Privacy Policy

This translation is provided for convenience. If it conflicts with the Korean version, the Korean version prevails.

Announcement date: September 6, 2026

Effective date: September 6, 2026

Trust (TRUST) (hereinafter referred to as “Company”) values ​​users’ personal information while providing Cochika (Coachka) and its accompanying website, mobile application, content, community, subscription, payment, settlement and related services (hereinafter referred to as “Services”).

The company complies with relevant laws and regulations such as the Personal Information Protection Act, and discloses the following information: for what purposes personal information is collected and used, to whom it is provided or entrusted with processing, how long it is stored for, and what rights users can exercise.

Article 1 Scope of Application

1. This privacy policy applies to all users, including members and non-members, who use the service or inquire about the company.
2. If a user provides personal information directly by moving from the service to another member's external link or to a site or service of a third party independent of the company, the third party's personal information processing policy will apply.
3. If the company provides separate information on personal information processing for a specific event, creator settlement, identity verification, or other functions, such information and this personal information processing policy will be applied together.
4. If the Company provides a translated version of this Privacy Policy, the translated version is for the convenience of users. If the contents of the Korean version and the translated version are different, the Korean version takes precedence. However, if the laws in force in the user's country of residence provide otherwise, such laws will be followed.

Article 2 Personal information processing principles

1. The company processes only the minimum amount of personal information necessary to provide services.
2. The company processes personal information for a specific purpose and scope that users can foresee, and if the purpose of processing changes, separate consent is obtained or necessary information is provided in accordance with relevant laws and regulations.
3. The company provides guidance and obtains consent for each of the following matters.
   1. Personal information required for conclusion and implementation of service use agreement
   2. Personal information provided optionally
   3. Personal information for receiving advertising information and marketing
   4. Personal information required to be provided to third parties
   5. Personal information in cases where separate consent is required before transferring personal information overseas
4. Users may not agree to providing optional information or receiving marketing, and the company will not restrict use of basic services just because they did not agree to providing optional information.
5. When a member discloses his or her profile or member content, that information may be provided to other users according to the disclosure scope set by the member.
6. When the company processes personal information based on legitimate interests, it comprehensively reviews the legitimacy of the purpose of processing, necessity of processing, reasonable expectations of users, impact on users, and personal information protection measures.

Article 3 Purpose of processing personal information

The company processes personal information for the following purposes:

1. Sign up, login, age verification and account management
2. Identification of members, creators, and subscribers and confirmation of service use eligibility
3. Provides profile, post, comment, reaction, follow, message and event functions
4. Content search, classification, recommendation, automatic translation, subtitles and device-specific optimization
5. Processing of purchase, cancellation, and refund of subscription products, one-time paid content, and subscription payments
6. Subscription creator application, identity verification, settlement and tax processing
7. Confirmation of legal representative consent and settlement eligibility for minor creators
8. Service notifications, notification of important matters related to payment, subscription, and account
9. User inquiries, exercise of rights, complaints and dispute handling
10. Detection of illegal/illegal use, account theft, fraudulent payment, spam, and security threats
11. Post reporting, blocking, age restrictions, content management and objection handling
12. Measure service quality, analyze errors, and improve functionality
13. Advertising information and event information to which the user has separately consented
14. Fulfillment of obligations under relevant laws and response to investigations, trials, and disputes

Article 4 Items of personal information processed, legal basis and retention period

1. Membership registration, login and account management

The company may process the following personal information for membership registration and account management.

processing items

• Member identification number
• [Email address or other login identifier you actually use]
• [One-way encrypted password]
• nickname
• [Confirmation value for date of birth, age range, or age 14 or older]
• Country/Region
• preferred language
• Registration date and time
• History of consent and withdrawal related to terms and conditions and personal information processing
• Login date and login success/failure record
• Account status and usage restriction history

Basis for processing

• Entering into and performing the service agreement under Article 15(1)(4) of the Personal Information Protection Act
• The company's legitimate interests include protecting accounts and preventing fraudulent use.

