Privacy Policy

This Privacy Policy explains how Hwahae, operated by Hwahae Global Inc. (“Hwahae” or the “Company”) processes information that is provided or collected through the website, mobile applications, and any other platforms or services where this policy is posted (collectively, the “Sites”).

The Company acts as the Controller of the information provided or collected through the Sites where this policy is posted, as well as through the Company's application on third-party websites or platforms.

Through this Privacy Policy, the Company informs users about:

• The purposes and methods of personal information processing
• The measures taken to protect personal information

If any modifications are made to this policy in the future, we will notify users through announcements on the Sites.

1. Information Collected and Methods of Collection

1. Collection of Personal Information

   The types of personal information collected by the Company are as follows.

   1. Information Provided by Users

      The Company may collect information that users directly provide.

      Service Name	Collected Information
      Sign-Up	1) Email Registration: Email, Password, Nickname 2) Social Login: - Google: Name, Google ID Code, Email, Profile Picture, Nickname
      SNS Event	- (Required) Nickname, Mobile Number, Age Group, Gender, Skin Type, Instagram Account URL, Number of Followers, Main Category - (Optional) Submission of Instagram Post URL
      Advertising/Partnership Inquiries	Company Name, Brand Name, Brand Launch Status, Name, Email, Contact Number, Inquiry Details
      Personalized Services	Gender, Year of Birth, Skin Type, Skin Concerns, Parental Status, Personal Color, Skin Tone, Scalp/Hair Concerns, Health Concerns
      TikTok Review Submission	- TikTok video URL - Account username (publicly visible) - Video content that may contain facial images, voice, or other identifiable elements * Video content may contain personal information such as the submitter’s face, voice, or other identifiable elements
      Text or Photo Review Submission	- User-submitted text reviews and/or uploaded image(s) of the user’s face or skin condition, which may include identifiable elements such as facial features or skin details - Image metadata, if applicable (e.g., date, device info)

   2. User Attribute Display and Usage

      Hwahae may collect non-identifiable personal attributes such as country, gender, skin type, skin tone, and skin concerns. These attributes may be displayed alongside user-submitted reviews to provide contextual relevance, and may also be used to personalize content and improve service features.

   3. Information Collected During Service Usage
      In addition to information provided directly by users, the Company may collect data generated during the use of its services.

      Category	Collected Data
      Device Information	- Device Type, OS Version, Model Name, ADID/IDFA
      Log Information	- Service Usage Records, Payment Records, Suspension Records, Access Logs, IP Address, Cookies
      Location Information	- Geographical IP-Based Location Data (only where permitted by law)

2. Collection Methods

   The Company collects user information through the following methods:

   • Direct user submissions via forms, registrations, surveys, and service inquiries.
   • Automated tracking technologies (e.g., cookies, beacons, analytics tools).
   • Business partners (e.g., loyalty program partners, social media platforms).
   • Third-party service providers and marketing affiliates.

3. Use of Collected Information

   The Company uses collected user information for the following purposes:

   1. Member management and identity verification
      • Detecting and preventing unauthorized service usage and fraudulent activities.
   2. Fulfilling contracts related to services requested by users, processing payments, and fee settlements
   3. Improving existing services and developing new services
   4. Notifying users of changes in website or application features and policies
   5. Other uses based on the user’s prior consent (e.g., marketing and advertisements)
   6. Searching, notifying, and automatically registering contacts saved in users’ address books
      • Suggesting and notifying other users who may be acquaintances.
   7. Statistical analysis of service usage
      • Providing services and advertisements based on demographic characteristics.
   8. Providing promotional event information and participation opportunities
   9. Compliance with applicable laws and legal obligations
   10. Displaying and promoting user-submitted reviews (including external video content)
   • User-submitted reviews (including text, image captions, or attached photos) may be displayed and promoted on the Company’s platform or promotional materials.
   • To improve accessibility across languages, such content may be automatically or manually translated.
   • Such translations are provided for convenience and may not always be fully accurate.
   • Translations may be processed by third-party vendors under confidentiality agreements.
   • User profile attributes that are non-identifiable (e.g., country, skin type, tone, concerns) may be used to personalize review display and improve service quality.

