Privacy Policy

The Company processes personal information for the following purposes. The personal information being processed is not used for purposes other than the following, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

① The Company retains and uses a member's personal information from the date the member registers for the service until the member withdraws, and when a member withdraws from the Company's service, the Company destroys the member's personal information without delay or stores it separately in accordance with Article 39-6 of the Personal Information Protection Act. However, information retained in accordance with relevant statutes is an exception.

② The processing and retention period of each type of personal information is as follows.

• Log records, IP addresses, etc. required for the provision of communication confirmation data: 3 months (Protection of Communications Secrets Act)
• Records concerning labeling/advertising: 6 months (Act on the Consumer Protection in Electronic Commerce)
• Records concerning consumer complaints and dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce)
• Records concerning identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection)
• Books and supporting documents concerning transactions: 5 years (Framework Act on National Taxes, Corporate Tax Act, Value-Added Tax Act, etc.)
• Records concerning contracts or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records concerning payment settlement and the supply of goods, etc.: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records concerning the collection/processing and use of credit information: 3 years (Credit Information Use and Protection Act)

③ In order to prevent acts of illegitimately or improperly obtaining economic benefits such as discount coupons and event benefits provided by this service by repeatedly re-registering and arbitrarily withdrawing after a member voluntarily withdraws, as well as acts such as identity theft occurring in this process, the Company retains the member's name, email address, and mobile phone number identification information for 1 month after the member's withdrawal.

④ Where it is necessary to retain information in preparation for litigation, disputes, or other necessary cases, or for customer response, the Company stores such information separately from other members' personal information during the relevant period in accordance with Article 39-6 of the Personal Information Protection Act.

⑤ The Company may continue to retain personal information in a form in which a specific individual cannot be identified, for purposes such as statistical compilation and academic research.

The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purposes of Personal Information Processing), and provides personal information to third parties only where it falls under Article 17 and Article 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of law.

① The Company may entrust the processing of personal information to other companies, etc., in order to improve its services. When entrusting the processing of personal information, the Company manages and supervises the service provider so that members' personal information is processed safely, and restricts the service provider from processing members' personal information for other purposes.

② When entrusting the processing of personal information, the Company will notify members of that fact in advance.

③ When entrusting the processing of personal information, the Company clearly stipulates, through an entrustment contract, etc., the service provider's strict compliance with instructions regarding personal information protection, confidentiality concerning personal information, the prohibition of provision to third parties, and liability in the event of an incident, and retains the contents of such contract in writing or electronically.

④ Status of personal information processing entrustment

① Data subjects may exercise their rights against the Company at any time, such as requesting to view, correct, delete, or suspend the processing of their personal information.

② The exercise of rights under paragraph 1 may be made to the Company in writing, by email, or by facsimile (FAX), etc., in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action thereon without delay.

③ The exercise of rights under paragraph 1 may be made through a representative, such as the data subject's legal representative or a duly authorized agent. In this case, you must submit a power of attorney in the form of Appendix No. 11 of the "Notification on the Method of Personal Information Processing (No. 2020-7)."

④ Requests to view personal information and to suspend its processing may be restricted with respect to the rights of the data subject pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑤ Requests to correct or delete personal information cannot demand its deletion where the collection of such personal information is specified as mandatory in other statutes.

⑥ When there is a request to view, a request to correct or delete, or a request to suspend processing pursuant to the rights of the data subject, the Company verifies whether the person making the request, etc., is the data subject in person or a legitimate representative.

① When personal information becomes unnecessary, such as upon the expiration of the retention period or the achievement of the processing purpose, the Company destroys the relevant personal information without delay.

② The procedure and method for destroying personal information are as follows.

Even without a member's withdrawal request, in accordance with Article 39-5 of the Personal Information Protection Act, in the case of a user who has not used the Company's information and communications services such as its website or app for 1 year from the date of last use, the Company must notify the user of the fact of destruction of personal information, the expiration date of the period, and the items of information to be destroyed, by email or SNS, etc., 30 days before the 1-year mark, and then destroy the personal information of the inactive user once 1 year has passed from the date of last use of the service. However, among the information to be destroyed, information corresponding to each statutory retention period specified in Article 2(2) of this policy shall be stored and managed separately from the personal information of active users during the relevant statutory period.

The Company takes the following measures to secure the safety of personal information.

• Technical measures: management of access rights to the personal information processing system, etc., installation of an access control system, encryption of unique identifying information, etc., and installation of security programs

① The Company uses 'cookies' that store usage information and retrieve it from time to time in order to provide individually customized services to users.

② A cookie is a small piece of information that the server (http) used to operate the website sends to the user's computer browser, and it may also be stored on the hard disk within users' PCs.

• Installation, operation, and refusal of cookies: You can refuse to store cookies through the option settings in the Tools > Internet Options > Privacy menu at the top of your web browser.

① The Company takes overall responsibility for tasks concerning the processing of personal information, and designates a Chief Privacy Officer as below in order to handle complaints from data subjects and provide relief for damages in relation to personal information processing.

② Data subjects may direct all inquiries, complaint handling, damage relief, and other matters concerning personal information protection that arise while using the Company's service (or business) to the Chief Privacy Officer and the department in charge. The Company will respond to and handle data subjects' inquiries without delay.

Data subjects may file a request to view their personal information pursuant to Article 35 of the Personal Information Protection Act with the department below.

Data subjects may inquire with the following organizations regarding damage relief, consultation, etc., for personal information infringement.

<The organizations below are separate from the Company. If you are not satisfied with the Company's own handling of personal information complaints and damage relief, or if you need more detailed assistance, please contact them.>

• Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency): Responsibilities — reporting personal information infringement, consultation requests / Website: privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: Responsibilities — application for personal information dispute mediation, collective dispute mediation (civil resolution) / Website: www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Crime Investigation Division: 02-3480-3573 (www.spo.go.kr)
• National Police Agency Cyber Safety Bureau: 182 (https://cyberbureau.police.go.kr)

This Privacy Policy applies from September 1, 2022.