> For the complete documentation index, see [llms.txt](https://yukki-studio.gitbook.io/yukki-studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yukki-studio.gitbook.io/yukki-studio/privacy-policy-of-yukki-studio.md). # Privacy Policy of Yukki Studio Yukki Studio ('', hereinafter 'Studio') establishes and discloses this Privacy Policy to protect and process the personal information of data subjects promptly and smoothly in accordance with Article 30 of the Personal Information Protection Act. This Privacy Policy will be effective from March 1, 2023. ## Article 1 (Purpose of Processing Personal Information) Studio processes personal information for the following purposes. Personal information being processed is not used for any purposes other than the following, and in case of any change in the purpose of use, Studio will take necessary measures such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act. 1. Website membership registration and management Studio processes personal information for the purpose of verifying membership registration, maintaining and managing member qualifications, and preventing unauthorized use of services. 2. Provision of goods or services Studio processes personal information for the purpose of providing services, providing content, providing customized services, and payment and settlement of fees. 3. Utilization of marketing and advertising Studio processes personal information for the purpose of developing new services (products), providing customized services, providing event and advertising information, providing opportunities to participate, verifying the validity of services, and grasping access frequency or statistics of members' use of services. ## Article 2 (Processing and Retention Period of Personal Information) 1. Studio processes and retains personal information within the period of retention and use of personal information agreed upon when collecting personal information from data subjects, unless otherwise provided by relevant laws and regulations. 2. The retention and use period of each personal information is as follows: * Website membership registration and management * Personal information related to website membership registration and management is retained and used for up to 3 years from the date of consent for the purpose of the above use. * Basis for retention: management of accounts on the site and in games, etc. * Relevant law: Record of consumer complaints or disputes: 3 years * Exceptions: Batch destruction upon termination of operating entity or service * Provision of goods or services * Personal information related to the provision of goods or services is retained and used for up to 5 years from the date of consent for the purpose of the above use. * Basis for retention: in-app payments and cancellations, etc. * Relevant laws: * Record of supply of goods and services, including payment records: 5 years * Record of contracts or cancellations of subscriptions, etc.: 5 years * Exceptions: Batch destruction upon termination of operating entity or service ## Article 3 (Items of Personal Information Being Processed) Studio processes the following personal information: 1. Website membership registration and management * Required items: email, password, login ID, service usage history, access log, access IP information 2. Provision of goods or services * Required items: payment history 2. Studio provides personal information to third parties as follows: * Name of recipient: * Purpose of use of the recipient's personal information: * Retention and use period of the recipient's personal information: ## Article 4 (Matters concerning the entrustment of personal information processing) 1. Studio entrusts the following personal information processing tasks to ensure smooth processing of personal information. 2. Studio * Trustee (trustee): administrator * Contents of entrusted business: purchase and fee payment, complaint processing, notification of notices, development of new services (products) and provision of customized services, provision of event and advertising information and opportunities for participation * Trust period: 5 years 2. When Studio signs a commission contract, it specifies matters regarding the prohibition of personal information processing for purposes other than those related to commission services, technical and administrative protective measures, restrictions on re-commissioning, management and supervision of trustees, and liability for damages, in accordance with Article 26 of the Personal Information Protection Act and other relevant laws and regulations, and monitors whether the trustee safely handles personal information. 3. When the contents of entrusted business or the trustee are changed, Studio will promptly disclose such changes through this privacy policy. ## Article 5 (Procedures and methods of personal information destruction) 1. Studio will destroy the relevant personal information without delay when personal information is no longer necessary due to the passage of the retention period for personal information or achievement of the processing purpose. 2. If personal information must be retained due to other laws despite the expiration of the retention period agreed upon with the data subject or the achievement of the processing purpose, Studio will transfer the personal information to a separate database or store it in a different location. * Legal basis: * Personal information items retained: account information, transaction date 3. The procedures and methods of personal information destruction are as follows: 4. Destruction procedure Studio selects personal information for destruction, obtains approval from the personal information protection officer, and destroys personal information. 5. Destruction method For electronically stored personal information, technical methods that make it impossible to reproduce the records are used. ## Article 6 (Rights and obligations of data subjects and their legal representatives and methods of exercising them) 1. Data subjects may exercise their rights, such as accessing, correcting, deleting, and suspending processing of their personal information, against Studio at any time. 2. The exercise of the rights under Paragraph 1 may be made in writing, email, fax, or other means as specified in Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and Studio will take action without delay. 