If the Company intends to use collected information for purposes other than those specified in this Privacy Policy, user consent will be obtained in advance.(Refer to Appendix <1> of the Privacy Policy for GDPR-compliant lawful processing options.)

3. Disclosure and Sharing of Collected Information

The Company does not disclose users' personal information to third parties except in the following cases.

1. Disclosure to Affiliates, Partners, and Service Providers
   1. When the Company’s affiliates, partners, or service providers perform services on behalf of the Company, including:
      • Payment processing
      • Order fulfillment
      • Product delivery
      • Dispute resolution (including payment and delivery disputes)
2. Disclosure with User Consent
   1. When a user chooses to share personal information with a specific company to receive information about that company's products and services.
   2. When a user chooses to share personal information with third-party websites or platforms, such as social networking sites.
   3. Any other cases where the user has given prior consent.
   4. Hwahae may publicly display and share user-submitted reviews (including text, image, or external video content) on its platform and promotional materials, based on user consent.
      Submitted review content may include identifiable elements (e.g., face, voice, country, skin type), including those in photos attached to text reviews, and may be used for promotional or service-related purposes, as agreed by the user.
3. Disclosure Required by Law
   1. When disclosure is required by law.
   2. When law enforcement agencies request information following legal procedures and regulations for investigative purposes.

4. Cookie Collection

The Company uses cookies to store and retrieve user information to provide personalized and customized services.

A cookie is a small piece of data sent from the server (HTTP) operating the website to the user's computer browser and is sometimes stored on the user's PC hard drive.

1. Purpose of Using Cookies*

   Cookies are used for:

   • Maintaining user settings when they revisit the website.
   • Tracking the user's visit and interaction history with different services and websites.
   • Recording popular search terms and security access status to enhance personalized user experiences.
   • Currently, cookies are used only for payment services.

2. Cookie Installation, Operation, and Rejection

   Users can manage cookie settings by adjusting their browser settings.        

   Specifically, users can:

   • Refuse or restrict the storage and use of cookies from both Hwahae and third parties.
   • Since cookie settings vary by browser, users should check their browser’s settings and apply the preferred options

   Below are general steps for disabling cookies in commonly used browsers:

   • Users can disable cookies through their browser settings. The methods for managing cookies in commonly used browsers are as follows:

     Browser	Method
     Internet Explorer	Click [Tools] (top right) > [Internet Options] > [Privacy] > [Advanced] > [Block Cookies]
     Microsoft Edge	Click [Settings] (top right) > [Privacy, Search, and Services] > [Tracking Prevention] > [Set Tracking Prevention Level] > [Always use "Strict" tracking prevention in InPrivate browsing] > [Privacy] > [Send Do Not Track Requests]
     Chrome	Click [Settings] (top right) > [Privacy and Security] > [Site Settings] > [Content] > [Third-party Cookies] > [Block Third-party Cookies]
     Firefox	Click [Settings] (top right) > [Privacy & Security] > [Manage Cookies and Site Data]
     Safari	Click [Settings] > [Privacy] tab > Set cookie and website data preferences

3. Important Notes on Cookie Collection

   1. If users reject cookies, some services requiring login may not function properly.
   2. The Company collects and uses behavioral information to provide users with optimized, personalized services and benefits, including customized online advertisements during service usage.
   3. Users can refuse the collection of behavioral information.

