SMTOWN

Article 1 (Personal Information Collected)

SM Entertainment Co., Ltd. (hereafter referred to as the "Company") collects the following personal information for membership registration, consultation, and service application.

1. ①Collected information
   1. 1.Information collected during membership registration: Name, ID, password, email address
   2. 2.Information collected during service use: Service usage records, access logs, cookies, IP information, device identification number (device ID), push tokens
   3. ※The above information about the device is in a format that cannot identify individuals, and the Company does not engage in activities that identify individuals based on the information collected.
2. ②Collection methods
   1. 1.Users consent to personal information collection and personally provide such information during membership registration and service use
   2. 2.Users provide personal information during consultation with the customer center, using a webpage, email, fax, phone, etc.
   3. 3.Users consent to personal information collection and personally provide such information for audition applications

Article 2 (Purpose of Collecting and Using Personal Information)

The company uses the personal information collected for the following purposes.

1. ①Performance of Service Contracts: Providing content, sending event gifts, etc.
2. ②Membership Management: Identity verification and personal identification for membership service usage, prevention of unlawful and unauthorized use by malicious users, confirmation of membership registration intentions, confirmation of age over 14, handling of complaints, delivery of announcements, and management of integrated IDs
3. ③Use for Marketing and Advertisement: Development and specialization of new service (product), delivery of advertisement information such as events, provision of service and posting of advertisement pursuant to demographical characteristics, identification of access frequency, and statistics on members’ use of services
4. ④Support for users’ audition applications

Article 3 (Retention and Usage Period of Personal Information)

In general, the Company destroys personal information without delay when the retention period has expired or when the information is no longer necessary, such as when the original purpose for collecting and using the information has been fulfilled. Nonetheless, if it is necessary to preserve information in accordance with the provisions of the applicable laws, the Company must retain the member information for a specific period of time as specified by the applicable laws and regulations.

1. ①Items to retain: ID (email address), name, password, service usage records, access logs, cookies, IP information, member number
2. ②Basis for retention: Act on the Consumer Protection in Electronic Commerce
3. ③Retention period: 3 years
   1. 1.Display / Advertising Records: 6 months (Act on the Consumer Protection in Electronic Commerce)
   2. 2.Record of contract or withdrawal of contract: 5 years (Act on the Consumer Protection in Electronic Commerce)
   3. 3.Record of payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
   4. 4.Records of consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce)
   5. 5.Records of collecting, processing, and using credit information: 3 years (Credit Information Use and Protection Act)

Article 4 (Procedures and Methods for Destruction of Personal Information)

The following is the procedure and method for destroying personal information.

1. ①procedure for destruction
   1. 1.After the purpose is achieved, the information entered by the Member for membership registration, etc. is transferred to a separate database (DB) or a separate filing cabinet in the case of paper, and stored for a period of time before being destroyed in accordance with Company guidelines and relevant laws and regulations.
   2. 2.Unless otherwise required by law, personal information transferred to a separate database will not be used for any other purpose than to be kept.
2. ②Methods of Destruction
   1. 1.Electronically stored personal information is deleted using a technical method that prevents the record from being reproduced.
   2. 2.Personal information printed on paper is shredded or incinerated.

Article 5 (Entrustment of Collected Personal Information)

1. ①For the smooth operation of the business, such as providing better services and facilitating customer convenience, the Company entrusts the following personal information handling tasks to an external professional company. During the contract period, the entrusted company keeps the Member's personal information. However, when the relevant laws specify a statutory retention period, the company keeps the Member's personal information for that time period.
2. ②The Company ensures, through the entrustment contract, that the entrusted company complies with personal information protection laws, keeps personal information confidential, does not provide information to third parties, accepts responsibility for accidents, and returns or destroys personal information after the entrustment period or after handling the information.
3. ③The service provider who has been entrusted with personal information

   ※ Depending on the change in service and the contract period, the entrusted company may change. When there is a change in the service, the company will notify Members in advance.