Retention period

• Until membership withdrawal or account deletion
• However, information that has a preservation obligation under relevant laws or is required to investigate disputes or misuse is stored separately for a separately determined period.

2. Social login

If a member selects social login, the company processes only the minimum amount of personal information required for login among the personal information provided by the social login provider.

processing items

• Social Login Business Name
• User identification value issued by social login provider
• [email address]
• [name or nickname]
• Social login link/disconnection date and time

The items actually provided to the company will be announced separately on the social login selection screen and consent screen.

Basis for processing

• Conclusion and implementation of service use agreement according to the login method selected by the user

Retention period

• Until social login linking is canceled or membership is cancelled.
• However, even if you disable social login linking, your account may be maintained if you register another login method.

3. Profile and creator information

processing items

• Nickname or activity name
• profile image
• Self-introduction
• Creator activity categories
• portfolio
• Links to external websites and social media
• Country/region and language used
• Disclosure scope set by the member
• Creator or Subscription Creator Status

Basis for processing

• Implementation of service use agreement to provide profile and creator activity functions

Retention period

• Until the member deletes the information or withdraws membership.
• In order to maintain service context after withdrawal, comments and joint creations that remain may be anonymized so that the author cannot be identified.

4. Member content and community usage information

processing items

• Text, photos, drawings, videos, sound sources
• About comments, reactions, follows and shares
• Links, translations, subtitles, event information
• Date and time of creation, modification, and deletion of posts
• Post visibility
• File format, size, and technical metadata of the content
• Report/block
• Provision and viewing history of subscription content and subscription benefits

Basis for processing

• Providing services requested by users, such as posting, saving, transmitting, disclosing, searching, and recommending
• The company's legitimate interest is to prevent copyright infringement, illegal content, and service abuse.

Retention period

• Until the member deletes the content or cancels membership
• The following information may be kept separately to the extent necessary:
  1. Materials that have a duty of preservation under the law
  2. Materials for which rights infringement reports or disputes are in progress
  3. Data preserved in accordance with lawful requests from investigation/trial and related agencies
  4. Backup data maintained for a certain period of time
  5. Data created separately by being legitimately shared and cited by other members
  6. Materials that require anonymization because they are included in joint creations or posts by other members

5. Private messages

If the Company provides member-to-member messaging functionality, we process the following information:

processing items

• Member identification numbers of sender and receiver
• Message content and attachments
• Sending/receiving date and time
• Read or not
• Report/block

Basis for processing

• Provide message service requested by member
• Our legitimate interest in preventing spam, harassment, fraud and illegal activity

Retention period

• [Enter a specific period of time based on your message deletion and retention policy]
• Messages that have been reported or disputed can be kept until [3 years] after the incident has been processed.
• Even if one member deletes a message, messages held by the other member may not be automatically deleted.

In principle, private messages are not disclosed to other users. However, it may be checked to the extent necessary by authorized personnel to investigate user reports, legal obligations, urgent safety risks, or service security violations.

6. Search, recommendation, automatic translation, subtitles and classification

processing items

• Content view, search, click and play history
• Follow, reaction, comment, subscription, hiding and reporting history
• Category of interest
• Content title, body, tags, and classification information
• Language used and country/region
• Device type and app version
• Original text requesting automatic translation or subtitle creation
• Automatically generated translations or subtitles

Basis for processing

• Implementation of service use agreements such as search, recommendation, translation, etc.
• The company's legitimate interest is to improve users' convenience in using services and content discovery.

Retention period

• Recommendation/search usage records that can identify individuals: [Last 12 months recommended, actual period confirmed]
• Translation/subtitle input data and results: until the original content or translation results are deleted or [Retention period of external translation business]
• Information that has been statistically processed so that it does not identify individuals can continue to be used in a form that does not constitute personal information.

