Bear Robotics, Inc. and its affiliates (“Bear Robotics,” “we,” “our,” and/or “us”) value the privacy of individuals who use our website (https://www.bearrobotics.ai/), our customer platform (“Bear Universe”), our mobile application (the “App”), our robots, and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information from users of our Services (“Users”). Depending on location, by using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. In this Privacy Policy, “Personal Information” means any information relating to an identified or identifiable individual.

Many of our Services are accessed by Users in connection with an agreement between us and the User’s employer or another business entity (for example, our customer agreement, terms and conditions, order form, or data processing agreement). This Privacy Policy supplements, and does not replace, those agreements. To the extent we process Personal Information on behalf of a business entity that has engaged us, our processing is governed by our agreement with that entity, and that business entity (and not Bear Robotics) is the controller of such Personal Information.

California residents: please also see our California Resident Privacy Notice, which is incorporated into and supplements this Privacy Policy and provides additional disclosures required under California law.

Maklumat Peribadi Kami Kumpul

We may collect a variety of Personal Information from or about you from various sources as described below. Where applicable, we indicate if you must provide us with your Personal Information, as well as the consequences of failing to do so. For example, if you do not provide Personal Information when requested, you may not be able to benefit from our Services if that information is necessary to provide you with them or if we are legally required to collect it.

A. Personal Information You Provide to Us

Account Information. When you sign up for our Services (for example, the App or Bear Universe), we collect identification details such as name, email address, distributor account ID and location ID, scheduling information, and account preferences such as language. If you sign up using a third-party account, we will also receive information from that third party such as your name, email address, distributor account ID, and location ID.

Communications. If you contact us directly, we may receive information about you, such as your identification details (name, email address, phone number) and additional information to help us respond to you (such as the reason for contacting us, your geographic region, the contents of any message or attachment you choose to send to us, and other information you choose to provide).

Uploaded Content. When you use the photo, video, or sound upload feature in our App or Bear Universe, we collect the photos, videos, and sound files you choose to capture, select, or upload, along with any metadata embedded in those files. We do not currently extract biometric identifiers (such as faceprints or voiceprints) from this content, and we do not currently use this content to train, develop, or improve artificial intelligence or machine learning models. If our practices change, we will update this Privacy Policy and, where required by applicable law, obtain your consent. The upload features are intended for adult use only. You must not upload content containing minors, and you represent that you have any necessary rights, permissions, and consents from individuals who appear in (or whose voice is included in) the content you upload. You may request deletion of content you have uploaded at any time as described in “Your Rights and Choices” below.

Job Applicant Information. If you apply for a job with us, we collect identification details and application details such as information about work experience and education, requirements for visa sponsorship, desired compensation range, and any other information you choose to provide. If you are a U.S.-based applicant, we may also collect information about your race or ethnicity and gender if you choose to provide this information.

B. Personal Information We Collect When You Use Our Services

Different parts of our Services collect different categories of Personal Information, as described below.

(i) Through our website (https://www.bearrobotics.ai/). When you visit our public website, we automatically receive information about your device and your interactions with the website, including IP address, device type, web browser type and version, operating system, pages or other content viewed, referrer information (the website you visited or search term you used before coming to our Services), dates and times of visits, and time spent on each page. We and our third-party partners also collect information using cookies, pixel tags, SDKs, and other tracking and analytics technologies (collectively, “Cookies”), as further described under “Cookies and Other Technologies” below.

(ii) Through Bear Universe. When you use Bear Universe (our customer platform), we collect information about your account and your interactions with the platform, including IP address, device type, browser type and version, operating system, pages or other content viewed within Bear Universe, dates and times of access, and actions taken within the platform. Where applicable, we also collect the photos, videos, and sound files you upload through Bear Universe as described under “Uploaded Content” above.

(iii) Through our mobile App. When you use our mobile App, we collect information about your device and your in-app activity, including IP address, device type, mobile operating system, type of mobile internet browser, app version, and in-app usage. Where applicable, we also collect the photos, videos, and sound files you upload through the App as described under “Uploaded Content” above. Our App requests permission to access your device camera, photo library, and local file storage (for images and sound files) to enable the upload features. You can grant or revoke any device permission through your device settings.

