Personal information items collected

1. The Company shall not collect any sensitive personal information which may lead to the infringement of human rights of users, including their race, ethnicity, ideas and creeds, place of birth and legal domicile, political orientations and criminal records, health status, and sexual life.
2. The Company shall collect and use the following essential personal information: ;
   • 1) Verification of a user’s identity and his/her willingness to obtain membership;

     - General Members: Name, ID, password, passport number (only for foreigners), alien registration number (foreigners residing in Korea), mobile phone number, e-mail address, country of birth, security password

     - corporate members: name of company, name of representative, business registration number, contact telephone number, place of workplace address, e-mail address, password, country of operation, cell phone number, secure password

   • 2) Self-authentication for payments and funds withdrawals

     - name, date of birth, account number, a copy of an identification card (any remaining information masked except for date of birth), cell phone number, secure password.

   • 3) Self-authentication for level up

     - cell phone number, e-mail address, a copy of an identification card (any remaining information masked except for date of birth), Connected information(CI), Duplicate membership verifying information (DI)

   • 4) Secure password initialization

     - name, e-mail address, cell phone number, a copy of an identification card (any remaining information masked except for date of birth), a facial photo

   • 5) Prevention of use by fraudulent members and prevention of unauthorized use

     - users’ IP address and date and time of their visit to the Company’s website

3. The following information may be created and collected in the process of using or processing services: Records on using services, payment records, records on the suspension and termination of services, access logs, cookies, users’ IP address, records on fraudulent or abnormal uses of services, Advertisement identifier(ADID/IDFA)

Collection method

1. The Company shall collect personal information through the following methods:
   • - homepage, cell phone applications, cell phone web page, fax, telephone, consumer bulletin board, e-mail, and event application
   • - Collection of personal information through a tool for collecting created information

Management of Membership

1. Self-authentication for the use of membership-based services, verification of individuals’ identity
2. Prevention of use of services by fraudulent members and of unauthorized use
3. Verification of users’ willingness to obtain membership and limitation on membership and the number of obtaining membership
4. Identification of minors
5. Records retention for consulting with customers, acceptance and handling of customers’ complaints and disputes resolution
6. Delivery of notices

Performance of agreements on the provision of services and payment of charges

1. Provision of services and contents, as well as tailored-made services
2. Payment and settlement of fees
3. Notification of the result of winning prizes at events/giveaways and delivery of products

Use for marketing and advertisements

1. Providing optimized services for customers
2. Developing and specializing in new services (products)
3. Providing services and posting advertisements according to demographic traits
4. Identifying the frequency of access to the Company’s homepage
5. Statistics on the use of services
6. Mailing periodicals and offering guidance on new products or services
7. Planning web services and events that meet customers’ interests
8. Delivering information on advertisements, such as giveaways and events, Company News and operation of member communities
9. Conducting customer questionnaire based survey

Partnership: The Company may provide customers’ personal information for its partners or share such information with its partners for the provision of better services. In case the Company does the foregoing acts, individual customers shall be notified in advance of who are our partners, what kinds of personal information items are provided or shared and why such personal information should be provided or shared and until when such information should be protected and managed, either in writing or e-mail, and give their consent to the provision and sharing of their personal information. If customers do not agree, the Company shall neither provide for its partners nor share their personal information with its partners. If there is any change in or termination of the Company’s partnership, the Company shall notify customers of such change or termination or seek their consent through the same procedure as described above.

Sale and merger and acquisition: If the Company sells its business, in whole or in part, or transfers and assumes the rights and obligations of any service providers, due to mergers and inheritances, the Company shall be sure to notify customers of such mergers and inheritances to guarantee customers their right related to the protection of their personal information.

Customers’ personal information is required for the performance of an agreement on the provision of services but it is significantly difficult to obtain customers’ ordinary consent due to economic and technological reasons.

