Privacy Policy

Table of Contents

Article 1. Purpose of Processing Personal Information

Article 2. Period of Processing and Retention of Personal Information

Article 3. Categories of Personal Information Processed

Article 4. Provision of Personal Information to Third Parties

Article 5. Outsourcing of Personal Information Processing

Article 6. Overseas Transfer of Personal Information

Article 7. Procedures and Methods for Destruction of Personal Information

Article 8. Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them

Article 9. Ensure the Security of Personal Information

Article 10. Refusal for Installation and Operation of Automatic Personal Information Collection Tools
Article 11. CPO and Department for Handling Grievances

Article 12. Remedies for Infringement of Rights and Interests

Article 13. Amendments to the Privacy Policy

Article 1 (Purpose of Processing Personal Information)

Manager Scarlet Co., Ltd. (hereinafter referred to as the "Company") processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than the following. If the purpose of use is changed, necessary measures such as obtaining separate consent in accordance with Article 18 of the「 Personal Information Protection Act」 will be implemented.

① Member Registration and Management: Processing is conducted for verifying the intent to join as a member, identifying and authenticating individuals for the provision of membership services, maintaining and managing membership status, preventing unauthorized use of services, and delivering various notices and notifications.

② Provision of Goods or Services: Processing is conducted for the purposes of purchasing goods, providing services, handling reservations and payments, providing content, offering customized services, identity verification, and age verification.

③ Customer Inquiries and Grievance Handling: Processing is conducted for the purposes of verifying the identity of the inquirer, confirming inquiry details, contacting/notifying for fact-finding investigations, and notifying the results of processing.

Article 2 (Period of Processing and Retention of Personal Information)

① The Company processes and retains personal information within the period of retention and use as prescribed by laws or within the period agreed upon by the data subject at the time of collection.

② The specific processing and retention periods for each category are as follows:

1. Homepage Member Registration and Management: Until the member withdraws from the service; provided, however, that if an investigation or inquiry due to a violation of relevant laws is ongoing, until the completion of such investigation or inquiry.

2. Provision of Goods or Services: Until the completion of the supply of goods/services and the completion of payment/settlement.

3. Retention pursuant to the Act on the Consumer Protection in Electronic Commerce:

1.Records on display/advertising: 6 months

2.Records on contracts or withdrawal of offers: 5 years

3.Records on payment and supply of goods: 5 years \

4.Records on consumer complaints or dispute resolution: 3 years

Article 3 (Items of Personal Information Processed)

① The Company collects and processes the following items of personal information:

1. Member Registration and Management (Required): Name (in English), Email address, Password (encrypted), Date of birth, Gender, Country, City of residence, Country code, Contact information.

2. Package Reservations, Payments, and MD Purchases (Required): Name (in English), Email address, Password (encrypted), Date of birth, Gender, Country, City of residence, Country code, Contact information, Payment information (card details, account information, etc.).

3. Items Automatically Generated during Service Use: IP address, Cookies, Service use records, Visit records, etc.

② The services operated by the Company are not intended for children (under 14 years of age for Korean nationals, or as defined by the laws of the respective country for foreign nationals). If the Company becomes aware that it has collected personal information from a child, it will delete such information and terminate the member's account. If you believe the Company has collected information from a child, please contact us using the contact information in "Article 11."

Article 4 (Provision of Personal Information to Third Parties)

① The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the data subject or special provisions of the law.

② The Company provides personal information to third parties.

1. SM Entertainment, SMEJ, SMEJ Plus and affiliated entertainment-related entities

Provision Purpose: Concert attendance, Fan club authentication

Provided Information: Name (English), Email, Date of birth, Gender, Country, Country code, Contact info, Japan Fan Club ID, Weverse Email, Weverse Membership ID Email, Weverse Membership ID

Period of Retention and Use: Until the provision of service or conclusion of the event

2. Hotels

Provision Purpose: Accommodation reservation and Check-in verification

Provided Information: Name (English), Gender, Country, Date of birth, Passport information (if necessary)

