CROSSHUB Co., Ltd. KPOP PRO Website Privacy Policy

① The Company processes the minimum amount of personal information necessary to receive, review, and respond to online inquiries submitted through the KPOP PRO website; review artist, content, marketing, and business proposals; and conduct further discussions where necessary.

② The personal information processed by the Company with the consent of the data subject is as follows.

1. Handling General Service Inquiries

A. Legal Basis

Consent of the data subject pursuant to Article 15(1)1 of the Personal Information Protection Act

B. Purposes of Processing

• Receiving, reviewing, and responding to inquiries about using the KPOP PRO service
• Receiving, reviewing, and responding to technical inquiries and error reports
• Receiving and reviewing user feedback and suggestions for improvement
• Requesting additional information and contacting the inquirer as necessary to handle the inquiry

C. Required Items

• Inquiry type
• Inquiry subject
• Inquiry details
• Name
• Email address

D. Optional Items

• Company name
• Job title
• Telephone number
• Website address

E. Retention and Use Period

One year from the date the inquiry is submitted

2. Handling Artist, Content, Marketing, and Business Proposals

A. Legal Basis

Consent of the data subject pursuant to Article 15(1)1 of the Personal Information Protection Act

B. Purposes of Processing

• Receiving and reviewing artist-related proposals
• Receiving and reviewing content proposals
• Receiving and reviewing marketing and promotional proposals
• Receiving and reviewing business partnership and collaboration proposals
• Further discussion and contact regarding the proposal and the possibility of a partnership

C. Required Items

• Inquiry type
• Inquiry subject
• Inquiry details
• Name
• Email address

D. Optional Items

• Partnership purpose and expected benefits
• Company name
• Job title
• Telephone number
• Website address

E. Retention and Use Period

One year from the date the inquiry is submitted

3. Verification of Inquiry Submission and Consent History

A. Legal Basis

Consent of the data subject pursuant to Article 15(1)1 of the Personal Information Protection Act

B. Purposes of Processing

• Verifying consent to the collection and use of personal information
• Verifying consent to the overseas transfer of personal information
• Verifying acknowledgment of the notes for partnership proposals
• Verifying whether the inquirer is at least 14 years old or is a legal representative
• Verifying the time of submission and the processing language
• Verifying successful submission of the inquiry and the processing history in the event of a dispute

C. Items Processed

• Whether consent was given to the collection and use of personal information
• Whether consent was given to the overseas transfer of personal information
• Whether the notes for partnership proposals were acknowledged
• Whether the inquirer is at least 14 years old or is a legal representative
• Submission language
• Date and time of submission

D. Retention and Use Period

One year from the date the inquiry is submitted

4. Transmission of Online Inquiries and Prevention of Fraudulent or Duplicate Submissions

A. Purposes of Processing

• Sending online inquiries by email
• Verifying whether transmission succeeded or failed
• Limiting repeated submissions from the same browser within a short period
• Preventing automated abnormal requests and misuse of the service
• Identifying transmission failures and responding to security issues

B. Items That May Be Processed or Generated

• Access IP address
• Date and time of request
• Transmission status
• Request-related metadata
• Browser-local stored information used to limit submission frequency

C. Retention and Use Period

• EmailJS transmission request activity and metadata: up to 30 days
• Browser-local stored information: until it is updated with the same information or the user deletes the website’s stored data from the browser

③ An online inquiry may be submitted without entering optional items. The Company processes such information only when the user chooses to provide it.

④ The Company does not use personal information for purposes other than those stated above. If the purposes of processing personal information change, the Company will obtain separate consent or take other necessary measures in accordance with applicable laws and regulations.

⑤ As a rule, the Company destroys personal information when the retention periods stated in Paragraphs 1 through 4 expire. However, where any of the following circumstances applies, the Company may retain the information to the extent necessary until that circumstance ceases to exist.

1. Where a dispute concerning personal information or a procedure for exercising rights is ongoing: until the procedure is completed
2. Where a competent authority makes a lawful request for retention in connection with an investigation or inquiry, or retention is required by law: until the investigation or inquiry is completed or the statutory retention period expires
3. Where an unresolved legal dispute exists between the Company and the data subject: until the dispute is finally resolved

① The Company does not collect personal information submitted directly by children under 14 through the online inquiry feature of the KPOP PRO website.

② Inquiries concerning users under 14 must be submitted by a legal representative using the legal representative’s own name and contact information.