(iv) Through our robots. Our robots collect operational data necessary to operate, navigate, and improve robot performance, including: point cloud data and 2D LiDAR data used for navigation and obstacle avoidance; mapping data of the venues in which our robots operate; robot usage data; and telemetry. Our robots do not perform facial recognition or use camera data to identify individuals, and we do not currently extract biometric identifiers from data our robots generate. Raw camera imagery is generally not stored on or transmitted off the robot during normal operation. When you request technical support, our support team may access raw imagery from the robot to diagnose the issue; we retain such imagery only for as long as necessary to address the support request and related operational purposes, and we do not currently use it to train artificial intelligence or machine learning models. Our robots do not collect or store photos, videos, or sound files uploaded through the App or Bear Universe; they receive that content from our servers solely to display or play it through the robot’s screen or speakers.

Cookies and Other Technologies. Our website uses both session Cookies (which disappear after you close your browser) and persistent Cookies (which remain after you close your browser and may be used by your browser on subsequent visits). We use the following types of Cookies on our website:

• Strictly Necessary Cookies. Some Cookies are strictly necessary to make our website available to you and you cannot use the website without this type of Cookie. We use this information to provide you with our Services, prevent misuse, and ensure our Services are working properly.

Cookie Name: gcm_consent

Provider: Bear Robotics

Purpose: Stores user consent choice; ensures tags only fire based on permission.

Expiry: 1 Year

Cookie Name: Osano Consent Manager

Provider: Osano

Purpose: Essential for compliance and to ensure consent is captured and respected before any non-essential tracking runs.

Expiry: 1 year

• Analytics or Performance Cookies. We use Cookies for analytics purposes to better understand how you use our website, to measure the effectiveness of our customer communications, to diagnose and fix technology problems, and otherwise to enhance our Services. We may use our own analytics Cookies or third-party analytics providers to collect and process certain data analytics on our behalf.

Cookie Name: _ga

Provider: Google

Purpose: Distinguishes unique users and session data.

Expiry: 2 Years

Cookie Name: _gid

Provider: Google

Purpose: Distinguishes unique users for a 24-hour window to group session activity.

Expiry: 24 Hours

• Advertising Cookies. We or our third-party advertising partners may place Cookies on our website to show you ads we think may interest you. For example, we may show you ads about our products and services on third-party websites and apps, or show you ads about third parties’ products and services on our website.

Cookie Name: _fbp

Provider: Meta

Purpose: Identifies browsers to provide advertisement delivery and retargeting on Facebook/Instagram.

Expiry: 3 Months

How We Use the Personal Information We Collect

We use Personal Information:

• To provide and maintain our Services;

• To personalize your experience on our Services;

• To understand and analyze how you use our Services, improve and enhance our Services, and develop new products, services, features, and functionality;

• To train, develop, and improve the artificial intelligence, machine learning, and models we use to support our Services, including those used for robot navigation, operational performance, and safety, using data generated by our robots and similar operational data. We do not currently use photos, videos, or sound files you upload through the App or Bear Universe, or raw imagery accessed during a technical support request, for these purposes;

• To facilitate transactions and payments;

• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;

• For marketing purposes, such as developing and providing promotional materials that may be relevant, valuable, or otherwise of interest to you;

• To generate anonymized or aggregated insights or data, such as to publish reports, use for insights, and aid robot navigation;

• To send you text messages and push notifications;

• To detect and prevent fraud and abuse, and respond to trust and safety issues that may arise;

• To process job applications;

• To display or play the photos, videos, and sound files you upload through the App or Bear Universe on the robot or robots you designate;

• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and

• For other purposes for which we provide specific notice at the time the Personal Information is collected.

Legal Bases for Processing European Personal Information

To the extent required by applicable law, if you are located in the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) (together “Europe”), we only process your Personal Information when we have a valid “legal basis,” including as set forth below.

Consent. You have consented to the use of your Personal Information. For example, we may process your Personal Information to send you marketing communications where you have consented to such use.

Contractual Necessity. We need your Personal Information to provide you with our Services. For example, to respond to your inquiries or requests.

Compliance with a Legal Obligation. We have a legal obligation to use your Personal Information. For example, to comply with tax, labor, and accounting obligations.

Legitimate Interests. We or a third party have a legitimate interest in using your Personal Information, such as for service development (including to train, develop, and improve artificial intelligence, machine learning, and models using operational data generated by our robots), internal analytics, and otherwise to improve the safety, security, and performance of our Services. We rely on our or a third party’s legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests.

How We Disclose the Personal Information We Collect

We share Personal Information with third parties in the following circumstances:

• To our current or future affiliates for any of the purposes described in this Privacy Policy.