4. Behavioral Information Collection

   The Company collects behavioral data as follows:

   Category	Details
   Types of Behavioral Information Collected	Website/App service visit history, search history, purchase history, advertising identifier
   Method of Collection	Automatically collected when users visit the website or open the app
   Purpose of Collection	To provide personalized product recommendation services (including advertisements) based on user interests and preferences
   Retention and Usage Period & Processing Afterward	Behavioral information is retained and used for statistical purposes only after account deletion

Allowing Online Personalized Advertising Providers to Collect Behavioral Information

We permit third parties and service providers to use online tracking technologies on our Sites for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear on our Sites, on other websites, or in our email communications

To the extent these online tracking technologies are deemed to be a “sale” / “sharing” (which includes targeted advertising, as defined under the applicable laws) under applicable U.S. state laws, you can opt-out of these online tracking technologies by submitting a request via Your Privacy Choices, which is available at the bottom of the Hwahae website. Please note, some features of our websites may not be available to you as a result. For Google Analytics, at your end, you may exercise an opt out going to tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt-out Browser Add-on. You may adjust your Google advertising settings by visiting adssettings.google.com.

The Company permits the collection and processing of behavioral information by online personalized advertising providers as follows:

1. Advertising providers collecting and processing behavioral information:
   • Meta, GA, Braze, Apple, AppsFlyer, Google Ads, TikTok, Kakao, Criteo
2. Method of Collection:
   • Automatically collected and transmitted when users visit the website or open the app
3. Types of Collected Behavioral Information:
   • Website/App visit history, search history, purchase history

1. Retention and Usage Period:

   • Retained for up to two (2) years from the date of collection, after which it is permanently deleted

2. Scope of Collected Behavioral Information:

   • The Company collects only the minimum necessary behavioral information required for online personalized advertising.
   • The Company does not collect sensitive behavioral data that may clearly infringe upon an individual’s rights, interests, or privacy, such as:
     • Thoughts, beliefs, family and relative relationships, education or medical history, other social activity records.

3. Protection of Minors (Under 14 Years Old):

   • The Company does not collect behavioral information for personalized advertising from users known to be under 14 years old or from online services primarily used by minors under 14.
   • The Company does not provide personalized advertising to users known to be under 14 years old.

4. Advertising Identifiers in Mobile Apps:

   • The Company collects and uses advertising identifiers for online personalized advertising in mobile applications.
   • Users can enable or disable personalized advertising by changing the settings on their mobile devices.

   How to enable/disable advertising identifiers on smartphones:

   Device	Method
   Android	[Settings] → [Privacy] → [Ads] → [Reset Advertising ID] or [Delete Advertising ID]
   iPhone	[Settings] → [Privacy] → [Tracking] → Disable [Allow Apps to Request to Track]

5. How to Block or Allow Online Personalized Advertising via Web Browser
   Users can block or allow personalized advertising by changing their web browser’s cookie settings.                    However, modifying cookie settings may affect the use of certain services, such as automatic login on websites.

   Browser	Method
   Internet Explorer	[Tools] (top right) → [Internet Options] → [Privacy] → [Advanced] → Block Cookies
   Microsoft Edge	[Settings] (top right) → [Privacy, Search, and Services] → [Tracking Prevention] → [Set Tracking Prevention Level] → Enable "Strict" tracking prevention for InPrivate browsing → [Privacy] → [Send Do Not Track Requests]
   Chrome	[Settings] (top right) → [Privacy and Security] → [Site Settings] → [Content] → [Third-party Cookies] → [Block Third-party Cookies]
   Firefox	[Settings] (top right) → [Privacy & Security] → [Manage Cookies and Site Data]
   Safari	[Settings] → [Privacy] → Manage Cookie Preferences

4. User Rights

Users or their legal representatives, as data subjects, have the following rights regarding the collection, use, and sharing of their personal information by the Company:

1. Right to Access Personal Information
2. Right to Rectify or Delete Personal Information
3. Right to Temporarily Suspend the Processing of Personal Information
4. Right to Withdraw Previously Given Consent

To exercise these rights, users can use the "Edit Profile" menu on the website or contact the Company (or the designated personal data protection officer or representative) via written request, phone, or email. The Company will   promptly take the necessary actions. However, the Company may refuse such requests if there are legitimate legal grounds or equivalent justifiable reasons.

