Circus Company Privacy Policy

Circus Company Inc. (hereinafter referred to as 'Circus Company'), in accordance with Article 30 of the Personal Information Protection Act, establishes and discloses the following personal information processing guidelines to protect the personal information of the data subjects of the Circus AR app and the Circus Company website, and to promptly and smoothly handle any grievances related thereto.

Article 1 (Purpose of Processing Personal Information)

Circus Company processes personal information for the following purposes. The personal information processed will not be used for any purpose other than the following, and if the purpose of use changes, we will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
1. Homepage membership registration and management: Personal information is processed for the purpose of confirming the intention to register, identity verification and authentication in accordance with the provision of membership services, maintaining and managing membership, identity verification in accordance with the limited identification system, preventing unauthorized use of services, confirming consent of legal representatives when processing personal information of children under the age of 14, various notifications, and handling grievances.
2. Provision of goods or services: Personal information is processed for the purpose of delivering goods, providing services, sending contracts and invoices, providing content, providing customized services, identity verification, age verification, payment and settlement, debt collection, etc.
3. Grievance handling: Personal information is processed for the purposes of identifying the complainant, verifying the complaint, contacting for fact-finding, and notifying the outcome.

Article 2 (Processing and Retention Period of Personal Information)

① Circus Company shall process and retain personal information within the period of retention and use of personal information in accordance with the law or the period agreed upon when collecting personal information from the data subject.
② The processing and retention periods for each category are as follows:
1. Homepage membership registration and management: Until withdrawal from the website. However, in the following cases, until the end of the relevant reason:
1) In the case of an ongoing investigation for violation of relevant laws and regulations, until the end of the investigation
2) If a credit/debt relationship remains due to the use of the website, until the settlement of the credit/debt relationship
2. Provision of goods or services: Until the completion of supply and settlement of payment. However, in the following cases, until the end of the relevant period:
1) Records on transactions such as display/advertising, contract contents and performance in accordance with the Act on Consumer Protection in Electronic Commerce, etc.
- Records on display/advertising: 6 months
- Records of contract or subscription withdrawal, payment, supply of goods, etc.: 5 years
- Records of consumer complaints or dispute handling: 3 years
2) Retention of communication factual verification data in accordance with Article 41 of the Protection of Communications Secrets Act
- Subscriber communication date, start/end time, counterpart subscriber number, usage, originating base station location data: 1 year
- Computer communication, Internet log data, and access point tracking data: 3 months

Article 3 (Provision of Personal Information to Third Parties)

① Circus Company processes personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only in cases falling under Article 17 of the Personal Information Protection Act, such as consent of the data subject or special provisions of the law.

Article 4 (Rights and Obligations of Data Subjects and Methods of Exercise)

① Data subjects may exercise the following rights related to personal information protection against Circus Company at any time:
1. Request to access personal information
2. Request for correction in case of errors
3. Request for deletion
4. Request to suspend processing
② The exercise of rights under Paragraph 1 may be made to Circus Company in writing, by telephone, e-mail, facsimile (FAX), etc., and Circus Company will take action without delay.
③ If the data subject requests the correction or deletion of errors in personal information, Circus Company will not use or provide the personal information until the correction or deletion is completed.
④ The exercise of rights under Paragraph 1 may be made through a representative, such as a legal representative or an authorized person. In this case, a power of attorney in the form of Appendix No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
⑤ Data subjects shall not infringe on the personal information and privacy of themselves or others processed by Circus Company in violation of the Personal Information Protection Act and other related laws.

Article 5 (Categories of Personal Information Processed)

Circus Company processes the following categories of personal information:
1. Homepage membership registration and management
- Required: Name, date of birth, ID, password, address, phone number, gender, email address, i-PIN number
- Optional: Marital status, interests
2. Circus AR App
- Required: Device ID of smartphone
- Optional: Name, phone number, email address, address, gender, interests
3. Provision of goods or services
- Required: Name, date of birth, ID, password, address, phone number, email address, i-PIN number, credit card number, bank account information and other payment information
- Optional: Interests, past purchase history
4. The following personal information items may be automatically generated and collected during the use of Internet services:
- IP address, cookies, MAC address, service usage records, visit records, unauthorized usage records, etc.

