SUPERCAT Mobile Service Privacy Policy

SUPERCAT Inc. (hereinafter referred to as the “Company”) uses users’ personal information in connection with certain services in order to provide the best possible service to users.

In handling users’ personal information, the Company complies with applicable laws and regulations, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., the Personal Information Protection Act, the Act on the Protection and Use of Location Information, and guidelines established by relevant authorities. To prevent the misuse of users’ valuable personal information, the Company establishes and implements this Privacy Policy to clarify the purposes, methods, and scope of the collection and use of personal information.

This Privacy Policy may be changed due to amendments to relevant laws and regulations or changes to the Company’s internal policies.

Article 1 [Personal Information of Users Collected and Used]

1. The following information may be collected and used to provide services smoothly and handle customer inquiries during membership registration and service provision. Users who are members and their legal representatives may refuse the collection and use of the information below at any time by withdrawing their consent to the provision of personal information (membership withdrawal).

(1) Member ID (including e-mail address), password, mobile phone number, date of birth, game version information, and device information (model name, mobile carrier information, operating system (OS) information and version, available memory and hard disk capacity, device identification number, MAC address, device language and country information).

(2) For services linked to external platforms such as social networking services (SNS) and chat services: platform ID, nickname, contact information such as friend lists, profile picture, name, gender, address, date of birth, language and country code.

(3) Service usage records, access logs, payment records and IP address generated in the course of using the services.

2. The following information may be collected and used if users wish to use additional services operated on the basis of their personal information, such as participation in events or advertisements or purchase of paid content. In such cases, the Company shall notify users of the relevant facts and obtain their consent.

(1) Mobile phone number, address, gender, e-mail address, age, marital status, areas of interest and occupation.

(2) For services linked to social community functions: third-party information, such as telephone numbers and e-mail addresses stored in the address book on a user’s device (including a mobile phone). Such third-party information is used only temporarily and is not stored.

(3) For the purchase of paid content or related services: credit card number, ID and password of a gift certificate payment partner, and bank account number of the transaction bank.

3. For services requiring age verification or identity authentication, the Company may collect the following information with the user’s separate consent.

(1) Encrypted personal identification information (CI).

(2) Duplicate registration verification information (DI).

(3) Name, date of birth and gender.

(4) Nationality information (Korean or foreign national).

4. The Company may collect personal information provided by Google through the following Google Analytics advertising features. Users may withdraw their consent to these features through Google Ads Settings or the advertising preferences for mobile applications.

(1) Remarketing with Google Analytics.

(2) Google Display Network Impression Reporting.

(3) Google Analytics Demographics and Interests Reporting.

(4) Integrated services that allow Google Analytics to collect data using advertising cookies and anonymous IDs.

Article 2 [Methods of Collecting Personal Information]

1. The Company may collect users’ personal information by the following methods.

(1) Information directly entered by a user through the website or in the course of using the services.

(2) Information provided by users during telephone consultations.

(3) Information received from partner companies.

(4) Collection through network communication information or access history.

Article 3 [Purposes of Collection and Use of Personal Information]

1. The Company may use the personal information collected for the following purposes.

(1) User management

- Identification of users for content provision; confirmation of duplicate registration; verification of age, gender and nationality; management of users who misuse the services; detection and restriction of abnormal use; performance of contracts; and resolution of disputes.

(2) Service provision

- Handling complaints and providing other customer services; delivery of notices; provision of paid payment services and notification of payment details; support for cooperative play in games and community services.

(3) Development of new services and use for marketing and advertising

- Information about new services and events; improvement of service quality; and processing of statistical information.

(4) Provision of automatic friend addition and registration functions

- Collection and use of users’ mobile phone numbers and third parties’ mobile phone numbers stored in the address books on users’ devices to provide automatic friend addition and registration functions.

Article 4 [Retention and Use Period of Personal Information]

1. Collected personal information shall be retained and used while the user maintains user status. If the user ceases to have such status, or if the purpose of use has been fully achieved even while the user maintains user status, the information shall be destroyed without delay. However, the Company shall retain the following information for the stated retention periods based on the respective grounds for retention.

(1) Grounds for retention: Resolution of consumer complaints and disputes following membership withdrawal and related purposes.

- Retention period: 30 days

- Information retained: Mobile phone number, e-mail address, access records, access date and time, access location information, records of improper use, device model information, download records, payment records, member ID, password and nickname.

(2) Grounds for retention: Notices concerning events and selection of event winners.

- Retention period: 30 days

- Information retained: Name, address, telephone number, mobile phone number, e-mail address, member ID, nickname, mobile carrier, open-market store ID, open-market store nickname and date of birth.

2. If the Company has obtained the user’s separate consent, it may continue to retain and use the user’s personal information. Notwithstanding Paragraph 1, where retention is required under applicable laws, including the Act on Consumer Protection in Electronic Commerce, Etc. (the “Electronic Commerce Act”) and the Protection of Communications Secrets Act, the Company shall retain the relevant information for the prescribed period. In such cases, the information shall be used only for the purpose of retention, and the retention periods are as follows.

(1) Records concerning display and advertising: 6 months (Electronic Commerce Act).

(2) Records concerning contracts or withdrawal of offers: 5 years (Electronic Commerce Act).

(3) Records concerning payments and the supply of goods, etc.: 5 years (Electronic Commerce Act).

(4) Records concerning consumer complaints or dispute resolution: 3 years (Electronic Commerce Act).

(5) Records concerning service use, including access logs and access IP information: 3 months (Protection of Communications Secrets Act).

Article 5 [Procedures and Methods for Destroying Personal Information]

1. In principle, the Company shall destroy personal information without delay once the purpose for its collection and use has been achieved.

(1) Destruction procedure

- Personal information whose retention period has expired shall be destroyed by methods that prevent its restoration.

