Privacy Policy

Company name (the “Company”) establishes and publishes this policy under Article 30 of Korea's Personal Information Protection Act to protect data subjects' personal information and handle related complaints promptly and smoothly.

Article 1. Purposes of personal information processing

The Company processes personal information for the following purposes only. If a purpose changes, necessary measures, including separate consent under Article 18 of Korea's Personal Information Protection Act, will be taken.

1. Website membership registration and management

Personal information is processed to confirm registration intent, identify and authenticate Members, maintain membership, perform required identity checks, prevent misuse, confirm legal-representative consent for children under 14, issue notices and handle complaints.

2. Provision of goods or services

Personal information is processed for delivery, service provision, contracts and invoices, content, personalized services, identity and age verification, payments and settlement, and debt collection.

3. Complaint handling

Personal information is processed to identify complainants, confirm complaints, contact or notify persons for fact-finding and communicate results.

Article 2. Processing and retention periods

① The Company processes and retains information for the period prescribed by law or agreed by the data subject when information is collected.

② The processing and retention periods for each category are as follows.

1. Website membership registration and management: until withdrawal from the business or organization's website

However, the following cases are retained until the relevant matter ends.

1) Until an investigation or inquiry into a breach of applicable law has ended

2) Until outstanding claims and obligations from website use have been settled

2. Goods or service provision: until supply and payment or settlement are completed

However, information is retained until the end of the following applicable periods.

1) Transaction records, including representations, advertising, contracts and performance, under Korea's Act on Consumer Protection in Electronic Commerce

- Representations and advertising records: 6 months

- Contracts or withdrawal, payments and supply records: 5 years

- Consumer complaint or dispute handling records: 3 years

2) Communications fact-confirmation data retained under Article 41 of Korea's Protection of Communications Secrets Act

- Subscriber communication dates, start/end times, counterpart numbers, usage counts and originating base station location data: 1 year

- Computer communications, internet logs and connection-location tracking records: 3 months

Article 3. Provision of personal information to third parties

① The Company processes information only within Article 1's purposes. It provides information to third parties only with consent, under specific laws, or in other cases falling under Articles 17 and 18 of Korea's Personal Information Protection Act.

② To facilitate service provision, the Company may provide only the minimum necessary information in the following cases with consent under Article 17(1)(1) of that Act.

- Recipient: <Example: OOO Card Co., Ltd.>

- Recipient's purpose: <Example: joint events, business partnerships and affiliated credit card issuance>

- Information provided: <Example: name, address, telephone, email and card payment account information>

- Recipient's retention period: <Example: transaction period under the credit card issuance agreement>

Article 4. Outsourcing of personal information processing

① The Company outsources the following personal information processing tasks for efficient handling.

- Outsourced tasks

- Processor: Imweb Inc.

- Tasks: shopping mall hosting systems, mobile apps, marketing and additional/partner services; outsourced Alimtalk, Friendtalk and SMS messaging; and sales-channel order integration

- Processor: OOO PG

- Tasks: payment and escrow services

- Processor: OOO Courier

- Tasks: product delivery

- Processor: OOO Customer Center

- Tasks: customer support

- Processor: OOO

- Tasks: identity verification

- **Subprocessors**

- **Subprocessor: Imweb Inc. → Infobip Ltd.**

- **Tasks: SMS and KakaoTalk Alimtalk informational messages**

- **Subprocessor: Imweb Inc. → Lunasoft Inc.**

- **Tasks: SMS, KakaoTalk Alimtalk informational messages and Friendtalk**

② When entering an outsourcing agreement, the Company specifies in writing, under Article 25 of Korea's Personal Information Protection Act, restrictions on processing beyond the task's purpose, technical and administrative safeguards, subprocessing limits, supervision and liability including damages. It supervises processors' secure handling of information.

③ Changes to outsourced tasks or processors will be disclosed promptly through this Privacy Policy.

Article 5. Rights of data subjects and legal representatives, and how to exercise them

① Data subjects may exercise the following personal information rights against the Company at any time.