Users may also request the removal of previously submitted external content, such as TikTok video links, by contacting Hwahae Customer Support. Upon receiving such requests, the Company will review and remove the content where appropriate, unless restricted by other legal obligations.

5. Security

To prevent unauthorized access, disclosure, use, or modification of personal data, the Company has implemented the following security measures:

1. Encryption of Personal Information
   1. Transmitting users' personal information via encrypted communication channels
   2. Encrypting and securely storing sensitive information, such as passwords
2. Measures Against Hacking and Cyber Threats
   1. The Company has installed systems in restricted access zones to prevent personal information from being leaked or damaged by hacking or computer viruses.
   2. Establishing and implementing an internal management plan
   3. Installing and operating access control systems
   4. Implementing measures to prevent falsification and modification of access logs

6. Protection of Children's Personal Information

The Company does not knowingly collect personal information from children under the age of 14 or the minimum age defined by applicable laws in certain jurisdictions without parental consent. If we become aware that a child under the age of 14 has provided us with personal information, we will delete the information from our records.

The Company's website, products, and services are primarily intended for general audiences.

7. Changes to the Privacy Policy

The Company reserves the right to modify or amend this Privacy Policy as necessary.

• If any changes are made, the Company will notify users through website announcements.
• If required by applicable laws, the Company will obtain user consent before implementing any changes.

8. Contact Information

For any questions regarding this policy or to update the personal information held by the Company, please contact us at:

• Company Name: Hwahae Global Inc.
• Address: #6, 396, Seocho-daero, Seocho-gu, Seoul, Republic of Korea
• Phone: +82-2-1811-4472
• Email: cs@hwahae.co.kr

Privacy Policy Appendix

<1> Lawful Processing of Personal Data Under GDPR

The Company processes users' personal data only in the following cases, in accordance with the General Data Protection Regulation (GDPR):

• When the user has given consent for the processing of their personal data.
• When processing is necessary for the performance of a contract to which the user is a party, or to take steps at the user’s request before entering into a contract.
  • Member management, identity verification, etc.
  • Execution of contracts related to services requested by the user, payment processing, and fee settlements.
• When processing is necessary to comply with a legal obligation to which the Company is subject.
  • Compliance with applicable laws, regulations, legal proceedings, and government requests.
• When processing is necessary to protect the vital interests of the user or another natural person.
  • Detecting, preventing, and responding to fraud, abuse, security risks, or technical issues that may cause harm to the user or others.
• When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company.
• When processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, provided that such interests are not overridden by the user’s interests or fundamental rights and freedoms, especially in cases where the user requires stronger data protection, such as children.

<2> User Rights Under GDPR

Users or their legal representatives, as data subjects, have the following rights regarding the collection, use, and sharing of their personal data:

• Right to Access Personal Data
  • Users or their legal representatives have the right to access their personal data and request confirmation of records related to data collection, usage, and sharing, in accordance with applicable laws.
• Right to Rectification
  • Users or their legal representatives have the right to request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten")
  • Users or their legal representatives have the right to request the deletion of data when the purpose for processing has been fulfilled, consent has been withdrawn, or other legal grounds apply.
• Right to Data Portability
  • Users or their legal representatives have the right to request the transfer of their data to themselves or another entity.
• Right to Object
  • Users or their legal representatives have the right to object to:
    • The processing of data for direct marketing purposes.
    • Processing based on legitimate interests, public duties, or official authority.
    • Processing for research and statistical purposes.
• Right to Object to Automated Decision-Making and Profiling
  • Users or their legal representatives have the right to object to automated data processing, including profiling, that has legal or significant effects on them.

To exercise these rights, users can use the "Edit Profile" menu on the website or contact the Company (or the designated personal data protection officer or representative) via written request, phone, or email. The Company will promptly take the necessary actions. However, the Company may refuse such requests only if there are legitimate legal grounds or equivalent justifiable reasons.

<3> Data Transfers Outside of the Country

As the Company operates on a global scale, it may provide users' personal data to Company affiliates or third parties located in other countries for the purposes stated in this Privacy Policy. The Company takes reasonable measures to protect personal data in locations where it is transferred, stored, or processed.

