Contents

The following are supplementary clauses applicable depending on your location or nationality. In the event of conflict between the following and the main text of this Privacy Notice, the following shall prevail.

EEA and UK

For the purposes of this section, the term “personal information” used in the main text of this Notice shall be replaced with the term “personal data” – the term shall have the same meaning as set out in Article 1

Clause Article 1 of this Notice shall be supplemented with the following text as a new final paragraph:

Article 1 Privacy Notice

For the purposes of the GDPR and the UK Data Protection Act 2018, Weverse Company Inc. is the entity (or “controller”) that decides how and why your personal data are processed and has primary responsibility for complying with applicable data protection laws.

Clause Article 2 of this Notice shall be replaced with the following:

Article 2 Purposes and Legal Bases for Processing of Personal Data

The purposes of processing of your personal data and the legal bases on which we rely under applicable laws are as follows:

Direct Marketing

We process personal data to contact you via email, telephone, direct mail or other communication formats to provide you with information regarding Sites, Apps or services that may be of interest to you. We also process personal data for the purposes of displaying content tailored to your use of our Sites, Apps or services. If we provide Sites, Apps or services to you, we may send or display information to you regarding our Sites, Apps or services, upcoming promotions and other information that may be of interest to you, including by using the contact details that you have provided to us, or any other appropriate means, subject always to obtaining your prior opt-in consent, to the extent required under applicable law.

You may unsubscribe from our promotional email list at any time by simply clicking on the unsubscribe link included in every promotional electronic communication we send or by unsubscribing online at [Link] Please note that it may take up to 2 weeks to process your unsubscribe request, during which time you may continue to receive communications from us. After you unsubscribe, we will not send you further promotional emails, but in some circumstances we will continue to contact you to the extent necessary for the purposes of any Sites, Apps or services you have requested.

The final paragraph of Clause Article 4 of this Notice shall be replaced with the following:

Article 4 Disclosure of Personal Data to Third Parties

We disclose personal data to other entities within the Weverse group, for legitimate business purposes and the operation of our Sites, Apps or services to you, in accordance with applicable law. In addition, we disclose personal data to:

• you and, where appropriate, your appointed representatives;
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
• accountants, auditors, consultants, lawyers and other outside professional advisors to HYBE, subject to binding contractual obligations of confidentiality;
• third party processors, located anywhere in the world, subject to the requirements noted below in this Section Article 4;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
• any relevant third party acquirer(s) or successor(s) in title, in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganization, dissolution or liquidation); and
• any relevant third party provider, where our Sites and our Apps use third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your personal data may be shared with the relevant third party provider. We recommend that you review that third party’s privacy policy before interacting with its advertising, plugins or content.

If we engage a third-party processor to process your personal data, the processor will be subject to binding contractual obligations to:

(i) only process the personal data in accordance with our prior written instructions; and
(ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

Please see Article 5 for more information on the third-party processors engaged by Weverse.

Clause Article 6 of this Notice shall be replaced with the following:

Article 6 International Transfer of Personal Data

Because of the international nature of our business, we transfer personal data within the Weverse group, and to third parties, as discussed further in Article 6, in connection with the purposes set out in this Notice. For this reason, we transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located, including Korea, Japan, and the United States.

If an exemption or derogation applies (e.g., where a transfer is necessary to establish, exercise or defend a legal claim) we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the EEA or UK to recipients located outside the EEA or UK who are not in jurisdictions formally designated by the European Commission or UK Government as providing an adequate level of protection for personal data, we do so on the basis of template transfer clauses adopted by the European Commission or adopted by a Data Protection Authority and approved by the European Commission, or adopted by the UK Government (as appropriate). You are entitled to request a copy of these clauses using the contact details provided in Section Article 13 below.

Please note that when you transfer any personal data directly to any Weverse entity established outside the EEA or UK, we are not responsible for that transfer of your personal data. We will nevertheless process your personal data, from the point at which we receive those data, in accordance with the provisions of this Notice.

Clause Article 8 of this Notice shall be replaced with the following:

Article 8 Procedures and Methods of Destroying Personal Data

We destroy your personal information in accordance with our internal policies and other applicable laws.

The following shall be added at the bottom of Clause Article 9:

Article 9 Your Legal Rights

In addition to the above rights, you remain entitled to all other statutory rights.

You may also have the following additional rights regarding the processing of your personal information:

• the right to object, on grounds relating to your particular situation, to the processing of your personal information by us or on our behalf, where such processing is based on Articles 6(1)(e) (public interest) or 6(1)(f) (legitimate interests) of the GDPR; and
• the right to object to the processing of your relevant personal data by us or on our behalf for direct marketing purposes.

Clause Article 11 of this Notice shall be replaced with the following:

Article 11 Cookies and Similar Technologies

When you visit a Site or use an App, we will typically place cookies onto your device or read cookies already on your device, subject always to obtaining your prior consent, where required, in accordance with applicable law. For further details, please see our Cookie Policy

Clause Article 13 of this Notice shall be replaced with the following:

Article 13 Contact Information

You may contact our DPO [privacy@weverse.io] if you wish to exercise your rights in connection with this Notice or your personal data. You may also contact our represnetative [EU LOCAL REPRESENTATIVE]

Clause Article 14 of this Notice shall not apply.

