EEA and UK

For the purposes of this section, the term “personal information” used in the main text of this Notice shall be replaced with the term “personal data” – the term shall have the same meaning as set out in Article 1

Clause Article 1 of this Notice shall be supplemented with the following text as a new final paragraph:

For the purposes of the GDPR and the UK Data Protection Act 2018, Weverse Company Inc. is the entity (or “controller”) that decides how and why your personal data are processed and has primary responsibility for complying with applicable data protection laws.

The final paragraph of Clause Article 4 of this Notice shall be replaced with the following:

Article 4 Disclosure of Personal Data to Third Parties

We disclose personal data to other entities within the Weverse group, for legitimate business purposes and the operation of our Sites, Apps or services to you, in accordance with applicable law. In addition, we disclose personal data to:

• you and, where appropriate, your appointed representatives;
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
• accountants, auditors, consultants, lawyers and other outside professional advisors to HYBE, subject to binding contractual obligations of confidentiality;
• third party processors, located anywhere in the world, subject to the requirements noted below in this Section Article 4;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
• any relevant third party acquirer(s) or successor(s) in title, in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganization, dissolution or liquidation); and
• any relevant third party provider, where our Sites and our Apps use third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your personal data may be shared with the relevant third party provider. We recommend that you review that third party’s privacy policy before interacting with its advertising, plugins or content.

If we engage a third-party processor to process your personal data, the processor will be subject to binding contractual obligations to:

(i) only process the personal data in accordance with our prior written instructions; and
(ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

Please refer to Article 5 for additional information about entities to which personal information is outsourced by the Company.

Clause Article 6 of this Notice shall be replaced with the following:

Article 6 International Transfer of Personal Data

Because of the international nature of our business, we transfer personal data within the Weverse group, and to third parties, as discussed further in Article 6, in connection with the purposes set out in this Notice. For this reason, we transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located, including Korea, Japan, and the United States.

If an exemption or derogation applies (e.g., where a transfer is necessary to establish, exercise or defend a legal claim) we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the EEA or UK to recipients located outside the EEA or UK who are not in jurisdictions formally designated by the European Commission or UK Government as providing an adequate level of protection for personal data, we do so on the basis of template transfer clauses adopted by the European Commission or adopted by a Data Protection Authority and approved by the European Commission, or adopted by the UK Government (as appropriate). You are entitled to request a copy of these clauses using the contact details provided in Section Article 12 below.

Please note that when you transfer any personal data directly to any Weverse entity established outside the EEA or UK, we are not responsible for that transfer of your personal data. We will nevertheless process your personal data, from the point at which we receive those data, in accordance with the provisions of this Notice.

Clause Article 8 of this Notice shall be replaced with the following:

Article 8 Procedures and Methods of Destroying Personal Data

We destroy your personal information in accordance with our internal policies and other applicable laws.

The following shall be added at the bottom of Clause Article 9:

Article 9 Your Legal Rights

In addition to the above rights, you remain entitled to all other statutory rights.

You may also have the following additional rights regarding the processing of your personal information:

• the right to object, on grounds relating to your particular situation, to the processing of your personal information by us or on our behalf, where such processing is based on Articles 6(1)(e) (public interest) or 6(1)(f) (legitimate interests) of the GDPR; and
• the right to object to the processing of your relevant personal data by us or on our behalf for direct marketing purposes.

Clause Article 11 of this Notice shall be replaced with the following:

Article 11 Cookies and Similar Technologies

When you visit a Site or use an App, we will typically place cookies onto your device or read cookies already on your device, subject always to obtaining your prior consent, where required, in accordance with applicable law. For further details, please see our Cookie Policy

EU LOCAL REPRESENTATIVE

Clause Article 7 of this Notice shall be replaced with the following:

Article 7 Retention of Personal Information

We take every reasonable step to ensure that your personal information is only processed for the minimum period necessary for the purposes set out in this Notice. We will retain your personal information in a form that permits identification only for as long as:

(1) we maintain an ongoing relationship with you; or
(2) your personal information is necessary in connection with the lawful purposes set out in this Notice, for which we have a valid legal basis.

Clause Article 9 of this Notice shall be replaced with the following:

Article 9 California Consumer Privacy Act Disclosures

Under the California Consumer Privacy Act (“CCPA”), we must disclose our practices regarding the collection, use, and disclosure of the personal information of California residents (“Consumers”).

Collection of personal information

We have collected and will collect the following general categories of personal information about Consumers:

• Personal identifiers, including names, postal addresses, IP addresses, and email addresses;
• Protected classifications, including age;
• Internet or other electronic network activity information; and
• Inferences for use in creating a consumer profile.

Our service is not offered for children (under 14 years old for South Korean and under 16 years old for international users). If we discover that we have collected the personal information of a child, we will delete the information and cancel the user's account. If you believe that we have collected information of a child, please inform us via contact information in Article 12.

