Privacy policy.

KMBOX Co., Ltd. (hereinafter referred to as the “Company”) attaches great importance to the protection of users’ personal information and complies with relevant laws and regulations, including the [Personal Information Protection Act], [Communications Secrets Protection Act], [Telecommunications Business Act], [Act on the Protection and Use of Location Information], and [Act on Promotion of Information and Communications Network Utilization and Information Protection]. Through the personal information processing policy, the Company informs users of the purposes and methods for which the personal information they provide is used and what measures are taken to protect personal information.

The Company may change the personal information processing policy at any time due to changes in government laws and guidelines or changes in the Company’s internal policies, and in the event of revisions, the Company will notify users of the changes through website notices (or individual notices) so that users can easily see them at any time. Therefore, users are requested to check the contents frequently when visiting the site.

Article 1 (Items of personal information collected and collection methods)

1. Items of personal information collected

1) The Company collects the following personal information when first registering as a member or using the service in order to provide various services.

1: Service name: Membership registration Collection purpose: Membership registration/login linked to SNS account Collection items: Google Play ID, Facebook ID, Apple ID, Nickname Category: Required

2: Service name: 1:1 inquiry (customer center) Collection purpose: Customer consultation (inquiry/answer) Collection items: E-mail, ID, nickname, terminal information (terminal name and OS version), user unique number, game version in use, store name in use Category: Required

3: Service name: Event/promotion Collection purpose: Event/promotion product delivery, etc. Collection items: Name, email, phone number, address, zip code Category: Optional

4: Service name: Recovery and refund Collection purpose: In cases where it is inevitably necessary for payment, etc. during the use of free/paid services Collection items: Telecommunications company information, email address, purchase history confirmation, real name and family relationship proof for confirmation of payment by someone other than the person himself Category: Optional

2) Services without a separate consent procedure for clause 1 do not collect required or optional items. 3) The following information may be generated and collected during the service use process or business processing.

- User's mobile phone terminal information (model name, OS version, mobile firmware version, device unique number), IP address, cookies, last access location

- Records when using location-based services (location information)

- Access time, service use records

2. Collection method

1) Collected through the consent procedure provided when signing up for the company's service

2) Collected through a separate consent procedure for promotions and events

3) Automatically collected through platforms that are affiliated with the company for service provision

4) Collected upon voluntary provision by the user or upon request as needed during customer response during payment and use

3. Members may refuse to collect and use the above personal information. However, if they refuse to collect and use personal information, it may be difficult to use some or all of the services.

Article 2 (Purpose of collection and use of personal information)

The company will not disclose the collected personal information without the user's prior consent and will use the collected personal information for the following purposes. 1. Identification of the user according to service use, customer consultation, service statistical analysis

- E-MAIL, nickname, SNS identification information, mobile phone model name, mobile phone OS version, mobile phone manufacturer, date and time information displayed on the mobile phone, mobile phone display resolution, mobile carrier information, Android Device ID

2. Prevention of member misuse and unauthorized use

- Access IP information, service use records, access logs, visit time, bad use records, date and time information set on the terminal

3. User personal identification and information sharing

- Profile photos, photos registered within the service, SNS identification information

4. Use for new service development and marketing/advertising

- New service development and provision of customized services, provision of services and advertisements based on statistical characteristics, verification of service validity, provision of event and advertising information and participation opportunities, determination of access frequency, statistical purposes regarding user service use

Article 3 (Processing and retention period of personal information)

1. In principle, the member's personal information is destroyed so that it cannot be restored or regenerated in accordance with the Personal Information Protection Act once the purpose of collection and use of personal information is achieved. The company completely deletes personal information when a member withdraws membership in order to prevent misuse in accordance with the terms and conditions and internal policies.

2. Notwithstanding Paragraph 1 of this Article, even if the purpose of collection or the purpose of provision has been achieved, if there is a need to preserve the information in accordance with the provisions of the Commercial Act or other laws and regulations, and if there is a reason for information protection in accordance with internal policies or other related laws and regulations, the company will preserve the user information for a certain period of time as specified in the related laws and regulations. In this case, the company will use the stored information only for the purpose of preservation, and the preservation period is as follows. 1) Records on contracts or cancellation of subscription, etc.

