FRAMEZ Privacy Policy

Article 1 (Purpose)
Gala Lab Corp. (hereinafter referred to as 'the Company', ‘We’, ‘Us’, or ‘our’) establishes the following Privacy Policy (hereinafter referred to as the ‘Privacy Policy’ or 'Policy') in order to protect the information (hereinafter referred to as 'personal information') of individuals who use (hereinafter referred to as 'users' or 'individuals') the services provided by the Company (hereinafter referred to as the 'Company's services'), to comply with relevant laws and regulations, and to promptly and smoothly handle grievances related to the protection of personal information of service users.
This Privacy Policy applies to members who use the Company's services and informs them of the purpose and manner in which the personal information provided by members is used and what measures the Company is taking to protect personal information. It also serves as a means to ensure the members' right to self-determination of personal information by stipulating the relationship of rights and obligations between the Company and members in relation to personal information.

Article 2 Scope of the Privacy Policy
1. For the purposes of this Privacy Policy, the Company shall be the personal information processor.
2. This Privacy Policy applies to all personal information collected by the Company, regardless of country or region.
3. The Company may apply additional terms in individual privacy policies or in this Privacy Policy for certain services or features as necessary. If there is any contradiction between this Privacy Policy and the individual privacy policy, the individual privacy policy shall prevail.

Article 3 Collection of Personal Information, Purpose of Use and Items
1. The Company collects the following personal information through legal and fair methods:
1.1 Personal information collected from users with their consent or in accordance with relevant laws and regulations
1.2 Personal information related to the use of the Service (including personal information generated through the use of the Service)
1.3 Personal information other than the above that has been collected lawfully, including when collected from third parties 
If the Company is unable to collect or receive personal information that is essential for the Company to provide the Service, you will not be able to access the Service.

2. Personal information collected from users with their consent or in accordance with relevant laws and regulations
2.1 The Company collects personal information at the time the user enter it by operating the device to use the Service or provide it through written or other media.
2.2 Registration and Profile Information: If you link your social media or third-party account to create an account, you will receive an email and nickname from that third-party service.
2.3 Purchase Information: Purchase Information includes records relating to the purchase of content provided by the Services. This includes information such as the content or product purchased, the amount, purchase time, and quantity. Payment is processed through an external payment processor (PG), and the Service does not directly collect and store sensitive information such as credit card numbers or bank accounts.
2.4 Communications. If you contact us directly, we may collect additional information about you depending on the purpose of your contact. For example, when you contact us, we will ask you for your nickname and email address, the nature of your inquiry, attachments if necessary, and any other information you choose to provide.

3. Personal Information related to use of the Services (including Personal Information Generated through use of the Services)
The Company collects information about your activities when you use the Services, including information about the device you use and how you use it.
3.1 Location Information: The Company infers your general location information (e.g., your access IP address may indicate your approximate geographic location).
3.2 Device Information: The Company collects information about your device, browser (including device type, OS, language and time zone settings, browser type, advertising identifiers that identify your device or browser, and device identifiers) or network information (IP address).
3.3 Usage Information: The Company automatically collects information about your interactions with the Services. This information may include the date and time you use the Services and content we provide, your navigation within the Services, and your usage behavior, such as the content or advertisements you view, tap, or click on.
3.4 Information from Cookies and Third-party SDKs: The Company may use cookies and software development kits (SDKs) provided by third parties for the purposes described in this Privacy Policy.

4. Personal information other than the above that has been collected lawfully, including when collected from third parties
As of the effective date of this Privacy Policy, we do not collect ongoing or bulk personal information about you from third parties to provide the Services.
If such collection occurs in the future, we will disclose and guide you through the revision of the Privacy Policy.

