Privacy Policy

Danal Co., Ltd. (hereinafter referred to as the "Company") values Users' personal information and complies with the Personal Information Protection Act and the relevant laws and regulations.

Through this Privacy Policy, the Company informs Users of the purposes and manner in which the personal information provided by Users is used, and of the measures taken to protect personal information.

Where the Company amends this Privacy Policy, it will give notice thereof through the KONDA app.

1. Purposes of the Collection and Use of Personal Information and Items of Personal Information Collected

1) Purposes of the Collection and Use of Personal Information

The Company processes personal information for the following purposes. The personal information being processed is not used for any purpose other than the following, and where the purpose of use is changed, the Company will take the necessary measures, such as obtaining separate consent.

2) Items of Personal Information Collected

The Company processes the following items of personal information to the minimum extent necessary.

2. Methods of Collecting Personal Information

1) Entered by the User in the mobile application operated by the Company

2) Collected in the course of payment history inquiries and the Company's customer service

3) Generated and collected automatically or manually in the course of the use or processing of the Service

3. Retention and Use Period of Personal Information

The Company retains the following information as set out below, in accordance with the relevant laws and regulations and its internal policies.

1) Retention of personal information under the relevant statutes

① Records concerning contracts or the withdrawal of subscription

- Legal basis for retention: Act on Consumer Protection in Electronic Commerce

- Retention period: 5 years

② Records concerning payment and the supply of goods

- Legal basis for retention: Act on Consumer Protection in Electronic Commerce
- Retention period: 5 years

③ Records concerning electronic financial transactions

- Legal basis for retention: Electronic Financial Transactions Act

- Retention period: 5 years where the transaction amount per transaction exceeds KRW 10,000, and 1 year where the transaction amount per transaction is KRW 10,000 or less

④ Records concerning consumer complaints or dispute handling

- Legal basis for retention: Act on Consumer Protection in Electronic Commerce

- Retention period: 3 years

⑤ App visit records

- Legal basis for retention: Protection of Communications Secrets Act

- Retention period: 3 months

4. Provision of Personal Information to Third Parties and Entrustment

The Company uses Users' personal information within the scope notified in this Privacy Policy, and does not use it beyond that scope or provide Users' personal information to third parties without Users' prior consent. Provided, however, that this shall not apply where personal information must be provided to an investigative agency or a similar body in accordance with the procedures and methods prescribed by statute, pursuant to the relevant laws and regulations or for investigative purposes. The cases in which the Company provides personal information to, and entrusts it with, third parties for the performance of its services are as follows.

Entrustment of Personal Information Processing

5. Procedures and Methods for the Destruction of Personal Information

In principle, the Company destroys personal information without delay once the retention period has elapsed or the purposes of collection and use have been achieved.

1) Methods of destruction

- Personal information stored in the form of electronic files is deleted using technical methods that make the records irreproducible (such as deleting the files and formatting the disk
or other storage media).
- Personal information printed on paper is destroyed by shredding with a shredder or by incineration.

2) Procedures for destruction

- Where personal information must continue to be retained under other statutes even though the retention period consented to by the data subject has elapsed or the purpose of processing has been achieved, such personal information is transferred to a separate database (DB) or retained in a different storage location.

6. Rights of Data Subjects and Legal Representatives and How to Exercise Them

1) Data subjects and legal representatives may at any time request access to, correction and deletion of, and suspension of the processing of, their personal information, and the withdrawal of consent, and the Company shall take the necessary measures without delay. In addition, where a request for correction and deletion, suspension of processing, or withdrawal of consent is made, the Company shall not use the relevant personal information until the correction is made, and where a request for deletion is made, the Company shall destroy it immediately so that it cannot be used for any purpose.

2) Data subjects and legal representatives may request access to, correction and deletion of, and suspension of the processing of, their personal information, and the withdrawal of consent, by contacting the Company's personal information manager in writing, by telephone, or by email, or by visiting the Company. Provided, however, that a request for access to personal information, suspension of processing, or withdrawal of consent may be restricted in the rights of the data subject pursuant to Article 35 (4) and Article 37 (2) of the Personal Information Protection Act, and a request for correction and deletion cannot be made for the deletion of personal information where such personal information is specified as a subject of collection in other statutes.

3) Personal information that has been terminated or deleted at the request of a User or a legal representative is processed by the Company as specified in the retention and use period of the personal information collected by the Company, and is handled so that it cannot be accessed or used for any other purpose.

7. Matters Concerning Access Rights to Information and Functions on Smartphones

1) The Company accesses information and functions on Members' smartphones in order to provide the KONDA app service. The Company provides guidance so that Members can clearly recognize the items accessed upon the initial installation and execution of the application, and obtains their consent thereafter.

2) How to consent to or withdraw consent to smartphone access rights

① Android: Settings → Apps → Permissions → Select consent or withdrawal for each access right (withdrawal is possible only for optional access rights)

② iOS: Settings → Apps → Select consent or withdrawal for each access right

8. Measures to Ensure the Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information.

1) Administrative measures

The Company has established an internal management plan for the safe handling of personal information, ensures that its executives and employees are familiar with and comply with it, and periodically inspects such compliance.

- Designation of personnel responsible for personal information management and personal information protection, such as the privacy officer and personal information protection staff

- Arrangements to ensure compliance with statutes and policies through regular in-house training and externally entrusted training on obligations relating to personal information protection

- Designation of the computer room, data storage room, and similar areas as controlled areas, with access controls in place

- Compliance with security checks for departing employees immediately upon the resignation of a personal information handler, in order to prevent personal information breaches

2) Technical measures

The Company has established the following technical measures to ensure the safety of personal information so that personal information is not lost, stolen, leaked, altered, or damaged when it is handled.

- Application of encrypted storage at the level required by domestic statutes, or of encryption technology (SSL/TLS, etc.) when personal information is transmitted securely over a network

- Measures to prevent damage from computer viruses by using antivirus programs

- In preparation for external intrusions such as hacking, an intrusion prevention system, an intrusion detection system, a denial-of-service (DDoS) prevention system, and similar systems are

applied

- Operation of an access control system to prevent the leakage of internal information from each server and from important databases, and application of personal information searches, encryption, and audit logging of printed output on the PCs of internal executives and employees

3) Physical measures

Locking of the locations where personal information is stored and kept, CCTV, access control systems, and similar measures

9. Matters Concerning the Designation of the Privacy Officer and Guidance on the Handling of User Grievances

1) In order to protect Users' personal information and to handle complaints relating to personal information, the Company designates the relevant department and the privacy officer as set out below. Users may report to the privacy officer or the department in charge any personal information protection grievance arising while using the Company's services. The Company will provide prompt and sufficient responses to Users' reports.

2) Other organizations

If you require a report or consultation concerning personal information infringement, please contact the following organizations.

①Personal Information Dispute Mediation Committee (www.kopico.go.kr) 1833-6972 (no area code)

②Personal Information Infringement Report Center (privacy.kisa.or.kr) 118 (no area code)

③Supreme Prosecutors' Office (www.spo.go.kr) 1301 (no area code)

④National Police Agency (ecrm.police.go.kr) 182 (no area code)

10. Matters Concerning Changes to the Privacy Policy

This Privacy Policy shall apply from December 10, 2025.