Customers’ personal information is required for payments of fees in return for services

There is a special provision in other laws, such as the Protection of Communications Secrets Act, the Framework Act on National Taxes, the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc, the Act on Real Name Financial Transactions and Confidentiality, the Credit Information Use and Protection Act, the Framework Act on Telecommunications, the Telecommunications Business Act, the Local Tax Act, the Framework Act on Consumers, the Bank of Korea Act, the Criminal Procedure Act. However, even if there is a special provision in laws compelling the provision of customers’ personal information and customers’ personal information is requested by an administrative or investigation agency for administrative or investigative purposes, the Company shall not provide such personal information unconditionally but only do so in accordance with legal procedures, including by way of a writ or a written request affixed with a seal of head of such agency as stipulated in laws.

A user inflicts mental and physical damage on others using the Company’s services and therefore, the Company has sufficient grounds to determine that such user’s personal information should be disclosed for the Company to take legal action against such infliction of harm.

Management of User Information;

Customers’ personal information shall be retained and used during a period when the Company provides services for customers. Upon a user’s withdrawal of membership, such user’s personal information shall be destroyed to ensure that his/her/its personal information is neither accessed nor used. However, if such user’s personal information needs to be retained in accordance with the provisions of relevant statutes, it shall be retained in accordance with the following provisions. ;

• Records on payments and the supply of goods: three (5) years;
• Records on payments and the supply of goods: three (5) years;
• Records on the handling of customers’ complaints and disputes: three (3) years;
• Taxes and utility charges payment record: (5) years;
• Login record: (3) months;
• Labeling and advertising record: (6) months;

Performance of agreements on the provision of services and payment of charges ;

If a customer demands access to transaction information that has been retained by the Company after obtaining the consent of such a customer, the Company shall immediately take a step to ensure that such information can be accessed and checked by such a customer. ;

Procedure and Timing for Destroying Personal Information

The Company shall immediately destroy the personal information provided by customers to obtain membership after the purpose of using such information has been fulfilled, including termination of services, and a retention period of such information as stipulated by its internal guidelines and other relevant statutes (please, refer to the above period of retention and use of personal information) has elapsed. In general, if there is no remaining creditor and debtor relationship, the Company shall, upon withdrawal of membership, immediately delete any personal information that has been collected by the Company at the time of obtaining membership and afterwards managed in the form of electronic files.

Destruction method

Any person information printed out on papers shall be destroyed by being shredded through shredders or burnt or dissolved through chemical solutions and any personal information stored in electronic files shall be deleted through technological methods that cannot reproduce such files.

Separate storage time frame and method

As per the "Personal information expiry system, a user account that has not used the service for 1 year will be switched to a dormant state. Dormant members" personal information are separately stored and managed with restricted access and security. ;

The user or his or her legal representative may exercise the following rights for registered personal information of the user.

• Right to demand access to personal information
• Right to demand correcting errors in personal information, if any
• Right to demand the deletion of personal information
• Right to demand the suspension of personal information processing

Users and legal representatives of children under fourteen years of age may log into the Company’s homepage (www.korbot.com) and access or modify the personal information of themselves or such children in the Member’s Information Change menu or may do so by sending e-mails or written requests to a chief privacy officer at the Company.

The user or his or her legal representative may withdraw (cancel) ‘Consent to Personal Information Collection and Use’ through email, phone, or fax.

If users and legal representatives of children under fourteen years of age request the correction and deletion of errors in their personal information, the Company shall neither use nor provide such personal information until such errors are corrected or deleted. The Company shall handle the personal information that is terminated or deleted at the request of such users and legal representatives in accordance with ‘Period of Retention and Use of Personal Information’ and prohibit such information from being accessed or used for any purposes other than those stipulated in the ‘Period of Retention and Use of Personal Information.’

