Noh Ji-Hye (“the Company”) complies with the Personal Information Protection Act and all applicable regulations to protect the freedom and rights of data subjects, legally processing and managing personal information safely. Pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses the following privacy policy to inform data subjects about the procedures and standards for processing personal information and to handle related grievances promptly and smoothly.

① The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act, will be taken.
② The Company processes personal information for the purpose of membership registration and management. This includes confirming the intention to register, identification and authentication for providing membership services, maintaining and managing membership qualifications, preventing fraudulent use of services, confirming the consent of a legal representative when processing personal information of children under 14, providing various notices and notifications, and handling grievances.
③ The Company processes personal information for the purpose of providing goods or services. This includes the provision of Muslim-friendly beauty and wellness services, private dining, night tours, halal-certified experiences, sending contracts and invoices, providing content, offering customized services, authentication, age verification, payment and settlement, and collection of receivables.
④ The Company processes personal information for the purpose of handling grievances. This includes verifying the identity of the data subject, checking complaint matters, making contact and notifications for factual investigation, and notifying the results of processing.
⑤ The Company processes personal information for marketing and advertising purposes. This includes developing new products and customized services, providing event and promotional information and participation opportunities, providing services and advertisements based on demographic characteristics, verifying service effectiveness, confirming access frequency, and compiling statistical analysis of service use by members.
⑥ The Company processes personal information for the purpose of service improvement and new service development. This includes analyzing usage patterns of existing services, compiling statistics for quality improvement, planning and developing new services, conducting user satisfaction surveys, and responding to or recovering from service failures.

① The Company processes and retains personal information within the personal data retention and usage periods stipulated by law or agreed to by the data subject when collecting the personal information.
② Personal information collected and used for membership registration and management is retained and used from the date of consent for collection and use until membership withdrawal. However, certain information will be retained for the periods specified below for the following reasons.
③ Retention periods required by the Act on the Consumer Protection in Electronic Commerce are as follows:Records of contracts or withdrawals: 5 yearsRecords of payment and supply of goods, etc.: 5 yearsRecords of complaints or dispute resolution by consumers: 3 yearsRecords of advertisements and labeling: 6 months
④ Retention periods required by the Protection of Communications Secrets Act: Website visit records (login records, access tracing data) are retained for 3 months.
⑤ Retention periods required by the National Tax Basic Act: All transaction books and supporting documents required by tax law are retained for 5 years.

① The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and only provides it to third parties if corresponding to Article 17 or Article 18 of the Personal Information Protection Act, such as with the consent of the data subject or if specially specified by law.
② Provision of personal information to partner businesses is as follows. Recipients: beauty shops, wellness centers, restaurants, travel agencies, experience providers on the platform. Information provided: name, mobile phone number, email address, reservation details (date/time, number of people, special requests). Purpose: providing reservation service, customer verification and contact, guidance on service use. Retention and usage period: 3 years after completion of service provision.
③ Provision of personal information to payment agencies is as follows. Recipients: Eximbay and other payment gateway providers. Information provided: name, mobile phone number, email address, payment information (card number, payment amount). Purpose: payment processing, confirmation and cancellation, fraud prevention. Retention and usage period: 5 years under the Act on the Consumer Protection in Electronic Commerce.
④ Provision under law: Personal information may be provided when required by investigative agencies for investigational purposes according to legal procedures and methods, for statistical compilation purposes required by Statistics Korea, or as otherwise required by related laws or procedures.
⑤ For provision to third parties, the Company will inform the data subject of the recipient, the purpose of use, the items to be provided, and the retention and usage period in advance, and obtain consent.

