Oho Tteok House (the ‘Company’) establishes and discloses the following personal information processing guidelines under Article 30 of the Personal Information Protection Act, to protect data subjects' personal information and to handle related complaints promptly and smoothly.

Article 1 (Purpose of Processing Personal Information)
The Company processes personal information for the following purposes. Personal information being processed will not be used for any other purpose, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Website membership registration and management
Personal information is processed to confirm intent to join, identify and authenticate members for membership services, maintain and manage membership, verify identity under the limited identity verification system, prevent fraudulent use of services, confirm consent of a legal guardian when processing personal information of children under 14, deliver notices, and handle complaints.

2. Provision of goods or services
Personal information is processed to deliver goods, provide services, send contracts and invoices, provide content, provide customized services, verify identity and age, process payments and settlements, and collect debts.

3. Handling complaints
Personal information is processed to verify the identity of complainants, confirm complaints, contact and notify for fact-finding, and report results.

Article 2 (Processing and Retention Period of Personal Information)
① The Company processes and retains personal information within the retention and use period required by law or consented to by the data subject at the time of collection.
② The processing and retention periods for each category are as follows.

1. Website membership registration and management: until withdrawal from the business/organization website
However, in the following cases, until the end of the relevant reason
1) If an investigation or inquiry is in progress due to a violation of relevant laws, until the end of the investigation or inquiry
2) If claims or debts related to website use remain, until those claims and debts are settled


2. Provision of goods or services: until the supply of goods/services and payment/settlement are completed
However, in the following cases, until the end of the relevant period
1) Records of transactions such as labeling/advertising, contract details, and performance under the Act on the Consumer Protection in Electronic Commerce
- Records on labeling and advertising: 6 months
- Records on contracts or withdrawal of offers, payments, and supply of goods: 5 years
- Records on consumer complaints or dispute resolution: 3 years
2) Retention of communication confirmation data under Article 41 of the Protection of Communications Secrets Act
- Subscriber telecommunication dates, start/end times, other party's number, frequency of use, and base station location data: 1 year
- Computer communication and internet log records and access location data: 3 months


Article 3 (Provision of Personal Information to Third Parties)
① The Company processes personal information only within the scope stated in Article 1 (Purpose of Processing), and provides it to third parties only with the data subject's consent, under special provisions of law, or in other cases under Articles 17 and 18 of the Personal Information Protection Act. Otherwise, it does not provide personal information to third parties.
② For smooth service provision, the Company may provide personal information to third parties to the minimum extent necessary with the data subject's consent under Article 17(1)1 of the Personal Information Protection Act in the following cases.
- Recipient of personal information: <e.g.) OOO Card Co., Ltd.>
- Recipient's purpose of use: <e.g.) business partnerships such as co-hosting events, issuing co-branded credit cards>
- Personal information provided: <e.g.) name, address, phone number, email address, card payment account information>
- Recipient's retention and use period: <e.g.) for the transaction period under the credit card issuance contract>


Article 4 (Outsourcing of Personal Information Processing)
① For smooth processing of personal information, the Company outsources personal information processing as follows.
- Outsourced tasks
- Contractor: imweb Inc. - Outsourced tasks: system provision for online store hosting, mobile app services, marketing and additional services, partner services, and messaging services such as KakaoTalk AlimTalk, FriendTalk, and SMS
- Contractor: OOO PG
- Outsourced tasks: payment and escrow services
- Contractor: OOO Courier
- Outsourced tasks: product delivery
- Contractor: OOO Customer Center
- Outsourced tasks: customer consultation
- Contractor: OOO
- Outsourced tasks: identity verification
- **Subcontractors**
- **Subcontractor: imweb Inc. → Infobip Ltd.**
- **Outsourced tasks: sending SMS and KakaoTalk AlimTalk (informational messages)**
- **Subcontractor: imweb Inc. → Lunasoft Co., Ltd.**
- **Outsourced tasks: sending SMS, KakaoTalk AlimTalk (informational messages), and FriendTalk**
② When concluding an outsourcing contract, the Company specifies in the contract, in accordance with Article 25 of the Personal Information Protection Act, the prohibition of processing personal information beyond the outsourced purpose, technical and administrative safeguards, restrictions on subcontracting, management and supervision of the contractor, and liability such as compensation for damages, and supervises whether the contractor processes personal information safely.
③ If the outsourced tasks or contractors change, we will disclose this through this Privacy Policy without delay.

