Privacy Policy

Article 1. Purposes of Collection and Use; Personal Information Collected

• We collect only the personal information necessary to provide our services and provide appropriate notice to data subjects when collecting such information.
• We do not use personal information for purposes other than those for which it was collected. If a purpose of use changes, we will take the measures required under Article 18 of the PIPA, including obtaining separate consent where required. Where processing without consent is permitted by law, we will consider the relationship to the original purpose of collection, whether the further use could reasonably have been foreseen, the potential impact on the data subject’s interests, and whether appropriate safeguards are in place.
• Under Article 28-2 of the PIPA, we may process pseudonymized information without the consent of data subjects for statistical purposes, scientific research purposes, archiving purposes in the public interest, and other purposes permitted by law. We separately store and manage additional information necessary for re-identification and implement appropriate technical and managerial safeguards to prevent unauthorized re- identification.
• The personal information we collect and use is described below.
  • Processing based on the data subject’s consent under Article 15(1)1 of the PIPA

Article 2. Provision of Personal Information to Third Parties

• We use personal information only within the scope of the purposes notified to data subjects and, in principle, do not use it beyond that scope or provide it to third parties without prior consent, except as permitted by applicable law, including in the following circumstances:
  • where separate consent has been obtained from the data subject;
  • where specifically provided by law or necessary to comply with a legal obligation;
  • where prior consent cannot be obtained because the data subject or the data subject’s representative is unable to express an intention, cannot be located, or for a similar reason, and processing is clearly necessary to protect the urgent interests of the life, body, or property of the data subject or a third party; or
  • in any of the following cases, provided that such use or provision is not likely to unfairly infringe the interests of the data subject or a third party:
    • where necessary for statistical or academic research purposes and the information is provided in a form that does not identify a specific individual;
    • where duties prescribed by another law cannot be performed without such use or provision and the matter has been deliberated and resolved by the Personal Information Protection Commission(PIPC);
    • where necessary to provide the information to a foreign government or international organization to implement a treaty or other international agreement;
    • where necessary for a criminal investigation or the institution or maintenance of a prosecution;
    • where necessary for a court to perform its judicial functions; or
    • where necessary for the execution of a sentence, custody, or protective disposition.

Article 3. Cross-Border Transfer of Personal Information

• We do not transfer personal information outside the Republic of Korea for data storage or other purposes.
• If we transfer personal information outside the Republic of Korea in the future, we will disclose the relevant details in this Privacy Policy without undue delay and take the measures required by applicable law.

Article 4. Destruction of Personal Information

• In principle, we destroy personal information without undue delay when the applicable retention period expires or the purpose of processing has been achieved.
• Our destruction procedures and methods are as follows:
  • Procedure: Personal information submitted for visitor registration is moved to a separate database after the relevant purpose has been achieved (or, for paper records, stored separately), retained for the period required under internal policies or applicable law, and then destroyed. Information retained separately will not be used for any other purpose unless required or permitted by law.
  • Methods
    • Electronic files are permanently deleted using technical methods that prevent restoration or reproduction.
    • Paper documents and other non-electronic records are destroyed by shredding or incineration.

Article 5. Users’ Rights and How to Exercise Them

• We restrict use of our services by children under the age of 14.
• Users have the following rights regarding their personal information, and we take appropriate measures to facilitate the exercise of those rights.
  • A request for correction or deletion may be restricted where another law expressly requires the relevant personal information to be collected.
  • Users may request suspension of processing at any time. We may deny such a request where permitted by law.
  • Users may withdraw consent to the collection and use of personal information at any time. If withdrawal results in destruction of personal information, related information generated or accumulated through use of our services may also be destroyed.
  • Requests may be submitted to the department responsible for privacy inquiries in writing, by telephone, or by email. We will respond without undue delay. Where there are legitimate grounds, we may restrict or deny a request for access to or rectification of all or part of a user’s personal information and will notify the user of the decision and the reason.

Article 6. Measures for Personal Information

• We implement technical, managerial, and physical safeguards designed to protect personal information from loss, theft, leakage, alteration, or damage.
  • Managerial safeguards: establishing and implementing an internal management plan, providing regular employee training, and obtaining employee security undertakings.
  • Technical safeguards: managing access rights to personal information processing systems, operating access-control systems, encrypting personal information, and installing and updating security software.
  • Physical safeguards: controlling access to restricted areas.

Article 7. Automatically Collected Information and Cookies

• We do not use cookies that store and retrieve usage information to provide personalized services.

Article 8. Rights of Data Subjects and How to Exercise Them

• Data subjects may request access to, rectification of, or deletion of their personal information held by the Company. If rectification is requested, we will not use the relevant personal information until the rectification is completed. Personal information erased in response to a valid request will no longer be retained. Requests may be submitted by email, fax, or telephone.
• Data subjects may exercise the following rights:
  • Request for access to personal information
    Under Article 35 (Access to Personal Information) of the PIPA, a data subject may request access to his or her personal information held by the Company at any time.
    Access may be restricted where:
    • access is prohibited or restricted by law; or
    • suspension is likely to endanger another person’s life or body or unfairly infringe another person’s property or other interests; or
  • Request for rectification or deletion of personal information
    Under Article 36 (Rectification or Erasure of Personal Information) of the PIPA, a data subject may request rectification or deletion of personal information held by the Company. Deletion may not be requested where another law expressly requires the relevant personal information to be collected.
  • Request for suspension of processing of personal information
    A data subject may request suspension of processing of personal information held by the Company under Article 37(Suspension of Processing of Personal Information) of the PIPA. We may deny such a request where:
    • specifically provided by law or necessary to comply with a legal obligation;
    • suspension is likely to endanger another person’s life or body or unfairly infringe another person’s property or other interests; or
    • suspension would make performance of a contract difficult, including by preventing the Company from providing agreed services, and the data subject has not clearly expressed an intention to terminate the contract.
  • Other matters
    • If a data subject requests rectification or deletion of inaccurate personal information, we will not use or provide the relevant information until the request has been completed. If inaccurate personal information has already been provided to a third party, we will notify that third party of the rectification or deletion without undue delay.
    • Personal information terminated or deleted at the request of a data subject or legal representative is handled in accordance with the applicable retention and use period and protected against access or use for any other purpose.

Article 9. Chief Privacy Officer and Contact Information

• We have designated a chief privacy officer with overall responsibility for personal information processing and for handling privacy-related inquiries, complaints, and requests for remedies.

• Users may contact the chief privacy officer or the responsible department regarding privacy-related inquiries, complaints, or requests for remedies arising from use of our services.

Article 10. Remedies for Infringement of Rights

• Data subjects may seek dispute resolution or consultation from the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), or other relevant authorities. For additional reports or consultations regarding privacy infringements, please contact the organizations below.
  • Personal Information Dispute Mediation Committee: 1833-6972 (no area code required) (www.kopico.go.kr)
  • Personal Information Infringement Report Center: 118 (no area code required) (privacy.kisa.or.kr)
  • Supreme Prosecutors’ Office: 1301 (no area code required) (www.spo.go.kr)
  • Korean National Police Agency: 182 (no area code required) (ecrm.police.go.kr)

Article 11. Changes to this Privacy Policy

• This Privacy Policy is effective as of September 1, 2026.
• We maintain this Privacy Policy to protect personal information and the rights and interests of data subjects and to facilitate the handling of privacy- related concerns. Any material changes will be announced through our website or, where appropriate, by individual notice.