① The Company entrusts the following personal information processing tasks for smooth operations:
② Entrustment to cloud service providers is as follows. Trustee: Gabia Inc. (Korea). Entrusted tasks: server hosting, data storage and backup, system operation management. Personal information items: all member information (name, contact info, email, service usage records, etc.). Retention and use period: until end of entrustment contract or upon request for deletion.
③ Entrustment to payment service providers is as follows. Trustees: Eximbay and other payment processors. Entrusted tasks: credit card payment processing, refund processing, provision of payment security services. Personal information items: name, contact information, email, credit card information. Retention and use period: 5 years after completion of payment (per relevant laws).
④ Entrustment to customer support service providers is as follows. Trustees: WhatsApp Inc. (USA) and other messenger service providers. Entrusted tasks: customer consultation, inquiry response, guidance on services. Personal information items: name, contact information, consultation content. Retention and use period: 3 years after conclusion of consultation.
⑤ Entrustment to marketing service providers is as follows. Trustees: email dispatch providers, SMS dispatch providers, ad platform providers. Entrusted tasks: dispatch of emails and SMS, provision of customized advertisements, marketing analytics. Personal information items: name, contact information, email, service usage patterns. Retention and use period: until the achievement of marketing purpose or upon consent withdrawal.
⑥ Upon entering into an entrustment contract, the Company specifies matters regarding prohibition of personal data processing for reasons other than for the entrusted task, technical and managerial protection measures, limitations on sub-entrustment, management and supervision of trustees, liability for damages, etc., in accordance with Article 26 of the Personal Information Protection Act, and supervises whether trustees handle personal information safely.
⑦ Any changes to the entrusted task or the trustee will be disclosed through this privacy policy without delay.

① The data subject may at any time exercise the following rights with regard to the protection of personal information against the Company.
② The data subject may exercise the right to request access to personal information. The data subject may request access to the personal information processed by the Company, and the Company will ensure that access is granted without delay unless there is a valid reason otherwise.
③ The data subject may exercise the right to request correction or deletion of personal information. If there is an error or similar in the personal information processed by the Company, the data subject may request correction or deletion. However, if the information is specified by another law as a subject of collection, deletion cannot be requested.
④ The data subject may exercise the right to request suspension of processing of personal information. The data subject may request suspension of processing of their personal information being processed by the Company. However, the request for suspension may be refused if there are special provisions in the law, if necessary to fulfill legal obligations, if there is a risk of harm to another person’s life or body, or if there is a risk of unjustly infringing the property or other interests of another person.
⑤ Exercise of the rights above may be made in writing, by email, or by fax in accordance with Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay. Such rights may be exercised through a legal representative or an agent such as a delegated person of the data subject. In such cases, a power of attorney must be submitted in the form stipulated in the “Notice on the Methods of Processing Personal Information” (Notification No. 2020-7), Annex 11.
⑥ Requests for access or suspension of the processing of personal information may be restricted under Article 35 Section 4 and Article 37 Section 2 of the Personal Information Protection Act. The Company confirms whether the requester is the data subject or a legitimate representative when the requests for access, correction/deletion, or suspension of processing are made.

① The items of personal information collected at the time of membership registration and management are as follows. Required items: name, mobile phone number, email address, password, date of birth, gender. Optional items: profile photo, nationality, religion (Muslim status), travel preferences.
② The items of personal information collected for the provision of goods or services are as follows. Required items: name, mobile phone number, email address, payment information (credit card number, expiration date, CVC), reservation information (type of service, date and time of use, number of people). Optional items: special requests, companion information.
③ The items of personal information collected when writing reviews or testimonials are as follows. Required items: author information (member ID), rating, review content, date and time written. Optional items: nickname, review photos.
④ The items of personal information collected for social login are as follows. For Google login: name, email address, profile photo. For Apple login: name (optional), email address (or masked email). For Facebook login: name, email address, profile photo.
⑤ The following personal information items are automatically collected: access IP address, cookies, MAC address, service usage records, visit records, abnormal usage records, device information (OS type, app version, device model name), location information (GPS coordinates).
⑥ For marketing utilization, the following personal information may be collected: service usage patterns, interests, preferences, purchase history, access frequency, ad click history. These are collected with separate consent.
⑦ For the handling of sensitive personal information, separate consent from the data subject will be obtained, and information such as religion (Muslim status), country of origin, or race, will be collected only when necessary due to the characteristics of the service and only to the minimum extent required.