Article 4 Purpose of Use of Personal Information
The Company uses the information collected for the following purposes:
1. To provide, maintain, improve and develop the Company's services
2. To perform services requested by users, such as responding to users' comments, questions, and requests and processing refunds
3. To maintain connections with social media or third-party services and applications
4. Develop services or content that may be useful, relevant, or otherwise of interest to the users
5. Personalize your experience on the Services, such as by recommending tailored content to you
6. To analyze trends, usage and activity on the Services
7. To send you necessary notifications (such as technical announcements, security alerts, service support and administration)
8. To facilitate your purchase and payment for paid content or features offered on the Service
9. To prevent violations of our Terms of Services or Operating Policies and any misuse, threats, or damage to the Services and to respond to any trust and safety issues that may arise
10. For compliance purposes, including enforcement of our Terms of Services, Operating Policy, this Privacy Policy, other agreements with you, or other legal rights, or to comply with applicable law, or as otherwise required by law or in good faith by legal process or governmental authorities
11. (In the case you have consented to receive advertisement) To send you promotions and advertisements of content or features that may be of interest to you and to measure their effectiveness
12. For other purposes that we specifically notify and disclose at the time of collection of your personal information

Article 5 Provision of Personal Information to Third Parties
1. Provision to third parties with user consent
With the consent of the user, the information of the user or the user's device may be provided.
2. Entrustment
2.1 The Company may entrust some tasks necessary for the provision of the Service (e.g. infrastructure construction and operation, development, payment, customer support, etc.) to a third party. In this case, all or part of your Personal Data may be transferred to the country or region in which the entrusted party is located.
2.2 To this end, the Company controls that only the minimum necessary personal information is entrusted and accessed, and manages that personal information is not processed beyond the scope of the entrusted business.
2.3 The Company reviews the compliance of the service provider before entrusting the service, concludes a contract to ensure compliance and supervise management, and establishes a system that complies with the system for protecting personal information in the country where the service provider is located and is properly managed.
2.4 The Company entrusts an external specialized company as follows to fulfill the service.
Entity Entrusted: Toss Payments Co.,Ltd.
Contact : support@tosspayments.com
Details of entrusted business: Payment agency business
Period of retention and use of personal information: Until withdrawal of membership or termination of consignment contract

3. Compliance with relevant laws and regulations and provision by legal procedures in connection therewith
3.1 The Company may disclose and provide the User's information if it receives a legal process or equivalent request from a government agency such as a warrant or court order in accordance with the relevant laws and regulations.
3.2 Provision may be made to protect the rights, property, and safety of the Company, the User, or a third party.

4. Provision as part of a business succession
In the event of a business-to-business transaction involving the Company Services covered by this Privacy Policy, such as an acquisition, merger, or change in business ownership, your personal information may be transferred to the business successor to fulfill the purposes for which it was originally used, to the extent applicable under the applicable jurisdiction.

Article 6 Retention, use period and destruction of personal information
1. Retention and use period of personal information
1.1 The Company retains personal information in order to provide the Service as requested by the User, to fulfill the purposes of use disclosed in this Privacy Policy, or to comply with applicable laws.
1.2 Unless the user withdraws from the service, the Company retains most of the user's personal information in principle.
1.3 If you withdraw from the Service, we will retain your personal information for a certain period of time for the following purposes in accordance with applicable laws and internal regulations.
1.4 In the case of relevant laws and regulations
a. To handle user complaints or disputes
b. Records of payments and supply of goods in connection with the Service
c. Records on the withdrawal of subscription or subscriptions related to the Services
1.5 In case of internal regulations
Investigation and sanction of misuse and abuse of company services

2. Destruction of Personal Information
2.1 In principle, the Company shall destroy the user's personal information without delay when the purpose of use is achieved, such as when the user withdraws from the service, terminates the service, or ends the retention period agreed to by the user.
2.2 If personal information is retained for a certain period of time in accordance with relevant laws and internal regulations, it shall be separated and managed separately.
2.3 If personal information is recorded and stored in the form of electronic files, it shall be destroyed using technical methods so that the data cannot be reproduced.
2.4 If personal information is recorded and stored in printouts such as paper documents, it is to be destroyed by shredding or incineration.

Article 7 Storage of Personal Information
1. The Company primarily stores users' personal information on local servers operated by Gala Lab Corp. for service provision. For certain service operations and data processing, overseas servers (e.g., Google Cloud) may be utilized.  
In such cases, the Company implements protective measures in accordance with relevant laws and regulations to ensure the secure management of personal information.

