Weverse Company Inc. (hereinafter referred to as the “Company”) holds the personal data of its Weverse Shop service (hereinafter referred to as the “Service”) users (hereinafter referred to as the “Members”) to the upmost importance. Therefore, the Company has a strict privacy policy. Through this privacy policy (hereinafter referred to as the “Privacy Policy”), we inform our Members of the purpose and manner for which their personal data is being used and security measures the Company implements to safeguard the personal data. This Privacy Policy may be amended pursuant to changes in the applicable laws, regulations, and/or the Company’s policy, so please check the Privacy Policy from time to time for possible changes when using the Service.
Privacy Policy will take effect for Weverse Shop.

① The following personal data is collected by the Company from the Members when they sign up for or use the Service.

[Required data collection]
Product purchase

• Purpose of collecting and using personal data : Upon purchasing products
• Types of personal information : Customer information (Name, email. and mobile phone number)
• Duration of keeping and usage personal information : Period of keeping personal information according to the relevant laws or 3 months after deleting the account

• Purpose of collecting and using personal data : Entering shipping address for purchasing products
• Types of personal information : Recipient information (Name, mobile phone number, and address)
• Duration of keeping and usage personal information : Period of keeping personal information according to the relevant laws or 3 months after deleting the account

• Purpose of collecting and using personal data : fraudulent purchase/usage or duplicate purchase/usage when purchasing/using the products
• Types of personal information : Name, address, mobile phone number, and gender (optional)
• Duration of keeping and usage personal information : Period of keeping personal information according to the relevant laws or 3 months after deleting the account

Auto-generated information

• Purpose of collecting and using personal data : Service usage, customer service, confirmation and prevention of fraudulent usage, and analysis and statistics
• Types of personal information : Cookies, service usage history (date of log-in, IP address, fraudulent usage, etc), device information (unique device identifiers and OS version)
• Duration of keeping and usage personal information : Period of keeping personal information according to the relevant laws or 3 months after deleting the account

Event

• Purpose of collecting and using personal data : Confirmation of raffle entries and shipping of event prizes for the event operation
• Types of personal information :
• (event prize shipping) Name, date of birth, mobile phone number, and address
• (Operation) Name, date of birth, mobile phone number, and social media account
• Duration of keeping and usage personal information : Retain the data for a year after the event ends. Data of participants who did not win the event are disposed within 7 days of the winner announcement

[Optional data collection]
Promotional information

• Purpose of collecting and using personal data : Sending promotional information regarding the service
• Types of personal information : Email and push notifications
• Duration of keeping and usage personal information : Period of keeping personal information according to the relevant laws or 3 months after deleting the account

② The Company uses the information provided by the members, who agreed to the details under the Terms of Use (Article 2: Creation and Use of Weverse Accounts), to create Weverse accounts, and the members can use the connected services provided by the COMPANY by using the Weverse accounts created by the Company as above.
③ The Company collects personal data of the Members as above, but it does not collect sensitive personal data (e.g., race and ethnicity, ideology and beliefs, birthplace and domicile, political views and criminal record, health status and sex life) that may infringe upon the basic human rights of the Members and particular identification data.
④ The Company asks for permission to access the stored data or functions within a Member’s mobile device when the Members use the Service through a mobile application. When required, the Company asks for such permission in the form of either access that is necessary no matter what to provide the Service and access that is not, which can later be changed by the Member through the “Settings” option on their mobile device.
⑤ The Service is not intended for children (i.e., under 14 years old for Koreans and under 16 years old for foreigners). If the Company becomes aware that the collected personal data is from a child, we will delete the personal data and close the subject user’s account. If you believe that the Company has collected personal data from a child, please contact privacy@weverseshop.io.

① The Company does not provide the Members’ personal information to third parties without the agreement of the relevant agreement with the Members.
② The Company can provide the personal information for the Members’ service usage by getting the Members’ consent or by other legal means as below.

① Members can login to the Service and view/change their personal data through the MY > MY DATA section; provided, however, their ID (i.e., email) cannot be changed.
② In accordance with the restrictions and requirements under the relevant laws and regulations, the Members may exercise their rights relating to their personal data against the Company. For example, in Korea, a Member may request the Company to suspend its processing of his/her personal data, delete his/her personal data, and/or revoke consent to the Company’s collection/use of his/her personal data.
③ Should there are errors with the information entered, the members can request to correct their information. However, if the information before and after the correction shows that no errors were present at the time of request and if the members committed fraud by making the corrections, the Company will revoke the corrections and notify the reasons immediately.
④ Data subjects may exercise their rights set forth in this Article by contacting support@weverseshop.io or privacy@weverseshop.io

① The company safely disposes of collected personal information without delay, after achieving the purpose, or after the person unsubscribes (when the person apply for withdrawal,  or when the person is forcefully withdrawn). In accordance with the relevant law and to achieve the aim of collecting personal information, the company retains the information for a certain period of time as stipulated below, and then disposes of it safely. 
- Keep the submitted personal information when subscribing to the service for three months after the service withdrawal to prevent fraudulent activities  
- The company retains certain information to adhere to the relevant law.