① The Company immediately destroys personal information when the retention period has passed or the processing purpose has been achieved and the information becomes unnecessary.
② If personal information retention period agreed by the data subject has expired or the processing purpose is achieved but personal information must continue to be preserved under another law, the information will be moved to a separate database (DB) or stored in a separate location.
③ The procedures for destroying personal information are as follows. The Company selects personal information to be destroyed and destroys it with the approval of the Company’s personal information protection officer. The data subject will be notified of the destruction schedule of relevant personal information in advance of destruction, and a period for raising objections will be given to collect opinions.
④ Methods of destruction: Electronic files are permanently deleted using technical methods that make records unrecoverable. Paper documents are shredded or incinerated. Backup data is also deleted.
⑤ Regular destruction schedules and cycles are performed quarterly, and emergency destruction procedures are implemented immediately if there is an urgent request. After completion, a separate log of the destruction target, date, method, person in charge, etc. is kept.
⑥ Where preservation is required by law, the information is retained separately for the legally stipulated period and managed separately.

① The Company takes technical, managerial, and physical measures necessary to ensure the safety of personal information in accordance with Article 29 of the Personal Information Protection Act.
② The number of personnel handling personal information is minimized and education is provided. Only designated staff handles personal data, and regular training is provided to enhance awareness of personal data protection, including regular monitoring of training completion.
③ Internal management plans are established and implemented. Such plans include assigning responsibilities for personal information protection and detailing required safety measures.
④ Personal information is encrypted. User passwords are encrypted and stored so only the user can access them. Important data is encrypted or locked before storage or transmission, and secure encryption algorithms are applied for sensitive data such as credit card details, with encryption keys kept separately.
⑤ Technical measures against hacking and computer viruses are taken. Security programs are installed and periodically renewed and inspected to prevent data leaks or damage. Systems are installed in access-controlled areas and are technically and physically monitored and blocked.
⑥ Access to personal information is restricted. Authorization for database system access is granted, changed, or revoked as necessary, with external access controlled by security systems. Access rights are limited to the minimum required for duty, and changes require the approval of the personal information protection officer.
⑦ Connection logs are maintained for at least one year (or two years if processing information of 50,000 or more subjects, or unique/sensitive data), and security features are used to prevent tampering, theft, or loss of access logs.
⑧ Physical security: Documents, storage devices, etc. containing personal information are stored in a securely locked place. Access control procedures are established and operated for physical storage locations.

① The Company is wholly responsible for personal information processing affairs, handling data subject complaints, and remedying infringements, and appoints the following as personal information protection officer.
② Protection Officer: Noh Ji-Hye, Title: CEO, Contact: +82-10-5912-0086, Email: thisis@easyplate.co. (To be changed to CTO in future, with advance notice through this policy.)
③ Personal Information Protection Department: Operations Team, Person in Charge: Noh Ji-Hye, Contact: +82-10-5912-0086, Email: thisis@easyplate.co.
④ Data subjects may direct all privacy-related inquiries, complaints, and remedies arising in the course of using the Company’s services or business to the protection officer or department; the Company will respond and process requests promptly.
⑤ Overseas user support: The Company provides consultation via WhatsApp (ID: gloamkorea), with available hours from 10:00 to 19:00 Saudi time (16:00 to 01:00 Korean time). Service is offered in English, and interpretation is provided if needed.
⑥ Roles of the protection officer include establishing and implementing privacy protection plans, reviewing the status and actual state of processing, overseeing those handling personal information, receiving and handling complaints, reporting and responding to breaches, and establishing and implementing privacy training plans.

① This privacy policy applies from the effective date, and any addition, deletion, or revision of the policy according to laws or company policy will be announced through notices at least seven days prior to implementation.
② In the event of changes disadvantageous to data subjects, notice will be made at least 30 days prior to implementation by email, service notifications, or website notices.
③ When the privacy policy is changed, the changed policy comes into effect from the effective date, and the previous policy has effect until the change.
④ If the data subject disagrees with the amended privacy policy, he or she may withdraw consent by canceling membership. Continued use of the service after the effective date constitutes agreement to the amended terms.
⑤ The Company will notify the reason for changes, summary of content, effective date, the data subject’s rights, and the way to exercise those rights when the policy is changed.

