Skinmed International Co., Ltd. (hereinafter referred to as the "Company") values the protection of your personal information and complies with the "Act on Promotion of Information and Communications Network Utilization and Information Protection."

Through the Privacy Policy, the Company discloses how the personal information you provide is being used and what measures are being taken to protect your personal information.

Collection of Personal Information and Collection Methods A. Types of Personal Information Collected a. The Company collects the following personal information for membership registration, consultation, and service application purposes:

Skinmed International Co., Ltd. (hereinafter referred to as the "Company") values the protection of your personal information and complies with the "Act on Promotion of Information and Communications Network Utilization and Information Protection."

Through the Privacy Policy, the Company discloses how the personal information you provide is being used and what measures are being taken to protect your personal information.

Collection of Personal Information and Collection Methods A. Types of Personal Information Collected a. The Company collects the following personal information for membership registration, consultation, and service application purposes:

1. Name, date of birth, gender, login ID, password, home phone number, mobile phone number, email address, information of legal guardian if the member is under 14 years old.
2. Address and payment information for service application purposes. b. Service usage records, access logs, cookies, IP addresses, payment records, and records of improper use may be generated and collected during service usage or business processing. B. Collection Methods The Company collects personal information through the website, paper forms, bulletin boards, email, event participation, delivery requests, phone, fax, and information collection tools.

Purposes of Collection and Use of Personal Information The Company utilizes the collected personal information for the following purposes:

1. Contract fulfillment and fee settlement for service provision.
2. Content provision, purchase and fee payment, shipping or billing statements, personal identification and financial service authentication.
3. Member management, including personal identification, prevention of improper use and unauthorized access, confirmation of membership intention, age verification, consent of legal guardian for collecting personal information of children under 14 years old, complaints and civil petition handling, and delivery of notices.
4. Marketing and advertising, including sending advertisements and promotional information, frequency analysis of access, and statistics related to service usage.

Retention and Use Period of Personal Information The Company destroys personal information without delay after the purpose of collection and use has been fulfilled. However, the following information may be retained for the reasons specified below:

1. A. Reasons for Information Retention under Internal Policy The Company may retain member information for up to 5 years after termination of service contract to prevent recurrence of improper use by a problematic member, resolution of disputes, and cooperation with investigative authorities.
2. B. Reasons for Information Retention under Relevant Laws and Regulations The Company may retain member information for a certain period of time as stipulated by related laws and regulations, such as the Act on Consumer Protection in Electronic Commerce, etc.
   1. a. Records related to contracts or withdrawal of offers: Retention Reason: Act on Consumer Protection in Electronic Commerce Retention Period: 5 years
   2. b. Records related to payment of fees and goods: Retention Reason: Value-Added Tax Act, Framework Act on National Taxes Retention Period: 5 years.
   3. c. Record of consumer complaints or dispute resolution
      Reason for retention: Consumer Protection Act in e-commerce and others
      Retention period: 3 years
   4. d. Log records
      Reason for retention: Telecommunications Secrets Protection Act
      Retention period: 3 months

Provision of personal information

The company does not provide user's personal information to third parties unless:

1. Users have given prior consent.

   There is a request from a law enforcement agency according to the procedures and methods specified by law for investigation purposes.

Personal information destruction procedure and method

The company will destroy the personal information without delay after the purpose of collecting and using the information is achieved. The procedure and method for destruction are as follows:

• Destruction Procedure
  1. The information you provided for membership registration is transferred to a separate database (in the case of paper documents, a separate file) after the purpose is achieved and is kept for a certain period of time according to the internal policy and relevant laws and regulations for information protection (see retention and usage period) before being destroyed..
  2. Personal information transferred to a separate database is not used for any other purpose other than storage unless required by law.

Users have given prior consent.

There is a request from a law enforcement agency according to the procedures and methods specified by law for investigation purposes.

Outsourcing of collected personal information

The company outsources the following tasks to external professional companies for service delivery:

• Korea Post EMS: delivery of ordered goods
• KG Inicis: payment and escrow service
• Cremapak Ltd.: bulletin board system and mileage system construction/maintenance

Rights of Users and Legal Guardians and Their Exercise Methods

• Users can view or modify their registered personal information at any time, and may also request to terminate their membership. In order to view or modify personal information, users can click on "Change Personal Information" (or "Modify Membership Information") and after going through a verification process, can directly view, correct, or terminate their information. To terminate membership (withdraw consent), users can click on "Membership Termination." Alternatively, users can contact the personal information protection manager in writing, by phone, or by email, and we will promptly take action.
• If a user requests correction of their personal information, we will not use or provide the information until the correction is completed. If incorrect personal information has already been provided to a third party, we will promptly notify the third party of the correction results to ensure that the correction is made.
• The company processes terminated or deleted personal information at the "Retention and Use Period of Personal Information Collected by the Company" in accordance with the regulations and prohibits its access or use for any other purposes.

Installation, Operation, and Refusal of Automatic Collection Devices for Personal Information

The company operates "cookies" and other tools that store and retrieve user information on a regular basis. Cookies are very small text files sent by a server that operates a website to a user's browser and stored on the user's computer hard disk.

The company uses cookies for the following purposes: [purpose of cookie use].

• Purpose of using cookies:
  1. Analyzing the frequency and time of visits by members and non-members, identifying users' preferences and interests, tracking their activities, and determining the extent of participation in various events and the frequency of visits to provide targeted marketing and personalized services.
  2. You have the option to choose whether or not to install cookies. Therefore, you can allow all cookies, confirm each time a cookie is saved, or refuse to store all cookies by adjusting the options in your web browser.
• Method of refusing cookie settings:
  1. To refuse cookie settings, you can choose to allow all cookies, confirm each time a cookie is saved, or refuse to store all cookies by adjusting the options in the web browser you are using.
  2. Example of setting method (for Internet Explorer): Tools > Internet Options > Privacy.
  3. However, if you refuse to install cookies, there may be difficulties in providing the service.

Personal Information Complaint Service:

To protect customers' personal information and handle complaints related to personal information, the company designates the following departments and personal information protection managers:

Personal Information Protection Manager:

• Name: Jung-han Ham
• Affiliation: Skinmed International Co., Ltd.
• Phone number: 6261-8143
• Email: lagom@lagom.kr

You can report all personal information protection-related complaints to the personal information protection manager or the responsible department while using the company's services. The company will promptly provide sufficient answers to users' reports. If you need to report or consult about other personal information infringements, please contact the organizations below:

1. Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without an area code)
2. Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
3. Cyber Investigation Department, Prosecutor's Office (spo.go.kr / area code + 1301)
4. Cyber Safety Bureau, National Police Agency (cyberbureau.police.go.kr / 182 without an area code)