◾️ Purpose of Processing, Items Collected, and Retention and Use Period of Personal Information

① Information regarding the items, purposes, and retention periods of personal information processed by the Company is provided below.

② Personal information being processed will not be used for purposes other than those specified above. In the event that the purpose of use changes, the Company will implement necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

③ The Company processes and retains personal information within the period of retention and use prescribed by law or agreed upon by the data subject at the time of collection. However, in the following cases, such information shall be processed and retained until the conclusion of the respective reason:

1) If an investigation or inquiry into a violation of relevant statutes is underway: Until the conclusion of such investigation or inquiry.

2) If any claims or debt obligations remain from the use of the website: Until the settlement of such claims or debt obligations.

3) If a mandatory retention period is required by relevant statutes: Until the expiration of such period.

• Act on Consumer Protection in Electronic Commerce: Records on contracts or withdrawal of offers, etc. (5 years)
• Act on Consumer Protection in Electronic Commerce: Records on payment and supply of goods, etc. (5 years)
• Act on Consumer Protection in Electronic Commerce: Records on customer complaints or dispute resolution (3 years)
• Act on Consumer Protection in Electronic Commerce: Records on labels and advertisements (6 months)

◾️ Provision of Personal Information to Third Parties

① The Company processes the personal information of data subjects only within the scope specified for the purpose of processing. The Company provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of the law, and does not provide personal information to third parties otherwise.

② In the event of emergency situations such as disasters, infectious diseases, incidents or accidents that pose an imminent danger to life or limb, or imminent loss of property, the Company may provide personal information to relevant authorities without the consent of the data subject as follows.

In such cases, the Company will provide only the minimum personal information required based on the relevant statutes and will not provide it for purposes other than the intended use.

◾️ Outsourcing of Personal Information Processing

① The Company entrusts the processing of personal information as follows to ensure smooth processing of personal information.

The Company entrusts the processing of personal information overseas as follows.

• Methods and procedures for refusing the transfer of personal information and the effects of such refusal: Data subjects may refuse the overseas transfer of their personal information by sending an email to the department in charge of personal information. However, if you refuse the overseas transfer of personal information, your use of Premium Membership services may be restricted.

② When entering into entrustment contracts, the Company specifies in documents such as contracts the matters concerning responsibilities, including the prohibition of processing personal information for purposes other than the performance of entrusted work, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of the entrustee, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the entrustee processes personal information securely.

③ If the content of the entrusted work or the entrustee changes, the Company will disclose such changes through this Privacy Policy without delay.

◾️ Destruction of Personal Information and Procedures

① The Company shall destroy personal information without delay when it becomes unnecessary, such as upon the expiration of the retention period or the achievement of the purpose of processing.

② If personal information must continue to be preserved in accordance with other statutes despite the expiration of the retention period agreed upon by the data subject or the achievement of the purpose of processing, the Company shall move such personal information to a separate database (DB) or store it in a different location.

③ The procedures and methods for destroying personal information are as follows:

• Destruction Procedure: The Company selects the personal information for which a reason for destruction has occurred and destroys the information upon approval from the Company’s Privacy Officer.
• Destruction Method: Personal information recorded and stored in the form of electronic files is destroyed in a manner that renders the records irrecoverable. Personal information recorded and stored on paper documents is destroyed by shredding with a shredder or by incineration.

◾️ Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them

① Data subjects may exercise their rights to access, correct, delete, and suspend the processing of their personal information against the Company at any time.

② Pursuant to Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, such rights may be exercised in writing, via email, or by facsimile (FAX), and the Company will take action regarding such requests without delay.

③ Rights may also be exercised through a legal representative or an authorized agent of the data subject. In this case, a power of attorney in accordance with Form No. 11 of the "Notice on Personal Information Processing Methods (No. 2023-12)" must be submitted.

④ Requests for access to and suspension of processing of personal information may be restricted pursuant to Article 35, Paragraph 4, and Article 37, Paragraph 2 of the Personal Information Protection Act.

⑤ Requests for the correction or deletion of personal information cannot be made if the personal information is specifically designated as a subject of collection under other statutes.

⑥ Upon receiving a request for access, correction, deletion, or suspension of processing according to the data subject's rights, the Company shall verify whether the person making the request is the data subject themselves or a legitimate representative.

◾️ Measures to Ensure the Security of Personal Information

① The Company takes the following measures to ensure the security of personal information:

1) Administrative Measures: Establishment and implementation of internal management plans, operation of a dedicated organization, and regular training for employees.

2) Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, and installation and update of security programs.

3) Physical Measures: Access control for computer rooms, data storage rooms, and other restricted areas.

◾️ Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company does not use "cookies" that store and frequently retrieve the user's information.

◾️ Collection, Use, and Refusal of Behavioral Information

① The Company collects and uses behavioral information to provide data subjects with optimized, customized services and benefits, as well as online personalized advertisements during the use of its services.

② The Company does not directly collect or process the behavioral information of users for the purpose of online personalized advertising.

③ The Company allows online personalized advertising service providers to collect and process behavioral information as follows:

• Advertising service providers intending to collect and process behavioral information: Google, Coupang, Hubbleview
• Method of collecting behavioral information: Automatic collection when the user visits or launches the service
• Items of behavioral information collected and processed: User's service visit history, search history, purchase history, click history, and Advertising Identifier (ADID/IDFA)
• Period of retention and use: Until the user's cookies are deleted or until the termination of the contract

④ Data subjects may block or allow personalized advertisements by changing their settings as follows:

[ Blocking/Allowing Advertising Identifiers on Smartphones ]

• Android: Settings > Privacy > Ads > Reset advertising ID or Delete advertising ID
• iOS: Settings > Privacy & Security > Tracking > Toggle off "Allow Apps to Request to Track"

※ Menu names and methods may vary slightly depending on the mobile OS version.

⑤ Data subjects may inquire about matters concerning behavioral information, exercise their right to refuse, or report damages through the Privacy Officer and the department in charge of personal information as guided in this Privacy Policy.

◾️ Privacy Officer and Requests for Access to Personal Information

① The Company has designated a Privacy Officer as follows to take overall responsibility for matters related to personal information processing and to handle complaints and provide remedies for damages to data subjects in connection with the processing of personal information.

② Data subjects may request access to their personal information pursuant to Article 35 of the Personal Information Protection Act through the department listed below. The Company will endeavor to ensure that such requests for access are processed promptly.

③ Data subjects may contact the Privacy Officer and the department in charge for any inquiries related to personal information protection, complaint handling, and remedies for damages that arise while using the Company's services (or business). The Company will respond to and process inquiries from data subjects without delay.

◾️ Remedies for Infringement of Rights

① The Company guarantees the data subject's right to self-determination of personal information and endeavors to provide consultation and remedies for damages caused by personal information infringement. If you require reporting or consultation, please contact the department in charge.

② To receive remedies for personal information infringement, data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Reporting Center of the Korea Internet & Security Agency, etc. For other reports or consultations regarding personal information infringement, please contact the following organizations:

• Personal Information Dispute Mediation Committee: (No area code) 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: (No area code) 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: (No area code) 1301 (www.spo.go.kr)
• National Police Agency: (No area code) 182 (ecrm.cyber.go.kr)

③ Any person whose rights or interests have been infringed upon due to a disposition or omission made by the head of a public agency in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

• Central Administrative Appeals Commission: (No area code) 110 (www.simpan.go.kr)