Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information will not be used for purposes other than those stated below, and if the purposes of use change, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Membership Registration and Management
   • Verifying the intention to sign up, identity authentication for member-only services, maintaining and managing membership status, preventing fraudulent use of services, and providing various notices.
2. Provision of Korea-Settlement Services
   • Providing housing services (apartment matching, contract support), financial services (support for opening bank accounts), telecommunications services (mobile activation support), administrative services (support for Alien Registration Card application), and medical services (support for National Health Insurance enrollment).
3. Customer Support and Complaint Handling
   • Verifying the complainant’s identity, confirming complaint details, contacting and notifying for fact-finding, and providing results.
4. Marketing and Advertising
   • Developing new services and providing customized services, offering event and promotional information and opportunities to participate, verifying service effectiveness, and analyzing access frequency.
5. Payments and Settlement
   • Processing payments arising from service use, handling refunds, and settling claims and obligations.

Article 2 (Legal Bases for Processing)

The Company processes personal information on the following legal bases:

1. Consent of the data subject (Article 15(1)1 of the PIPA)
2. Conclusion and performance of a contract (Article 15(1)2)
3. Where specially prescribed by law or inevitably required to comply with legal obligations (Article 15(1)3)
4. Where it is necessary to protect the vital interests of the data subject or a third party when the data subject or legal representative is unable to express intent or prior consent cannot be obtained due to an unknown address, etc. (Article 15(1)4)
5. Where necessary to achieve legitimate interests and such interests clearly override the rights of the data subject (Article 15(1)6)

Article 3 (Methods of Collection)

The Company collects personal information by the following means:

1. Website, written forms, fax, telephone, customer center inquiries
2. Event entries, delivery requests
3. Provision from partner companies
4. Automatic collection via information-generating tools

Article 4 (Items of Personal Information Processed)

4-1. Service Use

• At report-request stage (required): name, email, date of birth, gender, nationality, mobile phone number
• At service-use stage (additionally collected, only if necessary for the service): passport information
• Optional: KakaoTalk ID, other social media accounts

4-2. Payments and Settlement

• Required: payment method information, transaction history, refund account information
• Optional: billing postal address

4-3. Customer Support

• Required: name, contact information, inquiry details
• Optional: email address

4-4. Marketing Consent

• Optional: email, mobile phone number

4-5. Automatically Collected Information

• Items: service usage records, access logs, cookies, IP address, device information (OS, browser, etc.), location information, advertising identifiers (ADID, IDFA)

Article 5 (Processing of Sensitive and Unique Identifiers)

5-1. Sensitive Information

The Company, in principle, does not process information on ideology/beliefs, membership or withdrawal from labor unions or political parties, political views, health, or sex life.

5-2. Unique Identifiers

Passport number

• Purpose of collection: assistance with Alien Registration Card application, support for opening bank accounts, identity verification, and insurance-related support
• Legal basis: consent of the data subject; conclusion/performance of a contract
• Retention period: one (1) year after completion of the service or until membership withdrawal
• Safeguards: encrypted storage in a separate database, minimization of access rights, and retention of access logs

Article 6 (Processing of Personal Information of Children under 14)

The Company does not process personal information of children under the age of 14. If it becomes known that a user is under 14, such personal information will be promptly destroyed.

Article 7 (Processing and Retention Period)

7-1. General Retention

1. Membership registration and management: until membership withdrawal (provided that, where an investigation due to violation of law is ongoing, until the investigation ends)
2. Provision of services: one (1) year after completion of the service
3. Customer support: three (3) years after completion of consultation

7-2. Statutory Retention

• Records of contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods: 5 years (same Act)
• Records of consumer complaints or dispute handling: 3 years (same Act)
• Records of labeling/advertisement: 6 months (same Act)
• Accounting books and documents prescribed by tax laws: 5 years (Basic National Tax Act)
• Website visit logs: 3 months (Protection of Communications Secrets Act)

Article 8 (Provision to Third Parties)

In principle, the Company processes personal information within the scope specified in Article 1 and provides personal information to third parties only in the following cases.

8-1. Provision Based on Prior Consent

• Recipients: service providers such as real-estate agencies, banks, telecommunications companies, hospitals, and the National Health Insurance Service, as agreed by the customer
• Purpose: provision of Korea-settlement services (housing, finance, telecommunications, medical services)
• Items: name, contact information, nationality, passport information, address, and other items necessary for service provision
• Retention by recipient: one (1) year after service completion

8-2. Provision Required by Law

• Where requested by investigative authorities pursuant to applicable laws
• Provision in a form where specific individuals cannot be identified for statistics, academic research, or market research

Article 9 (Outsourcing of Processing)

The Company outsources the following tasks for efficient processing of personal information:

Article 10 (Cross-Border Transfer of Personal Information)

The Company transfers personal information overseas as follows:

Article 11 (Automatic Collection and Behavioral Information)

11-1. Cookies

The Company uses cookies to provide individualized services.

