# KSTAGE Privacy Policy _v6 - en_ Maskit Inc. (the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act ("PIPA") in order to protect the personal data of data subjects and to handle related grievances promptly. KSTAGE, operated by the Company, is an online ticketing service that sells tickets for performances held in Korea **directly** to overseas travellers (FIT) from Taiwan, Thailand, Japan and elsewhere; it is not a travel business selling bundled travel products. ## Article 1 Purposes of Processing and Items of Personal Data In accordance with PIPA, the Company collects and uses personal data only to the minimum extent necessary to provide the Service. ### 1-1. Personal data processed without the consent of the data subject (conclusion and performance of a contract) Legal basis Activity Purpose of collection and use Items processed Processing and retention period PIPA Article 15(1)4 (conclusion and performance of a contract) Booking / Payment / Ticketing / Refund Booking and ordering of performance tickets; payment and settlement; cancellation and refund processing; identity verification for ticket collection at the venue Passport name in Roman letters, email address, booking details (performance title, seat grade, booking number, payment amount) 5 years (Enforcement Decree of the E-Commerce Act, Art. 6(1)2 and 3) PIPA Article 15(1)4 (conclusion and performance of a contract) Social login (LINE - Google) Member identification, simple login, securing a means of contact for non-member bookings **LINE Login**: LINE user identifier, email address (optional), profile name (optional), profile image (optional) **Google Login**: Google account email address, name, profile image Until the service link is terminated or membership is withdrawn PIPA Article 15(1)4 (conclusion and performance of a contract) Email verification login Member identification; identity verification by one-time passcode (OTP) Email address, the passcode (**never stored in plain text; kept only in an irreversible form**), IP address of the request The passcode becomes invalid **15 minutes after issue** or immediately upon use. The plaintext passcode is not stored; only a non-reversible HMAC is retained. Automatic deletion of expired or used authentication records is not currently enabled. They are retained during service operation and manually deleted when a deletion request is processed or the end of the processing purpose is confirmed. PIPA Article 15(1)4 (conclusion and performance of a contract) Account identification and management of linked login methods Linking multiple login methods (LINE, Google, email) to a single account and identifying the same user on return visits Email address, whether the email is verified, the type of linked login method and the account identifier issued by that service, the time of linking, account status Until membership is withdrawn PIPA Article 15(1)4 (conclusion and performance of a contract) Maintaining login state and preventing unauthorised access Keeping the login state secure and protecting users against unauthorised access, such as account takeover or brute-force attempts on passcodes Session identifier, access IP address, browser and device information (User-Agent), records of authentication events such as login, logout and account linking, number of authentication requests (per email address and per IP address) Sessions expire at whichever comes first: **30 days from last use** or **90 days from first login** (terminated immediately on logout). Automatic deletion of stored session and authentication records is not currently enabled. They are retained during service operation and manually deleted when a deletion request is processed or the end of the processing purpose is confirmed. PIPA Article 15(1)4 (conclusion and performance of a contract) Sending booking notifications Sending notices essential to the transaction, such as booking confirmation, cancellation and ticketing Email address, LINE user identifier, whether LINE notifications can be delivered (official account friend status) Until membership is withdrawn or the service link is terminated PIPA Article 15(1)4 (conclusion and performance of a contract) Display language and country-specific policy application Providing screens and notices in the user's language, and applying consent and refund rules that differ by region of residence Display language setting, region of use (derived from the selected language) Until membership is withdrawn PIPA Article 15(1)4 (conclusion and performance of a contract) Customer management and prevention of misuse Managing consultation and handling history; protecting the Service from misuse such as repeated booking and cancellation Email address, consultation and handling records, customer status markers recorded by operators (such as caution or transaction restriction) 3 years (Enforcement Decree of the E-Commerce Act, Art. 6(1)4) PIPA Article 15(1)2 (compliance with legal obligations) Retention of consent records Keeping records to evidence