Genie Music Co., Ltd. (hereinafter “the Company”) establishes and discloses the Privacy Policy as the following to protect the personal information of the information owner and process the related complaints promptly and smoothly in accordance with the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter “Information Network Act”) and Personal Information Protection Act.

Article 1 Collection of Personal Information and Purpose of Use

1. The Company uses personal information for the purposes specified in each of the item below. The personal information processed will not be used for purpose other than the following, and in case the purpose of usage changes, it will take necessary measures, such as obtaining a separate agreement, according to Article 18 of the Personal Information Protection Act.

① Membership registration and management

Category	Member Category	Processed Items
Required items	Social media (Google, Apple) member	ID, Social media key value, email, nickname, date of birth, whether the member is Korean
Required items	Genie Music member	ID, email, nickname, date of birth

② Goods or service provision

Category	Processing Purpose	Processed Items
Required items	· Provide paid service · Confirm age or identity when using parts of the content according to the laws and regulations	Name, date of birth, gender, self-identification information (CI/DI), cell phone number
	· Processing of customer consultation services for purchased goods or services	Cell phone number
	· Billing, payment, settlement, and discount per the provision of paid service	※By payment method Credit card: Card company name PAYCO: Card company name Kakao Pay: Card company name NAVER Pay: Card company name
	· Prevent illegal and unauthorized service use · Identify access frequency and use for statistics	ID, service usage record, member device information
	· Identify service usage frequency and use for statistics · Provide customized service	Service usage record
Optional item	· Provide service usage information and notification	Cell phone number

③ Customer consultation

Category	Processing Purpose	Processed Items
Required items	Processing the customer consultation	Email, Cell phone number

④ etc.

Category	Processing Purpose	Processed Items
Required items	Offline performance ticket delivery and issuance	Name, Cell phone number, Date of birth, Email
Optional item	Hold events and ship winners' prizes	ID, email, cell phone number, address

2. While using the service, the following personal information items can be automatically created and collected.
· Service usage record, site visit record, abusing record, cookie, member device information (OS type, token for push notifications, device ID), browser information, product purchase history, IP address, MAC address, random value that transformed the Canvas Fingerprinting information (the image information created depending on the device that a user accesses)

3. This service is restricted for use by children (under the age of 14 for Koreans and under the age of 16 for foreigners). If the company recognizes the fact of collecting personal information from a child, the corresponding information will be deleted, and the user’s account terminated. If you think the Company collected information from a child, please contact help@stayg.tv.

Article 2 Processing and Retention Period of Personal Information

The Company processes and retains personal information within the retention / usage period of personal information agreed upon the collection of personal information. It destroys the customers’ personal information without delay when the membership is withdrawn, or the purpose of personal information processing has been achieved. However, the Company retains the personal information for a set period for the following cases as an exception:

1. According to the Company’s internal policy

A. The service was terminated due to cancellation or withdrawal, but there is unpaid product or service
: Until the payment is made in full

B. When there is a dispute between the Company and the customer, including civil complaint or lawsuit
: Until the dispute is resolved

C. When the Company has obtained individual consent from the customer
: Until the consented period ends

2. According to the related laws and regulations

Retained Information	Based Law	Retained Period
Record on contract or its withdrawal	Act on the Consumer Protection in Electronic Commerce	5 years
Record on payment and supply of goods, etc.	Act on the Consumer Protection in Electronic Commerce	5 years
Record on customer’s complaint or processing disputes	Act on the Consumer Protection in Electronic Commerce	3 years
Record on website visits	Protection of Communications Secrets Act	3 months

A. dormant customer refers to the customer who has not used the service for one year after membership registration or the last day of use and has not responded within 30 days to the notification of the Company asking of the intention to use the service a month before processing the account as dormant.

B. In order to protect the dormant customers’ personal information, the Company is storing it separately from other customers’ personal information. If the customer wants to use the service again, they can do so by going through the self-identification process.

C. The personal information stored separately will be stored for a set period according to the information protection reasons per internal policy and other related laws and regulations and then destroyed.