- Basis for retention: Act on Consumer Protection in Electronic Commerce, etc.

- Retention period: 5 years

2) Records on payment and supply of goods, etc.

- Basis for retention: Act on Consumer Protection in Electronic Commerce, etc.

- Retention period: 5 years

4) Records on consumer complaints or dispute resolution

- Basis for retention: Act on Consumer Protection in Electronic Commerce, etc.

- Retention period: 3 years

5) Records on electronic financial transactions

- Basis for retention: Electronic Financial Transactions Act

- Retention period: 3 years

6) Records on display/advertisement

- Basis for retention: Act on Consumer Protection in Electronic Commerce, etc.

- Retention period: 6 months

7) Records on identity verification

- Basis for retention: Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

- Retention period: 6 months

8) Personal information related to service use (access records, usage records, IP information)

- Basis for retention: Communications Secrets Protection Act

- Retention period: 3 months

Article 4 Sharing of personal information and provision

1. The company uses the member's personal information within the scope notified in the purpose of collection and use of personal information, and does not use it beyond the above scope or provide or share it with other persons or organizations without the member's prior consent. However, this does not apply in cases where the member has given prior consent or where legal action is required in accordance with the procedures and methods stipulated by law or a request is made by a relevant investigative agency due to an act that violates the company's terms of use or policies and operating regulations separately established by the company, based on relevant laws or for investigative purposes.

2. The company may provide or share the member's personal information with affiliates for business reasons such as providing customized services for members or users or other various services. However, when providing personal information or sharing information, the company will notify the affiliate's name, purpose of the partnership, scope of personal information provided or shared, and how long it will be used/stored in advance and obtain consent before providing the information. If the member does not consent, the information will not be provided or shared with the affiliate. 3. If a member has given prior consent, this means that he/she has consented to the provision of personal information to a third party while participating in various promotions such as using affiliate services, participating in events, conducting user research, or using donation services. Even in such cases, the company notifies the member in advance of the recipient of personal information, the purpose of use, the items of personal information provided, and the period of retention and use of personal information, and obtains explicit and individual consent for this. In all such processes, the company does not collect additional information against the member’s will or share information beyond the scope of consent with a third party.

Article 5 (Entrustment of Personal Information Processing)

The company entrusts some personal information processing tasks to ensure smooth processing of personal information, and supervises whether the recipient safely processes personal information in accordance with relevant laws when concluding an entrustment contract. If the content of the entrusted tasks or the recipient is added or changed, we will disclose it through the personal information processing policy without delay in accordance with relevant laws.

Article 6 (Rights of members and legal representatives and methods of exercising them)

1. Members may check, view, or modify their personal information at any time, and may also request cancellation of membership or deletion of personal information. However, if you delete personal information necessary for service provision, you may not be able to receive the relevant services.

2. If a member requests correction or deletion of his/her personal information, the company will take necessary measures immediately after verifying his/her identity. In addition, if use is restricted according to the terms of use, personal information such as member ID deletion may be destroyed at the discretion of the personal information protection officer.

3. If the company collects, uses, or provides personal information of children under the age of 14, the company must obtain the consent of the legal representative.

4. Access to and correction of a member's personal information may be made upon request by the member or the legal representative of a child under the age of 14 after verifying his/her identity.

5. If you request correction of errors in personal information, the personal information in question will not be used or provided until the correction is completed. In addition, if incorrect personal information has already been provided to a third party, the results of the correction process will be notified to the third party without delay to ensure that the correction is made. 6. The company processes personal information that has been terminated or deleted at the request of a member in accordance with the provisions of “Retention and Use Period of Personal Information Collected by the Company” and processes it so that it cannot be viewed or used for any other purpose.

Article 7 (Installation, operation, and refusal of automatic personal information collection devices)

1. Items collected: Visit records, access IP information, service use records. Advertising identifier, type of mobile communication terminal, model name, operating system, OS version, region, number of first executions, app updates, cookies (Cookies are a small amount of information that the server (http) used to operate the service sends to the user’s terminal and may be stored on the user’s terminal.)