the giving and withdrawal of consent, such as consent to provision to third parties Type of consent, whether and when it was given or withdrawn, the version of the terms or policy applied, region of use, display language Until membership is withdrawn (or, where a statutory retention period for the related transaction records remains, until the end of that period) PIPA Article 15(1)4 (conclusion and performance of a contract) Customer support Receipt and handling of enquiries, complaints and grievances relating to booking, ticketing and refunds Email address, booking details (performance title, booking number), content of the enquiry 3 years (Enforcement Decree of the E-Commerce Act, Art. 6(1)4) PIPA Article 15(1)4 (conclusion and performance of a contract) Payment Payment authorisation, cancellation and refund processing Payment authorisation records (sensitive payment data such as card numbers are **processed directly by the payment gateway** and are not stored by the Company) 5 years (Enforcement Decree of the E-Commerce Act, Art. 6(1)3) ### 1-2. Processing of personal data for the purpose of sending advertising information (marketing) The Company sends news about new shows and tours, on-sale announcements, offers such as discounts and coupons, and event news **by email, only to those who have separately consented to receive marketing (advertising) information**. The personal data used are the email address, the selected language and the member display name (if set); no new personal data is collected for this purpose. Advertising emails are marked "(광고)" (advertisement) at the start of the subject line and state the sender's name, contact details and how to unsubscribe. This consent is optional, and not consenting does not restrict use of the service. Users may withdraw their consent at any time, free of charge, through the unsubscribe link in an advertising email, My Page settings, or customer support (kstage@maskit.co.kr), and the Company notifies the result of processing a consent or withdrawal by email within 14 days. Upon withdrawal or account deletion, the user is removed from the mailing list immediately. For details, see "Consent to Receive Marketing Information". **Retention of consent records**: Records of consent and withdrawal (date and time, channel, and consent document version) are kept to prove consent, and after withdrawal or account deletion they are stored separately for the period required to prove consent under applicable laws and then destroyed. ### 1-3. Information generated and collected automatically in the course of using the Service Basis of collection Purpose of collection and use Items of personal data Processing and retention period PIPA Article 15(1)4 (conclusion and performance of a contract) Provision and operation of the Service, prevention of unauthorised access, stable operation of systems, service improvement Access logs, IP address, device and browser information (User-Agent), and cookies essential for maintaining the login session Automatic deletion is not currently enabled; retained during service operation and manually deleted when a deletion request is processed or the end of the processing purpose is confirmed The items, purposes and retention period of information collected automatically through the usage analytics tool (PostHog) and the advertising tools used for advertising measurement and targeted advertising (Google Analytics 4, Google Ads and the Meta Pixel, installed through Google Tag Manager), and how to refuse them, are described in Article 11. Where the Company collects and uses personal data on the basis of consent, it clearly informs the data subject of the purpose of collection and use, the items collected, the retention and use period, the fact that the data subject has the right to refuse consent and any disadvantage resulting from such refusal, before obtaining consent. The same procedure applies where additional collection and use of personal data becomes necessary in connection with new business activities. ## Article 2 Retention and Use Period of Personal Data - As a general rule, the Company destroys personal data without delay once the purpose of processing has been achieved or consent has been withdrawn. - Where retention is required under other laws, the Company stores the relevant personal data separately in a distinct database. The applicable statutory retention periods are as follows. Legal basis Subject Period Enforcement Decree of the E-Commerce Act, Art. 6(1)2 Records concerning contracts or withdrawal of subscription 5 years Enforcement Decree of the E-Commerce Act, Art. 6(1)3 Records concerning payment and the supply of goods 5 years Enforcement Decree of the E-Commerce Act, Art. 6(1)4 Records concerning consumer complaints or dispute handling 3 years Protection of Communications Secrets Act, Art. 15-2(2) Communication confirmation data (access logs) 3 months 3. Separately from the statutory retention periods above, the Company's default policy is to retain **the list