<4> Third-Party Websites and Services

The Company’s website, products, and services may contain links to third-party websites, products, or services.

Since the privacy policies of linked third-party sites may differ from the Company’s policies, users should review the privacy policies of those third-party sites separately.

<5> Notice to US Residents

If you are a US resident, you may have additional rights under applicable law.

• Users may request confirmation of any data breach involving their personal data.
• All users of the Company’s website can modify their information at any time by accessing their personal account and using the "Edit Information" menu.
• The Company does not track website visitors and does not use "Do Not Track" signals.
• The Company does not sell or share personal information for monetary consideration, however our use of third party targeted advertising and analytics cookies and other tracking technologies may constitute a “sale”, “share” or “targeted advertising” under certain US state privacy laws. Depending on your state of residence, you may opt-out using the information provided below.

California Shine the Light Notice:

Consumers who are residents of California may opt-out of having their personal information disclosed to third parties for their direct marketing purposes. We do not disclose Personal Information to third parties in a manner that triggers this opt-out requirement.

Your Privacy Rights

You may have certain rights and choices regarding our processing of your personal information. Depending on your jurisdiction, applicable law may entitle you to additional consumer rights, including the right:

• To know the categories and/or specific pieces of personal information collected about you, including the source of your personal information, whether your personal information is sold or disclosed and the purpose, and with whom your personal information was disclosed;
• To request deletion of personal information, if permissible by law;
• To correct inaccurate personal information we retain about you;
• To opt-out of “sale” and/or “share” of your personal information, targeted advertising, and profiling
• To limit the use of your sensitive personal information; and
• To appeal a decision regarding your request

Exercising your Privacy Rights to Know, Delete and Correct

• To exercise any of the above rights, send an email to the contact information set forth below. Please include “Privacy Rights Request” in the subject line of your email and provide sufficient information to enable to us identify you and the nature of the request.

Exercising your Right to Opt-Out of Sale. Share and Targeted Advertising

• We use cookies and other online tracking technologies to gather information when you interact with our websites, mobile application(s), and email communications. The online tracking technologies that we use on our website or mobile application(s) are deemed to be a “sale” / “sharing” / “targeted advertising” under applicable US state laws. We do not knowingly sell or share personal information of consumers under 16 years of age. Depending on your state of residence, you may opt-out of these online tracking technologies by submitting a request via Your Privacy Choices, which is available in the footer of our website.

Contact information:

• Hwahae Global

Legal Department, Privacy

• Security Team (cs@hwahae.co.kr)
• #6, 396, Seocho-daero, Seocho-gu, Seoul, Republic of Korea

<6> Notice to Residents of South Korea

The Company provides the following additional disclosures required under South Korea’s Information and Communications Network Act and Personal Information Protection Act.

(Further details on compliance with South Korean privacy laws will be outlined in this section.)

1. Purpose of Personal Data Collection and Use

Hwahae uses collected personal data for the following purposes:

[Service Classification - Required]

[Service Classification - Optional]

[Service Classification - Other]

2. Categories of Collected Personal Data

Hwahae collects personal data as follows:

[Service Classification - Required]

[Service Classification - Optional]

[Personal Data Processed Without User Consent]

Legal Basis: Article 15(1)(4) of the Personal Information Protection Act (Processing Necessary for Contract Performance)

[Service Classification - Other]

3. Provision and Delegation of Personal Data Processing

Hwahae entrusts certain personal data processing tasks to third-party service providers to ensure efficient service operation. The Company establishes agreements to ensure that personal data is securely managed in compliance with applicable laws.

[Current Domestic Data Processing Delegation]

[Overseas Personal Data Processing Delegation]

1. Legal Basis for Overseas Data Transfers

- Article 28-8(1)(3)(a) of the Personal Information Protection Act (Overseas   processing delegation and storage necessary for contract performance).