Purposes of cookies: providing differentiated information based on interests; improving services through analysis of visits and usage patterns; delivering targeted advertising.

11-2. Behavioral Information

• Items collected: website visit history, search history, click logs, usage patterns
• Methods: automatic collection via cookies, web beacons, and pixel tags
• Purposes: personalized advertising; statistics on service use
• Retention: one (1) year from collection

11-3. How to Opt Out

PC browsers – Chrome: Settings > Privacy and security > Cookies and other site data; Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

Mobile – Android: Settings > Google > Ads > Opt out of Ads Personalization; iOS: Settings > Privacy > Tracking > Disable “Allow Apps to Request to Track”

Article 12 (Destruction of Personal Information)

12-1. Principle

The Company promptly destroys personal information when the retention period expires or the processing purpose is achieved.

12-2. Procedures and Methods

• Procedure: select information subject to destruction and destroy it upon approval of the Chief Privacy Officer.
• Methods: electronic files—irreversible deletion (e.g., low-level format); paper—shredding or incineration.

Article 13 (Rights of Data Subjects and How to Exercise Them)

13-1. Rights

Data subjects may request notification of processing status, access, correction/deletion, or suspension of processing at any time.

13-2. How to Exercise

By letter, phone, or email: [email protected]

Requests through an agent require a power of attorney.

13-3. Limitations

Requests may be restricted under Articles 35(4) and 37(2) of the PIPA where access is restricted by law, where there is a risk of harm to another’s life/body, or where another’s property or interests may be unduly infringed.

Article 14 (Measures to Ensure Safety)

• Technical: access-right management; access control systems and log retention; encryption; security programs and updates
• Administrative: internal management plans; periodic staff training; minimization of personnel handling personal information
• Physical: access control to computer rooms and records storage rooms

Article 15 (Chief Privacy Officer)

1. The Company designates the following Chief Privacy Officer (CPO) to take overall responsibility for personal information processing and for handling complaints and relief.
2. The Company strives to handle requests for access promptly.

Chief Privacy Officer

• Name: Juhak Kim
• Position: CEO
• Contact: [email protected]

Article 16 (Remedies)

For reports and counseling regarding personal information infringement, please contact the following Korean agencies:

1. Personal Information Infringement Report Center (KISA): 118 — privacy.kisa.or.kr
2. Personal Information Dispute Mediation Committee: 1833-6972 — www.kopico.go.kr
3. Supreme Prosecutors’ Office: 1301 — www.spo.go.kr
4. National Police Agency: 182 — ecrm.police.go.kr

You may also file an administrative appeal pursuant to the Administrative Appeals Act where your rights/interests are infringed by a disposition or inaction of a public authority regarding requests under Articles 35–37 of the PIPA. See www.simpan.go.kr for details.

Article 17 (Criteria for Additional Use/Provision)

Without separate consent, the Company may additionally use or provide personal information when considering the criteria under Articles 15(3) and 17(4) of the PIPA and Article 14-2 of its Enforcement Decree: relation to the original purpose; foreseeability; no undue infringement of interests; and security measures such as pseudonymization or encryption.

Article 18 (EU General Data Protection Regulation)

For EU residents, the following additional rights are provided under the GDPR:

18-1. Additional Rights

Right to data portability; right to object to automated processing including profiling; right to restriction of processing; right to erasure (right to be forgotten).

18-2. Legal Bases

Lawful bases under GDPR Article 6: consent (a), performance of a contract (b), compliance with legal obligations (c), protection of vital interests (d), and legitimate interests (f).

Article 19 (U.S. State Privacy Laws)

19-1. California (CCPA/CPRA)

Rights: right to know; right to deletion; right to opt out of “sale” of personal information (the Company does not sell personal information); right to non-discrimination.

Categories: identifiers; commercial information; Internet activity; geolocation (IP-based).

19-2. Other States (Colorado, Connecticut, Virginia, Utah)

Common rights: confirm/access; correction; deletion; data portability; opt-out of targeted advertising and sale.

Article 22 (Governing Law and Jurisdiction)

1. Korean law governs the interpretation of this Policy and disputes between the Company and users.
2. Litigation shall be brought before the court of competent jurisdiction under the Civil Procedure Act of Korea.

Article 23 (Amendments)

1. This Policy applies from the effective date.
2. Changes will be announced via notice at least seven (7) days prior to the effective date.
3. Material changes will be announced thirty (30) days in advance and, if necessary, re-consent will be obtained.