Article 3 Customers and legal representatives Rights and Obligations and How to Exercise Them

1. The customer can exercise their rights related to personal information protection, including viewing, correcting, deleting, and suspending the processing of information, in the following ways:
A. Directly view or correct the personal information on the website through ‘My > Correct My Information > Settings’
B. Withdraw the consent to process personal information on the website through ‘My > Correct My Information > Withdraw from Service’

2. The customer can exercise their right per Paragraph 1 through a representative, such as a legal representative or an authorized person. In this case, the customer must submit a power of attorney according to the annex No. 11 of “Notification on Personal Information Processing Method (No. 2020-7).”

3. the company shall faithfully respond to the customer’s request to withdraw of agreement regarding personal information and other request on viewing and certification. In case the customer requests to modify or delete the erroneous personal information, etc., the Company does not use or provide the personal information until the requested modification or deletion is completed.

4. The customer shall enter their personal information accurately and in the most up-to-date state to prevent unexpected accidents in advance. The customer is responsible for the consequences of entering inaccurate information, and they may lose the membership if false information is entered, including stealing other people’s information.

5. The customer shall be careful not to violate the personal information and privacy of the customer themselves or others handled by the Company by violating related laws, such as Personal Information Protection Act.

Article 4 Notice of Personal Information Collection Source

1. According to Article 20 (Notification on Sources, etc. of Personal Information Collected from Third Parties) of the Personal Information Protection Act, the Company informs of the source of personal information collection as below:

Collection Source	Purpose of Collection/Processing
· Google · Apple · Genie Music	Collect/Process personal information for STAYG membership registration and service provision

2. When processing the personal information collected from other than the information owner, unless there is a justifiable reason, the Company shall notify the owner of the fact that they have the right to request the collection course, purpose of processing, and to stop the processing of personal information within 3 days of receiving the request of the information owner.

3. In accordance with each subparagraph of Article 20 Paragraph 4 of Personal Information Protection Act, if the Company refuses the request of the information owner under Paragraph 1 above, unless there is a justifiable reason, it should notify the basis and reason of the refusal within 3 days of receiving the request of the information owner.

Inquiry: help@stayg.tv

Article 5 Consignment of Personal Information Processing

1. The Company consigns the personal information processing to an external specialist consignee for smooth processing of personal information.

2. When signing the consignment contract with the consignee, the Company stipulates compliance with relevant laws and guidelines, information protection and confidentiality, prohibition of providing information to third parties, liability in case of an accident, consignment period, responsibility of returning or destroying the personal information after the processing is completed, etc. to manage and supervise if the consignee is safely processing the personal information.

3. The consignees that the Company consigns the personal information processing is as the following, and in the event of changes in consignment details or consignees, the Company notifies the changes through 「Privacy Policy」.

Consignees	Consigned Details
Payletter, Inc.	· Payment proxy for product payment · Billing system operation proxy
PayPal	· Payment processing for using paid service
(c)NICE Information Service	· Providing and proxy self-identification service
Amazon Web Service (Seoul Region)	· Cloud server operation and management
KT is	· Customer center commissioned operation

Article 6 Collection and Transfer of Personal Information Abroad

The company provides personal information overseas for certain services based on Article 28-8 of the Personal Information Protection Act (Transfer of Personal Information Abroad) as outlined below.

Purpose	Recipient	Items	Country	Timing and Method of Transfer	Retention and Usage Period
Use of Global Payment Methods	Paypal Pte. Ltd paypal@generalagent.co.kr	ID, Email	United States	When using global payment methods, the information is provided immediately through an encrypted communication network.	Reference to Payment Processor Privacy Statement

2. If users of the electronic payment service using global payment methods refuse the transfer of personal information abroad, they will not be able to use the service. If you do not use global payment methods, the transfer of information abroad will not take place.