① The data subject may seek dispute resolution or counseling for personal information infringement by contacting the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center, etc.
② Personal Information Dispute Mediation Committee: ☎1833-6972, www.kopico.go.kr
③ Personal Information Infringement Report Center: privacy.go.kr
④ Supreme Prosecutors' Office Cybercrime Investigation Division: ☎1301, www.spo.go.kr
⑤ National Police Cyber Investigation Center: ☎1566-0112, www.netan.go.kr
⑥ Remedy, counseling, and complaints for infringement of personal information may be filed with the above organizations. Under Articles 35, 36, and 37 of the Personal Information Protection Act, if a data subject suffers infringement of their rights or interests due to an act or omission by the head of a public institution, they may file an administrative appeal as stipulated by the Administrative Appeals Act.
⑦ Overseas users may also report to the personal data protection agency in their home country; the Company will cooperate with those agencies for prompt resolution.

① The Company transfers personal information of data subjects overseas as follows, to provide smooth service.
② Cloud service: Recipient - Gabia Inc. overseas region servers (Asia-Pacific region). Contact: Gabia Customer Service 1588-3543. Items: all member information (name, contact, email, usage records, etc.). Purpose: server hosting, data storage/backup. Destination: Singapore, Japan, etc. Retention: during service use or until membership withdrawal.
③ Overseas messengers: Recipient - WhatsApp Inc. (USA). Items: name, contact, consultation contents. Purpose: customer support, service assistance. Destination: USA. Retention: 3 years after consultation ends.
④ Overseas analytics services: Recipient - Google LLC (USA). Items: usage patterns, connection logs, device info. Purpose: service analytics and improvement. Destination: USA. Retention: per Google Analytics policy.
⑤ Consent for overseas transfer can be revoked at any time; in such cases, use of the service may be restricted. Contact the data protection officer for withdrawal of consent.
⑥ Information about personal data protection systems and environments in destination countries can be found in the “Guidelines for Overseas Transfer of Personal Information” published by the Personal Information Protection Commission and on the Company website.
⑦ Special provisions for foreign users: If required by home country governmental request, the Company may provide information under relevant treaties and law, giving prior notice and opportunity for objection. Where there is a conflict between local law and Korean law, the more favorable provision for the data subject shall apply.
⑧ For users subject to GDPR or other foreign data protection laws, the Company will guarantee the same rights and cooperate with supervisory agencies as necessary.

① The Company processes personal information of children under 14 only with the consent of a legal guardian.
② When collecting personal information from children under 14, the minimum necessary information such as name and contact information of the guardian will be requested in order to obtain consent.
③ Confirmation of legal representative’s consent is conducted by one of the following: direct signature on an online consent form, mobile phone authentication of the legal guardian, or submission of ID copy and consent form.
④ Whether the user is under 14 is checked during reservation, and if so, the service is restricted unless legal guardian consent is confirmed.
⑤ Legal guardians may withdraw consent or request access, correction, deletion, or suspension of processing for the child’s personal information. The Company will act promptly upon such request.
⑥ Separate consent is obtained from a legal guardian before providing or entrusting children's personal information to a third party; children’s information is managed with stricter security measures than for adults.

① When location-based services are used, GPS information is collected andused only for nearby service search and route guidance purposes. Consent forlocation collection can be withdrawn at any time, but related service may berestricted.
② When operating a review and testimonial system, nicknames, ratings,content, and attached photos of reviewers are processed in order to help otherusers choose services. Review authors can request correction or deletion at anytime.
③ The Company processes push notification tokens, email address, andmobile number in order to provide notifications such as reservationconfirmation, service changes, and promotions. Users may opt out at any time.
④ When participating in events or marketing, the user’s name, contact, andevent participation history are collected for winner announcements, prizedelivery, and marketing purposes. All information is deleted after the eventends except where separate consent was given.
⑤ Informationcollected automatically via cookies and similar technology is processed tooptimize service, provide tailored advertisements, and prevent abuse. Cookiescan be managed via browser settings.