개인정보 처리 방침

Article 1 (General Provisions)
GNISoft Co., Ltd. (hereinafter referred to as 'the Company') values users' personal information and complies with relevant laws such as the 「Personal Information Protection Act」, 「Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.」, and 「Communication Secret Protection Act」. Through this Privacy Policy, the Company informs users about how their personal information is processed, for what purposes, and what measures are taken to protect it.

Article 2 (Collected Personal Information Items and Collection Methods)
The Company collects the following personal information for service provision.

Information Collected upon Account Creation and Linking

• Guest Login: Unique Device ID, game play records, access logs, service usage records.
• Google Login: Unique Identifier (UID) provided by Google account, game play records (Note: User's email address may be used for authentication purposes during Google login, but the Company does not directly store or utilize the email address without the user's separate consent.)
• Apple Login: Unique Identifier (UID) provided by Apple account, game play records (Note: User's email address may receive some information according to Apple's policy during Apple login, but the Company does not directly store or utilize the email address without the user's separate consent.)

Information Collected during Service Use

• Nickname Setting: Nickname directly set by the user.
• Age Verification: Whether the user is under/over 20 years old (direct collection of date of birth or age is not performed).
• Game Play Data: Game scores, progress, item usage records, etc.
• Automatically Generated/Collected Information: IP address, visit date and time, service usage records, fraudulent usage records, mobile device information (OS version, model name, unique device number, etc.), telecommunication carrier information, payment records (for in-app purchases).

Personal Information Collection Methods:

• Direct input by the user during membership registration and service use (e.g., nickname).
• Login through affiliated services (e.g., Google/Apple login).
• Automatically generated and collected during service use.

Article 3 (Purpose of Collecting and Using Personal Information)
The Company utilizes the collected personal information for the following purposes.

Service Provision and Management

• User identification and authentication, guest account management, service usage record management, age verification.
• Content provision, payment settlement, user authentication, payment service provision.
• Providing optimized services and customized features to users.

Service Improvement and Development

• Development and specialization of new services (products), service improvement and quality enhancement based on statistical data.
• Providing ranking competition and social features among users (ranking system, friend features, etc.).
• Bug fixes, error checking and correction, service environment optimization.

Marketing and Advertising Utilization:

• Delivery of new service and event information, targeted advertising (based on user characteristics and interests).
• Understanding access frequency or statistical analysis of user's service usage.

Security and Dispute Resolution:

• Prevention of fraudulent use and unauthorized access, prevention of account theft and illegal use.
• Handling user complaints and grievances, preservation of records for dispute resolution.

Article 4 (Overseas Transfer of Personal Information)
The Company utilizes global infrastructure such as Google Firebase for stable service provision and efficient operation. In this process, users' personal information may be transferred, stored, and processed in countries outside South Korea (primarily the United States, Europe, etc.).
The transferred personal information is securely managed in accordance with the personal information protection laws of the respective country and this Privacy Policy. The Company takes necessary protective measures, such as entering into Standard Contractual Clauses, in accordance with relevant laws to ensure that personal information is securely protected.

Article 5 (Retention and Use Period of Personal Information)
Users' personal information is retained and used from the conclusion of the service contract until the termination of the service. In principle, after the purpose of personal information collection and use has been achieved, the information is promptly destroyed. However, if there is a need for retention according to relevant laws, the Company retains user information for a certain period specified by law, as follows:

Upon Membership Withdrawal:

Upon request for membership withdrawal and personal information destruction, the information is promptly destroyed.
However, information that needs to be retained according to relevant laws (e.g., Act on the Consumer Protection in Electronic Commerce, etc., Communication Secret Protection Act) will be retained for the period specified by those laws.

Retention Period according to Relevant Laws:

• Records regarding contracts or subscription withdrawals: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Records regarding payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Records regarding consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Website visit records: 3 months (Communication Secret Protection Act)
• Service usage records: 1 year (Communication Secret Protection Act)

Article 6 (Provision of Personal Information to Third Parties)
In principle, the Company does not provide users' personal information to external parties. However, exceptions are made in the following cases:

• When users have given prior consent.
• When required by law, or when investigative agencies request it for investigative purposes according to procedures and methods defined by law.