Article 7 Destruction of Personal Information

1. The Company destroys the personal information without delay when the retention period of the information has elapsed or the purpose of processing has been achieved, and the procedure and method of destruction are as the following:
A. Destruction Procedure
Select the personal information with the reason for destruction and destroy with the permission of the Personal Information Protection Officer
B. Destruction Method
· Personal information written or printed on paper: destroy via shredding or incineration
· Personal information saved in electronic file format, such as database: destroy with a technical method that cannot reproduce the information

2. In case the Company needs to continue retaining the personal information obtained with the agreement of the customer according to other laws and regulations even after the retention period of the information elapsed or the purpose of processing has been achieved, it shall move the personal information on a separate database or retain it in a different storage location.

Article 8 Measures of Ensuring Personal Information Safety

To ensure the safety of personal information, the Company is taking measures as the following:

1. Administrative measures: Acquire certifications such as Information Security Management System (ISMS), establish and implement internal management plan, limit the number of personnel processing personal information, regular employee training, sign Information Protection Agreement when hiring a new employee

2. Technical measures: manage access permission to personal information processing system, etc., operate attack prevention system and attack detection system to internal network, use encryption algorithm and security device, install vaccine programs

3. Physical measures: Limit the access to the computer room and data storage room

Article 9 Matters Regarding Installation, Operation, and Refusal of Automatic Personal Information Collection Device

1. When necessary for operating the service, the Company uses “Cookie,” which is a string information that the web server sends to the web browser and saves and resent to the server when there is an additional request from the server. It may collect and save the service usage information, such as customer’s IED, access IP, access log, and used content as cookie information.

2. The Company may use the collected and stored cookie information per Paragraph 1 for the following purposes:
A. Provide differentiated information according to the customer’s interest
B. Analyze the access frequency or visit duration of the member and non-member customers, identify the taste and interest of the user, and use it as a measure of target marketing and service improvement

3. The customer can set the level of information collection by selecting from the web browser’s [Tools] menu [Internet Options] -> [Security] -> [Custom Level]. However, in case of refusing the collection and storage of cookies, there may be difficulties in using the service.
- Chrome: Settings on the top-right of the web browser -> Personal Information and Security -> Site Settings -> Cookie and other site data
- Edge: Settings on the top-right of the web browser -> Cookies and Site Permissions
- Internet Explorer: Tools on the top of the web browser -> Internet Options -> Privacy -> Settings -> Advanced

Article 10 Personal Information Protection Officer and Remedy for Rights and Interests Infringement

1. The Company appoints a Personal Information Protection Officer as below to protect the customers’ personal information and process the complaints and request to view regarding personal information. If you have questions regarding personal information, please contact the Personal Information Protection Officer and Manager below.

Category	Personal Information Protection Officer	Personal Information Protection
Name	Hong Se-hee	Hwang Jeong-su
Position	Director of Office	Section Chief
Affiliation	Platform Business Office	Information Protection Team
Email	help@stayg.tv
Online Consultation	Bottom of the website > Service inquiry

2. In the event of customer’s personal information is infringed due to reasons attributable to the Company, the Company shall bear responsibility according to the related laws and regulations. However, it is not responsible for damages to information due to unexpected accidents caused by fundamental dangers on network such as hacking despite the technical security measures or various disputes due to the posts that the customer wrote.

3. If you need to report or consult about other personal information infringements, please inquire the organizations below:
A. Korea Internet & Security Agency Personal Information Infringement Report Center: privacy.kisa.or.kr, (without area code) 118
B. Supreme Prosecutors’ Office Cyber Investigation Division: www.spo.go.kr (without area code) 1301
C. National Police Agency Cyber Investigation Department: ecrm.police.go.kr (without area code) 182
D. Personal Information Dispute Mediation Committee: www.kopico.go.kr, (without area code) 1833-6972

Article 11 Linked Websites

1. The Company may provide links of other companies’ websites, etc. through its website to the customers, and if the customer has moved to an external website, etc. through the link, the Company’s 「Privacy Policy」 does not apply regarding the usage of the website.

2. The Company does not bear any responsibility regarding using the service or materials provided by the external website that the customer moved to via the links.

Article 12 Changes in Privacy Policy

This 「Privacy Policy」 will take effect starting 2024.10.30.