• To third-party service providers and processors that help us operate our Services, including for cloud hosting and storage (for example, Google Cloud, which hosts uploaded photo, video, and sound files), sending communications on our behalf, providing IT-hosting and maintenance, customer support, and other services for us. These third parties may access or process your Personal Information as part of providing those services to us, subject to contractual obligations to protect that information.

• To vendors that provide artificial intelligence services that provide backend support for our Services.

• Through working with our business partners to offer you certain products, services, or promotions.

• To analytics services such as Google Analytics that we use to collect and process certain analytics data. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/. You can opt out by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

• To third-party advertising partners to collect and process your information in order to show you ads that we think may interest you. Some of our advertising partners are members of the Digital Advertising Alliance (https://optout.aboutads.info) and serve ads through cookie-based technologies. Please visit their opt-out pages to learn about how you may opt out of receiving certain web-based personalized ads from member companies. These opt-outs will apply only to our third-party advertising partners that are members of these organizations. These opt-outs will not apply when our partners serve ads through non-cookie-based technologies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.

• To service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your Personal Information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable Personal Information was collected.

• With your permission.

We may access, preserve, and disclose your Personal Information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your Personal Information may occur if you post any objectionable content on or through the Services.

We do not sell or share photos, videos, or sound files you upload through the App or Bear Universe with third parties for advertising or marketing purposes.

Your Rights and Choices

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional email messages from us, you will continue to receive administrative messages from us. You can opt out of our promotional SMS messages by replying “STOP” to our message.

Uploaded Content. You may request deletion of any photo, video, or sound file you have uploaded through the App or Bear Universe at any time by emailing privacy@bearrobotics.ai. We will process such requests within the timeframes required by applicable law. Where available, you may also be able to remove uploaded content directly from within the App or Bear Universe; please note, however, that copies may continue to exist on our backend systems for a limited period until deletion is fully propagated.

U.S. State Privacy Rights. If you are a California resident, please refer to our California Resident Privacy Notice for additional information regarding your California-specific rights and our processing of your Personal Information. Residents of other U.S. states may have additional rights under applicable state privacy laws. You may contact us at privacy@bearrobotics.ai to inquire about any rights that may be available to you.

Your European Privacy Rights. To the extent applicable, if you are located in Europe, you have the additional rights described below:

• You may withdraw any consent you previously provided to us regarding the processing of your Personal Information at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

• You may ask us to provide you with a copy of the Personal Information we maintain about you, including a machine-readable copy, and request information about its processing.

• You may ask us to update and correct inaccuracies in your Personal Information, or to have the information anonymized or deleted, as appropriate.

• You may ask us to restrict the processing of your Personal Information, or object to such processing.

• You may withdraw your consent for us to process your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

• You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place. We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us in the first instance.

You may exercise these rights by contacting us as indicated in the “Contact Information” section. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and we may retain Personal Information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise have a legitimate reason to do so, to the extent permitted by applicable law.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. This Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties.

Retention

We take measures to delete your Personal Information or de-identify it when your Personal Information is no longer necessary for the purposes for which we process it unless otherwise required by law. Our retention periods are designed based on various factors, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and the statute of limitations. For example, we keep employee applications for one year from when the employment-related decision was made.

Photos, videos, and sound files uploaded through the App or Bear Universe are retained for as long as needed to provide our Services and until you request deletion. Deletion from backup or similar disaster-recovery systems may take longer, consistent with our standard backup practices.

Security

We protect your Personal Information by using physical and electronic safeguards appropriate to the risk of the Personal Information we maintain. However, because no electronic transmission or storage of Personal Information can be entirely secure, we can make no guarantees as to the security or privacy of your Personal Information.

Privasi Kanak-kanak

We do not knowingly collect, maintain, or use Personal Information from children under 13 years of age, and no part of our Services is directed to children. Our upload features (photo, video, and sound) are intended for adult use only, and you must not upload content containing minors. If you learn that a child has provided us with Personal Information, please contact us.

International Transfers

We transfer Personal Information to the United States, where our Services are hosted. We may also transfer your Personal Information to other countries or regions, such as in connection with storage, fulfilling your requests, and operating the Services.

If you are located in Europe, we transfer your Personal Information to countries that benefit from an EU or UK adequacy decision; subject to contractual protections, such as standard contractual clauses; to recipients who have adopted Binding Corporate Rules; or based on an appropriate legal derogation to the extent necessary. To the extent applicable, if you are located in Europe, you may contact us as specified below to obtain a copy of the safeguards we use to transfer Personal Information outside of Europe.

Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose Personal Information previously collected from you through the Services, we will notify you through the Services, by email, or by other communication.

