PRIVACY POLICY

Physionics (hereinafter referred to as "the Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to promptly and smoothly handle related grievances.

Article 1 (Purpose of Processing Personal Information)

Physionics processes personal information for the following purposes. The personal information being processed shall not be used for purposes other than those stated below, and if the purpose of use changes, necessary measures such as obtaining separate consent shall be implemented in accordance with Article 18 of the Personal Information Protection Act.

Website Membership Registration and Management Personal information is processed for the purposes of confirming membership registration intent, identification and authentication for providing membership services, maintaining and managing membership qualification, identity verification in accordance with the limited real-name verification system, preventing unauthorized use of services, verifying consent of legal representatives when processing personal information of children under 14 years of age, various notices and notifications, and handling grievances.

Provision of Goods or Services Personal information is processed for the purposes of product delivery, service provision, sending contracts and invoices, content provision, customized service provision, identity verification, age verification, payment and settlement of fees, and debt collection.

Handling Grievances Personal information is processed for the purposes of verifying the identity of complainants, confirming grievance matters, contacting and notifying for fact-finding investigations, and notifying processing results.

Article 2 (Processing and Retention Period of Personal Information)

① Physionics processes and retains personal information within the retention and use period of personal information according to laws and regulations or the retention and use period of personal information consented to when collecting personal information from data subjects.

② The processing and retention period for each personal information is as follows:

Website Membership Registration and Management: Until withdrawal from the Physionics website However, in the following cases, until the reason ends:
When investigations or inquiries due to violations of related laws are in progress: until the investigation or inquiry ends
When credit and debt relationships remain from website use: until the credit and debt relationships are settled
Provision of Goods or Services: Until completion of goods/service supply and payment/settlement However, in the following cases, until the end of the relevant period:
Records related to transactions such as labeling/advertising, contract content and performance under the Act on Consumer Protection in Electronic Commerce, etc.
Records on labeling/advertising: 6 months
Records on contracts or withdrawal of subscription, payment, supply of goods, etc.: 5 years
Records on consumer complaints or dispute resolution: 3 years
Retention of communication fact confirmation data in accordance with Article 41 of the Protection of Communications Secrets Act
Subscriber telecommunications date and time, start/end time, other party's subscriber number, frequency of use, location tracking data of originating base station: 1 year
Computer communications, internet log records, connection tracking data: 3 months
Article 3 (Provision of Personal Information to Third Parties)

① Physionics processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only when the cases under Articles 17 and 18 of the Personal Information Protection Act apply, such as the consent of the data subject or special provisions of laws, and does not provide the data subject's personal information to third parties otherwise.

② For smooth service provision, Physionics may provide personal information to third parties only to the minimum extent necessary with the consent of the data subject in accordance with Article 17, Paragraph 1, Item 1 of the Personal Information Protection Act in the following cases:

Recipients of personal information:
Purpose of use of personal information by recipients:
Personal information items provided:
Retention and use period of recipients:
Article 4 (Outsourcing of Personal Information Processing)

① Physionics outsources personal information processing tasks as follows for smooth personal information processing:

Outsourced Task Details

Consignee: Imweb Co., Ltd.

Outsourced task details: System provision for shopping mall hosting service, mobile app service, marketing service and additional/partnership service provision, and KakaoTalk notification, friend talk, and text message sending agency service, etc.

Consignee: OOO PG

Outsourced task details: Payment and escrow services

Consignee: OOO Delivery Service

Outsourced task details: Product delivery services

Consignee: OOO Customer Center

Outsourced task details: Customer consultation services

Consignee: OOO

Outsourced task details: Identity verification services

Re-outsourcing

Re-consignee: Imweb Co., Ltd. → Infobip Co., Ltd.

Outsourced task details: Text message sending, KakaoTalk notification (informational message) sending services

Re-consignee: Imweb Co., Ltd. → LunaSoft Co., Ltd.

Outsourced task details: Text message sending, KakaoTalk notification (informational message) and friend talk sending services

② When concluding outsourcing contracts, Physionics specifies in documents such as contracts matters concerning prohibition of processing personal information other than for the purpose of performing outsourced tasks, technical and managerial protection measures, restrictions on re-outsourcing, management and supervision of consignees, and responsibilities for damages in accordance with Article 25 of the Personal Information Protection Act, and supervises whether the consignee processes personal information safely.

③ If the content of outsourced tasks or the consignee changes, this will be disclosed without delay through this Privacy Policy.