7. Event registration and participation

If the company provides event registration/application/participation functions, the following information may be processed.

processing items

• Member identification number and nickname
• Profile information for event registrants or organizers
• Event name, date, location and details
• [Actual application items such as participant name, contact information, application details, attendance status, etc.]
• In case of payment event, order/payment/refund information

Basis for processing

• Providing event registration/application/participation services
• When transferring personal information to an external organizer, separate consent or basis for relevant laws and regulations

Retention period

• After the event ends [3 months]
• Contract and payment records for paid events are retained until the retention period stipulated by relevant laws and regulations.
• If a dispute arises, until the dispute is resolved.

8. Payment for subscriptions, paid content and support

processing items

• Member identification number
• Purchased products and creator information
• Order number and transaction number
• Payment amount, currency and tax information
• Payment date and time
• Type of payment method
• App market or PG company approval/receipt identification information
• Subscription start date, renewal date, end date and status
• Payment cancellation, refund, subscription withdrawal and chargeback information
• Transaction information required to determine fraudulent payments

The company processes payments through PG companies or app markets, and in principle does not directly store payment method authentication information, such as the entire card number, CVC, and account password. This statement will only be retained if this is the actual payment structure.

Basis for processing

• Conclusion and implementation of paid service contracts
• Obligation to preserve transaction records under e-commerce laws
• The company's legitimate interest is to prevent fraudulent payments and refund abuse.

Retention period

• Records of contracts or subscription withdrawals, etc.: 5 years
• Records of payment and provision of paid services: 5 years
• Records of consumer complaints or dispute resolution: 3 years
• Records of labeling and advertising: 6 months

9. Creator monetization and settlement

If a subscription creator or other monetization member uses the settlement function, the company may process the following information.

processing items

• name
• birth date
• Contact information and email address
• address
• Nationality, country of residence and tax residence
• Identity verification result
• [When using an identity verification agency, verification values ​​such as CI/DI]
• Business registration number and business information
• Bank name, account holder and account number
• Transactions subject to settlement, settlement amount, fees, refund and chargeback information
• Information required for withholding and reporting taxes
• [Payment and tax information required for overseas settlement]

Basis for processing

• Conclusion and implementation of creator/settlement agreement
• Fulfilling legal obligations related to tax, accounting and e-commerce
• The company's legitimate interests to prevent payment method theft, self-payment, and false transactions

Retention period

• After termination of settlement contract and completion of final settlement [5 years]
• Tax and accounting data are stored until the period specified in relevant laws and regulations.
• If a copy of your ID card is temporarily submitted, in principle, it will be deleted without delay after identity verification is completed. However, if storage is required in accordance with relevant laws, the grounds and period will be provided separately.

10. Confirmation of legal representative of minor creator

If a member over the age of 14 but under the age of 19 uses the monetization feature, the following information may be processed.

processing items

• Name, date of birth, and account information of minor members
• Name of legal representative
• Relationships with Minors
• Contact information and e-mail address of legal representative
• Result of identity verification by legal representative
• Consent form and date of consent
• Depositor and relationship confirmation data for settlement account

Basis for processing

• Monetization contract and settlement procedure for minors
• Consent of legal representative
• Protection of minors and fulfillment of contract-related obligations under relevant laws and regulations

Retention period

• [5 years] after termination of monetization contract
• If a dispute is ongoing, until the dispute ends.

11. Handling customer inquiries, exercising rights, and disputes

processing items

• Member identification number
• Full name or nickname
• Email address and contact information
• Inquiry/report/right exercise details
• attachment
• Consultation and response history
• Personal or agent verification data

Basis for processing

• Processing inquiries and complaints according to user requests
• Performance of service agreement
• Fulfillment of the company's legal obligations and response to disputes

Retention period

• General inquiries: [1 year] after completion of processing
• Consumer complaint or dispute resolution record: 3 years
• Personal information rights exercise record: [3 years] after processing is completed
• Ongoing disputes will continue until the end.