Protective measures for administrative purposes

1. Establishment and implementation of an internal management plan
   • - Matters on the appointment of the chief privacy officer
   • - Matters on roles and responsibilities of a chief privacy officer and a personal information- handling employee
   • - Matters on measures for ensuring the security of personal information
   • - atters on training on the personal information handling employee and companies entrusted with personal information processing
   • - Other matters required for the protection of personal information
2. Conducting its own internal audits
   • - Matters on divisions of duties between the chief privacy officer and an auditor
   • - Matters on roles and responsibilities of an auditor on personal information-related matters
   • - Conducting regular internal audits for ensuring the security of personal information handling

Technological protection measures

1. The Company operates a system designed to prevent the leakage of personal information in order to prevent the personal information-handling employee from leaking customers’ information. It also applies secure password algorithm to personal information that is transmitted via PCs and networks.
2. The Company grants each personal information handling employee one user account that has different functions and the least right to access a personal information handling system, which is required for performing his/her duties. If such personal information handling employee is replaced, the Company shall modify or delete his/her right to access the system and retain related records for at least five (5) years. In addition, the Company has established and applies a rule of creating a password for the personal information handling employee.
3. If the Company sends or receives individuals’ peculiar identification information and passwords via information communication networks or delivers them through supplementary storage mediums, it shall store them using commercial encryption software and encrypt passwords with secure password algorithms and store them in encrypted forms.
4. The Company retains and manages records on the personal information handling employee’s access to the personal information processing system for at least six (6) months and securely stores such records to ensure that such records are not forged, modified, stolen or lost.
5. The Company installs and operates security programs, such as vaccine programs that can prevent or cure malicious programs in the personal information processing system or computers used for business purposes. It also conducts regular PC checkups by using the automatic update function of such security programs.

Physical protective measures

The Company has established and operates a procedure for controlling entry to and exit from physical sites where personal information is stored, such as computer rooms and archives. It also stores and manages documents and supplementary storage mediums containing personal information at locations secured with locks.

The Company may install and operate cookies that store and frequently retrieve customers’ information through Internet services provided by the Company. Cookies mean a string of characters that a web server sends to a web browser to store it there and that is sent back to the server at the request of the server. If a customer accesses the Company’s website, the Company may read the contents of cookies stored at such a customer’s web browser and provide services by searching for additional information, without requiring such a customer to enter such additional information, including his/her/its name.

The Company may use customers’ information collected through cookies for the following purposes:

1. Providing different information depending on individuals’ interests
2. Identifying users’ tastes and interests by analyzing the access frequency or staying time of members or non-members, and using them for target marketing.
3. Tracing the contents that users read attentively and providing tailor-made services in his/her next visit to the Company’s website.
4. Providing guidance on a use period in using paid services.
5. Analyzing customers’ habits and using them as a measure for the reshuffling of services.

All customers have the right of choice over installation of cookies. They may accept or reject all cookies or receive notices whenever cookies are installed, by clicking “Tools>Internet Options> Personal Information > Advanced on the upper menu bar of a web browser. However, if a customer rejects the installation of cookies, he/she/it may have inconvenience or difficulty in using services.

Cookies expire at the termination of a web browser or when users log out of services.

The Company values the protection of customers’ personal information highly and does its best to ensure that their personal information is not damaged, compromised or leaked. However, the Company shall not be responsible for the information damaged by unexpected accidents that arise from basic dangers inherent at networks and all kinds of disputes that arise from postings made by visitors to the Company’s website, even though the Company has taken technological security measures.

The Company’s customer center offers swift and sincere replies to customers’ inquiries about the protection of their personal information. In addition, customers who wish to contact the chief privacy officer at the Company may contact him/her at the below telephone number or by e-mail. We will answer your inquiries on the protection of personal information swiftly and sincerely.

1. Chief Privacy Officer
   • Name: Dong Jin Hwang
   • Title: Director
   • email: [email protected]
2. Personal Information Handling Employee
   • Name: Eu Jin Han
   • Title: Director
   • email: [email protected]

You may make inquiries to the Personal Information Dispute Mediation Committee, Supreme Prosecutors’ Office, Korea National Policy Agency, Korea Internet & Security Agency if you need consulting to seek remedies for your compromised personal information.

1. Personal Information Dispute Mediation Committee (www.kopico.go.kr): 1833-6972
2. Supreme Prosecutors’ Office, National Digital Forensic Center (http://www.spo.go.kr): 1301
3. Korea National Policy Agency, Cyber Bureau (http://cyberbureau.police.go.kr): 182
4. Personal Information Response Center (http://privacy.kisa.or.kr): 118