Article 7 (Outsourcing Personal Information Processing)
The Company outsources personal information processing tasks as follows to improve service. When entering into outsourcing contracts, the Company clearly stipulates compliance with personal information protection laws, confidentiality of personal information, prohibition of provision to third parties, and liability in case of incidents.

Article 8 (Rights of Users and Legal Representatives and Methods of Exercise)
As a personal information subject, users can exercise the following rights.

User's Rights:

• Right to Request Access to Personal Information: The right to request information on whether their personal information is being processed and details of its processing.
• Right to Request Correction/Deletion: The right to request correction or deletion of personal information if there are errors or if the purpose of personal information processing has been achieved (except for information required to be retained by law).
• Right to Request Suspension of Processing: The right to request temporary suspension of personal information processing.
• Right to Withdraw Consent (Membership Withdrawal): The right to withdraw consent for personal information collection and use at any time.

These rights can be exercised through the in-game account deletion function, written requests, email, etc., to GNISoft Co., Ltd., and the Company will take action without delay.

Personal Information of Children Under 14 Years Old:

The Company does not collect personal information of children under 14 years old. If collection of personal information of children under 14 years old is necessary due to service characteristics, the Company obtains consent from their legal representative in accordance with the 「Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.」 and the 「Personal Information Protection Act」. Legal representatives can request access, correction, deletion, or suspension of processing of the child's personal information.

Users Residing in the European Economic Area (EEA) (GDPR-related Rights):

• Right to Data Portability: The right to transfer personal information to another service provider under certain conditions.
• Right to Object: The right to object to specific processing methods (e.g., for direct marketing purposes).
• Right regarding Automated Decision-Making and Profiling: The right to object to decisions based solely on automated processing.

Article 9 (Destruction of Personal Information)
In principle, the Company promptly destroys personal information after the purpose of personal information collection and use has been achieved.

Destruction Procedure:

Information entered by the user is transferred to a separate DB (or a separate document box for paper documents) after the purpose is achieved, stored for a certain period according to relevant laws and internal company policies, and then destroyed. In this case, personal information is used only for the purpose of retention unless required by law.

Destruction Methods:

• Electronic file format: Deleted using technical methods that prevent reproduction of records.
• Personal information printed on paper: Destroyed by shredding or incineration.

Article 10 (Measures to Secure the Safety of Personal Information)
The Company takes the following measures to securely process users' personal information.

Administrative Measures:

• Establishment and implementation of internal personal information protection management plans, regular employee training.

Technical Measures:

• Access control for personal information processing systems, encryption of unique identification information, installation and periodic updates/checks of security programs.

Physical Measures:

• Storage of documents containing personal information, auxiliary storage media, etc., in secure locations with locking devices.

Article 11 (Contact Information of Personal Information Protection Officer and Department)
The Company designates the following Personal Information Protection Officer and department to protect users' personal information and handle personal information-related complaints.

Personal Information Protection Officer:

• Name: Ryan Park
• Position: Head of Development
• Contact: nyx@gnisoft.co.kr

Personal Information Protection Department:

• Department Name: Development Department
• Contact: nyx@gnisoft.co.kr

Article 12 (Remedies for Infringement of User Rights)
If a user needs to report personal information infringement or consult, they can contact the following organizations for assistance.

• Personal Information Infringement Report Center (operated by Korea Internet & Security Agency): 118 (without area code) (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (without area code), cid@spo.go.kr
• National Police Agency Cyber Bureau: 182 (without area code) (cyberbureau.police.go.kr)
• European Data Protection Supervisor: edps.europa.eu (related to GDPR)
• California Privacy Protection Agency: cppa.ca.gov (related to CCPA)

Article 13 (Duty of Notification)
This Privacy Policy shall be effective from its enforcement date. In case of additions, deletions, or corrections to the content due to changes in laws or policies, the Company will notify users through announcements 7 days prior to the effective date of the changes.