1. Collected Personal Information and Collection Method

1. ① Company collects personal information as follows for membership subscription, consulting and providing services.
   : Login ID (e-mail), name, DOB, gender, password, mobile phone number, service usage record, connection log, cookies, payment records, preferred artists, etc.
2. ② Company collects personal information with the following methods.
   : Collection through service app or website (membership subscription, event participation, delivery request), and through generated information collection tools

2. Purpose of Collecting and Using Personal Information

1. ①Member management
2. ②Confirmation of identity, personal identification, unlawful use by faulty users and prevention of unauthorized use, confirmation of subscription intent, complaint handlings, conveying announcements, confirmation of legal representative in the future, record preservation for settling disputes in the future, conveying notifications, and confirmation of intent to withdraw membership from using the membership services.
3. ③Use for developing new services, marketing and advertising
4. ④Development and specialization for new services (products), conveying advertising information such as events, service provision and advertisements according to statistic features, identification of connection frequency, and statistics for member services

3. Personal Information Items Collected by Linking with SNS, Collection Method and Purpose of Use

When member logs into services offered by Company through the SNS Sign In function,

1. ①Company may collect member information disclosed on their SNS to increase user convenience of services and for the purpose states in the above “2. Purpose of Collecting and Using Personal Information”.
2. ②Collected items: name, SNS ID, profile photo or photo URL, SNS friends list, DOB, gender, etc.
3. ③Collection method: collect information disclosed by member through SNS
4. ④Member may use information disclosed by member in SNS or information entered in clause 2 of this article while using the services offered by Company, and Company may use the above information for the purposes as listed in the above clause 1.

4. Sharing and Provision of Collected Personal Information

1. ①By principle, Company shall not disclose the personal information of users. However, the following cases are exceptions.
   1. 1.When prior consent is given by user
   2. 2.When in accordance to regulations by law
2. ②Partner services included in the services may collect information related to the said partner service and the user activities. Such partner services are not developed or managed by Company, and therefore, Company shall not be held responsible for the actions of other companies. Members should carefully review the terms of use and privacy protection policies of services provided by other companies.

5. Possession and Usage Period of Personal Information

Company shall immediately destroy the information after achieving the purpose of collecting and using personal information. However, when necessary to preserve according to the regulations of relevant laws, Company shall store membership information for a period of time as prescribed by the Act on Consumer Protection in Electronic Commerce as follows.

1. ①Records on indications/advertisements: 6 months (Act on Consumer Protection in Electronic Commerce)
2. ②Records on contract and subscription withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce)
3. ③Records on payments and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
4. ④Records on consumer complaints and dispute remedies: 3 years (Act on Consumer Protection in Electronic Commerce)
5. ⑤Records on collection/handling and use of credit information: 3 years (Act on Use and Protection of Credit Information)

6. Personal Information Destruction Procedures and Methods

Company shall, in principle, immediately destroy information once the purpose of personal information collection and usage is achieved.

1. ①Destruction procedure: Once the purpose of the information collected by Company is achieved, it shall be destroyed with the exception of the case of “5. Possession and Usage Period of Personal Information”.
2. ② Destruction Method
   1. 1.Personal information printed on paper shall be shredded or incinerated
   2. 2.Personal information saved as electronic files shall be deleted using technical methods so that the records cannot be restored.

7. Rights of Users and Legal Representatives, and Exercising Methods

1. ①Users and legal representatives may view or edit their personal information or personal information for children under the age of 14 at any time, and may request withdrawal from subscription.
2. ②Viewing and editing of personal information of user or children under the age of 14 is possible after completing self-identification procedures. Or, Company’s personal information management supervisor can be contacted for immediate action.
3. ③When requesting corrections to errors on personal information, personal information shall not be used or provided until corrections are made. Furthermore, in the case that erroneous personal information has already been provided to a third person, the handling results shall be notified to the third person immediately to make corrections.
4. ④Personal information canceled or deleted by the request of the user or legal representative shall be handled as stated in “5. Possession and Usage Period of Personal Information” and measures shall be taken so that it cannot be viewed or used for any other purpose.

8. Installation, Operation and Refusal of Personal Information Automatic Collection Devices

In order to provide customized services to users, Company uses ‘cookies’ that saves and loads user information. Cookies are very small text files send to the user’s browser by the server and are used for operating the website and it is saved in the user’s computer hard disk.

1. ①Purpose of using cookies by Company : Used to provide customized information including advertisements to users by identifying visits and usage of Company’s services and websites by users, popular search words, secure access and user scope.
2. ② Installation/operation and refusal of cookies : Users have the right to choose whether to install cookies. By configuring the options in the web browser, users can allow all cookies, confirm to save cookies whenever they are saved, or refuse to save all cookies. However, when refusing to save cookies, there may be difficulties in using parts of the website services that require logging in.
3. ③ How to designate whether or not to allow cookie installation
   1. 1.For Internet Explorer
      1. -Select [Internet Options] in the [Tools] menu.
      2. -Click on the [Personal Information Tab].
      3. -Configure [Personal Information Handling Level].
   2. 2.For Chrome
      1. -Select [Delete Internet Use Information] in the [Tools] menu.
      2. -Select the amount of data to be deleted in the dialog box.
      3. -Click on [Delete Internet Use Information].

9. Customer Services for Personal Information

1. ①Company shall designate a supervisor and department as follows to handle complaints regarding personal information and to protect the personal information of customers.
   Personal Information Management Supervisor
   Name: Jeong Min-Su
   TEL: 02-6240-9800
   E-mail: privacy@smtown.com
2. ②Members may report all complaints and inquiries on personal information protection related to the use of Company’s services to the personal information management supervisor or the relevant department. Company shall make efforts to provide prompt and sufficient responses to the reports made by users.
3. ③Please contact the below institutes for reports or consultation on violations of personal information.
   1. 1.Personal Information Violation Reporting Center (www.1336.or.kr/118)
   2. 2.Information Protection Mark Certification Committee (www.eprivacy.or.kr/02-580-0533~4)
   3. 3.Supreme Prosecutors’ Office Internet Crime Investigation Center (http://icic.sppo.go.kr/02-3480-3600)
   4. 4.National Police Agency Cyber Terror Response Center (www.ctrc.go.kr/02-392-0330)

Announcement Date: April 17, 2019

Enforcement Date: April 23, 2019