Relationship to Other Agreements

This Privacy Policy describes how we collect, use, and disclose Personal Information for our own business purposes. Where we provide Services to or on behalf of a business entity (for example, a customer that has purchased or licensed our robots and platform), our processing of Personal Information on that entity’s behalf is governed by our agreement with that entity (such as our customer agreement, terms and conditions, order form, or data processing agreement). In that case, the business entity is the controller of the Personal Information processed on its behalf, and Users should also refer to that entity’s privacy notices for information about that entity’s practices. In the event of a conflict between this Privacy Policy and an applicable agreement with respect to such processing, the applicable agreement controls. Customers and other business partners are responsible for providing any notices and obtaining any consents from individuals who appear in, or whose voices are included in, content they (or their authorized Users) upload through the App or Bear Universe.

Contact Information

Bear Robotics is the controller responsible for processing your Personal Information collected for our own business purposes. (For Personal Information we process on behalf of a business entity that has engaged us, that business entity is the controller, as described in “Relationship to Other Agreements” above.) If you have any questions, comments, or concerns about our processing activities, please email us at privacy@bearrobotics.ai or write to us at 785 Broadway St, Redwood City, CA 94063, USA.

Last Updated: May 18, 2026

Korea Addendum

This Addendum (the “Addendum”) supplements the Bear Robotics Privacy Policy (the “Main Privacy Policy”) and applies exclusively to the processing of personal information of users in the Republic of Korea by Bear Robotics Korea, Inc. It should be read in conjunction with the Main Privacy Policy. The provisions of this Addendum do not modify or affect the application of the Main Privacy Policy to users in other jurisdictions, and do not extend to the privacy practices of Bear Robotics, Inc. or any other affiliate.

This Addendum describes Bear Robotics’ practices regarding the collection, use, and protection of personal information in compliance with the laws of the Republic of Korea. In the event of any conflict or inconsistency between this Addendum and the Main Privacy Policy, this Addendum shall prevail with respect to users in Korea. This Addendum may be amended or updated from time to time. For the purposes of this Addendum, “we,” or “us,” refers to Bear Robotics Korea, Inc.

1. Personal Information We Collect

A. Personal Information You Provide to Us.

Account Information: Name, email address, country, address, distributor account ID, location ID, scheduling information, language preferences

Communications: Name, email address, phone number, reason for contacting us, geographic region, the contents of a message or attachments that you may send to us, other information you choose to provide

Payment Information: Credit card information (card number, name of credit card company), bank account number, name of the account holder, business registration number

Purchase Information: Transaction details when you request a purchase, refund, or other related actions. With your consent, we may collect and process your Resident Registration Number for tax reporting purposes

Job Applicant information: full name, contact information (phone number, email address), educational background (school, major, graduation status), work experience and employment history, professional qualifications and certifications, skills and competencies (including language proficiency and technical skills), portfolio or other materials demonstrating job-related experience, requirements for visa sponsorship, desired compensation range, and any other information you choose to provide

Visitor Information: name, phone number, company affiliation, job title or position, date and time of visit, and purpose of visit

B. Personal Information We Collect When You Use Our Services.

Device Information: IP address, device type, operating system and version, web browser type and version, mobile operating system, type of mobile internet browser, device identifier, and device language settings

Usage Information: the pages or other content you view, referrer information (the website you visited or search term you used before coming to our Services), the dates and times of your visits, time spent on each page you visit, search queries, clickstream data, and error logs

Transaction Information: transaction identifier, time and date of the transaction, payment amount, payment method, delivery or route information, and actions taken in connection with such transaction

Information from Cookies and Other Technologies: Hardware and software information (IP address, browser type, device type, unique identifiers, protocol status and sub-status, bytes sent and received, server and carrier information, bandwidth, software version, domain name, access timestamps, system logs, error messages, and advertising IDs), and information about your activities on our Services using cookies, pixel tags, SDKs, or other tracking and analytics technologies (collectively, “Cookies”). For more detailed information regarding Cookies, please refer to Section 1.B (Information from Cookies and Other Technologies part) of the Main Privacy Policy and Section 11 of this Addendum.

2. Personal Information Collected from Sources Other Than the Data Subject

In the course of our recruitment process, we may collect personal information about job applicants from third-party career platforms through which you apply, including Saramin, JobKorea, Wanted, Rocket Punch, and Job Planet. The categories of information received from such platforms correspond to the Job Applicant Information described in Section 1.A above.