1. Request access to personal information

2. Request correction of errors

3. Request deletion

4. Request suspension of processing

② These rights may be exercised in writing, by telephone, email or fax. The Company will act without delay.

③ If correction or deletion is requested, the Company will not use or provide the relevant information until it has completed the correction or deletion.

④ These rights may be exercised through a legal representative or authorized agent. A power of attorney in Form 11 attached to the Enforcement Rules of Korea's Personal Information Protection Act must be submitted.

⑤ Data subjects must not infringe their own or others' personal information or privacy processed by the Company in violation of applicable law.

Article 6. Categories of personal information processed

The Company processes the following categories of personal information.

1. Website membership registration and management

Required: <Example: name, birth date, ID, password, address, telephone, gender, email and i-PIN number>

Optional: <Example: marital status and interests>

2. Provision of goods or services

Required: <Example: name, birth date, ID, password, address, telephone, email, i-PIN number, credit card number, bank account and other payment information>

Optional: <Interests and purchase history>

Article 7. Destruction of personal information

① The Company destroys personal information without delay when it is no longer needed, including when its retention period expires or its purpose is fulfilled.

② If another law requires continued retention despite expiry or fulfillment of purpose, the information will be moved to a separate database or storage location.

③ Destruction procedures and methods are as follows.

1. Destruction procedure

The Company identifies information due for destruction and destroys it with the privacy officer's approval.

2. Destruction method

Electronic records are destroyed so they cannot be restored. Paper records are shredded or incinerated.

Article 8. Security safeguards for personal information

The Company takes the following measures to secure personal information.

1. Administrative: internal management plans and regular employee training

2. Technical: managing system access permissions, installing access controls, and encrypting unique identifiers

and other information; installing security software

3. Physical: access control for computer rooms and records storage rooms

Article 9. Installation, operation and rejection of automatic data collection tools

① The Company uses cookies to store and retrieve usage information for personalized services.

② A cookie is a small piece of information sent by a web server (http) to a user's browser and stored on their computer or mobile device.

③ Data subjects can allow or block cookies through browser settings. Rejecting storage may make personalized services difficult to use.

▶ Allowing or blocking cookies in desktop browsers

- Chrome: Settings > Privacy and security > Delete browsing data

- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allowing or blocking cookies in mobile browsers

- Chrome: Mobile browser settings > Privacy and security > Delete browsing data

- Safari: Device settings > Safari > Advanced > Block all cookies

- Samsung Internet: Browser settings > Personal browsing data > Delete browsing data

④ The Company collects and uses information about visits and usage patterns across services and websites, popular search terms and secure connections to provide optimized information.

Article 10. Privacy officer

① The Company designates the following privacy officer to oversee processing and handle complaints and remedies relating to personal information.

▶ Privacy officer

Name: OOO

Position: OOO

Contact: <Telephone>, <Email>, <Fax>

※ You will be connected to the department responsible for privacy.

▶ Privacy department

Department: OOO Team

Contact: <Telephone>, <Email>, <Fax>

② Data subjects may contact the privacy officer or department for all privacy enquiries, complaints and remedies arising from the Company's services or business. The Company will respond and act without delay.

Article 11. Requests to access personal information

Data subjects may request access under Article 35 of Korea's Personal Information Protection Act through the following department. The Company will endeavor to handle requests promptly.

▶ Department receiving and handling access requests

Department: OOO

Contact: <Telephone>, <Email>, <Fax>

Article 12. Remedies for infringement of rights

Data subjects may contact the following organizations for remedies and advice concerning personal information infringements.

1. Personal Information Dispute Mediation Committee: 1833-6972 within Korea (www.kopico.go.kr)

2. Personal Information Infringement Report Center: 118 within Korea (privacy.kisa.or.kr)

3. Supreme Prosecutors' Office: 1301 within Korea (www.spo.go.kr)

4. National Police Agency: 182 within Korea (ecrm.police.go.kr/minwon/main)

Article 13. Effective date and changes to this Privacy Policy

This Privacy Policy applies from 20XX. X. X.