Privacy Policy (Effective: 2021.11.30 to 2023.05.25)

In order to provide the best service to users, ZEP Co., Ltd. (the “Company”) uses personal data from users to provide some of its services.

With respect to handling personal data of the users, the Company will comply with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., and other relevant laws and regulations including regulations enacted by the relevant authorities. The Company is to enact and apply the following Privacy Policy in order to prevent the misuse of users' valuable personal data and to clarify the purpose, methods, and scope in which personal data is collected and used. This Privacy Policy is subject to change due to amendments to applicable laws and regulations or amendments to the Company's internal policies.

Article 1 [Personal Data Collection and Collection Method]

① The Company will collect and handle the following personal data, and the collected personal data will not be used for purposes other than those specified herein.

1. Membership registration and managementRequired: email address (member ID), age verification (14 years of age or older), nickname, profile photo
2. Data automatically created and collected while using servicesIP address, service usage history, browsing history, date and time of membership registration, abuse history, device information

② The Company will collect personal data using the following methods:

• Data being directly input by the user on the Company’s website, applications, or within its services
• Data being collected through automatic collection devices

Article 2 [Purpose of Collection and Use of Personal Data]

① The Company may use collected personal data for the following purposes. Personal data which is handled by the Company is not used for other purposes than the following, and in the case of changes to the purpose of use, necessary measures such as consent receipt will be taken according to relevant laws and regulations.

1. Official website membership registration and user managementConfirmation on membership registration, self-identification/verification for provision of services, maintenance/management of membership qualifications, confirmation of valid membership registration records, management of abusers, revealing abusers and restricting their use, fulfillment of the contractual obligations, dispute resolution
2. Use of servicesComplaint handling and provision of other customer services, delivery of notices
3. Use required as per other applicable lawsPerformance of obligations stipulated in law, etc.

Article 3 [Retention Period of Personal Data and Withdrawal of Users]

① The Company will retain and use the personal data collected from the user while the user's status is maintained. If the purpose for the collection of the data is completely achieved, the data will be deleted immediately regardless of whether or not the user’s status is maintained. However, the Company will keep and use personal data for the written retention period if the Company has any of the following bases for retention:

• Retention basis : consumer satisfaction, dispute settlement, restriction to re-registration of membership, etc., when cancelling membership
• Retention period : 30 days
• Retained items : email, access records, abuse records, nickname

② Notwithstanding the provisions of Paragraph 1 above, if there is reason to hold personal data under relevant laws and regulations, the Company will preserve the data for a period of time prescribed in relevant laws and regulations including the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, Etc. In this case, the Company will separate the data to be preserved, and the preservation periods are as follows:

1. Records concerning display and advertising : 6 months (Act on the Consumer Protection in Electronic Commerce, Etc.)
2. Record of contract or withdrawal of subscription : 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
3. Record of payment and goods supply : 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
4. Record of complaints or disputes of consumers : 3 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
5. Books and supporting documents on all transactions as prescribed by tax law : 5 years (Framework Act on National Taxes)
6. Record on Electronic Financial Transactions : 5 years (Electronic Financial Transactions Act)
7. Record of access logs, connection IP information, etc. Service use : 3 months (Protection of Communications Secrets Act)

③ Your account will be withdrawn immediately upon application for withdrawal. User registration with the same email address will be restricted for one month after withdrawal.

Article 4 [Protection of Personal Data]

① The Company will collect and use the personal data of the user within the scope of Article 2 of this Privacy Policy. In cases in which personal data not mentioned in the Terms of Service or Privacy Policy is shared with third parties, the Company will notify the user in advance in order to obtain consent, and if the user does not agree to provide such data, the Company will not share the data with a third party. However, in the following cases, personal data may be shared with third parties without the consent of the user:

1. If the consent of the user has already been obtained
2. If there is an unavoidable situation in accordance with special provisions of the law or in order to comply with legal obligations (including cases of a request by an investigating agency or an administrative organ in accordance with the procedure and method prescribed by relevant laws and regulations for the purpose of investigation)
3. If a business assignment, merger, or etc. is to take place (However, if the user data needs to be transferred due to reasons related to the Company's assignment, etc., the Company will notify users of such fact in advance as per the procedure and method prescribed by applicable laws and provide members with the right to withdraw their consent to the transfer of personal data.)