Article 8 Personal Information of Children

1. The Company must obtain the consent of the legal representative to collect personal information of children under the age of 16.
If there is no consent, the child's membership registration is restricted.

2. If the Company is aware of or receives a report that a child has provided personal information without the consent of a legal representative, the Company shall take reasonable measures to deactivate the account and immediately delete the personal information of the child and legal representative in accordance with relevant laws and regulations. 


Article 9 Safe Management of Personal Information
1. The Company shall make reasonable efforts to safely manage the personal information it collects.
2. The Company takes strict security measures organizationally, humanly, physically, and technologically, and reviews and applies to the internal regulations and this Privacy Policy in accordance with relevant laws and internal and external environmental changes to continuously improve the protection of personal information.
3. The Company shall not provide any third party with any means of unauthorized access to any service data, including personal information collected by the Company.
4. In the process of processing personal information to achieve the purpose of use, if pseudonymization or anonymization is possible, it shall be managed through such processing, and important personal information required by relevant laws and regulations or as determined by the Company shall be managed as encrypted data.
5. Important data is backed up and managed from time to time to prevent damage to personal information, and an antivirus program that is periodically updated is installed and operated to prevent infection with malware or viruses.

Article 10 Rights and Obligations of the User
When we process your personal information, to the extent permitted by applicable law, you have rights regarding your personal information, such as the right to access or correct your personal information. If you wish to exercise any of these rights, you may do so through the functionality provided by the Company within the Service or by contacting the following:
- Department in charge : framez@galaglobal.com
1. User's Obligations (Security)
1.1 Users are obligated and responsible for complying with applicable laws and regulations to keep their personal information safe.
1.2 The Company shall not be liable for any events caused by the User's own negligence. Therefore, the User is obligated and responsible for periodically changing the Service account and password to protect their personal information and for safely managing the User's device.
1.3 In the event that the linked social media or third-party account is leaked (exposed) or hijacked, the User is responsible for changing the password of such account immediately.

2. User's Obligations (Personal Information)
2.1 You are responsible for entering and maintaining your personal information accurately and always up to date. You are responsible for any issues arising from your inaccurate information.
2.2 If the User infringes or steals the personal information of another person and uses the Service, the User may be punished in accordance with the relevant laws and regulations in addition to losing the right to use the Service.


Article 11 Other Important Matters
1. If you have any questions about this Privacy Policy or any questions, grievances, consultations, opinions, etc. related to the processing of personal information on the Service, please contact the following:
- Department in charge: framez@galaglobal.com

2. The Company may provide links to other companies' websites or materials as necessary in the course of providing the Service to users. In this case, the Company is not responsible for and cannot guarantee the usefulness of the services or materials provided through the external websites, as the Company has no control over the external websites and materials. Therefore, this Privacy Policy does not apply to your visit to the external websites and the overall activities processed through such websites.


Addendum to the Privacy Policy

The Company is disclosing this Privacy Policy to provide you with easy and transparent information about what information we collect from you or through third parties in providing our services, what purposes we use the collected personal information for, and how and when we destroy the personal information after fulfilling the purpose of use.
The general and principal contents can be found in the main body of the Privacy Policy, and this Appendix provides additional disclosures required by regulations related to personal information protection in relation to laws and regulations applicable.

Article 1 Collection, Purpose of Use, and Items of Personal Information
The Company collects the minimum personal information necessary for the establishment and fulfillment of the service use contract as follows, and provides the contents of the consent to the collection and use of personal information at the time of membership registration, and when the member clicks the 'Agree' button, the member is deemed to have agreed to the collection and use of personal information.

1. Required Personal Information Collection

    

        
2. Optional Personal Information Collection

    

3. Other Collected Information
3.1 The following information may be generated and collected in the process of using the Service. 
- Service usage records, service access records, cookies
- Information that can identify the device (OS information, hardware information, device ID)
3.2 The information collected by automatic generation is in a form that does not identify individuals, and the Company does not conduct activities to identify individuals by utilizing the collected information.
3.3 Please refer to Articles 9 and 10 for details of the information collected by automatic generation and how to refuse collection. 