of bookers provided to the venue** for **6 months after the performance ends** and then destroy it (see Article 5). This is a distinct retention period whose purpose and scope differ from the statutory retention period (5 years) for contract and payment records. ## Article 3 Processing of Personal Data of Children Under 14 The Company restricts membership registration and use of the Service by children under 14 years of age and does not collect or process the personal data of children under 14. ## Article 4 Procedure and Method of Destroying Personal Data - The Company destroys personal data without delay once it becomes unnecessary, for example because the retention period has elapsed or the purpose of processing has been achieved. - Personal data for which a ground for destruction has arisen is destroyed with the approval of the Chief Privacy Officer. - Information in electronic file form is permanently deleted by a method that makes recovery or reproduction impossible; paper documents are shredded or incinerated. - Information that must be retained under law is stored and managed separately from other personal data. ## Article 5 Provision of Personal Data to Third Parties - The Company provides personal data to third parties only within the scope of the data subject's consent or where there is a legal basis. - The Company provides the finalised list of bookers to **the relevant venue** for the purposes of **issuing tickets and verifying admission at the venue**. Recipient Purpose of provision Items provided Retention and use period The venue at which the performance is held (this differs by performance; **the recipient is disclosed individually on the booking screen for the relevant performance** and consent is obtained there) Ticket issuance, verification of attendees at the venue, and contact regarding ticket issuance Booker's name (passport name in Roman letters), email address, performance session, seat grade, number of tickets, booking number (voucher code) Retained for **6 months after the performance ends**, then destroyed The email address is provided only where **contact concerning ticket issuance** is necessary, such as a discrepancy at collection or a change of session, and the venue may not use it for marketing or any other purpose. 3. Users may refuse consent to the provision to third parties above; however, **where consent to provision of the list, which is essential for ticket issuance, is refused, booking that performance and collecting the ticket at the venue may not be possible**. 4. Where there is a lawful request from an investigative authority under Article 18(2)2 of PIPA (special provisions of law) and Article 215 of the Criminal Procedure Act (seizure, search and verification), the Company may provide the minimum necessary personal data without the consent of the data subject. ## Article 6 Outsourcing of Personal Data Processing In order to provide the Service smoothly, the Company outsources the processing of personal data as follows and stipulates the safe management of personal data in its outsourcing contracts. Processor Outsourced work Google LLC Database operation (Cloud SQL), file storage (Cloud Storage), service hosting (Google Cloud Platform), AI translation processing (Gemini / Vertex AI), **Google social login integration**, and **Google Analytics 4 and Google Ads (analysis of advertising traffic, measurement of advertising performance and targeted advertising)** Resend, Inc. Sending booking confirmation and notification emails, sending advertising information by email (only to those who have consented) LY Corporation (LINE) LINE Login integration; sending booking and performance notifications EXIMBAY Co., Ltd. Payment gateway (PG): authorization, cancellation and refund of payments made with overseas-issued cards and e-wallets (such as Alipay+) PostHog, Inc. Service usage analytics (collection, storage and analysis of visit and usage records and error information) Meta Platforms, Inc. Advertising performance measurement and targeted advertising through the Meta Pixel (collection and analysis of advertising traffic and conversion events, and ad delivery based on visit history) Where a payment gateway (PG) processor is added or changed, the Company will reflect this in this Policy and disclose it in advance. The Company specifies in contracts and other documents matters such as the prohibition of processing personal data beyond the purpose of the outsourced work, technical and administrative protective measures, restrictions on sub-processing, supervision of the processor, and liability including compensation for damage, and supervises whether the processor handles personal data safely. Where the content of the outsourced work or the processor changes, the Company will disclose this through this Policy without delay. ## Article 7 Transfer of Personal Data Overseas The Company uses Google Cloud Platform (operated by Google LLC) for database operation, file storage, service hosting, and AI-based multilingual