In accordance with Article 20 of the Personal Information Protection Act, you have the right to request information regarding the source from which your personal information was collected, the purpose of our processing, and the procedures for requesting the suspension of such processing. Such requests may be made using the contact information provided in Section 12 of this Addendum.

3. How We Use the Personal Information We Collect

We use Personal Information:

• To provide and maintain our Services;

• To personalize your experience on our Services;

• To understand and analyze how you use our Services, improve and enhance our Services and develop new products, services, features, and functionality;

• To train, develop, and improve the artificial intelligence, machine learning, and models that we use to support our Services;

• To facilitate transactions and payments;

• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;

• For marketing purposes, such as developing and providing promotional materials that may be relevant, valuable or otherwise of interest to you;

• To generate anonymized or aggregated insights or data such as to publish reports, use for insights and to aid robot navigation;

• To send you text messages and push notifications;

• To detect and prevent fraud and abuse, and respond to trust and safety issues that may arise;

• To receive, review, and evaluate job applications and candidate materials;

• To verify the authenticity of information provided by candidates, including through reference checks and credential verification (subject to separate consent where required);

• To administer and manage the overall recruitment process, including scheduling interviews and communicating with candidates;

• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency;

• To install, operate, and maintain robots deployed at customer sites, and to provide technical support and remote diagnostics;

• To process warranty claims and manage after-sales service, including the repair and replacement of parts;

• To manage visitor access to our facilities and ensure physical security;

• To comply with tax reporting obligations under the Framework Act on National Taxes and related laws (including the processing of Resident Registration Numbers where consented).

4. Retention

We take measures to delete your Personal Information when you delete your account, or your Personal Information is no longer necessary for the purposes for which we process it unless otherwise required by law including but not limited to the laws described below.

• Records of contract or withdrawal of offer (based on the Act on Consumer Protection in Electronic Commerce): 5 years

• Records of payments and provision of goods and services (based on the Act on Consumer Protection in Electronic Commerce): 5 years

• Records of consumer complaints or dispute resolution (based on the Act on Consumer Protection in Electronic Commerce): 3 years

• Electronic financial transaction records (based on the Electronic Financial Transactions Act): 5 years

• Records of recruitment-related personal information (based on the Act on Fair Hiring Procedure): For applicants whose recruitment process has been completed, personal information is destroyed within the period prescribed under Article 11 of such Act and its Enforcement Decree, except where the applicant has consented to retention for future recruitment consideration, in which case the retention period shall not exceed one year.

5. Entrustment of Personal Information Processing to Third Parties

Third-party service providers and our affiliates, acting on our behalf and listed below, may access and process your personal information to the extent necessary to perform the following tasks:

Name of entrusted company: S-1 Corporation (SECOM)

Entrusted Operations: Installation, operation, and monitoring of CCTV systems; operation and maintenance of office access control systems (including visitor access records)

Name of entrusted company: Toss Payments Corporation

Entrusted Operations: Processing of payments, refunds, and payment cancellations; verification of payment information; and related anti-fraud screening

Name of entrusted company: MStech / AJ Networks Co., Ltd.

Entrusted Operations: On-site installation, commissioning, preventive maintenance, and repair of robots deployed at customer sites

Name of entrusted company: YK Trans

Entrusted Operations: Delivery, installation-site transportation, and return logistics of robots, parts, and related equipment

6. Provision of Personal Information to Third Parties

In principle, we do not provide your personal information to third parties without your prior consent. We may, however, provide personal information without your separate consent in the limited cases permitted by law, including:

• Incident and insurance response — to liability insurers, medical institutions, emergency responders, and licensed investigators, in connection with accidents, safety incidents, medical emergencies, or insurance claim handling;

• Credit reporting and debt collection — to credit information companies, the Korea Credit Information Services, and licensed debt collection agencies, in connection with the reporting of delinquency information and the collection of overdue receivables;

• Legal and regulatory requests — to courts, law enforcement, prosecutors, regulatory authorities, tax authorities, and other governmental bodies, in response to warrants, subpoenas, or other binding legal process, or lawful requests made within their authority;

• Corporate transactions — to prospective or actual investors, acquirers, lenders, and their professional advisors, in connection with any financing, merger, acquisition, reorganization, or other business transfer, subject to appropriate confidentiality undertakings and, to the extent practicable, pseudonymization or minimization.

Each such provision is limited to what is necessary and is made in accordance with Articles 17(1)(ii), 18(2), and 27 of the Personal Information Protection Act, the Credit Information Use and Protection Act, and other applicable laws. Where your prior consent is required for a provision, you may refuse consent, in which case certain related Services may become unavailable.