4. The Company does not request personal information that may violate basic human rights (such as race and ethnicity, ideas and beliefs, origin and place of birth, political affiliation and criminal record, health status and sexual life), and does not collect or use it for any purpose other than the above. 

Article 2 Personal Information Processing and Retention Period
1. The Company shall retain personal information in order to provide the services requested by the user, fulfill the purposes of use disclosed in this Privacy Policy, or comply with relevant laws and regulations.
2. Unless the user withdraws from the service, the Company retains most of the user's personal information in principle.
3. If you withdraw from the service, we will retain your personal information for a certain period of time for the following purposes in accordance with relevant laws and internal regulations.
- As required by applicable laws and regulations

    

- In case of internal regulations: Records on investigation and sanction of misuse and abuse of company services

Article 3 Procedures and methods for destroying personal information
1. In principle, the Company destroys the personal information of users without delay when a user withdraws from the service, terminates the service, or achieve the purpose of use, such as the end of the retention period agreed to by the user.
2. If personal information is retained for a certain period of time in accordance with relevant laws and internal regulations, it shall be separated and managed separately.
3. If personal information is recorded and stored in the form of electronic files, it shall be destroyed using technical methods so that the data cannot be reproduced.
4. If personal information is recorded and stored in printouts such as paper documents, it shall be destroyed by shredding or incineration.

Article 4 Provision of Personal Information to Third Parties
1. In principle, the Company does not provide personal information to third parties beyond the purpose of use or without the consent of the user.
2. If the Company intend to provide your personal information to a third party, we will clearly inform you and obtain your consent in accordance with the procedures required by relevant laws and regulations.
3. However, the Company may provide personal information to a third party without your consent if there is an explicit basis in the relevant laws and regulations.
3.1 If there is a special provision in the law or it is inevitable to comply with the obligations under the law
3.2 (To the extent not exceeding the scope of the purpose of collecting personal information) If it is clearly recognized as necessary for the urgent interests of the life, body, or property of the information subject or a third party 
3.3 (To the extent not exceeding the scope of the purpose of collecting personal information) When it is necessary to achieve the legitimate interests of the Company and clearly overrides the rights of the data subject (but only if it is substantially related to the legitimate interests of the Company and does not exceed a reasonable scope)

Article 5 Entrusting of Personal Information Processing
1. In order to provide better services to users, the Company may entrust some of the personal information processing tasks if necessary.
2. When the Company entrusts a part of the personal information processing work, the Company shall reflect the responsibilities and standards to the entrustee through documents such as contracts and require the entrustee to comply with the laws and regulations related to personal information and the protective measures required by the Company.
3. When the entrustee re-entrusts the Company's personal information processing business, the Company obtains the consent of the entrustee.
4. The Company regularly manages and supervises the entrustee's safe processing of personal information based on documents such as contracts. However, the level of management and supervision shall be differentiated in consideration of the size and security level of the entrustee.

Article 6 Overseas Transfer of Personal Information
1. In order to provide better services to users, the Company may entrust the processing and storage of personal information collected from users overseas as follows.
2. Users have the right to refuse the overseas transfer of personal information, and can refuse the overseas transfer of personal information through the personal information protection officer and the department in charge of personal information protection. 
3. If a user refuses the overseas transfer of personal information, the Company shall exclude the user's personal information from the overseas transfer. However, in this case, considering the nature of the service that necessarily involves the overseas transfer of personal information, the user will not be able to use the service.

Article 7 Rights of Users and Legal Representatives and Methods of Exercise
1. Users may view or modify their personal information at any time, and may withdraw the processing of their personal information through the membership withdrawal procedure.
2. Users may also exercise their rights in accordance with the methods prescribed by relevant laws and regulations other than the methods provided by the Company within the Service. Users may also file an objection in this regard. The contact information for this purpose is as follows
- Contact: framez@galaglobal.com
3. If you wish to exercise your rights in a manner prescribed by applicable laws and regulations, the Company will verify that the person exercising the rights is the user or a legitimate representative.
4. Even if the user exercises the rights guaranteed by the relevant laws and regulations, the request may be denied if there is a legitimate reason, such as compliance with obligations under other laws and regulations.
5. The Company does not provide services to children who require the consent of a legal representative as disclosed in “Personal Information of Children.” However, if a child has provided personal information to the Company in violation of this Privacy Policy, the legal representative may exercise rights on behalf of the child by contacting the Company.