12. Reporting, blocking, content management and use restrictions

processing items

• Member identification information of the reporter and the person to be reported
• Reason for reporting and contents of report
• Posts, comments, messages and attachments subject to reporting
• blocking relationship
• Automatic detection results
• Result of staff review
• History of warnings, post restrictions, account suspensions, and monetization restrictions
• Member objections and submitted materials

Basis for processing

• Implementation of service use agreement and community operation policy
• The company's legitimate interests include protecting members, victims, and minors and preventing illegal activities.
• Obligations to prevent illegal information distribution and preserve data in accordance with relevant laws and regulations

Retention period

• After completion of report, sanctions and objection processing [3 years]
• Minimum identification information to prevent repeated subscriptions that circumvent permanent account usage restrictions: [Confirmation of retention and period]
• If an investigation, trial or dispute is in progress, until the end of such proceedings.

13. Information automatically generated and collected

The following information may be automatically generated or collected in the process of using the service.

• IP address
• Connection date and time
• session identifier
• cookie
• Device type and model
• Operating system and version
• Browser type and version
• app version
• Device/app language
• Screen size and time zone
• Access, usage, clicks, searches, and playback records
• Error and crash logs
• push notification token
• Abnormal access and security event recording
• [Advertising identifier if we operate advertising features]

Basis for processing

• Service provision and failure response
• The Company's legitimate interests include account protection, security, and prevention of fraudulent use.
• Provides recommendation and analysis functions
• When using for customized advertising, separate consent or basis for relevant laws and regulations

Retention period

• Service usage and analysis records: [12 months]
• Error/crash log: [12 months]
• Security event log: [3 years]
• Push token: until you delete the app, turn off notifications, log out, or delete your account.
• Advertising identifier: Until advertising consent is withdrawn or identifier is reset.

14. Information processed with separate consent

The company obtains separate consent for the following information if necessary.

Users can withdraw their optional consent at any time. The effect of withdrawal will not be retroactive to matters legally processed before withdrawal of consent.

Article 5 Personal information collection method

The company collects personal information through the following methods.

1. Sign up, log in and enter profile
2. Posting, comments, messages, and events during service usage
3. Purchase, subscription, refund, and settlement application
4. Provided by social login providers
5. Provision of transaction information from app markets, PG companies, and payment providers
6. Provision of verification results from identity verification, age verification, and settlement business operators
7. Customer center inquiries, reports, and exercise of rights
8. Rights infringement reports or damage reports submitted by other users
9. Cookies, SDK, logs and other automatic collection technologies
10. Offline or external event application form
11. Legitimate request or official document from the relevant agency

If the company collects personal information from a third party other than the user, the company will inform the user of the source of collection, purpose of processing, and right to request suspension of processing to the extent necessary in accordance with relevant laws and regulations.

Article 6 Processing and statutory retention period of personal information

The company destroys personal information without delay once the personal information retention period has expired or the purpose of processing has been achieved.

However, the following records are preserved for a certain period of time in accordance with relevant laws and regulations.

The statutory period for e-commerce is based on Article 6 of the Regulation on the Protection of Consumers in E-commerce, which came into effect on July 21, 2026.

The company shall store and manage personal information that needs to be preserved in accordance with the law separately from other personal information and shall not use it for purposes other than those set.

Article 7 Personal information of children under 14 years of age and minors

1. Cochika generally only allows users to sign up for an account if they are 14 years of age or older.
2. The company does not intentionally collect personal information of children under 14.
3. If the company discovers that a child under 14 has entered the service with a false age, the company will restrict the use of the account and delete personal information that is not required to be preserved in accordance with the law without delay.
4. Members aged 14 or older but under 19 may use general free services and content features.
5. If a member under 19 purchases a subscription product or a paid service, the consent of a legal guardian may be required.
6. If a member under 19 wishes to use the creator monetization function, the consent of a legal guardian must be obtained and the company must complete the verification procedure prescribed by the company.
7. When processing information related to minors, the company collects only the minimum information required for contracts and settlements.
8. Minors or a legal guardian acting in accordance with the relevant laws may request access to, correction, deletion, and suspension of processing of personal information.

