Cool As A Cucumber Inc. (the "Company") establishes the following privacy policy in accordance with the Act on Promotion of Information and Communications Network Utilisation and Information Protection, the Personal Information Protection Act and other relevant law, in order to protect users' personal information and to handle related complaints promptly and smoothly. The privacy policy is published on the service's home screen so users can read it at any time, and may change with relevant law, guidelines, notices or the Company's service policy.

Article 1. Consent to collection of personal information

We collect personal information from what you enter at signup, from access through linked social accounts (Gmail, Kakao), and when you enter events. At signup, additional information is optional and provided only if you choose to. For event entries and orders we ask for additional information so that ordering, payment and delivery can go smoothly.

Article 2. What we collect and why

Personal information means information about a living individual which identifies that individual by items it contains such as name, resident registration number or business registration number (including information that cannot identify a particular individual on its own but can readily do so in combination with other information). The site collects and uses customers' personal information for the following purposes. General member information When collected: at signup Required items: Kakao account information provided by Kakao login (phone number), ID (display name), and information on gender / age / region of service use Purpose: consultation while using the service, delivery of notices Retention: deleted immediately on withdrawal of membership

Article 3. Retention, period of use and destruction

Customers' personal information is destroyed without delay once the purpose of collection and use is achieved — for example on withdrawal of membership — or on a request to withdraw consent. Where relevant law such as the Act on Consumer Protection in Electronic Commerce requires information to be kept for a set period, for instance to confirm rights and obligations relating to transactions, it is kept only for that period. a. Grounds for retention under internal Company policy • Records of improper use (abnormal use of the service such as fraudulent signup or disciplinary records) • Items retained: the mobile number used to verify signup; for members under 14, the legal guardian's ID • Reason: prevention of fraudulent signup and misuse • "Records of improper use" means records of restrictions imposed by the Company for fraudulent signup, posts contrary to the operating principles, and the like. b. Where retention is required under relevant law such as Article 6 of the Act on Consumer Protection in Electronic Commerce or the Commercial Act, the Company keeps member information for the period those laws prescribe. In that case the Company uses the information only for the purpose of that retention. The periods are as follows. • Records of contracts and withdrawal of subscription Reason: Act on Consumer Protection in Electronic Commerce Period: 5 years • Records of payment and supply of goods Reason: Act on Consumer Protection in Electronic Commerce Period: 5 years • Records of electronic financial transactions Reason: Electronic Financial Transactions Act Period: 5 years • Records of consumer complaints or dispute handling Reason: Act on Consumer Protection in Electronic Commerce Period: 3 years c. Article 15-2 of the Protection of Communications Secrets Act • Access (log) records: 1 year d. Other relevant law The site destroys personal information as follows. a. Procedure • Information entered for signup and the like is moved to a separate database once its purpose is achieved (to a separate filing cabinet in the case of paper), kept for the period set by internal policy and other relevant law, and then destroyed. • That personal information is not used for any purpose other than retention, except where the law requires. b. Method • Personal information printed on paper is destroyed by shredding or incineration. • Personal information stored electronically is deleted using technical means that make the record unrecoverable. Under Article 29(2) of the Act on Promotion of Information and Communications Network Utilisation and Information Protection, the site may notify dormant members (those who have not used the service for 12 months) that their membership will lapse and, if there is no reply within the period stated in that notice, may end their membership. In that case a dormant member's personal information is stored and managed separately from other members', and the separately stored information is destroyed once the statutory retention period passes. Where the user requests it, information not yet destroyed is made available again when they resume using the service.

Article 4. Provision to third parties

The site does not use customers' personal information beyond the scope stated in "Article 1, What we collect and why", nor provide it to other people, companies or institutions. The following are exceptions. a. Where a relevant authority requests it for investigative purposes under relevant law b. Where it is provided to advertisers, partners or research bodies in a form that cannot identify a particular individual, for statistics, academic research or market research c. Where there is a request following a procedure prescribed by other relevant law Even where personal information is provided under the above, we will do our utmost to ensure it is not provided indiscriminately against the original purpose of collection and use.

Article 5. Outsourcing of processing

To provide a better service and greater convenience, the site outsources personal information processing to outside specialists as follows. • Building, maintaining and storing the computing system: Firebase * The information shared with the contractor is limited to the minimum necessary to achieve that purpose. Personal information is also provided selectively to the relevant company according to the customer's service request. * The list of contractors may change with the service and the contract period; changes will be announced in advance through notices. Short-term events are notified individually at the time of participation.

Article 6. Access and correction

You may view or correct your registered personal information at any time. Personal information can be edited through the Kakao service you used at signup.

Article 7. Withdrawing consent

You may withdraw your consent to the collection, use and provision of personal information given at signup at any time. To withdraw consent, tap "Delete account" in the My SOWANT menu; consent to collection, use and provision is withdrawn immediately. You may also contact the data protection officer in writing, by phone or by email, and the site will take the steps needed to withdraw your membership at once. Where consent is withdrawn and personal information destroyed, we will notify you of that without delay. The site takes the steps needed to make withdrawing consent (deleting your account) easier than the way personal information is collected.

Article 8. Children under 14

The site considers protecting children's personal information online just as important, and does not accept signups from children under 14, for whom a legal guardian's consent would be required. Where a child under 14 signs up or provides personal information through identity misuse or abuse of the system, the legal guardian may exercise all rights.

Article 9. Data protection officer

The site designates the following data protection officer to take overall responsibility for personal information processing and to handle users' complaints and provide remedies in connection with it. Data protection officer • Name: Cool As A Cucumber Inc. • Contact: coolasacucumberinc@gmail.com If you need to report or discuss an infringement of personal information, please contact the Personal Information Infringement Report Centre of the Korea Internet & Security Agency (KISA). If you have suffered financial or emotional harm through such an infringement, you may apply for a remedy to KISA's Personal Information Dispute Mediation Committee. • KISA privacy (https://privacy.kisa.or.kr / 118, no area code) • National Police Agency Cyber Bureau (https://cyberbureau.police.go.kr / 182, no area code) • Supreme Prosecutors' Office Cyber Investigation Division (https://spo.go.kr / 02-3480-3570) • Personal Information Infringement Report Centre, run by KISA (https://privacy.kisa.or.kr / 118, no area code) — Personal Information Dispute Mediation Committee, run by KISA (https://kopico.go.kr / 1833-6972)

Article 10. Changes to this policy

This privacy policy applies from its effective date (1 August 2024). Where content is added, removed or corrected under law or policy, we will give notice from seven days before the change takes effect.