Privacy Policy Purpose

Digital Nutrition Corp. (hereinafter referred to as 'the Company') complies with all laws and regulations related to the protection of personal information, including the Personal Information Protection Act, the Act on Promotion of Information and Communication Network Utilization and Information Protection, and other relevant laws and regulations established by national institutions, such as notices, orders, and guidelines. This Privacy Policy transparently provides information related to 'personal information,' including how the company collects information, how it uses the collected information, with whom it shares ('outsources or provides') the information as needed, and when and how it disposes of information that has achieved its purpose.

Consent for Collection and Use of Personal Information

The company provides information regarding the collection and use of personal information, including the minimum personal information necessary for the establishment and performance of the service usage contract and information identifiable to the user, when collecting and processing personal information for membership registration. When the user selects the 'Agree' button, it is considered that the user has consented to it.

Article 1 [Items and Methods of Collecting Personal Information]

The company collects and processes the following personal information for membership registration, customer consultation, payment for paid services, and various service provisions and contract performances:

Items of Personal Information Collected During Membership Registration: Social media ID (or email address format ID) and name (or nickname) used for membership registration through social login, profile image, social login creation number. In the case of membership registration through email, email address, password, and name (or nickname). Automatically Generated Information: During the process of using the service, the following information may be generated and collected - app push permission, model name of mobile phones and devices with smart OS, OS information, device token, Google Advertising Identifier (ADID), Apple Advertising Identifier (IDFA), IP address, cookies, visit date and time, records of improper use, and service usage records. During Payment for Paid Services: When necessary for payment, information such as credit card information, bank transfer information, telecommunication company information, gift voucher number, and other payment-related information may be collected. For events, promotions, prize delivery, and service inquiries, additional information may be collected with separate guidance on the purpose and storage period of the collected personal information, and consent will be obtained. Methods of Collecting Personal Information The company informs users in advance about the purpose of collecting and using personal information, the items to be collected, and the retention and usage period, and obtains consent. The company collects personal information through the following methods:

• When users agree to the collection and use of personal information during membership registration and service usage.
• When information is provided by affiliated services or partners due to collaboration services.
• Automatically generated information is collected during the use of mobile applications, websites, etc.
• Other methods of voluntary consent and provision by users during the service usage process.

Article 2 [Purpose of Collecting Personal Information]

The company uses the collected personal information for the following purposes:

• Contract performance related to service provision, billing for paid services, content provision, billing and payment for paid services, and purchase.
• Personal identification for the use of member services, prevention of misuse, verification of duplicate registration, record keeping for dispute resolution, complaint handling, etc.
• Development of new services, provision of customized services, confirmation of service effectiveness, understanding of access frequency, statistics on member service usage, provision of event and advertising information.

Article 3 [Retention and Usage Period of Personal Information]

The company promptly destroys personal information when the purpose of collecting personal information is achieved or the retention period expires when the member requests withdrawal or withdraws consent for the collection and use of personal credit information. However, the following information may be retained for the specified period:

• Membership registration and management: From the time of membership registration to the time of withdrawal (however, in cases falling under the following reasons, until the end of the relevant reason):

• 1. When an investigation or inquiry related to a violation of relevant laws is in progress, until the end of the investigation or inquiry.
  2. Necessary information such as name, mobile phone number, and account number is used for refund, reimbursement, etc.

• Service provision: Until the completion of service supply and payment/billing settlement (however, until the end of the relevant period in the following cases):

• 1. Record of electronic financial transactions: 5 years.
  2. Record of contracts or withdrawal of subscriptions, payment of fees, and supply records of goods: 5 years.
  3. Record of consumer complaints or dispute resolution: 3 years.
  4. Record of display/advertisement: 6 months.
  5. Website visit records: 3 months.

• Advertisement/marketing: Until withdrawal of consent or member withdrawal.

Even if the application is deleted, personal information may remain if the request for withdrawal is not made. If you want complete deletion of personal information, please be sure to request withdrawal.