(2) Destruction methods

- Personal information stored in electronic files shall be deleted using technical methods that prevent the records from being restored.

- Personal information printed on paper shall be destroyed using a shredder.

Article 6 [Sharing and Provision of Personal Information]

1. In principle, the Company does not provide users’ personal information to external parties. However, exceptions may be made in the following cases.

(1) The user has given prior consent.

(2) Disclosure is required under special provisions of law, a court judgment or order, a binding order of an administrative authority, or a request from an investigative authority made in accordance with procedures and methods prescribed by law for investigative purposes.

Article 7 [Rights of Users and Legal Representatives and How to Exercise Them]

1. Protection of personal information of children under 14 years of age

(1) Where consent is required for the collection, use or provision of personal information concerning children under 14 years of age (the “Child”), the Company shall obtain the consent of the legal representative separately from the Child’s consent.

(2) To obtain the consent referred to in Paragraph (1), the Company may request the minimum necessary information, such as the name and contact details of the legal representative. The personal information of the legal representative collected in this way shall not be used for purposes other than verification of the representative’s consent or provided to third parties.

(3) The legal representative’s consent form may be used for purposes such as the resolution of consumer complaints and disputes arising from contracts between the Child and the Company, withdrawal of offers, payment settlements and supply of goods.

(4) Where consent is withdrawn or the legal representative’s consent expires, the relevant consent form shall be destroyed by an irrecoverable method after 30 days have elapsed from the expiration of its purpose of use. However, if retention is required under applicable laws, including the Commercial Act or the Act on Consumer Protection in Electronic Commerce, Etc., the Company shall retain the legal representative’s personal information for the period prescribed by those laws.

(5) The Child’s legal representative may request access to or correction of the Child’s personal information or withdrawal of consent to its collection, use or provision. The Company shall take the necessary measures without delay upon receiving such a request.

2. Management of users’ own personal information

(1) Users and their legal representatives may access or modify their own personal information through the member information viewing and modification function within the services or by telephone consultation with a customer service representative. However, if the user’s personal information is linked to an external platform, such as an SNS or chat service, the user must access or change that personal information by the method provided by the relevant platform provider.

(2) If a user requests correction of inaccurate personal information, the Company shall correct the error without delay or inform the user of the reason why it cannot be corrected, and shall take other necessary measures. The Company shall not use or provide the relevant personal information until the necessary measures have been taken. However, if the provision of the information is requested pursuant to another law, the Company may provide or use that information.

Article 8 [Installation and Operation of Automatic Personal Information Collection Devices and How to Refuse Them]

1. The Company installs and operates devices that automatically collect personal information, such as cookies (access information files), which store and retrieve users’ information from time to time to provide personalized services. A cookie is a small text file sent to the user’s device by a server used to operate an application and stored in the device’s storage. When the user uses the application, the server reads the cookie stored on the device to maintain the user’s preferences and provide customized services.

2. The Company may use cookies and similar technologies for the following purposes.

(1) To analyze users’ access frequency, visit times and similar usage information.

(2) To identify users’ tastes and interests and track their usage patterns.

(3) To provide targeted marketing and personalized services based on participation in events, number of visits and similar information.

3. Users have the right to choose whether to allow cookies. Accordingly, users may allow all cookies through device settings or options, require confirmation each time a cookie is saved, or refuse the storage of all cookies. However, refusing to store all cookies may restrict or prevent use of the services.

Article 9 [Technical and Administrative Measures for Protecting Personal Information]

1. The Company takes the following technical and administrative measures to protect the personal information it handles and prevent the loss, leakage or damage of users’ personal information.

(1) Password encryption

- Users’ passwords are encrypted, stored and managed. Therefore, if users forget their passwords, the Company cannot retrieve the original passwords, and new passwords may be issued after a prescribed identity verification procedure.

(2) Enhanced network security

- The Company takes various technical measures to prevent the leakage of personal information through unauthorized network access, including hacking and computer viruses, and continuously monitors network connections.

- The Company also uses secure encrypted communications between its servers and databases.

(3) Security training and designation of responsible personnel

- The Company regularly provides employees with security training concerning users’ personal information, designates personnel responsible for handling personal information, strengthens their expertise, and minimizes the risk of personal information leakage.

(4) Access and storage control

- Areas where personal information is handled and stored are designated as security zones accessible only to those authorized to handle personal information. Tangible materials and electronic records containing personal information are stored in locked facilities or on computers with separately assigned access permissions.

Article 10 [Personal Information Manager and Contact Information]

1. Users may contact the manager or staff member designated below to submit opinions or complaints regarding the Company’s Privacy Policy. The designated person will make every effort to consider users’ opinions and handle complaints.

(1) Personal Information Manager

- Name: Lee Taesung

- E-mail: iwanlee@supercat.co.kr

2. Please contact the following organizations if you need to report or consult about other personal information infringements.

(1) Personal Information Dispute Mediation Committee (http://www.kopico.or.kr / 02-405-5150).

(2) Personal Information Infringement Report Center (http://privacy.kisa.or.kr / 02-405-5118).

(3) ePRIVACY (http://www.eprivacy.or.kr / 02-550-9531~2).

(4) Supreme Prosecutors’ Office, Cyber Investigation Division (http://cybercid.spo.go.kr / 1301).

(5) National Police Agency, Cyber Safety Bureau (http://www.ctrc.go.kr / 182).

(6) Illegal and Harmful Information for Youth Report Center (http://www.singo.or.kr / 1377).

Article 11 [Other Matters]

1. The Company’s Privacy Policy may be changed due to amendments to laws or changes to the Company’s internal policies. In such cases, the Company shall notify users of the changes through the Company’s website or within the services at least 7 days before the effective date of those changes, in a manner that allows users to review them.