Privacy Policy

Article 1. Purposes of processing personal information

Modoo Designer Corp. (the Company) complies with the Act on Promotion of Information and Communications Network Utilization and Information Protection and the Personal Information Protection Act. This policy protects users' personal information and rights and supports the resolution of privacy complaints. Revisions are announced on the website or individually.

The Company endeavors to keep personal information safe and prevent infringement of users' rights. Information is used for membership registration, customer consultation and paid services. This policy transparently explains what is collected, how it is used, with whom it is shared through processing delegation or provision, and when and how it is destroyed after its purpose has been achieved. Changes, including service-term changes or additional information collection, are explained through website notices or individual email notices.

Article 2. Information collected and collection methods

For membership registration and service provision, the minimum required information collected at initial registration is email address, name and password. Optional information includes profile photo, company or organization name and size, industry, department, user type (individual, business or organization), region, phone number and field values.

Additional transaction information may include date of birth for recurring payments, credit-card information (card number, expiry date and first two password digits), and accounting-contact details for tax invoices (name, phone and email). Service and consultation information may include the inquirer's name, email and phone, phone numbers, IP address, cookies, visit times, service-use records, improper-use records, browser, operating system, device and MAC address.

Information is collected through the website, written forms, telephone, email, event entries, fax, consultation tools and provision by partners.

Article 3. Collection and use purposes

1. Membership administration: service provision and improvement, identification, restricting members who breach the terms, preventing interference and misuse, confirming registration intent and limiting registrations or registration counts, confirming a legal representative's consent when collecting information about children under 14 and subsequently verifying that representative, preserving dispute-resolution records, handling complaints, delivering notices and confirming withdrawal intent.

2. New services, marketing and advertising: developing new and personalized services, providing services and advertisements by demographic characteristics, checking service effectiveness, providing information and participation opportunities for Company and affiliated events, providing advertising information, identifying access frequency and analyzing service-use statistics.

3. Performance of service contracts and settlement of paid-service charges: paid and customized services, billing, purchases and payment, identity verification, shipment of goods or invoices, and collection of charges.

4. Legal evidence: providing evidence in legal disputes.

Article 4. Consent to collection

During registration, users are given an opportunity to review the privacy policy fully and to register after agreeing. Members who complete registration are regarded as consenting to the collection procedures and purposes above. SMS opt-in is a separate, optional, unchecked consent and is not inferred from account creation or acceptance of general terms.

Article 5. Retention and use periods

Personal information is processed and retained within the period prescribed by law or agreed to by the data subject at collection.

1. Contract and withdrawal records: 5 years. 2. Payment and supply-of-goods records: 5 years. 3. Consumer complaints and dispute records: 3 years. 4. Display and advertising records: 6 months. These periods are specified in Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce. 5. Website visit records: 3 months under Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act.

6. Even without a specific statutory basis, information may be retained to prevent substantial Company loss or for crime investigations or litigation, limited to the minimum necessary items and period. This includes identifying information to prevent re-registration after withdrawal or to refuse transactions after unavoidable expulsion under the terms.

7. Under the personal information validity-period rule, information about members who have not used the service for one year is segregated or destroyed. Segregated information is destroyed without delay after four years. At least 30 days before the one-year period expires, the member is notified by email of segregation or destruction, the expiry date and the information affected.

Article 6. Destruction procedures and methods

In principle, information is destroyed without delay once its purpose has been achieved. Information entered by a user is moved to a separate database, or separate documents for paper records, and stored for the period required by internal policy and relevant law or destroyed immediately. Information moved to that database is not used for other purposes except as required by law.

Electronic files are destroyed using technical methods that prevent recovery. Printed personal information is shredded or incinerated.

Article 7. Provision of personal information

In principle, personal information is not provided externally. Exceptions are: prior user consent; statistics, academic research or market research in a form that cannot identify a particular person; business transfers or mergers, with advance notice and a right to withdraw transfer consent following legal procedures; and statutory requirements or requests by investigating authorities.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of use and provision described in this policy and will not be shared with any third party, except the messaging providers that deliver our text messages.

Article 8. Delegated processing

1. Processing is delegated for efficient operations: Amazon Web Services (AWS) for cloud IT infrastructure and PayApp Co., Ltd. for credit-card payment services. Other delegated activities include simple payments, customer consultation, electronic contracts, email sending, gift-coupon sending and user-customized advertising. Mobile phone numbers and SMS opt-in data are never provided for advertising.

Phone numbers and message contents needed to deliver verification codes and QR safety notifications are provided to domestic delivery processor Aligo or international processor Telnyx. SMS consent information is not provided for a processor's advertising or marketing.

2. Under Article 26 of the Personal Information Protection Act, written processing contracts specify prohibition of processing outside the delegated purpose, technical and administrative safeguards, subprocessing restrictions, processor management and supervision, and liability including damages. The Company supervises safe processing.

3. Changes to the delegated work or processor are disclosed without delay through this policy.

Article 9. Rights of users and legal representatives

1. Users and legal representatives can view or amend their own information or that of a child under 14, and request termination. Withdrawal emails sent to customer support are processed after identity verification.

2. Information terminated or deleted at the request of a user or legal representative is processed according to Article 5 and cannot be viewed or used for other purposes.

3. A representative exercising these rights must submit the power-of-attorney form prescribed by Annex Form 11 of the Enforcement Rules of the Personal Information Protection Act.

4. Access and suspension-of-processing requests may be restricted under Articles 35(5) and 37(2) of that Act. Deletion cannot be requested where another law expressly requires the information to be collected.

Article 10. Cookies and refusal

Modoo Designer Corp. uses cookies to store and retrieve usage information for personalized services. Cookies are small information sent by an HTTP server to the user's browser and may be stored on the computer's hard disk.

1. Cookies are used to understand visits and use patterns across services and sites, popular search terms and secure connections, and provide optimized information. 2. Users may refuse cookie storage through their browser's privacy settings. 3. Refusing cookies may make service use difficult.

Article 11. Security measures

Under Article 29 of the Personal Information Protection Act, technical, administrative and physical measures include:

1. Minimizing and training staff handling personal information: designated personnel are limited to those needing access. 2. Measures against hacking and viruses: security software is installed, updated and checked; systems are installed in access-controlled areas and technically and physically monitored and protected. 3. Encryption: passwords are stored and managed in encrypted form, and important files and transmitted data use encryption or separate safeguards such as file locks. 4. Access restrictions: database permissions are granted, changed and revoked to control access, and intrusion-blocking systems restrict unauthorized external access.

Article 12. Notice of changes

The policy applies from its effective date. Additions, deletions or corrections resulting from law or policy changes are announced at least seven days before they take effect.

Article 13. Privacy officer and contact

The Company appoints a privacy officer responsible for processing, complaints and damage relief. Responsible department: Customer Support Team. Email: modoodesigner.cs@gmail.com. Privacy officer: Hwimin Jeon (전휘민). Telephone: +82 32-710-2587. Email: modoodesigner.cs@gmail.com.

Members can contact the privacy officer or responsible department for any privacy inquiries, complaints or damage relief arising while using the Company's services.

Other reporting and consultation agencies: Privacy Infringement Report Center, https://privacy.kisa.or.kr/kor/main.jsp, 118 in Korea; Supreme Prosecutors' Office Internet Crime Investigation Center, http://www.spo.go.kr, +82 2-3480-2000; National Police Cyber Safety Bureau, http://cyberbureau.police.go.kr, 182 in Korea.

Effective date: September 1, 2022. Last updated: September 30, 2026 (SMS program and English version).