③ A legal representative must not enter a child’s name, email address, telephone number, account information, photograph, voice recording, or any other personal information relating to the child in the inquiry subject, inquiry details, or attached information.

④ Before an online inquiry is submitted, the Company requires the inquirer to confirm that one of the following applies.

1. The inquirer is at least 14 years old
2. The inquirer is the legal representative of a user under 14

⑤ If the Company confirms that personal information of a child under 14 has been collected without the lawful consent of the child’s legal representative, the Company will delete the personal information without delay.

⑥ The Company currently does not provide a procedure to verify the identity or consent of a legal representative for the purpose of collecting personal information directly from a child under 14. Accordingly, children under 14 may not submit online inquiries themselves.

① The Company processes personal information of data subjects within the scope of the purposes set forth in Article 1 and does not provide personal information to third parties except in the following cases.

1. Where separate consent has been obtained from the data subject
2. Where specifically provided for by law
3. Where unavoidable in order to comply with a legal obligation
4. Where an investigative agency or competent administrative authority lawfully requests the provision of information
5. Where clearly necessary to protect the life, physical safety, or property interests of the data subject or a third party and permitted by applicable laws and regulations

② If the Company provides personal information to a third party, it will notify the data subject in advance of the recipient, purpose of provision, items provided, and retention and use period in accordance with applicable laws and regulations, and will obtain separate consent where necessary.

③ Matters concerning the outsourcing of personal information processing and overseas transfers of personal information are described in Articles 4 and 5, respectively.

① The Company outsources personal information processing as follows for the receipt, storage, and handling of online inquiry emails.

② Matters concerning EmailJS, to which personal information processing is outsourced overseas, are separately described in Article 5.

③ When entering into outsourcing agreements and service agreements, the Company verifies and manages the following matters in accordance with applicable laws and regulations.

1. Prohibition on processing personal information for purposes other than performing the outsourced services
2. Restrictions on access to personal information
3. Measures to ensure the security of personal information
4. Management of subcontracting
5. Retention and destruction of personal information
6. Management and supervision of service providers
7. Notification and response in the event of a personal information breach
8. Damages and liability

④ If a service provider or the scope of outsourced services changes, the Company will disclose the change through this Privacy Policy.

① The Company outsources the processing and storage of personal information overseas in order to transmit KPOP PRO online inquiry details to the Company’s business email.

② Details of the overseas transfer of personal information are as follows.

③ EmailJS may use the following subprocessors located in the United States to provide its services.

1. Amazon Web Services, Inc.
   • Service: Server hosting and data storage
   • Location: United States
2. Redis, Ltd.
   • Service: Temporary data storage
   • Location: United States
3. Sentry, Inc.
   • Service: Error monitoring
   • Location: United States
4. Coralogix, Ltd.
   • Service: Log monitoring
   • Location: United States
5. Cloudflare, Inc.
   • Service: Hosting, networking, and security
   • Location: United States
6. Zendesk, Inc.
   • Service: Processing support data generated in the course of EmailJS customer support
   • Location: United States

④ If EmailJS changes its subprocessors or processing locations, the Company will review the changes and revise this Privacy Policy to the extent necessary.

⑤ A data subject who wishes to withdraw consent to an overseas transfer or request access to, correction of, or deletion of personal information transferred overseas may contact the Company using the contact details in Article 12. After reviewing the request, the Company will require EmailJS to take the necessary measures.

① The Company destroys personal information without delay when the retention period expires or the purpose of processing has been achieved and the personal information is no longer necessary.

② The Company’s standards for destroying personal information related to online inquiries are as follows.

1. KPOP PRO Online Inquiry Details and Inquirer Information
   • Deleted one year after the inquiry submission date
2. Inquiry Emails Received and Stored in DaouOffice
   • Deleted one year after the date the email was received
3. Outgoing Emails Generated in the Course of Responding to Inquiries
   • Deleted one year after the date the initial inquiry was received
4. Electronic Files Created by Separately Downloading or Copying Inquiry Details
   • As a rule, separate files are not created
   • If creation is unavoidable for business purposes, the files are deleted one year after the initial inquiry submission date
5. Printed Documents
   • As a rule, documents are not printed
   • If printing is unavoidable for business purposes, the documents are destroyed one year after the initial inquiry submission date

③ The Company periodically reviews and deletes inquiries whose retention period has expired.

④ Where personal information must continue to be retained under other laws and regulations, the information is stored separately from other personal information and destroyed when the statutory retention period expires.

