SOOMDAM (hereinafter referred to as the “Company”) establishes and discloses the following Personal Information Processing Guidelines in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to promptly and smoothly handle grievances related thereto. Article 1 (Purpose of Personal Information Processing) The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those listed below, and if the purpose of use changes, the Company plans to take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act. 1. Website Membership Registration and Management The Company processes personal information for the purposes of confirming intent to register as a member, identifying and authenticating the individual for the provision of membership services, maintaining and managing membership status, verifying identity in accordance with the implementation of the Limited Identity Verification System, preventing fraudulent use of services, confirming the consent of a legal representative when processing personal information of children under the age of 14, providing various notices and notifications, and handling grievances. 2. Provision of Goods or Services Personal information is processed for purposes such as product delivery, provision of services, sending of contracts and invoices, provision of content, provision of customized services, identity verification, age verification, payment and settlement of fees, and debt collection. 3. Handling of Grievances Personal information is processed for purposes such as verifying the identity of the complainant, confirming the details of the complaint, contacting and notifying for fact-finding investigations, and notifying the results of processing. Article 2 (Processing and Retention Period of Personal Information) ① The Company processes and retains personal information within the retention and usage period stipulated by relevant laws and regulations or within the retention and usage period agreed upon by the data subject at the time of collection. ② The processing and retention periods for each type of personal information are as follows: 1. Website Membership Registration and Management: Until withdrawal from the business/organization website However, in cases falling under the following reasons, until the relevant reason ceases: 1) If an investigation or inquiry is in progress due to a violation of relevant laws and regulations, until the said investigation or inquiry is concluded. 2) If claims or debts arising from website usage remain, until the said claims or debts are settled. 2. Provision of Goods or Services: Until the supply of goods/services and payment/settlement of fees are completed. However, in cases falling under the following reasons, until the end of the relevant period: 1) Records regarding transactions, such as labeling/advertising, contract details, and performance, pursuant to the "Act on the Consumer Protection in Electronic Commerce, etc." - Records regarding labeling/advertising: 6 months - Records regarding withdrawal of contract or subscription, payment settlement, and supply of goods, etc.: 5 years - Records regarding consumer complaints or dispute processing: 3 years 2) Retention of communication fact verification data pursuant to Article 41 of the "Act on the Protection of Communications Secrets" - Subscriber's telecommunication date and time, start and end times, counterparty subscriber number, usage frequency, and transmitting base station location tracking data : 1 year - Computer communication, internet log records, access location tracking data: 3 months Article 3 (Provision of Personal Information to Third Parties) ① The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides personal information to third parties only in cases falling under Article 17 of the Personal Information Protection Act, such as the consent of the data subject or special provisions of the law. ② The Company provides personal information to third parties as follows: - Recipients of personal information: Korea Post Parcel Service, Kyungdong Parcel Service - Purpose of use of personal information by recipients: Business partnership - Items of personal information provided: Name, address, phone number, email address, credit card payment account information - Retention and usage period by recipients: Until withdrawal from the website Article 4 (Rights of Users and Legal Representatives and Method of Exercising Them) ① Data subjects may exercise the following rights related to personal information protection against the Company at any time. 1. Request for access to personal information 2. Request for correction in case of errors, etc. 3. Request for deletion 4. Request for suspension of processing ② You may exercise your rights pursuant to Paragraph 1 against the Company in writing, by telephone, email, fax, etc., and the Company will take action without delay. ③ If a data subject requests correction or deletion regarding errors, etc. in personal information, the Company will not use or provide the relevant personal information until the correction or deletion is completed. ④ You may exercise your rights pursuant to Paragraph 1 through a representative, such as a legal representative of the data subject or an authorized agent. In this case, you must submit a power of attorney in accordance with Form No. 11 of the Enforcement Rules of the Personal Information Protection Act. ⑤ The data subject shall not infringe upon the personal information and privacy of themselves or others that the Company is processing in violation of the Personal Information Protection Act or other relevant laws and regulations. Article 5 (Items of Personal Information Processed) The Company processes the following items of personal information. 