Amred Cosmetic Co., Ltd. (hereinafter referred to as the “Company”) establishes and discloses the following Privacy Policy in accordance with Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and to promptly and smoothly handle any related grievances.

Article 1 (Purpose of Processing Personal Information)
The Company processes personal information for the following purposes. The personal information being processed will not be used for any purpose other than those listed below. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Website membership registration and management
The Company processes personal information for the purposes of confirming intent to register as a member, providing member services, identifying and authenticating users for the provision of member services, maintaining and managing membership status, verifying identity under the limited identity verification system, preventing unauthorized use of services, confirming consent from legal representatives when processing personal information of children under the age of 14, providing notices and announcements, and handling grievances.

2. Provision of goods or services
The Company processes personal information for purposes such as delivering goods, providing services, sending contracts and invoices, providing content, offering customized services, identity verification, age verification, payment and settlement of fees, and debt collection.

3. Handling grievances
The Company processes personal information for the purposes of verifying the identity of complainants, confirming complaint details, contacting and notifying parties for fact-finding, and informing them of the results of grievance handling.

Article 2 (Processing and Retention Period of Personal Information)
① The Company processes and retains personal information within the retention and use period prescribed by law or within the period agreed to by the data subject at the time personal information is collected.
② The processing and retention periods for each category of personal information are as follows:

1. Website membership registration and management: Until withdrawal from the business/organization website
However, in the following cases, until the relevant matter is concluded:

1) If an investigation or inquiry is in progress due to a violation of applicable laws and regulations, until the investigation or inquiry is completed
2) If creditor-debtor relationships remain in connection with website use, until such relationships are settled



2. Provision of goods or services: Until the supply of goods/services and payment/settlement have been completed
However, in the following cases, until the relevant retention period expires:

1) Records concerning transactions such as display/advertising, contract details, and performance under the Act on Consumer Protection in Electronic Commerce, etc.

* Records on display/advertising: 6 months
* Records on contract or subscription withdrawal, payment, and supply of goods: 5 years
* Records on consumer complaints or dispute resolution: 3 years

2. Retention of communication fact confirmation data under Article 41 of the Protection of Communications Secrets Act

* Subscriber telecommunication date and time, start/end time, counterparty subscriber number, frequency of use, and location tracking data of the originating base station: 1 year
* Computer communication and internet log records, and connection trace data: 3 months

Article 3 (Rights of Data Subjects and Legal Representatives and Methods of Exercising Them)

① A data subject may exercise the following rights related to personal information protection with respect to the Company at any time:

1. Request access to personal information
2. Request correction in the event of errors, etc.
3. Request deletion
4. Request suspension of processing

② The rights under Paragraph 1 may be exercised in writing, by telephone, email, facsimile (FAX), etc., and the Company shall take action without delay.

③ If a data subject requests correction or deletion of personal information due to errors, etc., the Company shall not use or provide the relevant personal information until such correction or deletion has been completed.

④ The rights under Paragraph 1 may be exercised through a legal representative of the data subject or an authorized agent. In such case, a power of attorney in the form prescribed by Appendix Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤ Data subjects shall not infringe on their own or others’ personal information and privacy that is being processed by the Company in violation of the Personal Information Protection Act and related laws and regulations.



Article 4 (Items of Personal Information Processed)
The Company processes the following items of personal information:

1. Website membership registration and management
Required items:
Optional items:

2. Provision of goods or services
Required items:
Optional items:

Article 5 (Destruction of Personal Information)
① The Company shall destroy personal information without delay when the retention period has expired or the purpose of processing has been achieved and the personal information is no longer necessary.

② If personal information must continue to be preserved in accordance with other laws and regulations even though the retention period consented to by the data subject has expired or the purpose of processing has been achieved, the Company shall transfer such personal information to a separate database (DB) or preserve it in a different location.

③ The procedures and methods of destroying personal information are as follows:

1. Destruction procedure
The Company selects personal information for which grounds for destruction have arisen and destroys such personal information with the approval of the Company’s Chief Privacy Officer.
2. Destruction method
Personal information recorded and stored in electronic file format shall be destroyed in a manner that prevents the records from being restored. Personal information recorded and stored in paper documents shall be destroyed by shredding or incineration.

Article 6 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information:

1. Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.
2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
3. Physical measures: Access control to computer rooms and document storage rooms

Article 7 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)
① The Company uses cookies, which store and retrieve usage information from time to time, in order to provide users with customized services.
② Cookies are small pieces of information sent by the server (HTTP) used to operate the website to the user’s computer browser and may be stored on users’ PCs or mobile devices.
③ Data subjects may allow or block cookies by changing their web browser settings. However, if cookie storage is refused, it may be difficult to use customized services.

▶ Allowing/Blocking Cookies in Web Browsers

* Chrome: Web browser settings > Privacy and security > Clear browsing data
* Edge: Web browser settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allowing/Blocking Cookies in Mobile Browsers

* Chrome: Mobile browser settings > Privacy and security > Clear browsing data
* Safari: Mobile device settings > Safari > Advanced > Block all cookies
* Samsung Internet: Mobile browser settings > Browsing history > Delete browsing history

④ In the course of providing services, the Company collects and uses information such as the user’s visit and usage patterns for each service and website, popular search terms, and whether secure access is used, in order to provide optimized information to users.



Article 8 (Chief Privacy Officer)
① The Company designates the following person as the Chief Privacy Officer to take overall responsibility for personal information processing and to handle complaints and provide remedies related to personal information processing:

▶ Chief Privacy Officer
Name: Hae-yong Jeong
Title: CEO
Contact: <02-543-3110>
※ You will be connected to the department in charge of personal information protection.

▶ Department in Charge of Personal Information Protection
Department: Business Planning Team
Contact: <02-543-3110>, [zavy.xy.lfestyle@gmail.com](mailto:zavy.xy.lfestyle@gmail.com)

② Data subjects may contact the Chief Privacy Officer and the responsible department regarding all inquiries, complaints, and remedies related to personal information protection arising while using the Company’s services (or business). The Company will respond to and process such inquiries without delay.

Article 9 (Remedies for Infringement of Rights and Interests)
Data subjects may contact the following institutions for damage relief and consultation regarding personal information infringement:

1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 ([www.kopico.go.kr](http://www.kopico.go.kr))
2. Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors’ Office: (without area code) 1301 ([www.spo.go.kr](http://www.spo.go.kr))
4. National Police Agency: (without area code) 182 (ecrm.police.go.kr/minwon/main)



Article 10 (Enforcement and Amendment of this Privacy Policy)
This Privacy Policy shall take effect on October 1, 2025.