Article 5 (Rights of Data Subjects and Legal Representatives and Methods of Exercise)

① Data subjects may exercise the following personal information protection-related rights against Physionics at any time:

Request to view personal information
Request for correction if there are errors
Request for deletion
Request for suspension of processing
② The exercise of rights under Paragraph 1 may be made to Physionics in writing, by telephone, email, facsimile (FAX), etc., and Physionics will take action without delay.

③ If a data subject requests correction or deletion of errors in personal information, Physionics will not use or provide the personal information until the correction or deletion is completed.

④ The exercise of rights under Paragraph 1 may be made through a legal representative of the data subject or an agent such as a person who has received delegation. In this case, a power of attorney in accordance with Form No. 11 attached to the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤ Data subjects shall not infringe upon the personal information and privacy of themselves or others processed by Physionics in violation of the Personal Information Protection Act and other related laws and regulations.

Article 6 (Personal Information Items Processed)

Physionics processes the following personal information items:

Website Membership Registration and Management Required items: Optional items:

Provision of Goods or Services Required items: Optional items:

Article 7 (Destruction of Personal Information)

① Physionics destroys personal information without delay when personal information becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.

② If personal information must continue to be preserved in accordance with other laws despite the elapse of the personal information retention period consented to by the data subject or the achievement of the processing purpose, the personal information shall be moved to a separate database (DB) or stored in a different storage location.

③ The procedures and methods for destroying personal information are as follows:

Destruction Procedure Physionics selects personal information for which reasons for destruction have occurred and destroys the personal information with the approval of Physionics' Personal Information Protection Officer.

Destruction Method Physionics destroys personal information recorded and stored in electronic file format so that records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding or incinerating them.

Article 8 (Measures to Ensure Safety of Personal Information)

Physionics takes the following measures to ensure the safety of personal information:

Managerial measures: Establishment and implementation of internal management plans, regular employee training, etc.
Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
Physical measures: Access control to computer rooms, data storage rooms, etc.
Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

① Physionics uses 'cookies' that store and retrieve usage information from time to time to provide individual customized services to users.

② A cookie is a small amount of information sent by the server (http) used to operate a website to the user's computer browser and is stored on the user's PC or mobile device.

③ Data subjects can set cookie permission, blocking, etc. through web browser option settings. However, if cookie storage is refused, difficulties may arise in using customized services.

▶ Allow/block cookies in web browser

Chrome: Web browser settings > Privacy and security > Clear browsing data
Edge: Web browser settings > Cookies and site permissions > Manage and delete cookies and site data
▶ Allow/block cookies in mobile browser

Chrome: Mobile browser settings > Privacy and security > Clear browsing data
Safari: Mobile device settings > Safari > Advanced > Block all cookies
Samsung Internet: Mobile browser settings > Browsing history > Delete browsing history
④ Physionics collects and uses information to provide users with optimized information by identifying visits and usage patterns, popular search terms, secure connection status, etc. for each service and website visited by users during service use.

Article 10 (Personal Information Protection Officer)

① Physionics designates a Personal Information Protection Officer as follows to take overall responsibility for personal information processing and to handle complaints and remedy damages of data subjects related to personal information processing.

▶ Personal Information Protection Officer Name: OOO Position: OOO Contact: , , ※ Connects to the Personal Information Protection Department.

▶ Personal Information Protection Department Department name: OOO Team Contact: , ,

② Data subjects may inquire with the Personal Information Protection Officer and the department in charge regarding all matters related to personal information protection such as inquiries, complaint handling, and damage relief that occurred while using Physionics' services (or business). Physionics will respond to and process inquiries from data subjects without delay.

Article 11 (Request for Access to Personal Information)

Data subjects may make requests for access to personal information in accordance with Article 35 of the Personal Information Protection Act to the department below. Physionics will strive to ensure that requests for access to personal information by data subjects are processed promptly.

▶ Department for receiving and processing requests for access to personal information Department name: OOO Contact: , ,

Article 12 (Remedy Methods for Infringement of Rights)

Data subjects may inquire with the following organizations regarding damage relief and counseling for personal information infringement:

Personal Information Dispute Mediation Committee: 1833-6972 (without area code) (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (without area code) (privacy.kisa.or.kr)
Supreme Prosecutors' Office: 1301 (without area code) (www.spo.go.kr)
National Police Agency: 182 (without area code) (ecrm.police.go.kr/minwon/main)
Article 13 (Enforcement and Amendment of Privacy Policy)

This Privacy Policy is effective from [Date: Month, Day, Year, 20XX].