Article 4 [Handling and Outsourcing of Collected Personal Information]

The company operates by outsourcing personal information to external contractors or services to improve services. When the outsourcing business is terminated, the personal information will be promptly destroyed.

Article 5 [Installation, Operation, and Refusal of Personal Information Automatic Collection Devices]

The company may operate 'cookies (Cookie, access information file)' to constantly store and identify user information for providing specialized custom services, etc. The company uses cookies to analyze the user's connection frequency, visit time, understand the user's preferences and interests, and provide targeted marketing and personalized services, etc. Users have the option to control 'cookies.' Users can set the cookie permission level in their web browser [Tools -> Internet Options -> Privacy -> Advanced]. However, choosing to reject the storage of all cookies may cause difficulties in providing some services. The company may use technology (advertising identifiers, etc.) that performs functions similar to cookies in cases where cookie functions cannot be used, such as mobile applications.

Article 6 [Personal Information Disposal Procedure and Method]

The company promptly destroys personal information when the purpose of processing personal information is achieved. The company disposes of personal information in the following ways:

• Electronic files: File deletion and formatting of storage media such as disks.
• Personal information disposal procedure for dormant accounts:

• 1. The company converts the personal information of accounts that have not logged in for more than a year into dormant accounts for separate management to protect personal information.
  2. Information of dormant accounts: All information collected/managed through membership registration or member information modification.
  3. The company notifies the user of relevant information through email, etc., one month before the start of the separate storage period of personal information for dormant accounts.
  4. Personal information of dormant accounts is destroyed without delay after three years from the start of separate storage. However, personal information that has not been destroyed will be provided again when the user resumes service usage.

Article 7 [Measures to Ensure Security of Personal Information]

The company takes necessary administrative and technical measures to prevent personal information from being lost, stolen, leaked, forged, altered, or damaged in the handling of user's personal information.

Administrative Measures:

• Establishment and implementation of internal management plans.
• Minimization of personal information processing employees and education. Technical Measures:
• Access control management of personal information processing systems.
• Installation of access control systems.
• Application of encryption technology for unique identification information, etc.
• Installation and update of security programs.
• Maintenance of access records and prevention measures against forgery and alteration.

Article 8 [Rights of Users and Legal Representatives and Their Exercise Methods]

Users can exercise the following rights related to personal information protection against the company at any time:

• Request for access to personal information.
• Request for correction if there are errors.
• Request for deletion.
• Request to stop processing. The exercise of the above rights can be done in writing, by phone, or by email (share@digitalnutrition.info). The company will take immediate action in response to such requests. If a user requests correction or deletion of personal information, the company will not use or provide the information until the correction or deletion is completed. The exercise of these rights can be done through a legal representative or a delegate. In this case, a power of attorney according to Form 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

Users should not infringe on the personal information and privacy of the company, other users, or third parties by violating laws and regulations related to personal information protection.

Article 9 [Designation of Personal Information Protection Manager]

The company has designated the following personal information protection manager to protect the personal information of users and handle complaints related to personal information:

• Personal Information Protection Manager: Kori, CTO (Chief Technology Officer).
• Contact: share@digitalnutrition.info If you need to report or consult about other personal information infringements, please contact the following organizations:
• Personal Information Dispute Mediation Committee (www.kopico.go.kr).
• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code).
• Cybercrime Investigation Unit, Supreme Prosecutors' Office (http://www.spo.go.kr / 1301 without area code).
• Cybercrime Investigation Unit, National Police Agency (http://cyberbureau.police.go.kr / 182 without area code).

Article 10 [Changes and Notices to the Privacy Policy]

If there are additions, deletions, or changes to the content due to changes in company policies, government policies, or security technologies, the company will notify users through 'Notices' on the application, website, etc. from 7 days before the enforcement of the changes. The changed Privacy Policy will take effect 7 days after the date of the change notice.

Supplementary Provision

This Privacy Policy is effective from September 26, 2023.