7. International Transfer of Personal Information

Your personal information may be transferred internationally to one or more of our affiliates or third parties or directly collected from overseas to carry out outsourcing agreements with us.

The overseas transfer of personal information described in the table below is essential to the provision of our Services. Such transfers are made on the legal grounds set forth in Article 28-8(1) of the Personal Information Protection Act, as specified for each recipient in the table below. For transfers based on your separate consent under Article 28-8(1)(i), you may withdraw your consent at any time by contacting our Customer Support at 070-7576-1714, in which case the related Services may become unavailable. For transfers based on the necessity of contract performance under Article 28-8(1)(iii), withdrawal of consent is not applicable; however, you may terminate your use of the Services through the same channel.

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Bear Robotics, Inc. privacy@bearrobotics.ai

Destination: USA

Information items: Account information, communications, payment information, purchase information, job applicant information, device information, usage information, transaction information, and cookie-based information

Time/method of transfer: Continuously, through encrypted network transmission whenever data is processed in the course of providing the Services

Recipient purpose: Operation and maintenance of the global service platform; integrated technical support and remote diagnostics; integrated customer support; corporate management; human resources management; and data analytics

Retention: Until withdrawal of membership, completion of the purposes of processing, or expiration of the retention period required by applicable laws, whichever is later

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Amazon Web Services, Inc. aws-korea-privacy@amazon.com

Destination: USA (and other AWS regions as applicable)

Information items: All personal information stored or processed within the cloud infrastructure

Time/method of transfer: Continuously, through encrypted network transmission when data is stored, retrieved, or processed

Recipient purpose: Provision of cloud computing infrastructure, data storage, and related technical services

Retention: Until contract termination with the recipient or deletion of the stored data

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Google LLC support-kr@google.com

Destination: USA

Information items: Email contents, document contents, device information, IP address, cookie identifiers, usage data, and advertising identifiers

Time/method of transfer: Continuously during the use of Google Workspace for business communications and during access to the Services for analytics

Recipient purpose: Provision of email, collaboration, and productivity tools; measurement and analysis of Service usage; and infrastructure services

Retention: Until contract termination with the recipient or deletion of the data by the recipient in accordance with its retention policies

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Slack Technologies, LLC privacy@slack.com

Destination: USA

Information items: Name, email address, message contents, file attachments, and workspace activity logs

Time/method of transfer: Continuously during the use of internal communication tools

Recipient purpose: Provision of team communication and collaboration services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Salesforce, Inc. privacy@salesforce.com

Destination: USA

Information items: Name, email address, phone number, company affiliation, job title, and records of communications and transactions

Time/method of transfer: Continuously when customer or prospect information is created or updated in the CRM

Recipient purpose: Provision of customer relationship management, sales pipeline management, and related services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Zoom Video Communications, Inc. privacy@zoom.us

Destination: USA

Information items: Name, email address, meeting participation records, and (where applicable) audio/video recordings

Time/method of transfer: When a video meeting is hosted or joined

Recipient purpose: Provision of video conferencing and webinar services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): DocuSign, Inc. privacy@docusign.com

Destination: USA

Information items: Name, email address, IP address, electronic signature, and contents of the signed document

Time/method of transfer: When an electronic signature request is sent, executed, or completed

Recipient purpose: Provision of electronic signature and agreement management services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Okta, Inc. privacy@okta.com

Destination: USA

Information items: Name, email address, authentication logs, and device information

Time/method of transfer: Continuously whenever a user authenticates to access the Services

Recipient purpose: Provision of identity management, single sign-on, and access control services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Atlassian, Inc. (Jira, Confluence) privacy@atlassian.com

Destination: USA

Information items: Name, email address, workspace contents, and activity logs

Time/method of transfer: Continuously during the use of internal knowledge management and project tracking tools

Recipient purpose: Provision of knowledge management, project tracking, and team collaboration services

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii) / (i) where applicable

Recipient (Name / Contact): Anthropic, PBC / OpenAI, L.L.C. privacy@anthropic.com / privacy@openai.com

Destination: USA

Information items: Inputs and outputs submitted to the AI services, which may include information contained in user queries or uploaded content

Time/method of transfer: When AI-assisted features are used within the Services or internal workflows

Recipient purpose: Provision of large language model and AI-assisted features

Retention: Until contract termination with the recipient or expiration of the provider’s data retention period (typically 30 days under zero data retention terms, where applicable)

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Breezy HR, Inc. (a subsidiary of Learning Technologies Group) privacy@breezy.hr