   1. 1.Domestic entrusted companies

      Name of entrusted company	Megazone Cloud Co., Ltd.
      Entrusted work and the purpose of entrustment	Operation of AWS services

      Name of entrusted company	Hyosung ITX Co., Ltd.
      Entrusted work and the purpose of entrustment	Support for ‘KWANGYA 119’ reporting and tipping off operations

   2. 2.Overseas entrusted companies

      Name of entrusted company	Amazon Web Service
      Entrusted work and the purpose of entrustment	System management through AWS
      Contact information of the entrusted company	Aws-korea-blog@amazon.com
      The country to which personal information is transferred	Japan (AWS Tokyo Region)
      Items of personal information to be transferred	All personal information collected in the process of providing services
      Date of personal information transfer	Date of membership registration
      Method of personal information transfer	Storage of personal information in AWS cloud computing environment

      Name of entrusted company	SENDGRID
      Entrusted work and the purpose of entrustment	Sending emails for membership registration and password reset
      Contact information of the entrusted company	datasubjectrequests@sendgrid.com
      The country to which personal information is transferred	United States
      Items of personal information to be transferred	Name, email
      Date of personal information transfer	Date of membership registration
      Method of personal information transfer	Sent via network with each service use

Article 6 (Provision of Personal Information to Third Parties)

1. ①The Company processes users' personal information only within the scope specified in the purpose of processing personal information, and only transmits personal information to a third party for cases under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the user and special provisions of the law. Otherwise, the Company does not provide personal information of users to a third party.
2. ②order to provide smooth service in the following cases, the Company discloses personal information to third parties only to the extent necessary with the user's consent.

   Recipient of the information	Purpose of providing the information	Items of information provided	Duration of storage and utilization
   SM BRAND MARKETING Co., Ltd.	Membership verification associated with the sale of exclusive items to members	Name, ID	Until membership cancellation

3. ③In emergency situations such as natural disasters, infectious diseases, events/accidents that pose an imminent threat to life or body, and imminent property loss, the Company must provide personal information to relevant organizations without the consent of the subject of information, in accordance with the personal information handling and protection rules for emergencies jointly announced by the relevant government departments. Please click here* for additional details.

Article 7 (Matters Concerning the Installation, Operation, and Rejection of Automatic Collection of Personal Information)

The Company employs "cookies" that frequently store and retrieve user data. The server used to operate the Company's website stores the cookie as a text file on the user's computer's hard drive. The Company employs cookies for the purposes outlined below.

1. ① Objective of using cookies
   1. 1.Targeted marketing and personalized services are provided by analyzing the access frequency and visit time of members and non-members, identifying users' tastes and interests and tracking their traces, and determining the level of participation in various events and the number of visits, etc.
   2. 2.Users have the option of installing cookies. The user can therefore configure their web browser to accept all cookies, check each time a cookie is saved, or reject all cookies.
2. ②Methods to disable cookie settings
   1. 1.A user can accept all cookies by selecting the web browser's option, check each cookie before saving it, or reject all cookies.
   2. 2.Methods to disable cookie settings
      1. -Internet Explorer users: [Tools] > [Internet options] > [Privacy] > [Settings]
      2. -Chrome users: [Settings] > [Show advanced settings] > [Privacy and security] > [Cookies and other site data]
   3. 3.If a user declines to accept cookies, it may be difficult to provide services.

Article 8 (Measures for Personal Information)