1. Website Membership Registration and Management - Required items: Name, Date of Birth, ID, Password, Address, Phone Number, Email Address 2. Provision of Goods or Services - Required items: Name, Date of Birth, ID, Password, Address, Phone Number, Email Address, Payment Information 3. The following personal information items may be automatically generated and collected during the process of using internet services: IP Address, Cookies, MAC Address, Service Usage Records, Visit Records, Records of Improper Use, etc. Article 6 (Destruction of Personal Information) ① The Company shall destroy the relevant personal information without delay when it becomes unnecessary, such as due to the expiration of the personal information retention period or the achievement of the processing purpose. ② If personal information must continue to be preserved pursuant to other laws despite the expiration of the personal information retention period consented to by the data subject or the achievement of the processing purpose, the Company shall transfer the relevant personal information to a separate database (DB) or preserve it in a different storage location. ③ The procedures and methods for the destruction of personal information are as follows: 1. Destruction Procedure The Company shall select the personal information for which a reason for destruction has arisen and destroy the personal information upon obtaining approval from the Company's Chief Privacy Officer. 2. Method of Destruction The Company destroys personal information recorded and stored in the form of electronic files using methods such as Low Level Format to ensure the records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding or incineration. Article 7 (Measures to Ensure the Safety of Personal Information) The Company takes the following measures to ensure the safety of personal information: 1. Administrative Measures Establishment and implementation of internal management plans, regular employee training, etc. 2. Technical Measures Management of access rights to personal information processing systems, etc., installation of access control systems, encryption of unique identification information, etc., installation of security programs 3. Physical Measures Access control to computer rooms, data storage rooms, etc. Article 8 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices) ① The Company uses ‘cookies’ that store and frequently retrieve usage information to provide individually customized services to users. ② Cookies are small amounts of information sent by the server (http) used to operate the website to the user's computer browser, and are sometimes stored on the hard disk of the user's computer. - Purpose of using cookies: Cookies are used to provide information optimized for the user by identifying their visit and usage patterns regarding each service and website visited, popular search terms, secure connection status, etc. - Installation, operation, and refusal of cookies: You can refuse cookie storage through the option settings in the Tools > Internet Options > Privacy menu at the top of the web browser. - Refusing cookie storage may cause difficulties in using personalized services. Article 9 (Personal Information Protection Officer) ① The Company is responsible for overseeing all business related to the processing of personal information and designates a Personal Information Protection Officer as follows to handle complaints and provide relief for damages to data subjects regarding the processing of personal information. ▶ Chief Privacy Officer - Name: Teachele Kim - Position: CEO - Contact: +82-10-7740-7489 - Email: tckim7489@naver.com ※ You will be connected to the Department in charge of Personal Information Protection. ② Data subjects may contact the Chief Privacy Officer and the relevant department regarding all inquiries, complaints, and damage relief matters related to personal information protection arising from the use of the Company's services (or business). The Company will respond to and process the Data Subject's inquiries without delay. Article 10 (Request for Access to Personal Information) Data subjects may request access to their personal information pursuant to Article 35 of the Personal Information Protection Act to the department listed below. The Company will endeavor to ensure that the Data Subject's request for access to personal information is processed promptly. ▶ Department Receiving and Processing Requests for Access to Personal Information - Name: Teachele Kim - Position: Representative - Contact: +82-10-7740-7489 - Email: tckim7489@naver.com Article 11 (Methods for Remedying Infringement of Rights) Data subjects may contact the following institutions regarding remedies for damages, consultation, etc., concerning personal information infringement. ▶ Personal Information Infringement Report Center (Operated by Korea Internet & Security Agency) - Scope of Duties: Reporting personal information infringement, requesting consultation - Website: privacy.kisa.or.kr - Phone: 118 (without area code) - Address: Personal Information Infringement Report Center, 3F, 9 Jinheung-gil, Naju-si, Jeollanam-do (301-2 Bitgaram-dong), 58324 ▶ Personal Information Dispute Mediation Committee - Scope of Duties: Application for personal information dispute mediation, collective dispute mediation (civil settlement) - Website: www.kopico.go.kr - Phone: 1833-6972 (without area code) - Address: 4F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul, 03171 ▶ Supreme Prosecutors' Office Cybercrime Investigation Division: 02-3480-3573 (www.spo.go.kr) ▶ National Police Agency Cyber Bureau: 182 (cyberbureau.police.go.kr) Article 12 (Enforcement and Amendment of Personal Information Processing Policy) This Personal Information Processing Policy is effective from June 17, 2026.