⑤ The methods for destroying personal information are as follows.

1. Electronic Files

   Permanently deleted in a manner that prevents recovery or restoration.

2. Emails

   Deleted from inboxes, archives, sent-mail folders, and trash, and processed so that they cannot be recovered to the extent under the Company’s control.

3. Paper Documents

   Destroyed by shredding or incineration.

⑥ Personal information is destroyed under the supervision of the Chief Privacy Officer or the personnel responsible for personal information protection.

① Data subjects may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction of personal information
3. Request deletion of personal information
4. Request suspension of personal information processing
5. Withdraw consent to the collection and use of personal information
6. Withdraw consent to the overseas transfer of personal information
7. Request an explanation regarding the processing of personal information
8. Submit complaints and request remedies relating to personal information

② Because the KPOP PRO website does not provide a member account or a screen for viewing personal information, requests to exercise rights may be submitted through the following methods.

• Email: kpoppro@kpoppro.app
• Telephone: 02-780-9930
• Mail: Room 301-17, Startup Building, 67 Yusang-ro, Deokjin-gu, Jeonju-si,
  Jeonbuk Special Self-Governing Province, Republic of Korea (Palbok-dong 2-ga, Jeonju Advanced Venture Complex)

③ When a request to exercise rights is submitted, the Company may request the following information to verify that the requester is the data subject associated with the inquiry.

1. Name entered when the inquiry was submitted
2. Email address entered when the inquiry was submitted
3. Inquiry subject or time of submission
4. Minimum additional information necessary for identity verification

④ The Company does not request unnecessary personal information beyond what is required for identity verification.

⑤ Rights may be exercised through the data subject’s legal representative or an authorized representative. In such a case, the Company may request a power of attorney or documentation verifying the relationship in order to confirm that the representative is duly authorized.

⑥ Upon receiving a request to exercise rights, the Company will notify the requester of the result within the period prescribed by applicable laws and regulations.

⑦ Requests for access, deletion, or suspension of processing may be restricted in the following cases.

1. Where specifically provided for by law
2. Where necessary to comply with a legal obligation
3. Where there is a risk of unjustly infringing upon another person’s life, physical safety, property, or other rights or interests
4. Where deletion or suspension of processing would prevent compliance with a legal obligation
5. Where the Company cannot verify that the requester is the data subject or a duly authorized representative

⑧ Data subjects must provide accurate personal information and must not impersonate another person or enter a third party’s personal information in an inquiry without legitimate authority.

Within the scope of its actual operations, the Company implements the following administrative and technical measures to ensure the security of personal information.

1. Access Authority Management
   • Limiting personnel who may access inquiry emails and personal information to those who require access for business purposes
   • Removing or adjusting access rights when the person in charge changes or the relevant duties end
   • Restricting unnecessary sharing of personal information
2. Protection of Accounts and Authentication Information
   • Securely managing passwords for business email and external service accounts
   • Not storing account authentication information in source code or public repositories
   • Not granting account access rights that are unnecessary for using the service
3. Protection During Transmission
   • Using encrypted communications such as HTTPS when transmitting online inquiries
   • Not transmitting personal information over unencrypted connections
4. Restrictions on Abnormal Requests and Duplicate Submissions
   • Applying functions to restrict automated abnormal requests
   • Applying transmission frequency controls to limit repeated submissions within a short period
   • Managing authorized origins and security settings registered with EmailJS to suit the operating environment
5. Data Minimization
   • Requiring only the minimum information necessary to handle inquiries
   • Treating company name, job title, telephone number, and website address as optional items
   • Not requesting resident registration numbers, passport numbers, account information, or health information
6. Retention Period and Destruction Management
   • Applying a retention period of one year from the inquiry submission date
   • Periodically deleting inquiry emails and related materials after the retention period expires
   • Restricting unnecessary downloads and copies of files containing personal information
7. Management of Service Providers
   • Reviewing the personal information processing and security policies of EmailJS and DaouOffice
   • Reflecting changes to service providers or processing locations in this Privacy Policy
8. Security Maintenance
   • Applying security updates to business devices and software
   • Implementing basic security measures to prevent malware and unauthorized access

① The Company currently does not operate Google Analytics, Google Tag Manager, Meta Pixel, Amplitude, or any other cookies or behavioral information collection tools for visitor analytics or personalized advertising on the KPOP PRO website.

② The Company does not provide personalized advertising and does not collect advertising identifiers.