1. ①The Company develops and implements an internal management plan for the secure handling of personal data, as well as providing training.
2. ②When it comes to users' personal information, the company takes technical precautions to ensure that it is not lost, stolen, leaked, altered, or damaged.
3. ③Personal information is managed on an internal network that cannot be accessed or infiltrated from the outside. Important information is safeguarded using a separate security function that encrypts files and transmits data or employs a file lock function.
4. ④The Company is making every effort to secure the in-house network by using a firewall and an intrusion detection system for each server, as well as strengthening security by installing an access control system, in preparation for external intrusions such as hacking.
5. ⑤The Company protects personal information by installing a vaccine program that allows the personal information processing system and the personal information handler to continuously check for malicious programs such as computer viruses and spyware that have infiltrated the information devices used for personal information processing and to take the necessary precautions.
6. ⑥The Company limits the number of people who have access to a user's personal information to a bare minimum. The Company prepares internal procedures for access and management of personal information, implements access control and device lock, and ensures that employees are aware of and follow the procedures to ensure the safety of personal information.
7. ⑦The handover of tasks to personal information handlers is done in a secure manner. Even when employees join or leave the Company, their responsibilities for personal information mishaps are clarified.
8. ⑧Users are responsible for maintaining accurate information by verifying and managing the personal information they provide to the company. If a user uses another person's personal information without permission or infringes on another person's rights while using the Internet site, the user may face civil and criminal penalties as well as company sanctions.
9. ⑨The Company is not liable for any issues arising from the loss of personal information such as an ID, password, or resident registration number as a result of the user's negligence or Internet problems. As a result, each user must carefully manage his or her ID and password in order to protect his or her personal information and assume responsibility for its management. However, if the user's personal information is lost, leaked, altered, or damaged as a result of a company internal manager's mistake or a technical management accident, the Company will immediately notify the user and take appropriate measures and compensation.

Article 9 (Additional Use and Provision of Information)

1. ①In accordance with paragraph 3 of Article 15 and paragraph 4 of article 17 of the Personal Information Protection Act, the Company may use and disclose personal information without the user's consent for the purposes of Article 14-2 of the Enforcement Decree of the Personal Information Protection Act.
2. ②The Company considers the following factors when deciding on the additional use and disclosure of personal data without the user's consent.
   1. 1.Whether the additional use and disclosure of personal information is related to the initial purpose of collection
   2. 2.Whether additional use or disclosure of personal information is predictable in light of the circumstances under which the information was collected or established practices for handling the information.
   3. 3.Whether the additional use or disclosure of personal information violates the interests of users in an unreasonable manner
   4. 4.Whether necessary safety measures, such as pseudonymization or encryption, have been implemented

Article 10 (Obligation to Notify when Changing Privacy Policy)

1. ①In the event of additions, deletions, or other revisions to the content of this privacy policy in accordance with government policy or company policy, the company will make an announcement of such changes on the first page of the service website of the service at least 7 days in advance. As for changes that are disadvantageous to users, the company will make announcements to users with a period of at least 30 days in advance, and ensure that the differences before and after the revision are clearly presented and easily understood by users.
2. ②This policy goes into effect on October 4, 2023.
   1. -Announcement date: September 19, 2023
   2. -Effective date: October 4, 2023
3. ③The previous privacy policies are available for review below.
   1. -Effective between April 22, 2019 and May 31, 2021
   2. -Effective between May 31, 2021 and June 19, 2022
   3. -Effective between June 20, 2022 and October 3, 2023

Article 11 (Complaint handling service related to personal information)

1. ①The Company has designated the following department and a chief privacy officer in order to protect the personal information of customers and respond to complaints involving such information.
   1. -Name of Chief Privacy Officer: Choi Byung-beom
   2. -Telephone: 02-6240-9800
   3. -email: privacy@stown.com
2. ②Users can report any complaints regarding the protection of personal information that occur while using the Company's services to the chief privacy officer or the responsible department. The Company will respond promptly and adequately to user reports.
   Users are encouraged to contact the following organizations to report or seek advice on other personal information violations.
   1. 1.Personal Information Dispute Mediation Committee (http://www.kopico.go.kr/ Tel: 1833-6972 without area code)
   2. 2.Personal Information Infringement Report Center (http://privacy.kisa.or.kr, 118 without area code)
   3. 3.Information Protection Mark Certification Committee (www.eprivacy.or.kr, 02-550-9531 to 2)
   4. 4.Korean National Police Agency Cyber Bureau (www.ctrc.go.kr, 02-3150-2659)
3. ③A person whose rights or interests have been violated by the disposition or omission of the head of a public institution with regard to requests made under Article 35 (viewing of personal information), Article 36 (correction / deletion of personal information), and Article 37 (suspension of processing of personal information, etc.) of the Personal Information Protection Act may request an administrative appeal pursuant to the provisions of the Administrative Appeals Act.
   1. ‣Central Administrative Appeals Commission: (without area code) 110 (www.simpan.go.kr)