Use of Personal information

We may use the categories of personal information described above for the following business or commercial purposes:

• Advance our commercial or economic business interests;
• Maintain or service customer accounts;
• Provide customer service;
• Process or fulfill orders and transactions;
• Provide advertising or marketing services;
• Provide analytic services;
• Perform internal research for technological development;
• Ensure the quality and safety of services or devices;
• Improve the quality and safety of services or devices;
• Debugging to address impairments to operational functionality;
• Detect security incidents;
• Comply with applicable law and law enforcement requirements;
• Protect against malicious, deceptive, fraudulent or illegal activity;
• Prosecute those responsible for malicious, deceptive, fraudulent or illegal activity; and
• Defend against or bring legal action, claims and other liabilities.

Categories of Sources of Personal information

We collect or obtain personal information of Consumers from the following sources:

• Information provided to us by Consumers;
• Information we obtain on our own;
• Information provided to us through collaboration with Consumers;
• Information provided to us in the course of our relationship with Consumers;
• Information made public by Consumers;
• App data;
• Site data;
• Information registered by Consumers;
• Information obtained from content and advertising providers; or
• Information provided to us by third parties.

Right to Know About Personal Information We Collected about You

Consumers have the right to submit a verifiable consumer request that we disclose the following personal information we collected about you over the 12-month period preceding the verifiable consumer request, in a readily useable format:

• The categories of personal information we collected about you
• The purposes for which the categories of personal information collected about you will be used.
• The categories of sources for the personal information we collected about you.
• The categories of third parties with whom we share your personal information.
• Our business or commercial purpose for collecting your personal information.
• The specific pieces of personal information we collected about you.
• The categories of personal information we have disclosed for a business purpose.

Right to Request Deletion of Personal Information

Consumers have the right to request that we delete any personal information we have collected from them.

Right to Non-Discrimination

Consumers have the right to be free from discrimination when they exercise their rights under the CCPA and, should you exercise those rights, we cannot:

1. Deny you goods or services;
2. Charge you a different price or rate for goods or services;
3. Provide you with a different level of quality of goods or services;
4. Suggest that you may receive a different level of quality of goods or services.

Notice of Financial Incentive

We offer consumers who provide personal identifiers, including their name, home address, and email address, and commercial information, including their purchase history and access to Weverse community events. As participants in these programs, consumers will have the opportunity to win prizes. The value of this personal information to our business will vary depending on the consumer's purchases from Weverse. Consumers may opt-in to our community events by signing up on our website. Consumers may cancel their participation in these events at any time.

Authorized Agent

Under the CCPA, you may appoint an authorized agent to submit requests to exercise your rights on your behalf. Should you choose to do so, for your and our protection, we will require your authorized agent to provide us with a signed permission demonstrating they are authorized to submit a request on your behalf. We note, should your authorized agent fail to submit proof that they have been authorized to act on your behalf, we will deny their request.

The terms used in Clause Article 2 of this Notice shall be replaced with the following:

The description of this Notice shall be replaced with the following: “We process your personal information for the following purposes pursuant to applicable law.”

Clause Article 4 (Provision of Personal Information to Third Parties), Article 5 (Entrustment of Personal Information), and Article 6 (International Transfer of Personal Information) of this Notice shall be replaced with the following:

Except in the following cases, we do not provide third parties with your personal information, unless you consent thereto or the disclosure is otherwise expressly prescribed in applicable law.

• Please refer to details about providing personal information to third parties in Article 4.

Joint Use

The companies listed below and included in the above details about third parties provided with personal information are part of the company’s group. The types of jointly used personal information; the bounds of jointly using parties; the purpose of using; and the names of the companies and their representatives with responsibilities of managing personal information are listed below.

Companies included in the group (jointly using parties): HYBE Co., Ltd., BIGHIT MUSIC, Inc., PLEDIS Entertainment, Inc., BElift Lab Inc., KOZ ENTERTAINMENT, SOURCE MUSIC Co.Ltd., ADOR Co., Ltd., Weverse Company Inc., Weverse Japan Inc.

• Types of information for joint use: Same as listed in “Details About Providing Personal Information To Third Parties" and “Types of personal information”.
• Management responsibilities: The names of the company’s representatives are the same as listed in each company’s website.
• Purpose of use: Same as listed in “Details About Providing Personal Information To Third Parties" and “Types of personal information”.

References: Personal Information Protection Systems of Countries Receiving Information

Provision by Entrustment

The company has entrusted specialized companies and platforms with the tasks of processing personal information within reasonable scopes, in order to achieve the purposes of providing service and fulfilling contracts, and improving the convenience of customers.

• Please refer to details about entities to which personal information is outsourced in Article 5.
• Please refer to details about the international transfer of personal information in Article 6

When signing a contract with entrusted companies, important issues are addressed including prohibition of processing personal information for purposes other than entrusted purposes; technical and managerial measures to protect information; prohibition of re-entrustment; management and supervision of entrusted companies; and indemnification for possible damages. The company supervises the entrusted companies to ensure they handle the information safely.

If there are any changes in the entrusted tasks or list of entrusted companies, we will make sure to notify by sharing the revised Privacy Policy.

References: Personal Information Protection Systems of Countries Receiving Information

he following shall be added to Clause Article 12.

• COMPANY: Weverse Company In.
• ADDRESS: 6F, C, Pangyo Tech-One Tower, 131, Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• CEO: JOON WON CHOI