User Rights Regarding Overseas Data Transfers

• Users can refuse overseas data transfers by contacting Hwahae Customer Support (cs@hwahae.co.kr).
• If a user refuses the overseas transfer of their personal data, Hwahae will exclude their data from international transfers.
• However, certain services requiring overseas data transfers may be restricted for users who opt out.

Provision of Personal Data to Third Parties

Hwahae does not share users’ personal data with third parties beyond the     scope disclosed in this Privacy Policy, unless:

1. The user has given explicit consent for additional sharing.
2. The disclosure is required by law.
3. A third-party service is integrated with Hwahae services, and data sharing is necessary for service usage.

For orders and payments, data may be shared with sellers (third parties) as         necessary for seamless transaction processing, including consultation and delivery.

Users can check the detailed list of third-party recipients by clicking the relevant sections under "Data Recipients".

1. Data Recipients: Product Sellers

   Purpose of Data Sharing	Shared Data	Retention & Usage Period
   Processing necessary tasks related to service contracts and e-commerce transactions (including product sales, returns, refunds, and customer support)	1) Buyer Information: Nickname, Name, Mobile Number, Email Address 2) Recipient Information: Name, Mobile Number, Address 3) Product Purchase, Cancellation, Return, and Exchange Details 4) Invoice Information	Until the end of service usage. However, some data may be retained as required by applicable laws.

2. Data Recipients: Event Partner Brands

   Purpose of Data Sharing	Shared Data	Retention & Usage Period
   Providing event-related information (e.g., event details, participation methods, survey distribution, product delivery, customer support)	1) Event Winners' Information: Name, Mobile Number, Address	Until event prize distribution is completed.

User Rights and Data Protection Measures

• If Hwahae partners with third-party services to improve its offerings, users will be immediately notified via an updated Privacy Policy and an official announcement.
• Users have the right to refuse the delegation and sharing of personal data. However, refusal may result in limited access to certain services.
• Hwahae ensures that entrusted third-party service providers securely handle personal data through contractual agreements and ongoing supervision.
• Third parties that receive personal data from Hwahae must delete the data without delay once the purpose of collection or sharing has been fulfilled.

4. Processing of Personal Location Data

Hwahae collects and processes users' location data in compliance with the    Location Information Act to ensure safe management.

1. Hwahae receives location data from location-based service providers and uses it to provide services such as awarding Hwahae Points (tentative name) based on local weather conditions and delivering related content.

• Users’ location data is collected only for checking current weather conditions and is gathered only in certain situations while using the app.
• Retention period: 1 year.

2. In accordance with Article 16(2) of the Location Information Act, Hwahae automatically records and retains verification data on the collection, use, and provision of personal location data in the location information system for 6 months.

3. Once the purpose of using or providing location data is achieved, Hwahae immediately deletes personal location data, except for records required under Article 6 (verification data of location data usage and provision).

4. Hwahae does not use or share personal location data with third parties beyond the scope specified in the Terms of Use.

5. If the Company is unable to maintain the service due to changes in location-based service provider policies, legal restrictions, or other circumstances, the Company may limit, modify, or discontinue all or part of the service.

   • In such cases, Hwahae will notify users in advance via the internet or direct notification.

6. Collection and Use of Location Data for the Protection of Minors and Vulnerable Individuals:

   • If a legal guardian consents to the collection, use, or provision of location data for the protection of the life or physical safety of the following individuals, their consent is considered valid:
     • Children under the age of 8
     • Adults under legal guardianship
     • Individuals with severe mental disabilities, as defined by the Welfare of Persons with Disabilities Act (Article 2, Section 2, Clause 2) and the Act on the Promotion of Employment and Vocational Rehabilitation of Disabled Persons (Article 2, Section 2). (Limited to those officially registered as disabled under Article 32 of the Welfare of Persons with Disabilities Act.)
   • A guardian wishing to consent to the use or provision of location data for the protection of the above individuals must submit a written consent form, along with proof of guardianship, to the Company.
   • Once a guardian consents to the collection or provision of personal location data, they gain full authority to exercise the rights of the data subject.