Article 8 The possibility of disclosing the personal information made public under Article 8 and sensitive information

1. Personal information that may be disclosed

When a member publicly uses the service, the following information may be disclosed to other members or non-members.

• Nickname or activity name
• profile image
• Self-introduction
• Creator category and portfolio
• External social media links
• Posts, comments, and reactions
• Information displayed as public items regarding follow or subscription status
• Event information
• Information disclosed by members as their own

Electronic mail addresses, payment information, settlement information, identity confirmation information, non-public messages, temporary storage data, reporting content, and information submitted only to the company shall not be disclosed. However, information disclosed by a member by directly including such information in a post, profile, comment, photo, or video shall be disclosed according to the scope of disclosure set by the member.

2. Posts containing sensitive information

The company does not require sensitive information such as religion, beliefs, political views, health, or sexual life as a mandatory requirement for sign-up or basic service use.

However, if a member directly includes sensitive information related to themselves in a profile, post, comment, photo, or video, such information may be disclosed to other users according to the scope of disclosure set by the member.

A member may limit the disclosure of sensitive information by the following methods.

1. Do not input or delete sensitive information before posting.
2. [Actual name of the profile or post settings menu] to change the scope of disclosure.
3. Delete the post or profile.
4. Request deletion or restriction of processing through the company customer service center.

The possibility of disclosure and the method of non-disclosure should be explained easily on the function screen. This is a requirement for the privacy policy.

3. Personal information of others.

A member should secure the necessary consent and rights before posting the contact information, address, identity information, health information, private conversation, photos, or videos of others.

If the company receives a report that personal information of others has been disclosed without consent, it may take measures such as exposure restriction, temporary blocking, or deletion in accordance with relevant laws and operating policies.

Article 9 Disclosure of third-party personal information

1. The company shall process personal information only within the scope of the personal information handling policy, and shall not provide it to a third party without the user's consent.
2. The company may provide personal information to a third party only in the following cases.
   1. The user has separately consented to the third party.
   2. There are special provisions under the law or a legal obligation to comply with the law.
   3. The provision is required to implement the contract concluded with the user and is permitted by the relevant laws.
   4. The provision is required to protect sudden and serious interests in life, body, or property.
3. The company shall provide personal information to a third party on a regular basis and shall record the actual content in the following table.

1. We provide only the minimum information necessary for subscription creators to provide subscription benefits, and we do not provide payment method information, real names, addresses, or settlement information for subscribers.
2. When a member makes their profile or posts public, this is considered a request for the provision of the member's profile or posts. The company clearly informs the public of the scope and results of the posts.
3. When the status of information provided to third parties changes, the company will change this privacy policy and obtain the consent of the user if consent is required.

Article 10 of the personal information handling work is entrusted to a specialized company.

The company may entrust some tasks required for service operations to a specialized company.

The company must state the exact legal name of the contracting party and the entrusted work in the contract, not the type of company listed below.

The company shall specify the following matters in writing when entrusting and shall manage and supervise the entrusted operator's personal information handling status.

1. Prohibition of handling personal information outside the entrusted purpose
2. Technical and management protective measures for personal information
3. Management of access rights for personal information
4. Restriction on reentrustment and management of reentrusted operator
5. Upon expiration of the retention period, the item shall be returned or disposed of.
6. In the event of an accident, the company shall notify the affected party and bear liability for damages.
7. The company shall conduct inspections and supervise the entrusted party.

In the event that the entrusted party delegates a portion of its work to another party, the company shall verify the current status of re-delegation and make it public in accordance with relevant laws.

