Effective date: March 30, 2025

Cosa Piora Corp. establishes and discloses this Korea Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (PIPA) and other relevant laws and regulations of the Republic of Korea. This policy applies to the processing of personal information of individuals located in Korea or whose data is processed in Korea and covers the collection, use, storage, provision, and destruction of such information.

This policy has been updated to reflect the integration of previous provisions under the Act on Promotion of Information and Communications Network Utilization and Information Protection (the Network Act), which have now been largely consolidated into PIPA. This version aligns with the structure recommended by the Personal Information Protection Commission (PIPC) and follows the requirements specified in PIPA Article 30 regarding the public disclosure of personal information processing policies.

The PIPC is the central regulatory authority responsible for enforcing the PIPA. It oversees compliance, provides guidance, and may impose administrative sanctions on organizations that fail to fulfill their legal obligations under the Act.

Article 1. Purpose of Processing Personal Information (PIPA Articles 15, 17, and 18)

Cosa Piora processes personal information for the following purposes:

• Membership Management
  Collection and use of personal information necessary for user registration, maintenance of account credentials, verification of identity to prevent unauthorized access, and monitoring of user eligibility (e.g., age restrictions for individuals under 16). This also includes communications related to important service notices and any modifications to terms and services.
• Provision of Goods and Services
  Use of personal data to facilitate the purchase, billing, payment processing, product delivery, handling of returns or repairs, and resolution of any technical issues encountered during service use.
• Service Improvement
  Analysis of user activity, preferences, and system logs to enhance website and app performance, improve user interface design, and refine the functionality of services based on aggregated data insights.
• Customer Service
  Use of user information to provide prompt responses to inquiries, process support tickets, resolve complaints, and deliver confirmations regarding transactions, changes to service status, or service usage activity.
• Marketing and Promotions
  Sending off promotional emails, newsletters, and service updates to users who have opted in, as well as invitations to participate in events, surveys, and other marketing-related activities based on expressed interest or interaction history.
• Repurposing and Analysis
  Using previously collected data to perform statistical analysis, improve service personalization, or develop new services or features. When data is used for secondary purposes beyond the original intent, it will be handled in accordance with PIPA Article 18, and separate consent will be obtained if required.
• Targeted Marketing
  Leveraging behavioral analytics, such as browsing activity, past purchases, and platform interactions, to offer personalized advertisements, product recommendations, and content aligned with user interests in accordance with applicable consent and opt-out provisions under PIPA.

Article 2. Items of Personal Information Collected and Method of Collection (PIPA Article 23)

Cosa Piora collects personal information through its official website, mobile applications, customer service channels, and online forms during user interactions such as account registration, newsletter sign-up, and service inquiries. Collection may occur via automated tools (e.g., cookies) or voluntarily provided input fields.

The types of personal information collected include:

• Membership Management
  Includes information necessary to verify identity and manage user accounts, such as full name, email address, country of residence, date of birth (to enforce age restrictions), contact phone number, and mailing address for shipping and billing purposes.
• Newsletter Subscription:
  Includes only the user’s email address, which is used for sending updates, promotional content, and event notifications to users who opt in.
• Service Usage and Customer Support
  When users make inquiries or engage with customer service, we may collect additional information such as device data, preferred language, service history, and communication records, solely for the purpose of resolving issues or improving user satisfaction.
• Automated Collection (Cookies and Analytics Tools)
  We may also collect technical information automatically, including IP address, browser type, access time, and interaction patterns using cookies or third-party analytics tools. This data is used to enhance functionality, perform diagnostics, and deliver a better user experience.

Cosa Piora does not collect sensitive personal information (as defined under PIPA Article 23, such as biometric data, political opinions, health records, etc.) unless explicitly required for a specified legal or service-related purpose and with the user’s prior, separate consent.

Article 3. Retention and Destruction of Personal Information (PIPA Article 21)

Personal information is retained only for the period necessary to fulfill its collection purpose or as required by applicable law. Specific cases include:

• Membership Data: Personal information will be retained until the user deletes their account or withdraws consent. In accordance with applicable laws and data protection guidelines, if a user does not log in for one (1) year or more, their personal information may be classified as dormant and managed separately. Dormant data will be securely stored, used only for legally permitted purposes, and reactivated only upon re-verification or user request. Prior notice will be provided before any changes in data status.
• Service Records:
  Retained for the following statutory periods:
  • Records on contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
  • Records on payment and supply of goods: 5 years
  • Records on consumer complaints or dispute resolution: 3 years
  • Tax-related records: 5 years (National Tax Basic Law)

Cosa Piora destroys personal information without delay once it becomes unnecessary, such as after the retention period has expired or the purpose of processing has been achieved. Destruction methods include secure deletion of digital files and shredding of physical documents in accordance with internal policies and PIPA Article 21.