Article 8 Personal Information of Children Under 16
The Company must obtain the consent of the legal representative (consent through mobile phone authentication of the legal representative) when collecting personal information of children. If the legal representative does not consent, the child will not be able to register, and all personal information of the child and the legal representative will be immediately destroyed.  

Article 9 Remedies for infringement of rights and interests
1. The information subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency's Personal Information Protection Reporting Center, etc. to receive relief due to personal information infringement. In addition, please contact the following organizations for other personal information infringement reports and consultations.
- Personal Information Dispute Mediation Committee: www.kopico.go.kr
- Personal Information Infringement Report Center: privacy.kisa.or.kr
- Supreme Prosecutors' Office: www.spo.go.kr
- National Police Agency: ecrm.cyber.go.kr
2. The Company guarantees the right of self-determination of personal information of the information subject, and strives to provide counseling and damage relief due to personal information infringement, and if you need to report or consult, please contact the department in charge below.
- Contact: framez@galaglobal.com

Article 10 Personal Information Protection Officer and Department in Charge of Personal Information Protection
1. The Company is responsible for the processing of personal information in general, and appoints the person in charge of personal information protection as follows to handle complaints and damage relief of information subjects related to the processing of personal information.
1.1 Personal information protection officer and person in charge
- Name: Namsung Lee
- Affiliation : Strategic Planning Department
- Contact : framez@galaglobal.com

2. Users may contact the person in charge of personal information protection and the department in charge for all personal information protection-related inquiries, complaints, and damage relief arising from the use of the services provided by the Company. The Company will answer and process the user's inquiry without delay.

Article 11 Installation/Operation and Rejection of Automatic Personal Information Collection Devices
1. The Company uses 'cookies' that store and retrieve usage information from time to time to provide personalized and customized services to users.
2. Cookies are very small text files sent to the user's browser by the server used to operate the website and are stored on the user's computer's hard disk or mobile. 
3. Cookies do not automatically or actively collect personally identifiable information, and you can refuse the storage of these cookies or delete them at any time.
4. You have a choice about the installation of cookies. By setting the options in your web browser, you can accept all cookies, confirm each time a cookie is stored, or refuse to store all cookies. However, if you refuse to save cookies, you may have difficulty using some services that require you to log in.
5. You can specify whether to allow cookies to be installed as follows
- Chrome: Settings menu > Privacy and Security> Third-party cookies
- Firefox: Options menu > Privacy & Security > Cookies and Site Data
- Safari: Preferences menu > Privacy tab > Cookie and website data
- Microsoft Edge: Settings > Privacy, search, and services> Cookies
- Whale: Settings menu > Privacy > Security > Third-party Cookies
- Android: Launch home screen internet browser > More > Settings > Privacy & security > Accept cookies
- iOS: Settings > All Apps > Safari > Advanced

Article 12 Handling of Behavioral Information
1. The Company collects and uses behavioral information to provide optimized services to users. 
2. Behavioral information collected in accordance with this Privacy Policy is not used for customized advertisements, but is used for research on basic materials necessary for improving service performance and quality and content development.
3. When collecting user behavioral information, the Company does not collect sensitive behavioral information that may clearly infringe on the privacy of users, such as race, religion, politics, sexual orientation, or medical history, and does not make any inferences.
4. The handling of behavioral information is as follows.
- Items of Behavioral Information Collected: User's activity information within the Service
- Method of collecting behavioral information: automatically generated and transmitted in the process of using the Service
- Purpose of collecting behavioral information: Improvement of service performance and quality, research on basic data necessary for content development
- Period of retention and use of behavioral information: Until withdrawal from the service
- How to exercise user control: Web browser (Chrome / Firefox / Safari / Microsoft Edge / Whale), smartphone (iOS / Android)
5. Remedies for user damage
If you have any questions about behavioral information, please contact us below and we will respond and reply.
- Contact : framez@galaglobal.com