translation processing. **The database, file storage, and service servers used for booking information are located in the Republic of Korea (Seoul region)**; however, the providers listed below are companies headquartered outside Korea, and personal data may be transferred abroad in the course of system operation, technical support, and processing of certain functions. Recipient Country of transfer Items transferred Purpose of transfer Retention and use period Google LLC (Google Cloud Platform: Cloud SQL / Cloud Storage / service hosting / Google AI / Google Login / Google Analytics 4 / Google Ads) Republic of Korea (Cloud SQL, Cloud Storage, and service hosting -- Seoul region) - United States and others (AI translation processing; Google social login authentication; Google Analytics 4 and Google Ads) Personal data collected in the course of using the Service generally, access logs, performance information or notification text entered for translation processing, and **the Google account email address, name and profile image where Google Login is used**, and behavioural information collected through Google Analytics 4 and Google Ads (page addresses, referral source and advertising click identifiers such as gclid, product view and purchase (conversion) events including the transaction identifier, amount and currency, device and browser information, cookie identifiers -- see Article 11 for details) Database operation, file storage, and service hosting; AI translation (Gemini / Vertex AI) processing; **Google social login authentication**; analysis of advertising traffic, measurement of advertising performance (conversions) and targeted advertising (Google Analytics 4 and Google Ads) For the duration of provision of the Service (destroyed without delay upon termination of the outsourcing contract or achievement of the purpose of processing). Behavioural information in Google Analytics 4 is retained for up to 14 months from collection; conversion data received by Google Ads is retained in accordance with Google's policies (the _gcl_au and _gcl_aw cookies expire after 90 days) (Article 11) Resend, Inc. United States Email address, and booking information contained in the body of booking confirmation and notification emails Sending booking confirmation and notification emails, sending advertising information by email (only to those who have consented) Until the purpose of sending is achieved LY Corporation (LINE) Japan LINE user identifier, email address (optional), profile name (optional), profile image (optional), and information on notification recipients LINE Login integration; sending booking and performance notifications Until the service link is terminated or membership is withdrawn PostHog, Inc. United States Visit and usage records (page addresses, referral source, clicks, etc.), device and browser information, the country and city estimated from the IP address (the IP address itself is not stored), an anonymous identifier, internal member number when logged in, booking progress information, and error information (see Article 11 for details) Compiling service usage statistics and improving the Service, identifying errors, and measuring the effectiveness of marketing Up to 7 years from the date of collection (destroyed without delay upon termination of the outsourcing contract or achievement of the purpose of processing) Meta Platforms, Inc. (Meta Pixel) United States Page addresses, referral source and advertising click identifier (fbclid), product (performance or tour) view and purchase events (product identifier, amount and currency, quantity, transaction identifier (booking number)), device and browser information, IP address, and advertising identifiers stored in cookies (_fbp, _fbc) -- see Article 11 for details Analysis of advertising traffic, measurement of advertising performance (conversions) and targeted advertising (ad delivery and delivery optimisation based on visit history) Retained in accordance with Meta's data policy (the _fbp cookie expires after 90 days). Destroyed without delay upon termination of the outsourcing contract or achievement of the purpose of processing Data is transferred to PostHog, Inc., Google LLC (Google Analytics 4 and Google Ads) and Meta Platforms, Inc. (Meta Pixel) from the user's browser over the internet from time to time, whenever a user uses the KSTAGE website. Users may refuse consent to the overseas transfer. However, hosting and the database are an essential basis for providing the Service, so booking services may be unavailable if consent is refused; **LINE and Google social login may be replaced by email verification login**. A refusal may be communicated to customer support at kstage@maskit.co.kr. The transfers for usage analytics (PostHog) and advertising measurement and targeted advertising (Google Analytics 4, Google Ads and the Meta Pixel) can be refused by the methods described in Article 11, and refusing them does not restrict use of the Service, including bookings. ## Article 8 Rights and