② Members have the right not to consent to the provision of personal data to third parties and may withdraw their consent to the provision of personal data to third parties. Even if they do not consent, services that are not based on provision of personal data to third parties will remain available, while the use or provision of services dependent on the provision of this data to third parties may be limited. Notification will be provided for any other changes to the provision of personal data to third parties through separate notifications.

Article 5 [Handling Consignment of Collected Personal Data]

① The Company consigns personal data as described in Paragraph 2 in order to increase the quality of its services and to perform a certain part of tasks required to provide services and stipulates necessary matters for the personal data to be safely managed as per applicable laws and regulations upon conclusion of the consignment contract. Also, the amount of data to be shared is limited to the minimum amount necessary to achieve the concerned purposes.

② The trustees and entrusted task are as below:

• Trustee Amazon Web Service Inc.
• Entrusted task Operation and maintenance of cloud servers located in South Korea storing personal information

③ If the trustee or its task changes, it will be announced through this Privacy Policy.

Article 6 [Procedures and Methods for Destroying Personal Data]

① In principle, when the purpose for collecting and using a user’s personal data is achieved, the Company will destroy the data without delay. The Company’s procedures and methods for personal data destruction are as follows:

1. The data entered by the user for the purpose of membership registration, etc., is transferred to a separate database (or, in the case of paper documents, a separate document box) after the purpose is accomplished as per the internal policy and other relevant laws and regulations; the data is then stored temporarily and then destroyed. Personal data will not be used except for as prescribed by laws.
2. Personal data printed on paper is destroyed by a shredder. Personal data stored in the form of electronic files is deleted using a technical method that prevents it from being restored.

② The Company will, in accordance with Article 39-6 of the Personal Information Protection Act, in order to protect the personal data of those who have not used the service for a long period, immediately destroy the personal data of the user, or save or manage it separately, if the following conditions are met:

• Subject: Users who have not logged in for the past 1 year or have no history of inquiries or users who have no history of payment settlement for the past 1 year (In case of members registered for settlement)
• The Company notifies the user through email, etc. 1 month before the separation and storage of the personal data of the user who has not used the service for an extended period.

Article 7 [Rights and Obligations of Users and Legal Representatives]

① Users and their legal representatives may view or modify their personal data at any time. This can be done through Settings-View and Change Member Information within the service or through a wired phone call with an agent. However, if the user's personal data is linked with an external platform, such as Google, the user must view or change the personal data according to the method provided by the concerned platform vendor.

② If a user requests the correction of a personal data error, the Company will correct the error without delay or inform the user of the reason for not correcting it and will not use or share the data until necessary action is taken. However, the Company may provide such data when requested in accordance with applicable laws.

③ If the person whose data is to be collected is under 14 (a “Child”), the Company will obtain the consent of the legal representative separately from the Child's consent for the collection, use, provision, etc. of personal data protection.

④ In order to obtain the consent as described in Paragraph 1, the Company may request the minimum amount of data necessary, such as the name and address of the legal representative, and the collected personal data of the legal representative may not be used for purposes other than to confirm the consent of the legal representative and may not be shared with third parties. The agreement of the legal representative is used for a Child for the resolution of customer complaints when there is a dispute with the Company, for the withdrawal of subscriptions, settlement of payments, and the supply of goods.

⑤ The withdrawal of consent or the expiration of the validity of the legal representative’s consent will be executed in a non-renewable manner 30 days after the expiration date. However, if there is a legal need to preserve the data as defined in the Commercial Act or the Act on the Consumer Protection in Electronic Commerce, Etc., the Company will keep the personal data of the legal representative for the period set by applicable laws and regulations.

⑥ The legal representative of the Child may request the retrieval of the Child's personal data, corrections, or the withdrawal of consent to the collection, use and provision of personal data. If such a request is made, the Company will take necessary measures without delay.

Article 8 [Installation and Operation of Automatic Personal Data Collection Tools and Their Refusal]

① The Company installs and operates tools that automatically collect personal data, such as cookies (access information files) that store and retrieve user data from time to time to provide personalized services. A cookie is a small text file sent to the user's device by the server used to run an application and stored in your device's storage. When the user uses the application, the server reads the contents of the cookies stored in the user's device to maintain the user's preferences.