Article 4. Provision of Personal Information to Third Parties (PIPA Article 17)

Cosa Piora does not share personal information with third parties without prior consent from the individual, except in the following circumstances:

• When required by law
• When necessary for public health and safety
• When the data subject or legal representative has provided consent
• When it is necessary to protect the life, body, or property of a person, and it is difficult to obtain the data subject’s consent

If personal data is provided to a third party, Cosa Piora will disclose the recipient, purpose, and scope of the information shared.

Article 5. Outsourcing of Personal Information Processing (PIPA Article 26)

Cosa Piora may outsource the processing of personal information to third-party service providers for tasks such as logistics, payment processing, customer support, and IT infrastructure. In such cases, Cosa Piora ensures the following:

• A contract is signed with the service provider outlining confidentiality obligations
• Supervision of the service provider’s handling of personal information
• Immediate notification to users if there are any changes in the scope of outsourced services

All third-party processors are required to comply with relevant data protection regulations.

Article 6. Rights of Users and Legal Representatives (PIPA Articles 35–37)

Users (or their legal representatives) have the right to request the following actions regarding their personal data:

• Access to their personal information (PIPA Article 35)
• Correction or deletion of inaccurate or outdated personal information (PIPA Article 36)
• Suspension of processing of their personal information (PIPA Article 37)
• Withdrawal of consent at any time, which may result in limited access to certain services

To exercise these rights, users may contact our Data Protection Officer. Requests will be addressed without delay in accordance with applicable laws.

Article 7. Security Measures to Protect Personal Information (PIPA Article 29)

Cosa Piora takes appropriate administrative, technical, and physical measures to protect personal information from loss, theft, leakage, falsification, or damage. These include:

• A contract is signed with the service provider outlining confidentiality obligations
• Access control and user authentication
• Encryption of personal information and secure storage systems
• Regular internal audits and staff training on data protection
• Maintenance of logs and prevention of unauthorized access

These measures are continuously reviewed and updated to maintain the integrity and security of personal data.

Article 8. Use of Cookies and Similar Technologies

Cookies and similar technologies may be used on our website to enhance user experience, analyze service usage patterns, and provide personalized content. Users may control cookie settings through their web browser.
Please note that disabling cookies may limit access to certain features or functionality of our website.

Article 9. Behavioral Advertising and Targeting (PIPA Article 24-2)

Cosa Piora may collect and use behavioral information through cookies, device identifiers, or third-party tools to provide customized advertisements based on user interests. This may involve profiling to analyze preferences or usage patterns.

Under Article 24-2 of the Personal Information Protection Act (PIPA), users have the right to refuse the processing of their personal information for behavioral advertising purposes. Users may exercise this right by adjusting their browser or mobile device settings to limit ad tracking, by managing their preferences through our platform, or by withdrawing consent.

Although South Korea does not have a centralized opt-out tool for interest-based advertising, users may visit internationally recognized platforms such as https://optout.aboutads.info to manage advertising preferences from participating ad networks. Users are also encouraged to review and customize privacy settings within third-party services they use.

Article 10. Cross-Border Transfers of Personal Information (PIPA Articles 17 & 28-8)

If personal information is transferred overseas (e.g., for cloud storage or analytics services), Cosa Piora will inform users of the following details in advance and obtain consent:

• The recipient and country of transfer
• The purpose of the transfer
• The type of personal information transferred
• The date and method of transfer
• The retention and use period

All overseas transfers are carried out in compliance with PIPA’s requirements for cross-border data protection.

Article 11. Remedies for Infringement of Rights (PIPA Article 43)

If you believe your personal information has been misused or that your rights under PIPA have been violated, you may contact the following organizations for consultation or dispute resolution:

• Personal Information Dispute Mediation Committee
  Website: https://www.kopico.go.kr
• Personal Information Protection Support Center (KISA)
  Website: https://privacy.kisa.or.kr
• Cyber Investigation Division, Supreme Prosecutors' Office
  Website: https://www.spo.go.kr
• Cyber Terror Response Center, National Police Agency
  Website: https://www.police.go.kr

Article 12. Contact Information for Inquiries (PIPA Article 31)

If you have any questions or requests regarding your personal information, please contact our Data Protection Officer:

• Data Protection Officer: Privacy Compliance Manager
• Email: legal@cosapiora.com

We are committed to responding promptly to all privacy-related inquiries.