7. The Chief Privacy Officer (CPO) serves as the Location Data Protection Officer.

   • For more details on personal location data processing, refer to the Location-Based Service Terms of Use.

5. Retention and Use Period of Personal Data

Hwahae deletes users' personal data without delay when it is no longer necessary unless it must be retained under internal policies or applicable laws.

1. Retention Due to Legal and Internal Policies

• If personal data is no longer needed due to expiration of the retention period or completion of its processing purpose, Hwahae promptly deletes the relevant data.

• However, some personal data may be temporarily stored for a certain period before deletion if required by internal policies or other legal obligations.

  Retention Item	Legal Basis	Retention Period
  Records related to display/advertising	Act on Consumer Protection in Electronic Commerce	6 months
  Records related to payment transactions and supply of goods/services	Act on Consumer Protection in Electronic Commerce	5 years
  Records related to consumer complaints or dispute resolution	Act on Consumer Protection in Electronic Commerce	3 years
  Website visit records	Protection of Communications Secrets Act	3 months

2. Retention and Use Period of Personal Data

• If the user's consented retention period has expired or the purpose of data processing has been achieved, but other laws require continued storage, the personal data is moved to a separate database (DB) or stored in a different location.
• Separately stored personal data will not be used for any purpose other than legal retention purposes, except as required by law.

3. Inactivity for One Year

• If a user does not use Hwahae's services for one year, their personal data will be deleted or separately stored and managed in accordance with internal policies.
• Users will receive prior notice before their personal data is deleted or moved.

6. Personal Data Disposal Procedures and Methods

• Hwahae identifies personal data that needs to be deleted, obtains approval from the Chief Privacy Officer (CPO), and then proceeds with data disposal.
• Personal data stored electronically is permanently deleted using technical methods to prevent recovery.
• Personal data stored in paper form is shredded or incinerated to ensure complete disposal.

7. User and Legal Guardian Rights, Obligations, and Methods of Exercise

Hwahae respects and values users' rights regarding personal data.

• Users (or their legal guardians if under 14 years old, including those registered via SNS) can:

  • View or modify their personal data and location data at any time.
  • Withdraw consent for data collection and usage (unsubscribe or delete their account).

• Contact Information for Requests

  Hwahae Customer Support: cs@hwahae.co.kr

  To View, Modify, or Delete Personal and Location Data:

  : My Page → Edit My Info

  To Withdraw Consent (Unsubscribe) or Delete an Account:

  : My Page → Settings → Delete Account

Hwahae may provide links to external websites or third-party resources.

• Hwahae has no control over external sites and cannot guarantee the accuracy, reliability, or usefulness of their services or content.
• When users click on a link provided by Hwahae and are redirected to an external website, Hwahae is not responsible for the privacy policies or data handling practices of that site.
• Users should carefully review the privacy policy of any newly visited website before using its services.

8. Automated Data Collection Devices (Cookies and Behavioral Data Collection)

Hwahae uses cookies and other automatic data collection tools, which users can choose to disable.

1. Purpose of Cookies

• Cookies store and retrieve user information to provide a personalized and optimized service experience.
• Usage includes:
  • Analyzing visit frequency, browsing patterns, and preferred services.
  • Delivering tailored personal services (Currently, cookies are only used for payment services).

2. How to Disable Cookie Collection

• Users can refuse cookies, but this may cause inconveniences in web usage and limit access to some login-required services.

  Browser	Cookie Blocking Method
  Internet Explorer	Tools (top right) → Internet Options → Privacy → Advanced → Block Cookies
  Microsoft Edge	Settings → Privacy, Search & Services → Tracking Prevention → Enable Strict Tracking Prevention → Privacy → Send Do Not Track Requests
  Chrome	Settings → Privacy and Security → Site Settings → Cookies and Site Data → Block Third-Party Cookies
  Firefox	Settings → Privacy & Security → Cookies and Site Data Settings
  Safari	Settings → Privacy Tab → Set Cookie & Website Data Levels

Hwahae collects and utilizes behavioral data during service usage to provide:

• Optimized personalized services
• Exclusive user benefits
• Online targeted advertisements

📌 Users have the right to refuse behavioral data collection if they do not wish to receive personalized ads or customized services.