California Consumer Privacy Act (CCPA)

Clause Article 7 of this Notice shall be replaced with the following:

Article 7 Data Retention

We take every reasonable step to ensure that your personal information is only processed for the minimum period necessary for the purposes set out in this Notice. We will retain your personal information in a form that permits identification only for as long as:

(1) we maintain an ongoing relationship with you; or
(2) your personal information is necessary in connection with the lawful purposes set out in this Notice, for which we have a valid legal basis.

Clause Article 9 of this Notice shall be replaced with the following:

Article 9 California Consumer Privacy Act Disclosures

Under the California Consumer Privacy Act (“CCPA”), we must disclose our practices regarding the collection, use, and disclosure of the personal information of California residents (“Consumers”).

Collection of Personal Information

We have collected and will collect the following general categories of personal information about Consumers:

• Personal identifiers, including names, postal addresses, IP addresses, and email addresses;
• Protected classifications, including age;
• Internet or other electronic network activity information; and
• Inferences for use in creating a consumer profile.

Our service is not offered for children (under 14 years old for South Korean and under 16 years old for international users). If we discover that we have collected the personal information of a child, we will delete the information and cancel the user's account. If you believe that we have collected information of a child, please inform us via contact information in Article 13.

Use of Personal information

We may use the categories of personal information described above for the following business or commercial purposes:

• Advance our commercial or economic business interests;
• Maintain or service customer accounts;
• Provide customer service;
• Process or fulfill orders and transactions;
• Provide advertising or marketing services;
• Provide analytic services;
• Perform internal research for technological development;
• Ensure the quality and safety of services or devices;
• Improve the quality and safety of services or devices;
• Debugging to address impairments to operational functionality;
• Detect security incidents;
• Comply with applicable law and law enforcement requirements;
• Protect against malicious, deceptive, fraudulent or illegal activity;
• Prosecute those responsible for malicious, deceptive, fraudulent or illegal activity; and
• Defend against or bring legal action, claims and other liabilities.

Categories of Sources of Personal information

We collect or obtain personal information of Consumers from the following sources:

• Information provided to us by Consumers;
• Information we obtain on our own;
• Information provided to us through collaboration with Consumers;
• Information provided to us in the course of our relationship with Consumers;
• Information made public by Consumers;
• App data;
• Site data;
• Information registered by Consumers;
• Information obtained from content and advertising providers; or
• Information provided to us by third parties.

Disclosure of Personal information

We do not sell any personal information to third parties. In particular, we do not sell the personal information of minors under 16 years of age. In the preceding 12 months, we have disclosed the following categories of personal information to the following categories of recipients:

Clause Article 11 of this Notice shall be replaced with the following:

Article 11 California’s “Shine the Light” Law

Under California’s “Shine the Light” law, California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or our affiliates in connection with direct marketing performed by such third parties or our affiliates. The aforementioned notice will identify the categories of information we shared with third parties and our affiliates, and will include a list of names and addresses of such data recipients. If you are a California resident and would like a copy of this notice, please submit a written request to the following email address:

Clause Article 13 of this Notice shall be replaced with the following:

Article 13 Consumer Rights under the CCPA

If you are a Consumer, the CCPA grants you the following rights regarding your personal information. If you make a certain request to us in order to exercise, or cause an authorized representative you appointed to exercise on your behalf, your rights to know and delete set forth in the CCPA, we will generally require you to provide us with certain personal information for the purpose of identifying you in the course of handling your request and compare such personal information against the personal information we have collected about you to verify your identity (“verifiable consumer request”).

Verifiable consumer requests to know or delete may be submitted through one of the following methods:

• Call us toll free at: (209) 370-0219
• Or by email at:

Right to Know About Personal Information We Collected about You.

Consumers have the right to submit a verifiable consumer request that we disclose the following personal information we collected about you over the 12-month period preceding the verifiable consumer request, in a readily useable format:

• The categories of personal information we collected about you.
• The purposes for which the categories of personal information collected about you will be used.
• The categories of sources for the personal information we collected about you.
• The categories of third parties with whom we share your personal information.
• Our business or commercial purpose for collecting your personal information.
• The specific pieces of personal information we collected about you.
• The categories of personal information we have disclosed for a business purpose.

Right to Request Deletion of Personal Information.

Consumers have the right to request that we delete any personal information we have collected from them.

Right to Non-Discrimination.

Consumers have the right to be free from discrimination when they exercise their rights under the CCPA and, should you exercise those rights, we cannot:

1. Deny you goods or services;
2. Charge you a different price or rate for goods or services;
3. Provide you with a different level of quality of goods or services;
4. Suggest that you may receive a different level of quality of goods or services.

Notice of Financial Incentive

We offer consumers who provide personal identifiers, including their name, home address, and email address, and commercial information, including their purchase history and access to Weverse community events. As participants in these programs, consumers will have the opportunity to win prizes. The value of this personal information to our business will vary depending on the consumer's purchases from Weverse. Consumers may opt-in to our community events by signing up on our website. Consumers may cancel their participation in these events at any time.

Authorized Agent

Under the CCPA, you may appoint an authorized agent to submit requests to exercise your rights on your behalf. Should you choose to do so, for your and our protection, we will require your authorized agent to provide us with a signed permission demonstrating they are authorized to submit a request on your behalf. We note, should your authorized agent fail to submit proof that they have been authorized to act on your behalf, we will deny their request.

Clause Article 14 of this Notice shall not apply.