Article 11 *Article 11: Overseas Transfer of Personal Information*

Any act of providing personal information overseas, delegating processing to an overseas business, or storing personal information on an overseas server shall be considered a transfer of personal information overseas. The current Personal Information Protection Law stipulates that the company shall make its policy of handling personal information public to include the legal basis for overseas transfer, the entity receiving the transfer, the country, the item, the purpose, the timing, and the method of the transfer.

Before launch, the user shall select one of the following two methods:

Selection Option A: If the user does not choose to transfer personal information overseas or delegate processing to an overseas business.

The company shall not transfer the user's personal information overseas or delegate processing to an overseas business. In the event that the transfer of personal information overseas is to occur, the company shall notify the user of the necessary measures in advance in accordance with relevant laws and shall amend this personal information handling policy.

Selection Option B: If the transfer of personal information overseas is to occur.

The user may refuse or withdraw consent for overseas transfer based on separate consent; refusal of consent may limit the use of the selected function.

Refusal of foreign processing or storage required for service provision may prevent account creation or service provision. The company will provide the refusal method and specific limitations in this screen.

Article 12 Destruction of Personal Information

1. The company will destroy personal information without delay when the retention period has expired or the purpose for processing has been achieved.
2. Personal information required by law shall be stored separately from other personal information and shall not be used for purposes other than the statutory retention purpose.
3. Electronic files shall be deleted in a secure manner that makes recovery or reproduction difficult.
4. Paper documents shall be shredded or incinerated.
5. If personal information is stored on an external storage medium, it shall be deleted in a manner that makes recovery difficult or the storage medium shall be physically destroyed.
6. Personal information remaining in service operation backups will be deleted sequentially within [up to 30 days or the actual backup rotation period] and will not be used during the backup period except for disaster recovery purposes.
7. If anonymous comments, co-creative works, or other content legitimately shared by other members remain after a member's withdrawal, the identification relationship between the content and the member account shall be removed.

Article 13 Cookies and Automatic Collection Devices

1. The use of cookies

The Company may use cookies or similar technologies to maintain login status, ensure security, set language preferences, facilitate service use, and analyze usage patterns.

Users may allow cookies to be stored in browser settings or block them. Blocking essential cookies may make it difficult to use login, account security, or some services.

2. Behavioral information collected by third parties

If you install a third-party analysis and advertising SDK in a service, you must disclose the following.

If using third-party analysis or ad tools, delete the above table and record only cookies and usage data collected by the company.

3. Customized Ad Settings

In the case of providing customized advertising, users may be restricted from using behavior information through the following methods.

1. To turn off customized advertising, users can access the [Personal Information or Advertising Settings Menu] within the service.
2. Users can restrict advertising tracking from the mobile operating system settings.
3. Users can reset the device's advertising identifier.
4. Users can block third-party cookies in the browser.

Article 14 Recommended, Automatic Translation, Artificial Intelligence, and Automated Processing.

1. Content Recommendation.

The company may analyze the following information to display content and creators that are likely to be of interest to the member.

• Follow relationship.
• Search query and view and playback history.
• Reactions, comments, subscriptions, hidden, and reporting history
• Category of interest
• Language used and country/region
• Title, tags, and classification information of content

Recommendation results may be generated by automated statistical and classification models and may not accurately reflect the user's actual preferences or intentions.

Users may adjust or delete some information used for recommendations through the [Recommendation Settings or Record Reset Menu].

2. Automatic Translation and Subtitles

Automatic translation and subtitle functions may cause the text of posts, comments, messages, or videos to be transmitted to the company's system or an external processing provider.

The company will take reasonable measures to not transmit account information that is not required for translation or subtitle processing. When using an external processing provider, the company will disclose the entrusted party and the status of overseas transfer in accordance with Articles 10 and 11.

3. Automated Content Detection

The company may use an automated detection system for the following purposes.

• Spam and repetitive promotion detection
• Detection of account misuse and unauthorized access
• Detection of illegal recordings and child or adolescent sexual content
• Classification of obscene material, violence, harassment, and hate content
• Detection of fraudulent payments, false transactions, and abnormal settlement indicators
• Determination of priority for reporting

Automatic detection results may be used to temporarily restrict posts, set review priorities, or support decision-making by responsible personnel; in the event of a complaint regarding severe penalties, the company may provide a procedure for review by a person within its scope.

