Privacy

Article 1 (Purpose of processing personal information)

The Company processes personal information for the purposes below. Processed personal information is not used for any other purpose. If the purpose of use changes, the Company will take necessary measures under applicable law, such as obtaining separate consent.

1. Membership registration and management

Confirming intent to join; verifying identity and age; identifying and authenticating the member for membership services; maintaining and managing membership; preventing misuse of the service; notices and notifications; handling complaints

2. Provision of goods or services

Delivery of goods; sending contracts and invoices; providing content; providing customized services; identity verification; payment of charges and settlement; collection of claims

3. Customer counseling and complaint handling

Confirming the identity of the complainant; confirming the complaint; contact and notice for fact-finding; notifying the result of handling

4. Performance of statutory duties

Retention, provision, reporting, and other duties under applicable law

Article 2 (Personal information items processed)

The Company may process the following personal information to provide the service.

1. Email membership registration

Required: email, password, name, mobile phone number

2. Social login such as Naver and Kakao

Identifier (unique ID), nickname, email, and other items within the scope the user consents to and provides on that service

(The items actually provided follow what that provider discloses and the scope the user consents to.)

3. Orders, payment, and shipping

Orderer information (name, contact details, email); recipient information (name, contact details, shipping address); order history; payment-related information (type of payment method, payment approval result, etc. — sensitive payment information such as card numbers is processed by the payment institution, and the Company may review only what is necessary under applicable law and contract.)

4. Customer inquiries

Inquiry content, contact details, order number (where applicable), attachments (where applicable)

5. Information that may be collected automatically while using the service

IP address, cookies, time of visit, service use records, device information, etc.

Article 3 (Processing and retention period of personal information)

1. The Company processes and retains personal information within the retention and use period set by law, or the period for which the user consented when the information was collected.

2. The processing and retention period for each category is as follows.

• Membership registration and management: until membership is withdrawn. However, if an investigation or inquiry is underway for a violation of applicable law, until that investigation or inquiry ends
• Provision of goods or services: until supply of the goods or services is completed and payment of charges and settlement are completed. However, if applicable law requires retention for a certain period, the information is retained for that period.
• Customer counseling and complaint handling: for the period required by applicable law after counseling or the complaint is handled

3. Where laws such as the Act on the Consumer Protection in Electronic Commerce require information to be kept for a certain period, the Company retains personal information for the period those laws set. (Specific numbers of days follow applicable law.)

4. Personal information whose retention period has ended is destroyed without delay. If applicable law still requires retention, it is kept only within that purpose.

Article 4 (Provision of personal information to third parties)

The Company processes users’ personal information within the scope stated in Article 1, and provides personal information to third parties only in cases that fall under the Personal Information Protection Act, such as the user’s consent or a special provision of law.

(If, as of now, there is any third-party provision other than ordinary consignment of work, the recipient, purpose, items, and retention period will be added to and announced in this policy.)

Article 5 (Entrustment of processing of personal information)

To provide the service smoothly, the Company may entrust the processing of personal information as follows.

1. Payment processing: payment-agency service provider (the payment operator in use)

2. Shipping: courier or logistics consignee (the shipping operator in use)

3. Identity verification, notices, etc.: relevant service providers (where applicable)

When entering into a consignment contract, the Company clearly provides for strict observance of instructions on personal-information protection, confidentiality, limits on sub-consignment, responsibility in the event of an incident, and return or destruction of personal information after processing ends, and supervises this.

If the consignee or the work changes, the Company will publish that through this policy.

Article 6 (Cross-border transfer of personal information)

In principle, the Company does not transfer users’ personal information abroad. However, if a cross-border transfer occurs in the course of using services such as cloud, email, or analytics tools, the Company will, under applicable law, inform the user of the country of transfer, the time and method of transfer, the recipient, and the purpose, items, and retention and use period, and obtain consent, or satisfy another requirement the law allows. When those details are confirmed, they will be stated specifically in this policy.

Article 7 (Procedure and method of destroying personal information)

1. When personal information becomes unnecessary — for example because the retention period has ended or the purpose of processing has been achieved — the Company destroys that personal information without delay.

2. If the law requires personal information to be preserved further, the Company moves that information to a separate database (DB) or stores it in a different location.

3. Method of destruction

• Electronic files: permanently deleted in a way that cannot be recovered or reproduced
• Paper documents: shredded or incinerated

Article 8 (Rights and duties of users and legal representatives, and how to exercise them)

1. Users may at any time exercise against the Company rights such as requesting access to, correction of, deletion of, or suspension of processing of personal information.

2. Rights may be exercised in writing, by email, through customer service, or similar means, and the Company will act without delay.

3. If a user requests correction of an error in personal information, the Company will not use or provide that personal information until the correction is completed.

4. If the Company processes personal information of a child under 14, it obtains the consent of the legal representative under applicable law.

Article 9 (Measures to secure the safety of personal information)

The Company takes the following measures to secure the safety of personal information.

• Administrative measures: establishing and implementing an internal management plan, staff training, etc.
• Technical measures: management of access rights, operation of an access-control system, encryption of unique identifiers and similar data, installation of security programs
• Physical measures: access control for computer rooms, records-storage rooms, and the like

Article 10 (Installation, operation, and refusal of cookies)

1. The Company may use ‘cookies’ that store and retrieve usage information from time to time in order to provide individually customized services to users.

2. A cookie is a small amount of information that a server used to operate the website sends to the user’s browser, and it may be stored on the user’s PC or mobile device.

3. Users may refuse the storage of cookies through their web-browser option settings. However, if cookie storage is refused, it may be difficult to use customized services.

Article 11 (Personal information protection officer)

The Company takes overall responsibility for work relating to the processing of personal information, and designates a personal information protection officer as follows to handle user complaints and provide remedies in connection with the processing of personal information.

Personal information protection officer

Name: Park Soyoon (Representative)

Contact: 010-9482-6175

Email: born1101@naver.com

Users may inquire of the personal information protection officer about all matters concerning personal-information protection inquiries, complaint handling, and remedies that arise while using the Company’s services. The Company will answer and handle user inquiries without delay.

Article 12 (Remedies for infringement of rights)

To obtain a remedy for infringement of personal information, users may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and similar bodies.

• Personal Information Dispute Mediation Committee: (no area code) 1833-6972
• Personal Information Infringement Report Center: (no area code) 118
• Supreme Prosecutors’ Office: (no area code) 1301
• National Police Agency: (no area code) 182

Article 13 (Changes to the privacy policy)

This privacy policy applies from the effective date. If there is any addition, deletion, or correction of content due to law or this policy, the Company will announce it through a notice on the website (or an individual notice) before the change takes effect.

Addendum

Trade name: Jennie

Representative: Park Soyoon

Business registration no.: 139-12-07167

Address: 경기도 화성시 동탄순환대로10길 30-23 3506동 809호

Email: born1101@naver.com

Customer service: 010-9482-6175

Date of announcement: 2026-09-05

Effective date: 2026-09-05