2. Types and methods of cookie use:

1) Google Analytics: We use a behavioral information analysis tool provided by Google, and GA collects the main actions (behavioral information) of users of our service through cookies. The collected information cannot identify individual users, but you can refuse it using the method below.

2) Pixel: We use a behavioral information analysis tool provided by Facebook, and Pixel collects the main actions (behavioral information) of users of our service through cookies. The collected information cannot identify users individually, but you can refuse it using the method below.

3. How to install/operate cookies and refuse them: The collected cookies are transferred to and stored by Google and Facebook in the United States. You can refuse to store cookies using the method below.

1) For iPhone: Safari App > Clear history and website data > OK

2) For Chrome: Chrome App > More in the upper right corner > Delete history > Select period > Check the boxes next to 'Cookies and site data' and 'Cached images or files' > Delete history

Article 8 (Procedures and methods for destroying personal information)

In principle, the member's personal information is destroyed without delay once the purpose of collecting and using personal information is achieved. The procedures and methods for destroying personal information are as follows.

1. Destruction procedures

The company stores personal information for the retention period according to the retention basis and then destroys it so that it cannot be restored or reproduced. 2. Destruction Method

1) Personal information printed on paper is destroyed by shredding or incineration.

2) Personal information saved in electronic file format is deleted so that the records cannot be restored or reproduced.

Article 9 (Technical/Administrative Protection Measures for Personal Information)

1. Members' personal information is primarily protected by the password set by the user. Therefore, members must never disclose or share their passwords to others, and must log out and close the web browser after using the company's services. In particular, the above procedure is absolutely necessary to prevent personal information from being disclosed to others when sharing a computer with others or using it in a public place.

2. When processing members' personal information, the company implements the following technical and administrative measures to ensure the safety of personal information so that it is not lost, stolen, leaked, altered, or damaged.

1) Technical Measures

- Members' passwords are encrypted so that individual users' passwords cannot be known. - We regularly back up information to prepare for damage to personal information, and use the latest antivirus programs to prevent leakage or damage to members' personal information and data.

- We use encrypted communication to safely transmit personal information on the network.

- We use an intrusion prevention system to control unauthorized access from the outside, and we strive to equip ourselves with all possible technical devices to secure complementarity in other systems.

2) Management measures

- We limit the processing of personal information to the personal information protection manager and a minimum number of personnel, and restrict access to personal information for other personnel.

- We always emphasize the obligations related to personal information protection through education for personal information processing personnel, and we regularly check the implementation of the personal information processing policy and the compliance of the person in charge, and we make every effort to immediately correct and rectify any problems that are found.

3. The company does not assume any responsibility for personal information leakage or damage caused by the member's own mistakes or carelessness, or other basic Internet risks. Article 10 (Contact information of the personal information protection manager and department in charge)

If an accident occurs that is contrary to the matters notified to the user due to the company's fault in protecting personal information, the personal information protection manager will take full responsibility. However, the company will not be held liable for any problems caused by unexpected accidents such as hacking or network risks, such as information damage, infringement, or leakage, or personal information leakage caused by the user's negligence, despite technical supplementary measures.

The company has designated the personal information protection manager as follows to protect customers' personal information and handle complaints related to personal information.

If you need to report or consult about other personal information infringements, please contact the following organizations. - Personal Information Infringement Report Center (http://privacy.kisa.or.kr, Tel. 118)

- Supreme Prosecutors' Office, Advanced Crime Investigation Division (http://www.spo.go.kr, Tel. 02-3480-2000)

- National Police Agency, Cyber ​​Security Bureau (http://www.ctrc.go.kr, Tel. 182)

- Personal Information Dispute Mediation Committee (http://www.kopico.go.kr / Tel. 1833-6972)

Article 11 (Changes and Notification of Personal Information Processing Policy)

In the event of additions, deletions, or modifications to the Personal Information Processing Policy, the principle is to notify through a notice 7 days prior to the revision, and any changes that are disadvantageous to members are notified 30 days prior to the revision.

Supplementary Provisions

This Personal Information Processing Policy is effective from 01/01/2021.