(1) The Company processes and retains personal information for the period to which the customer consented to when personal information was collected. When the purpose of processing personal information is achieved or the period agreed by the customer expires or the customer withdraws their consent to the processing of their personal information, the relevant personal information will be destroyed.

(2) Regarding the personal information of customers who have not used the Company's services for the period of three years (if a different period is designated by other laws or at the customer's request, during such period), the Company will either destroy the information immediately after 3 years or store and manage it separately from other customers' personal information. In this case, the Company will notify the customer of the following by email, writing, phone, or similar methods 30 days prior to the expiration of the above period: the fact about destruction or separate storage/management of personal information, the expiration date of the period, and the relevant personal information items.

(3) Notwithstanding Paragraphs 1 and 2, if it is necessary to preserve the personal information of a customer for a certain period of time pursuant to the provisions of relevant laws and regulations, including the cases listed below, the Company may retain all or part of the personal information collected during such period as an exceptional case.

A. Records on contracts or withdrawal of offers, etc. in accordance with the Act on Consumer Protection in Electronic Commerce, etc.: 5 years

B. Records on payment and supply of goods, etc. in accordance with the Act on Consumer Protection in Electronic Commerce, etc.: 5 years

C. Records on the handling of complaints or disputes by consumers in accordance with the Act on Consumer Protection in Electronic Commerce, etc.: 3 years

D. Records on the collection, processing and use of credit information in accordance with the Credit Information Use and Protection Act. 3 years

E. Records on contracts or withdrawal of offers, etc. in accordance with the Act on Consumer Protection in Electronic Commerce, etc.: 5 years

F. If any claims/debt relationships remain due to use of the website, until the relevant claims/debt relationships are settled.

G. Data to confirm communication facts, such as computer communications and internet logs, in accordance with the Protection Of Communications Secrets Act: 3 months or 12 months

A. If the customer's consultation or complaint is related to an affiliate of SeAH Group, the customer's personal information may be provided to the relevant affiliate to facilitate provision of services to the customer. In this case, the Company will obtain prior consent from the customer.

B. If there are special provisions in other laws such as the Protection Of Communications Secrets Act, Framework Act on National Taxes, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., Act on Real Name Financial Transactions and Confidentiality, Credit Information Use and Protection Act, Framework Act on Telecommunications, Telecommunications Business Act, Local Tax Act, Framework Act on Consumers, Bank of Korea Act, Criminal Procedure Act, etc. However, even if an administrative or investigative agency requests for administrative or investigative purposes to the extent specifically prescribed by law, customers’ personal information will not be provided unconditionally and will be provided in accordance with the appropriate procedure as prescribed by law, including where a request is made through a warrant or in writing with the signature or seal of the head of the relevant agency.

C. Other cases where personal information may be provided to a third party pursuant to Articles 17 and 18 of the Personal Information Protection Act.

(1) In order to provide smooth services, the Company entrusts personal information processing to an external professional Company as follows:

(2) When concluding an entrustment contract, the Company will specify the following matters related to responsibility in documents such as the contract, and will supervise whether the trustee safely processes personal information: prohibition of processing personal information other than for the purpose of performing entrusted work in accordance with Article 26 of the Personal Information Protection Act, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of the trustee, compensation for damages, entrusted period, and obligation to return or destroy personal information after completion of processing.

(3) If there is a change in the details of the entrusted work or the trustee, the Company will disclose it through this Privacy Policy without delay.

(1) Customers can exercise their privacy rights on their personal information at any time as follows:

(2) You may exercise your rights in Paragraph 1 via email or phone, and the Company will take action without delay.

(3) If a customer requests correction or deletion of errors in personal information, the Company will not use or provide the personal information until correction or deletion is completed.

(4) The exercise of rights under Paragraph 1 may be made through an agent of the customer, such as a legal representative or a person who has been delegated. In this case, the customer must submit a power of attorney according to Attachment No. 11 of the “Notice on Personal Information Processing Methods (No. 2020-7)”.

(5) Customers must not infringe the personal information and privacy of the data subject himself or others processed by the Company in violation of related laws such as the Personal Information Protection Act.

(1) Technical protection measures

(2) Administrative protection measures

(3) Physical protection measures

(1) The Company is responsible for overall management of personal information processing, and has designated the Personal Information Manager and the Department of Personal Information Protection as shown below to protect personal information, handle customer complaints and provide relief for damages related to personal information processing.

(2) Please contact the Manager and the Department of Personal Information Protection for all personal information protection-related inquiries, complaint handling, damage relief, etc. that occur while using the Company's services (or while doing business with us), including requests to view personal information pursuant to Article 35 of the Personal Information Protection Act. The Company will to and process inquiries from customers without delay.

(3) The Company values its customers' personal information and does every effort to prevent its customers' personal information from being damaged, infringed, or leaked. However, the Company shall not be responsible for any damage to personal information due to unexpected accidents caused by basic network risks such as hacking, and for various disputes caused by postings made by customers if such an incident occurs despite the Company taking all possible technical supplementary measures.

(1) This Privacy Policy is effective from February 1, 2023. If there are additions, deletions, or corrections to changes in accordance with laws and policies, we will be notified through a notice at least 7 days prior to the implementation of the changes.