Destination: USA

Information items: Full name, email address, phone number, address (optional), resume/CV, cover letter (optional), portfolio (optional), education history (optional), work experience (optional), certifications (optional)

Time/method of transfer: When an applicant submits an application through a career platform or directly, and continuously thereafter whenever applicant records are created, updated, or reviewed, through encrypted network transmission

Recipient purpose: Provision of applicant tracking system services, including the receipt, storage, and management of applications; support for resume screening, interview scheduling, candidate evaluation, and related recruitment workflow features

Retention: Until one year after application submission (or such other period required or permitted by applicable law), or until contract termination with the recipient, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Coderbyte, Inc. support@coderbyte.com

Destination: USA

Information items: Full name, email address, coding assessment submissions, assessment results, and related evaluation data

Time/method of transfer: When a coding assessment is assigned to an applicant, and upon the applicant’s submission of the assessment, through encrypted network transmission

Recipient purpose: Provision of online coding assessment and candidate technical evaluation services

Retention: Until completion of the applicable recruitment process and deletion of the assessment records in accordance with our retention policy, or until contract termination with the recipient, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): LinkedIn Corporation privacy@linkedin.com

Destination: USA

Information items: Full name, email address, phone number (where provided), professional profile information (including education, work experience, skills, and certifications), resume/CV, and application materials submitted through LinkedIn

Time/method of transfer: When a job posting is created, when an applicant submits an application via LinkedIn, and when applicant communications occur through LinkedIn’s recruitment tools, through encrypted network transmission

Recipient purpose: Posting of recruitment announcements; receipt of job applications submitted through LinkedIn; and provision of LinkedIn’s recruiter tools and candidate management features

Retention: Until contract termination with the recipient, or until the applicant data is deleted in accordance with LinkedIn’s retention policies, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Squarespace, Inc. privacy@squarespace.com

Destination: USA

Information items: IP address, geographic region, browser type, operating system, access timestamp, session duration, and pages visited

Time/method of transfer: Automatically and continuously whenever a user accesses the Bear Robotics Korea website (kr.bearrobotics.ai), through the Squarespace content delivery infrastructure

Recipient purpose: Hosting and operation of the Bear Robotics Korea website; collection of website analytics

Retention: Until you delete your account, your Personal Information is no longer necessary for the purposes for which we process it, or the contract with the recipient is terminated, whichever is earlier

Legal basis: Article 28-8(1)(iii)

Recipient (Name / Contact): Calendly LLC privacy@calendly.com

Destination: USA

Information items: Name, email address, phone number (where provided), inquiry content, and other information voluntarily entered into the contact form

Time/method of transfer: When a user submits the contact-sales form on kr.bearrobotics.ai/contact-sales, through encrypted network transmission

Recipient purpose: Receipt and management of sales inquiries; scheduling of meetings with Bear Robotics Korea sales representatives

Retention: Until completion of the related sales inquiry handling, or contract termination with the recipient, whichever is earlier

8. Destruction of Personal Information

When we destroy personal information, we take commercially reasonable and technically feasible measures to ensure that it cannot be restored or reconstructed. Electronic documents or files containing personal information are deleted in a manner that prevents recovery or reconstruction. Non-electronic documents or files containing personal information are destroyed through shredding or incineration.

In cases where personal information must be retained beyond the retention and usage periods in accordance with applicable laws and regulations, such information is stored separately from other personal data to the extent technically possible and commercially reasonable.

9. Measures to Ensure the Security of Personal Information

Please refer to Section 8 of the Main Privacy Policy.

In the event of a suspected or detected security breach, we reserve the right to suspend your access to the Services, in whole or in part, without prior notice. If you believe your account has been compromised, please contact us immediately using the contact information provided below.

10. Rights and Obligations of Data Subjects and Legal Representatives, and Procedures for Exercising Those Rights

You may, at any time, request us to access, transfer, rectify, erase, or suspend the processing of your personal information, or withdraw your consent (the “Exercise of Rights”). To exercise your rights, you may contact us using the contact information provided below via written request, telephone, email, or our website. We will process your request without undue delay. The Exercise of Rights may be performed through a legal representative or an agent duly authorized by you. Please note, however, that the Exercise of Rights may be restricted pursuant to applicable privacy laws and regulations. The right to request the deletion of personal information may be restricted if such information is required for collection and retention under other applicable laws and regulations.

11. How We Use Cookies and Your Right to Opt-Out

We use Cookies that frequently store and retrieve usage information to provide you with personalized services and enhanced user experience.