Article 5 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)

① Data subjects may exercise the following rights regarding personal information protection against the Company at any time.
1. Request to access personal information
2. Request for correction of errors
3. Request for deletion
4. Request to suspend processing
② Rights under Paragraph 1 may be exercised in writing, by phone, email, or fax, and the Company will take action without delay.
③ If a data subject requests correction or deletion of errors in personal information, the Company will not use or provide that personal information until the correction or deletion is completed.
④ Rights under Paragraph 1 may be exercised through a representative such as a legal representative or an authorized person. In this case, a power of attorney in the format of Annex 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
⑤ Data subjects must not infringe on their own or others' personal information and privacy processed by the Company in violation of the Personal Information Protection Act or other relevant laws.


Article 6 (Personal Information Items Processed)
The Company processes the following personal information items.

1. Website membership registration and management
Required items: <e.g.) name, date of birth, ID, password, address, phone number, gender, email address, i-PIN number>
Optional items: <e.g.) marital status, interests>

2. Provision of goods or services
Required items: <e.g.) name, date of birth, ID, password, address, phone number, email address, i-PIN number, and payment information such as credit card number and bank account information>
Optional items: <interests, past purchase history>

Article 7 (Destruction of Personal Information)
① When personal information is no longer needed, such as when the retention period expires or the purpose of processing is achieved, the Company destroys it without delay.
② If personal information must be kept under other laws even though the retention period consented to by the data subject has expired or the purpose has been achieved, it is moved to a separate database (DB) or stored in a different location.
③ The procedure and method of destruction are as follows.
1. Destruction procedure
The Company selects personal information for which a reason for destruction has occurred and destroys it with the approval of the Company's Privacy Officer.
2. Destruction method
Personal information recorded and stored in electronic files is destroyed so that the records cannot be reproduced, and personal information recorded and stored on paper is shredded or incinerated.

Article 8 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information.
1. Administrative measures: establishing and implementing an internal management plan, regular staff training, etc.
2. Technical measures: managing access rights to personal information processing systems, installing access control systems, encrypting unique identification information
and other data, and installing security programs
3. Physical measures: access control for computer rooms and records storage rooms

Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)
① The Company uses ‘cookies’ that store and retrieve usage information to provide personalized services to users.
② Cookies are small pieces of information sent by the server (http) used to operate the website to the user's browser and stored on the user's PC or mobile device.
③ Data subjects can allow or block cookies through their web browser settings. However, refusing to store cookies may make it difficult to use personalized services.

▶ Allowing/blocking cookies in web browsers
- Chrome: Settings > Privacy and security > Clear browsing data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allowing/blocking cookies in mobile browsers
- Chrome: Mobile browser settings > Privacy and security > Clear browsing data
- Safari: Device settings > Safari > Advanced > Block All Cookies
- Samsung Internet: Mobile browser settings > Browsing history > Delete browsing history

④ During service use, the Company collects and uses information such as visits to and usage patterns of each service and website, popular search terms, and secure connection status, to provide users with optimized information.


Article 10 (Privacy Officer)
① The Company designates the following Privacy Officer, who is responsible for overseeing personal information processing and for handling complaints and remedies of data subjects related to personal information processing.

▶ Privacy Officer
Name: OOO
Title: OOO
Contact: <phone number>, <email>, <fax number>
※ You will be connected to the privacy department.

▶ Privacy Department
Department: OOO Team
Contact: <phone number>, <email>, <fax number>

② Data subjects may contact the Privacy Officer and the responsible department with any inquiries, complaints, or remedies related to personal information protection arising from using the Company's services (or business). The Company will respond to and handle such inquiries without delay.


Article 11 (Requests to Access Personal Information)
Data subjects may request access to personal information under Article 35 of the Personal Information Protection Act from the department below. The Company will make every effort to process such requests promptly.

▶ Department receiving and processing access requests
Department: OOO
Contact: <phone number>, <email>, <fax number>

Article 12 (Remedies for Infringement of Rights)
Data subjects may contact the following organizations for remedies or consultation regarding personal information infringement.
1. Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
4. Korean National Police Agency: (no area code) 182 (ecrm.police.go.kr/minwon/main)


Article 13 (Effective Date and Changes to the Privacy Policy)
This Privacy Policy is effective from XX. X, 20XX.