② The Company may use cookies for the following purpose:

• To analyze visits to and uses of the website and provide the user with personalized usage environments

③ The installation of cookies is optional. As a result, the user can allow all cookies in the device settings or options, require permission to be given each time a cookie is saved, or refuse to save all cookies. However, if the user refuses to store all cookies, the service may be restricted or unavailable.

Article 9 [Technical and Administrative Protection Measures for Personal Data]

① The Company takes the following technical and administrative measures while handling users’ personal data in order to prevent it from being lost, stolen, leaked, altered, or damaged.

1. Password encryption
• Users’ passwords are encrypted, stored, and managed. Therefore, even if a user forgets his or her password and confirming said password is impossible, a new password can be issued after a predetermined identification process.
2. Enhanced network security
• (a) The Company takes various technical measures to prevent the leakage of users’ personal data due to atypical network access from hacking, computer viruses, etc., and is constantly monitoring the network connection.
• (b) The Company uses a secure cryptographic communication method for communication between its server and database and makes every effort to secure all systems using all possible technical means.
3. Minimization and training of handling staff
• (a) The Company's personal data handling staff is limited to the person in charge. A separate password is assigned to the person in charge and is then updated periodically. The Company continuously reinforces compliance with the Privacy Policy through regular training.
• (b) The Company has internal procedures for preventing the leakage of data through the implementation of the security contract of the data handler and through the auditing the implementation of the Privacy Policy and the compliance of the employee.
• (c) Personal data security is handled thoroughly during personnel changes and responsibilities for accidents are clearly defined after both entering and leaving the Company.
4. Access and storage control
• The area where personal data is handled and stored is set as a secure zone so that only those who have the right to handle personal data can access it. Tangible and electronic records containing personal data are stored securely in areas that are equipped with security devices and require special permissions to access.
5. Operation of personal data protection team
• Through the in-house personal data protection organization, the Company checks the implementation of the Privacy Policy and the compliance of the person in charge.

② Users are obligated to protect themselves and not to infringe on the data of others. Users should be careful that their personal data, such as their password, is not leaked, and also that the personal data or postings of other users are not negatively affected. The Company will not take any responsibility for any personal data issues that occur due to a user's carelessness or mistake.

Article 10 [Personal Data Protection Manager]

① The Company makes its best effort to provide the best service while keeping personal data safe. The personal data protection manager is responsible for the protection of personal data in case of incidents as described above. However, despite technical remedies, the Company has no liability for any damage to data due to unexpected accidents caused by basic network dangers such as hacking, and any disputes over the posts made by visitors.

② You may contact the designated responsible person below to communicate your opinions or complaints about the Company's Privacy Policy. The following staff will make their best effort to collect your opinions and handle complaints.

Personal data protection manager

• Name : YOONSEUNGJAE
• Email address : hello@zep.us

③ In some circumstances you are entitled to the erasure of your personal data without undue delay.

Those circumstances include :

• (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• (ii) you withdraw consent to consent-based processing;
• (iii) you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and
• (iv) the personal data have been unlawfully processed. However, there are exclusions of the right to erasure.

The general exclusions include where processing is necessary :

• (a) for exercising the right of freedom of expression and information;
• (b) for compliance with a legal obligation; or
• (c) for the establishment, exercise or defense of legal claims.

You may request erasure of your information by contacting us at hello@zep.us

④ Please contact the following organizations if you need to report or consult about other personal data infringement.

[For South Korea]

• Personal Information Infringement Notification Center ( https://www.1336.or.kr /(02)1336 )
• ePRIVACY ( https://www.eprivacy.or.kr / (02)580-0533~4)
• Supreme Prosecutor's Office, Advanced Crime Investigation Department ( https://www.spo.go.kr / (02)3480-2000)
• Cyber Terrorism Response Center ( https://www.police.go.kr/www/security/cyber.jsp / (02)392-0330)

[For other countries]

Article 11 [Opinion Collection and Complaint Processing]

The Company has opened a window for filing opinions and complaints regarding the protection of personal data. Users who are dissatisfied with the handling of personal data may inquire about such issues to the person in charge of the personal data management of the Company and then will be notified of the result of their inquiries.

• Personal data protection manager email address: hello@zep.us

Article 12 [Notification Obligation]

The Company's Privacy Policy is subject to change due to changes in laws and the internal policies of the Company. In such cases, the Company will notify the user of the changes in a way that users can confirm on the official website or within services.

This policy will take effect on November 30, 2021.