Privacy Policy

1. Personal data we collect

The Company collects the minimum data necessary for sign-up, service delivery and payment. We do not collect mobile phone numbers.

1. Email sign-up: email address and password (stored one-way hashed; the Company cannot read the original password).

2. Social login (Kakao / Google): the profile information each provider returns on authentication (a unique identifier, nickname, and email address where provided). Kakao login may not provide an email depending on the user's consent scope.

3. Paid pass payment: payment approval result and transaction identifiers. Card and other payment-method details are entered on the payment provider's (Toss Payments) own screen and are not stored on the Company's servers.

4. Automatically generated data: access logs, browser/device information, IP address, cookies, and service-usage records (keywords viewed, tracked items, and the like).

2. Purposes of collection and use

The Company uses collected personal data only for the following purposes.

• Member identification, login and account management
• Providing and personalizing the Coupang public-data analytics service
• Processing paid-pass payments, managing pass periods and related notices
• Responding to inquiries and delivering announcements
• Preventing misuse, ensuring service stability, and improving the service through statistical analysis

3. Retention and use period

In principle the Company destroys personal data without delay once its purpose is achieved or the user requests withdrawal. Where retention is required by law, data is kept for the periods below.

• Member information: until the member withdraws
• Records on contracts and withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on payment and supply of goods: 5 years (same Act)
• Records on consumer complaints and dispute handling: 3 years (same Act)
• Login/access records: 3 months (Protection of Communications Secrets Act)

4. Provision to third parties

The Company does not provide or sell users' personal data to third parties beyond the purposes stated in this Policy, except with the user's prior consent or where required by law or by a lawful request from an investigative authority.

5. Entrustment of processing

To operate the service the Company entrusts personal-data processing as follows, and requires that entrusted data be handled securely.

• Toss Payments Co., Ltd. — processing of paid-pass payments and cancellations/refunds
• Vultr Holdings Corporation — service server operation and data storage (overseas cloud infrastructure)

6. Users' rights and how to exercise them

Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal data, via the privacy officer or the contact below. The Company acts without delay. Where a correction is requested, the Company does not use or provide the data until the correction is complete.

7. Destruction procedure

When personal data becomes unnecessary, the Company destroys it without delay: electronic files are deleted by a technical method that prevents recovery, and paper records are shredded or incinerated.

8. Cookies and how to refuse them

The Company uses cookies to maintain login sessions and analyze service use. Users may refuse cookie storage in their browser settings, in which case some features that require login may be limited.

9. Security measures

The Company applies administrative and technical safeguards including one-way hashing of passwords, minimization and control of access rights, and transport encryption (HTTPS).

10. Children under 14

The service is intended for users aged 14 and over and does not accept sign-ups from children under 14. If an account is found to belong to a child under 14, the Company deletes it and its data without delay.

11. Privacy officer

The Company designates the following privacy officer to oversee personal-data processing and to handle user complaints and remedies.

Privacy officer: Gu Nam-won

Contact (email): contact@mallbiseo.kr

12. Remedies for infringement

Users may contact the following bodies for dispute resolution or consultation regarding privacy infringement.

Personal Information Dispute Mediation Committee (privacy.go.kr / 1833-6972)

Privacy Infringement Report Center, KISA (privacy.kisa.or.kr / 118)

13. Changes to this Policy

This Policy applies from its effective date. Any additions, deletions or corrections will be announced within the service at least 7 days before they take effect.