Cookies are small text files sent by a website’s server to your browser. These files are stored on your computer or mobile device and are automatically sent back to the server by the browser whenever the website is accessed. For more detailed information regarding Cookies, please refer to Section 1.B (Information from Cookies and Other Technologies part) of the Main Privacy Policy.

You can manage your cookie preferences, including allowing or blocking cookies, through your browser settings. However, please be aware that disabling cookies may affect the functionality of our website.

[Desktop]

•  Chrome: Settings > Privacy and Security > Third-party cookies

•  Edge: Settings > Privacy, Search and Service > Cookies

[Mobile]

•  Chrome: Settings > Site settings > Cookies

•  Safari: Settings > Apps > Safari > Advanced > Block All Cookies

•  Samsung Internet: Settings > Site and Download > Site Permissions > Cookies

12. Chief Privacy Officer and Responsible Personnel

Pursuant to Article 31 of the Personal Information Protection Act, Bear Robotics Korea, Inc. has designated the following person as its Chief Privacy Officer, responsible for the protection of personal information of users in the Republic of Korea, and has established a Privacy Department to respond to user inquiries and handle related complaints. This designation is made solely for the purposes of Bear Robotics Korea, Inc.’s compliance with the Personal Information Protection Act and does not extend to Bear Robotics, Inc. or any other affiliate of Bear Robotics, Inc.

Chief Privacy Officer

Name: Hyungjin Choi

Position: Head of Bear Robotics Korea

Privacy Department

Phone: 070-7576-1714

Email: legal@bearrobotics.ai

If you need to report or consult on other privacy infringements, please contact the following institutions.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / Phone number: 1833-6972

• Privacy Infringement Report Center: privacy.kisa.or.kr / Phone number: 118

• National Police Agency: ecrm.police.go.kr / Phone number: 182

Last Updated: 2026. 5. 15.

Previous Versions:

- N/A (Initial Publication)

Japan Appendix

The following provisions apply if you are a data subject to whom the Act on the Protection of Personal Information (“APPI”) applies.

International Transfer of Personal Information

In connection with the provision of our Services, your Personal Information may be transferred to and processed in countries outside Japan, including the United States. In accordance with Article 28 of the APPI, we obtain your consent prior to transferring your Personal Information to third parties located in foreign countries. In providing such consent, please note the following:

(a) Your Personal Information may be transferred to the United States, where Bear Robotics, Inc. is headquartered. For information on the personal data protection system in the United States, please refer to the survey published by the Personal Information Protection Commission (PPC) at: https://www.ppc.go.jp/enforcement/infoprovision/laws/.

(b) Your Personal Information may also be transferred to other countries where our service providers or affiliates are located. Where the specific country cannot be identified in advance, we will provide relevant reference information upon request.

(c) The recipients of your Personal Information are required to implement measures for the protection of personal data in accordance with the standards set forth under the APPI, including measures aligned with the principles of the OECD Privacy Guidelines.

1. Your legal rights

Under certain circumstances, you have the following rights under the APPI in relation to your Personal Information:

Notification of Purpose of Use of Personal Information

Please refer to “How We Use the Personal Information We Collect” of the main body of this Privacy Policy for the details of purpose of use of Personal Information.

Disclosure of Personal Information

You have the right to request the disclosure of your Personal Information and the record of provision of your Personal Information. There are a wide range of exemptions to this right — for example, when disclosure is likely to seriously disrupt the proper implementation of our business. We will respond to any such requests as accurately and completely as possible, and as soon as reasonably practicable, except to the extent required or authorised under the APPI.

Correction, Addition, or Erasure of Personal Information

You have the right to ask for your Personal Information to be corrected, added, or erased if it is not correct.

Suspension of Use or Deletion of Personal Information

You may request that we suspend:

• the use of, or delete, your Personal Information if such use or the collection of that data violates certain provisions of the APPI;

• the provision of your Personal Information to third parties if such use violates any provisions of the APPI regarding third-party or cross-border transfers; and

• the use of, delete, or suspend the provision of your Personal Information if (a) it is no longer necessary for us to use the data; (b) a material data breach has occurred; or (c) your rights or legitimate interests may be harmed for any other reason, unless it will be excessively costly or difficult to suspend the use of or delete your Personal Information and we take necessary alternative measures to protect your rights and interests.

If you request that we suspend use of or delete your Personal Information, or suspend provision of it to third parties, we will comply to the extent required or authorised under the APPI.

If you wish to exercise any of your rights as set out above, please contact us.