fulfilled, information provided by data subjects is transferred to a separate database (or a physical file cabinet for hard copies). It is then stored for a certain period according to the company’s policy and applicable laws (See Section 5: Personal Information Processing and Retention Period) before being destroyed.
  • Except when required by law, the information is not used for any purpose other than retention.
• • Destruction Methods
  • Hard copies of documents containing personal information shall be destroyed through shredding or incineration.
  • Electronic files containing personal information shall be deleted using technical measures that ensure irrecoverability.

• Requests may be made via email using the "Personal Information (Access, Correction, Deletion, or Suspension of Processing) Request Form" [Appendix 1] from the Personal Information Protection Commission's Guidelines. The Company will take prompt action upon receiving such requests. You may be asked to provide documents to verify your identity (e.g., resident registration card, passport, or driver's license).
• If you file a request to correct or delete an error in your personal information, the Company will cease processing and provision of that data until the correction or deletion is completed.
• A legal representative or authorized agent may exercise rights on behalf of the data subject. In such cases, a completed form must be submitted in accordance with the "Power of Attorney" template [Attachment 2] from the Personal Information Protection Commission's Guidelines. Additionally, the Company may request supporting documents, such as the data subject's seal certificate and the representative's identification, to verify the authenticity of the authorization.
• If the Company has a legitimate reason to refuse the exercise of rights, the data subject will be notified along with an explanation.

• • What are Cookies?
  • Cookies are small text files sent by the website server to the user's browser, and stored on the user's hard drive. When a user revisits the website, the server reads the stored cookies to maintain user preferences and provide a more personalized experience.
  • Cookies do not automatically or actively collect information that can identify individuals. Users can refuse or delete cookies at any time.
• • Purpose of Cookies
  • Cookies are used to store user preferences, such as language settings, in order to provide a faster and more convenient web experience.
  • Cookie information (_ga, _gid) used by Google Analytics (a web analytics tool provided by Google to measure website usage) may be stored on users' devices. Users can refuse the use of Analytics by disabling cookies.
• • How to Enable or Disable Cookies
  • Users have the right to choose whether to allow cookies. Users can configure their web browser settings to allow all cookies, require confirmation each time a cookie is stored, or reject all cookies.
  • Refusing cookies may impact some website functionalities.

    [How to configure cookies:]

    a. Edge: Select Settings < Cookies and site permissions

    b. Chrome: Click [⋮] → Settings → Privacy and Security

• • Password Encryption
  • Passwords set by users through the website are securely encrypted and known only to the user. Access to or modification of personal information is restricted to the user.
• • Anti-Hacking Measures
  • The Company takes every possible measure to prevent the leakage or damage of personal information caused by hacking, computer viruses, or other malicious activities. Data is regularly backed up to prevent loss, and up-to-date antivirus software is used to protect user data from breaches or corruption.
  • Encrypted communications are used to ensure the secure transmission of personal information over networks. Unauthorized access from outside the Company is blocked using an intrusion prevention system (IPS), and every effort is made to implement additional technical measures to maintain system security.
• • Limited Access & Staff Training
  • Access to personal information is strictly limited to designated personnel. Each handler is assigned a unique password, which is regularly updated.
  • The Company provides ongoing training to these personnel to emphasize the importance of protecting personal information.
• Personal Information Protection Organization
  • The Company operates an internal team responsible for personal information protection. This team monitors the implementation of the Company’s privacy policy and the compliance of relevant personnel. If any issues are identified, the team takes prompt corrective actions.
  • However, the Company shall not be held liable for any damages arising from the user’s own negligence or incidents occurring in areas beyond the Company’s control, provided that the Company has fulfilled its legal obligations for the protection of personal information.