③ The KPOP PRO online inquiry feature may use the browser’s local storage (localStorage) to limit repeated submissions within a short period.

④ Inquiry details, names, email addresses, telephone numbers, and other information entered by users in the inquiry form are not stored in local storage.

⑤ Local storage may contain an identifier and transmission-time information necessary to limit submission frequency.

⑥ Locally stored information may remain on the device until it is updated with the same restriction information or the user deletes the site’s stored data through the browser settings.

⑦ Users may delete locally stored information by using the browser’s site data deletion feature. Deleting locally stored information may reset the repeated-submission restriction, but does not affect general browsing of the website.

⑧ When an online inquiry is transmitted, EmailJS may temporarily process the access IP address and request metadata for security, abuse prevention, and request handling. Further details are provided in Articles 1 and 5.

① The Company does not request or process the following information for collection through the KPOP PRO online inquiry feature.

1. Resident registration number
2. Passport number
3. Driver’s license number
4. Alien registration number
5. Bank account number
6. Credit or debit card information
7. Passwords and verification codes
8. Health and medical information
9. Biometric information
10. Sex life, political opinions, religion, or trade union membership information
11. Criminal history records
12. Personal information of children under 14
13. Personal information of third parties that is not necessary to handle the inquiry

② Data subjects must not enter the information listed in Paragraph 1 in the inquiry subject, inquiry details, partnership purpose and expected benefits, or website address.

③ If the Company confirms that unique identification information, sensitive information, or third-party personal information unnecessary for handling the inquiry has been entered, the Company may mask or delete the information and, where necessary, ask the inquirer to resubmit the inquiry.

④ If the Company determines that such information is unnecessary to handle the inquiry, it may delete the entire inquiry or the relevant portion without delay.

① The Company does not make fully automated decisions using information from online inquiries submitted through the KPOP PRO website that have a significant effect on the rights or obligations of data subjects.

② Whether to respond to an inquiry, review a partnership proposal, or make further contact is determined by the personnel in charge after reviewing the inquiry details and business needs.

③ The Company does not process personal information collected through online inquiries into pseudonymized information under Articles 28-2 and 28-3 of the Personal Information Protection Act for statistical compilation, scientific research, or record preservation in the public interest.

④ If the Company introduces automated decision-making or pseudonymized information processing in the future, it will provide prior notice through this Privacy Policy of the purposes, data subjects, items, period, methods for exercising rights, and security measures.

① The Company has designated the following Chief Privacy Officer to oversee personal information processing and handle inquiries, complaints, requests to exercise rights, and requests for remedies relating to personal information processing.

Chief Privacy Officer

• Name: Jinwoo Lee
• Position: Director
• Role: Chief Information Security Officer (CISO)
• Telephone: 02-780-9930
• Email: kpoppro@kpoppro.app

② The contact point for personal information inquiries and requests to exercise rights is as follows.

KPOP PRO Privacy Contact

• Telephone: 02-780-9930
• Email: kpoppro@kpoppro.app
• Address: Room 301-17, Startup Building, 67 Yusang-ro, Deokjin-gu, Jeonju-si,
  Jeonbuk Special Self-Governing Province, Republic of Korea (Palbok-dong 2-ga, Jeonju Advanced Venture Complex)

③ Data subjects may submit inquiries and complaints relating to personal information, requests for access, correction, deletion, or suspension of processing, withdrawal of consent, and requests for remedies arising from use of the KPOP PRO website through the contact details above.

④ After reviewing the data subject’s request, the Company will take the necessary measures in accordance with applicable laws and regulations.

① Data subjects may file a report or request consultation with the following institutions for dispute resolution, counseling, or remedies relating to a personal information breach.

② The institutions above are separate from the Company. Requests to access, correct, delete, or suspend the processing of personal information processed by the Company, as well as requests to withdraw consent, may be submitted directly to the Company using the contact details in Article 12.

① This Privacy Policy takes effect on August 6, 2026.

② This Privacy Policy is the initial version of the KPOP PRO Website Privacy Policy.

③ If the Company changes this Privacy Policy, it will disclose the changes, reasons for the changes, and effective date through the website.

④ If there is a change to matters that materially affect the rights of data subjects, including the personal information processed, purposes of processing, retention period, provision to third parties, outsourcing of processing, or overseas transfer, the Company will provide a comparison of the content before and after the change.

⑤ If previous versions of this Privacy Policy exist, the applicable period for each version will be displayed, and previous versions will be retained and made continuously available to data subjects.