3. If the rights under Paragraph 1 are exercised through the data subject's legal representative or an authorized representative, a power of attorney in accordance with Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted. 4. The rights of the data subject to access and to suspend processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act. 5. If the personal information is specified as a collection target under other laws, the request for correction or deletion of personal information cannot be made. 6. Studio verifies whether the requester for access, correction/deletion, or suspension of processing of personal information is the data subject or a legal representative. ## Article 7 (Measures for ensuring the safety of personal information) Studio takes the following measures to ensure the safety of personal information: 1. Regular self-auditing To ensure the security of personal information handling, we conduct regular (quarterly) self-audits. 2. Establishment and implementation of internal management plan To process personal information safely, we establish and implement internal management plans. 3. Technical measures for hacking prevention Studio installs security programs and periodically updates and checks them to prevent personal information leakage and damage caused by hacking, computer viruses, etc. We also install systems in areas with restricted access and monitor and block them technologically and physically. 4. Encryption of personal information Users' personal information is stored and managed with encrypted passwords that only the user can know. For important data, separate security functions such as encryption of files and transmitted data or file locking are used. 5. Preservation of access records and prevention of tampering We keep and manage access records for personal information processing systems for at least one year. However, when adding personal information for more than 50,000 people or processing unique identification information or sensitive information, we keep and manage them for more than two years. In addition, we use security functions to prevent tampering, theft, and loss of access records. 6. Access restrictions for personal information We take necessary measures to control access to personal information by granting, changing, and canceling access rights to the database system that processes personal information. We also control unauthorized access from outside using intrusion prevention systems. 7. Use of lock devices for document security We store documents and auxiliary storage media containing personal information in secure locations with lock devices. ## Article 8 (Installation, operation, and refusal of devices that automatically collect personal information) Studio does not use cookies to store and retrieve usage information of data subjects. ## Article 9 (Collection, Use, and Provision of Behavior Information and Refusal) does not collect, use, or provide behavioral information for online targeted advertising purposes. ## Article 10 (Criteria for Additional Use and Provision of Personal Information) Studio may use and provide personal information without the data subject's consent under Article 15, Paragraph 3, and Article 17, Paragraph 4 of the Personal Information Protection Act and Article 14-2 of the Enforcement Decree of the Personal Information Protection Act. In this case, we consider the following: * Whether the purpose of using and providing personal information is relevant to the original collection purpose. * Whether there is a predictability of additional use and provision based on the personal information collection context or processing practice. * Whether additional use and provision of personal information unfairly infringe upon the data subject's interests. * Whether necessary measures such as anonymous processing or encryption have been taken to secure safety. ※ Criteria for judgment on additional use and provision should be determined and disclosed by the business/organization itself. ## Article 11 (Matters related to the personal information protection manager) 1. Studio takes responsibility for overseeing the processing of personal information, and designates the following personal information protection manager in charge of handling complaints and resolving any issues related to the processing of personal information: * Personal Information Protection Manager * Name: Baek Un-yeong * Position: Manager * Title: CEO * Contact: +821099721362, * Connects to the Personal Information Protection Department 2. If the data subject has any inquiries, complaints, or requests for relief related to the protection of personal information while using Studio's services or businesses, they can contact the personal information protection manager or department. Studio will respond and process the inquiry without delay. ## Article 12 (Department Receiving and Processing Requests for Personal Information Access) Data subjects can request access to personal information under Article 35 of the Personal Information Protection Act to the following department. Studio will make every effort to ensure that personal information access requests are promptly processed. * Department Receiving and Processing Requests for Personal Information Access * Department Name: Development Team * Contact Person: Baek Un-yeong * Contact: +821099721362, ## Article 13 (Remedies for Infringement of Data Subject's Rights and Interests) Data subjects can apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency's Personal Information Infringement Report Center, or other institutions related to personal information infringement. In addition, any person whose rights or interests have been infringed by the disposition of a public institution as specified under Article 35 (Request for Personal Information Access), Article 36 (Request for Correction or Deletion of Personal Information), or Article 37 (Request for Suspension of Personal Information Processing) of the Personal Information Protection Act, or by the act of an official in charge thereof, may demand administrative relief under the Administrative Litigation Act. For more information on administrative litigation, please refer to the website of the Central Administrative Appeals Commission ([www.simpan.go.kr](http://www.simpan.go.kr)). ## Article 14 (Changes to Privacy Policy) 1. This privacy policy shall be effective from March 1, 2023.