② Personal information stored in the form of electronic files are deleted in a way that cannot be restored, while personal information stored in the form of prints and physical records are disposed of by shredding or by burning up.
③ The company separately stores personal information of inactive accounts (inactive longer than a year after signing up) in accordance with the Weverse Shop user’s agreement. The personal information stored separately is disposed of after retaining it for four years.   
The company shall notify the inactive subscriber at least 30 days prior to the end of validation date.  Notification contents are as follows:  
- The fact that personal information is disposed of, or the fact that personal information is separately stored and managed
- Date of the disposal
- Content of personal information disposed of

The Company uses cookies to save and occasionally search through data related to Members. Cookies are small text files sent from website servers to the user’s computer browser (e.g., Internet Explorer, Safari, Chrome, Firefox). Cookies identify the computers used by the Members but do not identify the individual Members themselves.
(1) Operation of cookies
① Provide differentiated information depending on the individual’s area of interest.
② Engage in targeted marketing by determining the Members’ preferences and areas of interesting based on an analysis of how often Members and non-Members visited the website and/or used the Service.
③ Provide personalized service to Members on their next visit/use by tracking content that the Members showed an interest in.
④ Use as criteria in deciding whether and how to improve the Service by analyzing the customers’ habits.
(2) Members’ options regarding cookies
By adjusting the web browser, the Members can choose whether to accept all cookies, to be notified when cookies are installed, or deny all cookies; provided, however, if a Member refuses to install cookies, he/she cannot use some of the services that require the Member to log in.
Below are the steps for changing the settings for installation of cookies on Internet Explorer:
① Under the [Tools] menu, select [Internet Options].
② Click the [Privacy] tab.
③ In the [Settings] section in the [Privacy] tab, the user can select the cookies setting by moving the slider. (Moving the slider to the top will block cookies from all websites and moving the slider to the bottom will allow cookies from all websites.)
(3) Cookies will expire once the user closes the browser or logs out of the browser.

(1) In processing personal data, the Company may take reasonable safety measures to ensure that personal data is not lost, stolen, leaked, altered, or damaged. The Company may use the following technical measures for such purpose.
① A Member’s personal data is protected by password and encrypted information. Even with these safety measures, there is still a high possibility that a Member’s password or personal data may be leaked to others if a Member accesses the Internet in a public area or through other means. As such, what is most important is to thoroughly protect the personal data of the Members as much as possible. Therefore, all Members should also be careful not to leak or provide their personal data to others, and take responsibility in managing their personal data. The Company is not responsible for problems that may arise from the Member’s own negligence or the inherent dangers of using the internet.
② Fundamentally, the Members’ personal data is protected by password and encrypted information. Files and transferred data are encrypted and important data is protected by separate security features.
③ The Company uses anti-virus software to prevent damages that arise from computer viruses and regularly updates the software.
④ To prevent leakage or damage of Members’ personal data from hackings, computer viruses, and other sources of intrusion, the Company maintains a 24-hour intrusion detection and intrusion prevention system that monitors possible threats from outside sources.
(2) The Company recognizes the importance of protecting personal data, so we limit the number of employees who process personal data to only those that are necessary. The Chief Privacy Officer (CPO) regularly educates/trains these employees to ensure the protection of the Members’ personal data. Also, the Company regularly reviews the relevant employees’ compliance with the provisions of this Privacy Policy, and where a violation is found, the Company orders the employees to correct/improve the violation and take any other necessary measures.

The Company operates a customer service center in order to facilitate communications with Members regarding any feedback or complaints they may have regarding the protection of their personal data.
In Korea, if a dispute arises between the Member and the Company with respect to personal data-related matters, the Member may contact any one of the following agencies and seek consultation regarding a possible privacy violation.

Korea Internet & Security Agency	http://privacy.kisa.or.kr	118
Personal Information Dispute Mediation Committee	http://www.kopico.go.kr	1833-6972
Cyber Criminal Investigation, Supreme Prosecutor’s Office	http://www.spo.go.kr	1303
Cyber Terror Response Center of the National Police Agency	http://cyber.go.kr	182

The Company has designated a Chief Privacy Officer as below, and the Company’s internal department responsible for managing matters related to the processing of personal data always puts forth its best efforts to protect your valued personal data.
Any Member who has any questions, comments, or complaints relating to his/her personal data, please reach out to one of the contacts listed below through email or by phone. The Company will make every effort to respond promptly and with sincerity.

Chief Privacy Officer
Name	Ryeo Sung Koo
Phone Number	1544-0790
Email	privacy@weverseshop.io

Department responsible for processing complaints
Name of Department	Commerce Business Department
Phone Number	1544-0790
Email	privacy@weverseshop.io

In order to provide the Service to the Members, carry out the Service agreements entered into with the Members, and promote the convenience of the Members, the Company outsources the processing of the Members’ personal data to Korean and foreign third-party service providers (“Outsourced Processors”) or platforms specializing in data processing when necessary and within the scope disclosed under this Privacy Policy.

When entering into an outsourcing agreement with an Outsourced Processor, the Company makes sure that the following provisions are included in the agreement: prohibition on processing personal information for purposes outside the initial scope of processing tasks that were outsourced, technical and managerial safeguards, restrictions on subcontracting by the Outsourced Processor, matters relating to the supervision of the Outsourced Processor, and liability for damages that may arise out of a violation of the Outsourced Processor’s obligations. The Company also supervises the Outsourced Processor to ensure that it securely processes the personal data.
If there are any changes to the tasks to be outsourced or the list of Outsourced Processors, they will be reflected in this Privacy Policy without delay.

This Privacy Policy was promulgated on June 3, 2019. Any changes (e.g., addition, deletion or revision) to this Privacy Policy pursuant to amendments in the Company’s or Korean government’s policy will be notified in advance to the Members on the Company’s website. For material changes that may significantly impact the Members’ rights, notice will be given 30 days prior to the scheduled effective date of such changes.
Privacy Policy version number: V2.9
Effective date: 2021.09.08