Obligations of Data Subjects and Their Legal Representatives, and How to Exercise Them - A data subject may at any time request the Company to **access, transfer, correct or delete their personal data, to suspend processing, or to withdraw consent**. - Rights may be exercised in writing, by email or otherwise in accordance with Article 41(1) of the Enforcement Decree of PIPA, and the Company takes action without delay after receipt (in principle **within 10 days**). - Rights may also be exercised through the data subject's legal representative or a duly authorised agent, in which case a power of attorney must be submitted. - A data subject's right to request access to personal data and suspension of processing may be restricted under Article 35(4) and Article 37(2) of PIPA. - Deletion may not be requested in respect of personal data that other laws expressly require to be collected. - The Company verifies whether the person exercising the rights is the data subject or a duly authorised agent. Right Method Processing period Access / correction My Page within the Service, or customer support (email) Immediately to within 10 days Deletion / suspension of processing Request to customer support (email) Within 10 days Withdrawal of consent Consent management within the Service, or customer support (email) Immediately ## Article 9 Chief Privacy Officer The Company designates a Chief Privacy Officer as set out below to take overall charge of work relating to the processing of personal data and to handle data subjects' complaints and provide remedies for damage. Item Details Chief Privacy Officer Bae Hoyeon (concurrently serving as Representative Director) Contact info@maskit.co.kr - +82-2-6349-0155 General enquiries (customer support) kstage@maskit.co.kr Data subjects may also consult or report personal data infringements to the following bodies. - Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr) - Privacy Infringement Report Centre: 118 (privacy.kisa.or.kr) - Korean National Police Agency: 182 (ecrm.cyber.go.kr) ## Article 10 Measures to Ensure the Safety of Personal Data The Company implements the following administrative, technical and physical measures for the safe processing of personal data. - Administrative measures: establishment and implementation of an internal management plan; minimising the number of staff handling personal data; regular training. - Technical measures: management of access rights to the personal data processing system and operation of an access control system (including row-level access control in the database); encryption in transit (HTTPS/TLS); encrypted storage of authentication credentials and system secret keys; separate authentication and session time limits for administrator accounts; retention of access records and prevention of forgery or alteration. - Physical measures: storage of documents and auxiliary storage media containing personal data in a secure location with a locking device. ## Article 11 Cookies and Other Automatic Collection Devices, and Behavioural Information The Company uses **cookies that are essential to providing the Service**, such as maintaining the login session and storing the display language setting, as well as the cookies and browser storage (local storage) used by the usage analytics tool and the advertising tools (for advertising measurement and targeted advertising) described below. A cookie is a small amount of information sent to a user's browser by the server used to operate a website. Users may refuse the storage of cookies through their browser settings, in which case there may be difficulty in using parts of the Service such as logging in. Where a browser sends a "Do Not Track" setting or a Global Privacy Control (GPC) signal, the Company does not run either the usage analytics tool or the advertising tools described below in that browser. Refusing does not restrict use of the Service, including bookings. ### 11-1. Usage analytics tool The Company uses the following usage analytics tool to compile service usage statistics and improve the Service. Category Details Analytics tool PostHog (operated by PostHog, Inc., United States) -- collected information is stored on PostHog servers located in the United States (see Article 7, Transfer of Personal Data Overseas). Items collected Addresses of pages visited and the previous site (referral source and campaign parameters such as UTM), usage records such as the buttons pressed, their position on the screen and scrolling, device, browser and operating system type and screen size, the country and city estimated from the IP address (the IP address itself is not stored), an anonymous identifier stored in cookies or browser storage, internal member number when logged in, display language and currency settings, booking progress information (selected performance, session, seat grade and quantity, amount and currency, payment step and result, internal booking number), and error information Items not collected Name, email address, telephone