• Category , Name , Department , Email

  Category	Name	Department	Email
  Personal Data Protection Officer for Recruitment	Yoo Jae-hyuk	People & Operations	jobs@42dot.ai

• If you need to report or seek consultation regarding any other personal information infringements, please contact one of the following organizations:

• Personal Information Infringement Reporting Center: http://privacy.kisa.or.kr / 118

  Cyber Investigation Division, Supreme Prosecutors’ Office: http://www.spo.go.kr / 1301

  Cyber Safety Bureau, National Police Agency: https://ecrm.cyber.go.kr / 182

  Personal Information Dispute Mediation Committee: https://www.kopico.go.kr / 1833-6972

• Scope of data collection: Personally identifiable video footage featuring visitors (recorded through fixed video surveillance cameras)
  
  
  ◦ Video Recording Devices

  Location and Coverage, Number of Cameras, Storage Location, Recording Hours, Retention Period

  Location and Coverage	Number of Cameras	Storage Location	Recording Hours	Retention Period
  Headquarters (B1, B2 Reception Areas)	55	CCTV Management Server	24 hours	30 days from recording date
  Office Shuttle Buses	8	CCTV Memory	During vehicle operation	10 days from recording date

  
  
  ◦ Responsible Personnel

  Role, Department / Name, Email

  Role	Department / Name	Email
  Personal Video Data Manager	People & Operations / Yoo Jae-hyuk	pm@42dot.ai
  Designated Access Holder	Property Management / Choi Kwang-ho	pm@42dot.ai

• How to access footage: Footage can be viewed at 4F, HQ, upon approval of the Personal Video Data Manager
• Requests for access, confirmation, or deletion of video information: Requests can be submitted to the Video Recording Device Administrator (Personal Video Data Manager). Such requests are limited to footage clearly featuring the requester or footage necessary to protect the life, body, or property of the data subject.
• Measures employed to safeguard video data: internal systems, access control and restrictions, secure storage and transmission technologies, processing logs and anti-tampering measures, secured storage facilities with locking mechanisms.

• In accordance with Article 25-2 of the Personal Information Protection Act, the Company installs, operates, and manages mobile video recording devices. Personal video data collected through cameras mounted on autonomous driving research vehicles are anonymized and stored after the retention period expires. However, under the ICT Regulatory Sandbox special permission, the data may be retained and further used for up to two years exclusively for research purposes (autonomous driving research and learning) in a secure, protected environment.
  ◦ Mobile Video Recording Devices

  Location & Coverage, Number of Devices, Recording Hours, Retention Period, Storage Location

  Location & Coverage	Number of Devices	Recording Hours	Retention Period	Storage Location
  Dashcam installed on autonomous vehicles (external recording)	86	Vehicle operation hours (07:00–25:00)	Up to 30 days from recording date	Vehicle interior (dashcam memory) / Cloud storage (domestic)
  Cameras for AD research (external recording)	516	Vehicle operation hours (07:00–25:00)	Up to 30 days from recording date	Cloud storage (domestic)

  ◦ Responsible Personnel

  Role, Department / Name, Email

  Role	Department / Name	Email
  Onboard Video Data Manager / Designated Access Holder	Autonomous Driving / Jeong Seonggyun	cs@42dot.ai

• Records are kept of any use of video data beyond its intended purpose, disclosures to third parties, destruction activities, and access requests. Once the retention period expires, the video data is permanently deleted using methods that prevent recovery.
• How to access footage: Footage can be viewed at 4F, HQ, upon approval of the Personal Video Data Manager
• Requests for access, confirmation, or deletion of video data: Requests can be submitted to the Video Recording Device Administrator (Personal Video Data Manager). Such requests are limited to footage clearly featuring the requester or footage necessary to protect the life, body, or property of the data subject. The Company may deny access if the retention period has expired, if there is a legitimate reason such as concern over infringement of another person's rights, or in other justified circumstances.
• Measures employed to safeguard video data: internal systems, access control and restrictions, secure storage and transmission technologies, processing logs and anti-tampering measures, secured storage facilities with locking mechanisms.

• • Announcement Date: April 29, 2025

  • Effective Date: May 7, 2025

  • Previous Versions of this Privacy Policy:

  ◦ June 7, 2024 ( V.1.1 )

  ◦ August 4, 2021 ( V.1.0 )

• * This English version of the Privacy Policy is provided for reference purposes only for global users. In the event of any discrepancy or conflict between the English version and the Korean version in terms of content or interpretation, the Korean version shall prevail.