'CARMAX CENTER' (hereinafter referred to as 'the Company') values your personal information and complies with the "Act on Promotion of Information and Communications Network Utilization and Information Protection."

Through this Privacy Policy, the Company informs you about how the personal information you provide is used, for what purposes, and what measures are being taken to protect your personal information.

The Company will notify you through website announcements (or individual notices) when the Privacy Policy is revised.

This policy takes effect from: January 21, 2026.

1. Personal Information Collected

The Company collects the following personal information for consultation and other purposes.

Contact Us
- Items Collected: Name, Contact Information, Email, Content, etc.

2. Purpose of Collection and Use of Personal Information

The Company uses the collected personal information for the following purposes:
Contract fulfillment for service provision and inquiry/response related to service provision

3. Retention and Use Period of Personal Information

In principle, personal information is destroyed without delay after the purpose of collection and use is achieved. However, if it is necessary to retain information in accordance with relevant laws and regulations, the Company will retain member information for the period specified by relevant laws and regulations as follows.

Retention Items and Legal Basis for Retention of Payment Records

• - Records related to contracts or withdrawal of subscription: 3 years
• - Records related to contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
• - Records related to payment and supply of goods, etc.: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
• - Records related to consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce, etc.)

4. Procedures and Methods for Destruction of Personal Information

In principle, the Company destroys personal information without delay after the purpose of collection and use is achieved. The procedures and methods for destruction are as follows.

Destruction Procedures
Information entered by members for membership registration, etc., is moved to a separate database after the purpose is achieved (or to a separate filing cabinet in the case of paper documents) and stored for a certain period in accordance with internal policies and other relevant laws for information protection (refer to retention and use period) before being destroyed.
Personal information moved to a separate database is not used for purposes other than retention unless required by law.

Destruction Methods
Personal information stored in electronic file format is deleted using technical methods that make the records irreproducible.

5. Provision of Personal Information

The Company does not provide users' personal information to external parties in principle. However, exceptions are made in the following cases:
When users have given prior consent, when required by law, or when requested by investigative agencies in accordance with procedures and methods prescribed by law for investigative purposes

6. Hosting and Maintenance

The Company operates services by entrusting them to external specialized companies as follows.

• - Trustee: Three Any I&C Co., Ltd.
• - Entrusted Business: Website and system management (hosting / maintenance)

7. Rights of Users and Legal Representatives and Methods of Exercise

Users may view or modify their registered personal information at any time and may also request cancellation of membership.
To view or modify personal information, users can click 'Change Personal Information' (or 'Modify Member Information', etc.), and to cancel membership (withdraw consent), users can click "Withdraw Membership" and go through identity verification procedures to directly view, correct, or withdraw.
Alternatively, if you contact the personal information management officer in writing, by phone, or by email, we will take action without delay.
If you request correction of errors in personal information, we will not use or provide the personal information until the correction is completed.
If incorrect personal information has already been provided to a third party, we will notify the third party of the correction processing results without delay to ensure correction is made.
Personal information terminated or deleted at the user's request is processed in accordance with the "Retention and Use Period of Personal Information Collected by the Company" and cannot be viewed or used for other purposes.
For children under 14 years of age, legal representatives have the right to view or modify the child's personal information and the right to withdraw collection and consent.

8. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company operates 'cookies' that frequently store and retrieve your information. A cookie is a very small text file sent by the server used to operate the website to your browser and stored on your computer's hard disk.

The Company uses cookies for the following purposes.

Purpose of Using Cookies, etc.
Analysis of connection frequency and visit time of members and non-members, understanding of user preferences and areas of interest and tracking, target marketing and personalized service provision through understanding of event participation and visit frequency. You have the right to choose whether to install cookies.
Therefore, you can allow all cookies, check each time a cookie is stored, or refuse to store all cookies by setting options in your web browser.

How to Refuse Cookie Settings
You can refuse cookie settings by selecting options in the web browser you use to allow all cookies, check each time a cookie is stored, or refuse to store all cookies.

Setting Method
Example (Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy
However, if you refuse to install cookies, there may be difficulties in providing services.

9. Customer Service Regarding Personal Information

The Company has designated the following departments and personal information management officers to protect customers' personal information and handle complaints related to personal information.

For other reports or consultations regarding personal information infringement, you can contact the following agencies.

• - Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code)
• - Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301 without area code)
• - National Police Agency Cyber Bureau (police.go.kr / 182 without area code)