Seoul's EPS-TOPIK Privacy Policy

Article 1Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information processed will not be used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Membership registration and management: identifying Members, confirming intent to join, verifying that a user is 14 years of age or older, preventing fraudulent use of the Service, and providing notices
2. Providing the Service: delivering learning content, storing and syncing learning records, analyzing learning level and providing personalized recommendations (AI tutor), and generating reports
3. Providing Paid Services: confirming in-app payment processing, managing purchase history, and processing refunds
4. Handling grievances: receiving inquiries and communicating outcomes
5. Marketing and advertising (optional): informing users about new features and events (only for Members who have consented)
6. Service improvement: analyzing usage statistics, error analysis, and quality improvement

Article 2Personal Information Collected and Collection Methods

1. Items collected

※ The Company does not directly collect financial information such as card numbers or bank account numbers. Payments are processed through the Google Play billing system.

※ If the Service is used before sign-up (in anonymous/guest mode), learning records are stored only on the user's device and are not transmitted to the Company's servers. However, service usage statistics and app error logs (de-identified information) may be collected from the first use of the app.

2. Collection methods

• Directly entered by the user during sign-up and while using the Service
• Collected through Google account linkage
• Automatically generated and collected while using the Service

Article 3Retention and Use Period of Personal Information

1. The Company processes and retains personal information within the retention/use period required by law or agreed to by the user.
2. The specific retention periods are as follows.
   • Member information and learning records: until membership withdrawal (account deletion); destroyed without delay upon withdrawal
   • E-commerce related records (retained under applicable law) — contract/withdrawal records: 5 years; payment/supply of goods records: 5 years; consumer complaint/dispute resolution records: 3 years
   • Service access records (Protection of Communications Secrets Act): 3 months

Article 4Provision of Personal Information to Third Parties

The Company processes users' personal information only within the scope specified in Article 1 and does not provide it to third parties without the user's prior consent, except in the following cases.

1. Where the user has given prior consent
2. Where required by law, or requested by an investigative agency in accordance with the procedures and methods prescribed by law for investigative purposes

Article 5Outsourcing and Cross-Border Transfer of Personal Information

The Company outsources the processing of personal information as follows for the smooth provision of the Service, and some processors handle personal information outside Korea. The learning data database (Cloud Firestore) is stored in a South Korea (Seoul) region.

2. These cross-border transfers are necessary for the use of cloud infrastructure essential to providing the Service. Users may contact the Data Protection Officer to object to the cross-border transfer of their information, though this may limit their ability to use the Service.
3. The Company supervises whether processors handle personal information safely in accordance with the Personal Information Protection Act when entering into outsourcing agreements.

Article 6Destruction Procedures and Methods (Account and Data Deletion)

1. The Company destroys personal information without delay once it becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.
2. When a user deletes their account in-app or requests deletion by email, account information and learning records are deleted immediately. However, information subject to a statutory retention obligation under Article 3, Paragraph 2 is separately stored for the applicable period before being destroyed.
3. Method of destruction: information in electronic file form is deleted using a technical method that prevents recovery; paper documents are shredded or incinerated.

Article 7Rights and Obligations of Users and Legal Representatives, and How to Exercise Them

1. Users may exercise their rights to access, correct, delete, or request suspension of processing of their personal information from the Company at any time.
2. Rights may be exercised through in-app features (profile editing, account deletion) or by written or email request to the Data Protection Officer, and the Company will act on such requests without delay.
3. Rights may also be exercised through a user's legal representative or an authorized agent.
4. Requests to access personal information or suspend its processing may be restricted under the Personal Information Protection Act.

Article 8Automatic Collection Devices and How to Opt Out

1. The Company may collect a device's advertising identifier (ADID) and app usage records for service usage analysis, error analysis, and the provision of advertising.
2. The Service offers rewarded advertising that members voluntarily choose to watch. In this process, the advertising provider (Google AdMob) may collect and use advertising identifiers, device information, and app usage records to serve ads and measure their performance.
3. The Company does not combine advertising identifiers with members' learning records to identify individuals.
4. Users may reset or delete their advertising identifier, or opt out of ad personalization, through their device settings (Android Settings > Privacy > Ads). Non-personalized ads may still be shown in that case.

Article 9Measures to Secure Personal Information

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: minimizing personnel with access to personal information, and establishing internal management plans
2. Technical measures: encryption of data in transit (HTTPS/TLS), access control, and application of Google Firebase security rules
3. Physical measures: use of the physical security systems of cloud infrastructure providers (Google)

Article 10Data Protection Officer

The Company designates a Data Protection Officer who is responsible for personal information processing and for handling users' complaints and remedying any harm related to personal information processing, as follows.

• Data Protection Officer: Minho Cho (Representative)
• Email: support.seoulepstopik@gmail.com

Users may direct all inquiries, complaints, and requests for remedy related to personal information protection that arise while using the Service to the Data Protection Officer. The Company will respond and act on such inquiries without delay.

Article 11Remedies for Infringement of Rights

Users may apply to the following institutions for dispute resolution or consultation to obtain remedies for personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)

Article 12Changes to This Privacy Policy

1. This Privacy Policy applies from its effective date.
2. Where content is added, removed, or amended, the Company will provide notice through an in-service announcement at least 7 days before the change. However, where there is a material change to matters such as the items collected or the purpose of use, affecting users' rights, notice will be given at least 30 days in advance.

Addendum

This Privacy Policy takes effect as of July 20, 2026.
Amended July 28, 2026 (revised Article 8 on advertising; disclosed advertising identifier collection and the Google AdMob processor).