4. Generative AI training

The company shall not use a member's content or non-public messages for the training of a generative AI model or provide such content to a third party for such purposes without the member's separate consent.

In the event that the company intends to use a member's content for generative AI model training, the company shall provide separate guidance and obtain consent.

1. The scope of personal information and content used for training
2. Purpose of Learning and Types of Models
3. Roles of the Company and External Business Entities
4. Independent Learning and Use by External Business Entities
5. Duration of Possession and Possibility of Deletion
6. Method of Refusal and Revocation
7. Transfer Outside the Country

5. Automated Decision Making

If the Company Uses a Fully Automated System to Make Decisions That Have a Significant Impact on the Member's Rights or Obligations, the Company Will Publish the Following Information.

• Types and Results of Automated Decision Making
• Types of Major Personal Information Used
• Key criteria and procedures for handling
• How a Principal Requests an Explanation or Review
• Where the law grants the right to refuse, the manner of exercising that right shall be determined.
• Requesting reprocessing due to human intervention

The current Personal Information Protection Act stipulates the rights and obligations of data subjects when fully automated decisions have a significant impact on their rights and obligations, including the right to request explanation and review.

If Cochika does not fully automate the final decision-making process regarding permanent account restrictions, revenue suspension, and settlement refunds, it is appropriate to add the following statement to the publication.

The company does not make final decisions affecting members significantly, such as permanent account restrictions, long-term suspension of earning functions, or reversal of settlement funds, solely through automated systems.

If actual operations differ from this provision, the following text shall not be used; specific criteria and procedures for automated decisions must be separately formulated.

Article 15 Mobile Application Permissions

The company may request the following access rights to provide specific functions of mobile applications.

Consent to access is not required to use the basic service; however, access may be restricted for functions requiring this permission.

The company will not access device information prior to obtaining access permission; users may change access permission settings at any time from the device operating system settings.

Article 16 Rights and methods of exercise by the legal person and legal guardian

1. Users may request the following from the company in accordance with relevant laws.
   1. Confirmation and access to information processing
   2. Correction or deletion of personal information
   3. Cessation of personal information processing
   4. Revocation of consent
   5. Declining marketing communications
   6. Explanation or review of automated decision-making
2. Users may exercise their rights through the following methods.
   1. [Account or personal information settings menu] within the service
   2. Customer service center
   3. Email: subup26@naver.com
   4. Written or other method as instructed by the company
3. The company may request the minimum information necessary to verify whether the person requesting the right is the person or a legally authorized agent.
4. In the case where an agent exercises the right, the company may request the assignment letter and the identity information of the person or the authorized agent.
5. The company shall process the request within the period prescribed by the relevant laws, and shall inform the reasons for refusal or the method for exercising the right in the case where the request is partially or wholly refused.
6. In the event that there is a concern that another person's life, body, property, or rights may be infringed upon, or that access or deletion is restricted by law, requests may be restricted.
7. Users may delete their own posts and comments before they leave the service.
8. After leaving the service, anonymous posts remain, and the identification relationship with the account is removed, making it difficult for users to delete them directly.
9. A subscription purchased through the App Market may not be automatically terminated solely by deleting the Cochika account; users must cancel the automatic renewal in the subscription management screen of the App Market prior to account deletion.
10. The company does not intentionally cause any disadvantage to users as a result of their exercise of personal information rights.

Article 17 Security measures for personal information

The company shall implement the following measures to prevent the loss, theft, leakage, forgery, or damage of personal information.

1. Administrative measures

• Establishment and implementation of a personal information internal management plan
• Designation of the personal information protection responsible person and the personal information handler
• Access rights to personal information are granted only to the minimum number of personnel required for business operations.
• Personal information handling personnel are educated and supervised.
• Contracts, inspections, and supervision with entrusted persons are conducted.
• Procedures for responding to personal information infringement incidents are operated.