Article 6 (Destruction of Personal Information)

① Circus Company destroys personal information without delay when it becomes unnecessary, such as the expiration of the retention period or the achievement of the processing purpose.
② If the retention period agreed upon by the data subject has expired or the processing purpose has been achieved, but personal information must continue to be retained in accordance with other laws, the personal information shall be transferred to a separate database (DB) or preserved in a different storage location.
③ The procedures and methods for destroying personal information are as follows:
1. Destruction procedure: Circus Company selects the personal information for which the reason for destruction has occurred and destroys it with the approval of the Personal Information Protection Officer.
2. Destruction method:
Circus Company destroys personal information stored in electronic file format using technical methods such as Low Level Format so that the records cannot be reproduced, and destroys personal information stored in paper documents by shredding or incinerating them.

Article 7 (Measures to Ensure the Safety of Personal Information)

Circus Company takes the following measures to ensure the safety of personal information:
1. Administrative measures: Establishment and implementation of internal management plan, regular employee training, etc.
2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
3. Physical measures: Access control to computer rooms, data storage rooms, etc.

Article 8 (Installation, Operation and Rejection of Automatic Personal Information Collection Devices)

① Circus Company uses 'cookies' to store and retrieve usage information from time to time in order to provide individualized customized services to users.
② Cookies are small amounts of information sent to the user's computer browser by the server (HTTP) used to operate the website and may be stored on the hard disk of the user's PC.
a. Purpose of using cookies: Cookies are used to provide optimized information to users by identifying the type of visit and usage of each service and website visited by users, popular search terms, secure connections, etc.
b. Installation, operation and rejection of cookies: You may reject the storage of cookies by setting the options in Tools>Internet Options>Privacy menu at the top of your web browser.
c. If you refuse to save cookies, you may experience difficulties in using customized services.

Article 9 (Personal Information Protection Officer)

① Circus Company is responsible for the overall handling of personal information processing and designates a Personal Information Protection Officer as follows to handle complaints and damage relief from data subjects related to personal information processing: ▶ Personal Information Protection Officer
Person in charge: CEO Sunwook Park
Contact: 02-6261-2330, thanks@cscom.io
※ You will be connected to the Personal Information Protection Department.
▶ Personal Information Protection Department
Person in charge: CEO Sunwook Park
Contact: 02-6261-2330, thanks@cscom.io
② Data subjects may contact the Personal Information Protection Officer and the department in charge regarding all personal information protection-related inquiries, complaint handling, damage relief, etc. arising from the use of Circus Company's services (or business). Circus Company will respond to and handle inquiries from data subjects without delay.

Article 10 (Request for Access to Personal Information)

Data subjects may request access to personal information pursuant to Article 35 of the Personal Information Protection Act to the following department. Circus Company will endeavor to promptly process data subjects' requests for access to personal information.
▶ Department for receiving and processing requests for access to personal information
Person in charge: CEO Sunwook Park
Contact: 02-6261-2330, thanks@cscom.io

Article 11 (Remedies for Infringement of Rights)

Data subjects may contact the following organizations for damage relief, consultation, etc. regarding personal information infringement.
<The following organizations are separate from Circus Company. If you are not satisfied with Circus Company's own complaint handling or damage relief results, or if you need further assistance, please contact them.>
▶ Personal Information Infringement Reporting Center (operated by the Korea Internet & Security Agency)
- Responsibilities: Report personal information infringement, request consultation
- Website: privacy.kisa.or.kr
- Phone: 118 (no area code required)
- Address: 3F, 9 Jinheung-gil, Naju-si, Jeollanam-do, 58324, Republic of Korea
▶ Personal Information Dispute Mediation Committee
- Responsibilities: Personal information dispute mediation application, collective dispute mediation (civil settlement)
- Website: www.kopico.go.kr
- Phone: 1833-6972 (no area code required)
- Address: 4F, Government Seoul Building, 209 Sejong-daero, Jongno-gu, Seoul, 03171
▶ Cybercrime Investigation Division, Supreme Prosecutors' Office: 02-3480-3573 (www.spo.go.kr)
▶ Cyber Safety Bureau, National Police Agency: 182 (http://cyberbureau.police.go.kr)

Article 12 (Changes to Privacy Policy)

① This Privacy Policy is effective as of June 1, 2018.