number, passport information and payment method information such as card numbers are not sent to the analytics tool; text displayed on the screen (such as button labels and the contents of input fields) is not read; and no screen recording (session replay) is made. Purposes Compiling service usage statistics and improving the Service, identifying errors, and measuring the effectiveness of marketing Retention and use period Up to 7 years from the date of collection (the data retention period under the PostHog plan). Destroyed without delay upon termination of the outsourcing contract or achievement of the purpose of processing. How to refuse Turning on your browser's "Do Not Track" setting or a GPC signal stops the analytics tool from running. If you block cookies and site data in your browser settings, the anonymous identifier is not stored and your visits are not linked to one another, and the tracking protection features of your browser or browser extensions may also stop analytics data from being sent. ### 11-2. Collection and use of behavioural information for advertising measurement and targeted advertising In order to analyse visits arriving through advertising, to measure advertising performance (product views and booking conversions), and to deliver targeted advertising that uses users' KSTAGE visit history for ad delivery by Google and Meta, the Company uses the tools of the advertising providers listed below, installed through Google Tag Manager. In the course of this, behavioural information such as users' website visit and usage history is collected and used. Category Details Advertising providers collecting and processing behavioural information Google LLC (Google Analytics 4 and Google Ads, United States) - Meta Platforms, Inc. (Meta Pixel, United States). Collected information is stored on each provider's servers in the United States (see Article 7). Both providers use this behavioural information to deliver the Company's advertisements and measure their performance, and may also use it, in accordance with their own privacy policies, for their own advertising services (such as selecting audiences and optimising ad delivery). Behavioural information collected Addresses of pages visited and the previous site (referral source, campaign parameters such as UTM, and advertising click identifiers gclid and fbclid), product (performance or tour) detail view events (product identifier), purchase (conversion) events (transaction identifier (booking number), payment amount and currency, quantity, product identifier, whether the booking was free of charge), device, browser and operating system type and screen size, display language, IP address (Google Analytics 4 does not store IP addresses and uses them only to estimate an approximate location), and advertising identifiers stored in cookies (Google: _ga, _gcl_au, _gcl_aw; Meta: _fbp, _fbc) Items not collected Name, email address, telephone number, passport information, payment method information such as card numbers, and anything entered on the payment screen are not sent to the advertising providers. Sensitive behavioural information that risks infringing individual rights, interests or privacy, such as information on ideology, beliefs or medical history, is not collected. Method of collection Sent automatically from the browser through tags (scripts) embedded in the web pages when a user visits and uses the KSTAGE website. Purposes of collection and use (1) Analysing advertising traffic (which advertisement or medium a visit came through); (2) measuring advertising performance (product views and booking conversions) and reporting on advertising campaigns; (3) targeted advertising -- showing KSTAGE advertisements again on Google and Meta services and the places where they deliver ads, based on a user's KSTAGE visit history (such as the performances or tours viewed and whether a booking was made) (retargeting), and using booking conversion information to optimise ad delivery so that advertisements are shown more to users who are more likely to book Retention and use period Google Analytics 4: user- and event-level data for up to 14 months from collection, and the _ga cookie for up to 2 years - Google Ads: the _gcl_au and _gcl_aw cookies for 90 days; conversion data received by Google is retained in accordance with Google's policies - Meta Pixel: the _fbp cookie for 90 days; event data received by Meta is retained in accordance with Meta's data policy. After the retention period, the data is deleted under each provider's procedures. How users can exercise control (1) Turning on your browser's "Do Not Track" setting or a GPC signal stops the Company from running the advertising tools at all, so no behavioural information is sent to the advertising providers. (2) You can block or delete cookies in your browser settings (guides for major browsers: [Chrome](https://support.google.com/chrome/answer/95647) - [Edge](https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09) - Safari ([iPhone](https://support.apple.com/105082) - [Mac](https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac)) - [Firefox](https://support.mozilla.org/kb/clear-cookies-and-site-data-firefox)); deleting cookies removes the advertising identifiers stored in that browser. (3) Google: you can turn off personalised ads in [Ads Settings](https://adssettings.google.com), and stop data being sent to Google Analytics with the [Google Analytics Opt-out Browser Add-on](https://tools.google.com/dlpage/gaoptout). (4) Meta: in [Ad preferences](https://www.facebook.com/adpreferences/ad_settings) you can choose not to have activity information from ad partners used to show you ads, and in [Manage your activity off Meta technologies](https://www.facebook.com/off_facebook_activity) you can disconnect your activity on other websites. (5) Mobile devices: you can reset your device's advertising identifier or limit app tracking -- on iPhone and iPad, turn off "Allow Apps to Request to Track" under Settings > Privacy & Security > Tracking ([guide](https://support.apple.com/102420)); on Android, reset or delete the advertising ID under Settings > Privacy > Ads. Refusing does not restrict use of the Service, including bookings. Enquiries and remedies Enquiries and complaints concerning behavioural information may be addressed to the Chief Privacy Officer in Article 9, and remedies may be sought from the bodies listed in Article 12. Further details of how the advertising providers process personal data are available in their privacy policies (Google: [policies.google.com/privacy](https://policies.google.com/privacy), and how Google uses information from sites that use its services: [policies.google.com/technologies/partner-sites](https://policies.google.com/technologies/partner-sites) - Meta: [facebook.com/privacy/policy](https://www.facebook.com/privacy/policy)). The Company uses the behavioural information it collects only for the purposes above (analysing advertising traffic, measuring advertising performance and targeted advertising). **The Company does not direct targeted advertising at children under the age of 14, and does not use for targeted advertising the behavioural information of users it knows to be under 14.** Should the Company change the purposes for which it uses behavioural information or its advertising providers, it will amend this Policy and give notice in advance. ## Article 12 Remedies for Infringement of Data Subjects' Rights In order to obtain a remedy for infringement of personal data, a data subject may apply for dispute resolution or consultation to the following bodies. - Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr) - Privacy Infringement Report Centre: 118 (privacy.kisa.or.kr) - Supreme Prosecutors' Office Cyber Investigation Division / Korean National Police Agency National Office of Investigation: 182 (ecrm.cyber.go.kr) ## Article 13 Changes to this Privacy Policy This Policy applies from **3 December 2026**. Where it is amended in line with changes in law or in the content of the Service, the Company will announce the changes through the initial screen of the Service or a notice at least 7 days before they take effect (30 days before, where the change is unfavourable to data subjects). This revision (announced on 3 November 2026, effective 3 December 2026) is made so that the behavioural information collected through the advertising tools is used for targeted advertising in addition to advertising measurement, and so that Google Ads is added to the advertising tools. Targeted advertising (retargeting and ad delivery optimisation) has been added to the purposes of collection and use in Article 11-2, together with the fact that the advertising providers (Google LLC and Meta Platforms, Inc.) may use this behavioural information for their own ad delivery, the ways to refuse targeted advertising (browser cookie settings, Google and Meta ad settings, and mobile advertising identifier settings), and the fact that the Company does not direct targeted advertising at children under 14. Google Ads (conversion measurement and targeted advertising) is now listed alongside Google Analytics 4, with the related advertising click cookie (_gcl_aw) and retention period, and the booking number in purchase events is now correctly described as a "transaction identifier (booking number)". 1-3, Article 6 (Outsourcing of Personal Data Processing) and Article 7 (Transfer of Personal Data Overseas) have been updated accordingly. Because this change may be unfavourable to data subjects, notice is given 30 days before it takes effect. Until the effective date, the previous Policy (effective 10 November 2026; until 9 November 2026, the Policy effective 2 November 2026) continues to apply. Google Ads and the Meta Pixel will run from 3 December 2026, and behavioural information collected up to 2 December 2026 is used only to analyse advertising traffic and measure advertising performance and is not used for targeted advertising. --- KSTAGE - https://kstage.live/privacy