2. Technical measures.

• Encryption of personal information transmission intervals.
• One-way encryption of passwords.
• Encryption of important information such as settlement accounts and self-identification information.
• Management of access rights, changes, and deactivation.
• Recording and inspection of access logs to the personal information processing system.
• Unauthorized access detection and blocking
• Security updates and vulnerability management
• Backup and recovery system operations
• Malware and security threat prevention measures

3. Physical measures

• Access control to physical places where personal information is stored
• Safe storage of paper documents and storage media
• Management of media exchange and safe disposal

The company does not implement protective measures in the privacy policy and will review protective measures when service structure changes.

In the event of personal information infringement or when such infringement is confirmed, the company informs the user of necessary matters in accordance with relevant laws and reports to relevant agencies.

Article 18 Contact Information for Personal Information Protection Responsibility

The Company shall, in charge of personal information handling, designate the following as the Personal Information Protection Officer and the Department of Personal Information Handling to handle inquiries and complaints regarding personal information of users.

Personal Information Protection Officer

• Name: Jeoyohan
• Position: Representative
• Phone Number: 010-5026-5099
• Email: subup26@naver.com

Department of Personal Information Handling

• Department Name: Cochika Customer Service Center
• Phone Number: 010-5026-5000
• Email: subup26@naver.com
• Operating Hours: 09:00~18:00 Korean Time
• Address: Miseong Villa B102, 103 Sillim-ro 11-gil, Seoul

The user may contact the above number to request inquiries, complaints, dispute resolution, and rights exercises related to personal information generated during service usage.

Article 19 Procedures for Remedying Personal Information Rights Infringement

In the event that a user requires consultation or remedial measures regarding personal information infringement, they may contact the company as well as the following institutions.

1. Personal Information Dispute Mediation Commission
   • Telephone: 1833-6972
2. Personal Information Complaints Center
   • Telephone: Without a country code, 118
3. Public Prosecution Service
   • Telephone: Without a country code, 1301
4. Ministry of Justice
   • Phone: 182 (no area code)

This institution is an independent entity separate from the company, and the specific procedures for reporting and consultation should follow the guidance of each institution.

Article 20 Additional Guidelines for the Use and Provision of Personal Information

The company may use or provide additional personal information within a scope reasonably related to the original purpose, provided that the relevant laws allow it.

When determining whether additional use or provision is necessary, the following factors shall be considered:

1. Relevance to the original purpose of collection
2. Predictability of the user, taking into account the circumstances under which the information was collected and the manner of processing
3. Impact on the user's interests or rights
4. Whether security measures such as anonymization, encryption, and access restrictions are implemented
5. Necessity of additional use or provision and the extent to which personal information is minimized

If the additional use or sharing of personal information continues, the personal information protection officer checks whether the above standards are met.

Article 21 Changes to the Personal Information Privacy Policy

1. If the relevant laws, services, or personal information processing methods are changed, the company may change this personal information privacy policy.
2. Generally, changes are notified to users through the service notice at least 7 days before the effective date.
3. Changes that are unfavorable to users or important changes are notified to users at least 30 days before the effective date.
   1. Major changes to the purpose of processing
   2. Expansion of mandatory collection items
   3. Major extension of the period for keeping personal information
   4. New third-party provision
   5. New overseas transfer
   6. AI training of member content
   7. Automated decision-making that significantly impacts user rights
4. Changes requiring separate consent from the law are processed without user consent.
5. Silence or simple service use by the user is not considered separate personal information consent.
6. The previous privacy policy is stored within the service for the user to check.

Supplementary provisions

1. This Privacy Policy takes effect on September 6, 2026.
2. The effective date of the previous privacy policy and the record of changes are as follows.
   • Initial effective date: September 6, 2026
   • Change: [specified date]