1. Collection of Behavioral Data by Hwahae

1. Behavioral Data Collection by Third-Party Advertisers

   Hwahae permits the following advertising partners to collect and process behavioral data:

   • Advertisers collecting behavioral data:
     • Meta, GA, Braze, Apple, AppsFlyer, Google Ads, TikTok, Kakao, Criteo
   • Collection method:
     • Automatically collected and transmitted when users visit Hwahae's website or use the app.
   • Collected behavioral data:
     • Website/App visit history, search history, purchase history.
   • Retention period:
     • Up to 2 years from the collection date, after which it is deleted.

2. Restrictions on Behavioral Data Collection

   1. Minimal Data Collection

      • Hwahae only collects the minimum required behavioral data for personalized advertising.
      • Hwahae does not collect sensitive behavioral data that could infringe on users’ rights, freedoms, or privacy (e.g., political views, religious beliefs, family relationships, medical history, social activities).

   2. Protection of Users Under 14

      • Hwahae does not collect behavioral data for personalized advertising from users under 14 years old.
      • Hwahae does not display personalized ads to users known to be under 14.

   3. Advertising Identifier Collection & Management (Mobile Apps)

      • Hwahae collects and uses advertising identifiers for online personalized ads in mobile apps.
      • Users can disable personalized advertising by adjusting their mobile device settings:

      Device	Ad Identifier Management Method
      Android	Settings → Privacy → Ads → Reset Advertising ID or Delete Advertising ID
      iPhone	Settings → Privacy → Tracking → Disable "Allow Apps to Request to Track"

3. Cookie Management for Personalized Ads (Web Browsers)

   Users can block or allow cookies to control personalized ads. However, disabling cookies may affect automatic login and some website functionalities.

   Browser	Cookie Blocking Method
   Internet Explorer	Tools (top right) → Internet Options → Privacy → Advanced → Block Cookies
   Microsoft Edge	Settings → Privacy, Search & Services → Tracking Prevention → Enable Strict Tracking Prevention → Privacy → Send Do Not Track Requests
   Chrome	Settings → Privacy and Security → Site Settings → Cookies and Site Data → Block Third-Party Cookies
   Firefox	Settings → Privacy & Security → Cookies and Site Data Settings
   Safari	Settings → Privacy Tab → Set Cookie & Website Data Levels

4. Contact Information for Behavioral Data Inquiries

   Users can contact the Personal Data Protection Department for inquiries related to behavioral data, opt-out requests, or to report any issues.

   Department	Contact Person	Email
   Information Security Team	In-Ho Kwon	privacy@hwahae.com

9. Measures to Ensure Personal Data Security

Hwahae implements the following technical and administrative measures to safeguard users' personal data.

10. Updates to the Privacy Policy

• Hwahae will immediately notify users of any changes to its privacy policy.
• The privacy policy may be updated periodically to reflect legal, governmental, or internal policy changes.
• Any updates will be posted in the Hwahae app for transparency.

11. Privacy Officer & Customer Service for Inquiries

Reporting & Consulting for Personal Data Breaches

If you need to report a personal data breach or seek consultation, you may contact the following official agencies for assistance:

• Personal Information Dispute Mediation Committee
  • ☎ 1833-6972 (toll-free)
  • 🔗 https://www.kopico.go.kr
• Personal Data Infringement Report Center
  • ☎ 118 (toll-free)
  • 🔗 https://privacy.kisa.or.kr
• Supreme Prosecutors’ Office
  • ☎ 1301 (toll-free)
  • 🔗 https://www.spo.go.kr
• Korean National Police Agency
  • ☎ 182 (toll-free)
  • 🔗 https://ecrm.police.go.kr