Period of Retention and Use: 6 months after completion of stay

3. Travel Agencies and Airlines

Provision Purpose: Travel Agencies and Airlines

Provided Information: Travel package composition, Flight reservation and Ticketing

Period of Retention and Use: Name (English), Email, Gender, Date of birth, Country code, Contact info, Passport information (if necessary)

Article 5 (Outsourcing of Personal Information Processing)

① The Company outsources personal information processing to ensure smooth business operations as follows:

② Outsourcing for Online Payment Services::

1. Trustee: Viva Republica Co., Ltd.(Toss)

2. Outsourced Work: Processing payments (domestic credit cards, bank transfers, etc.) and preventing payment fraud.

③ Outsourcing for Aviation and Accommodation Services:

1. Trustee: Domestic hotels, airlines, and travel agencies

2. Outsourced Work:

1.Service Reservation and Fulfillment: Agency for flight ticketing and boarding procedures, accommodation reservations and check-in/out verification, travel product schedule management, and provision of local services.

2.Identity Verification: Identification and reservation history verification for service use.

3.Customer Support: Processing reservation changes/cancellations, sending service-related notices (emails, etc.), and handling customer consultations and complaints (CS).

Settlement Management: Settlement of payments and issuance of supporting documents for service use.

④ In accordance with Article 26 of the「Personal Information Protection Act」, the Company specifies in documents such as contracts the prohibition of processing personal information for purposes other than the performance of outsourced work, technical and managerial protection measures, restrictions on re-outsourcing, management and supervision of trustees, and liability for damages, and supervises whether the trustee processes personal information safely.

Article 6 (Overseas Transfer of Personal Information)

The Company transfers personal information overseas when necessary to provide services, and the details are as follows:

① Overseas Payment Outsourcing:

1. Trustee: PayPal (USA)

2. Items Transferred: Payment information, Name, Email address

3. Country/Time/Method of Transfer: USA / Transferred via network at the time of payment

4. Retention and Use Period: Until completion of service provision and expiration of the statutory retention period.

② Overseas Service Use::

1. Trustee: Hotels, airlines, and local travel agencies in the destination country.

2. Items Transferred: Essential reservation information such as Name (English), Contact info, and Passport information.

3. Destination Country: The country of travel.

4. Purpose of Transfer: Reservation of overseas travel packages and provision of local services.

Article 7 (Procedures and Methods for Destruction of Personal Information)

① The Company destroys personal information without delay when it becomes unnecessary, such as the expiration of the retention period or achievement of the processing purpose.

② The procedures and methods for destruction are as follows:

1. Destruction Procedure: The Company selects the personal information for which the reason for destruction occurred and destroys it with the approval of the Privacy Officer.

2. Destruction Method: Information in the form of electronic files is deleted using technical methods that cannot reproduce the records, and paper documents are shredded or incinerated.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

① Data subjects may exercise their rights to access, correct, delete, or suspend the processing of their personal information at any time against the Company.

② Such rights may be exercised in writing or via email to the Company, and the Company will take action without delay.

Article 9 (Measures to Ensure the Security of Personal Information)

The Company implements the following measures to ensure the security of personal information:

① Administrative Measures: Establishing and implementing internal management plans, providing regular training for employees, etc.

② Technical Measures: Managing access rights to personal information processing systems, installing access control systems, encrypting unique identification information, and installing security software.

③ Physical Measures: Controlling physical access to server rooms, data storage rooms, and other restricted areas.

Article 10 (Installation, Operation, and Rejection of Automatic Personal Information Collection Devices)

① The Company uses "cookies" to store and retrieve user information periodically to provide personalized services.

② Users may refuse the storage of cookies by adjusting their mobile or web browser settings. However, refusing to store cookies may result in difficulties accessing personalized services.

Article 11 (Privacy Officer and Contact Information)

The Company has designated a Privacy Officer to oversee the processing of personal information and to handle user complaints and provide remedies for damages related to personal information processing as follows:

1. Privacy Officer

- Name: Lee, Jun

- Title : CEO

- Phone: +82-2-6237-0050

- Email: hello@concontown.com

2. Data Protection Department

- Department : CONCONTOWN Operations Team

- Phone: +82-2-6237-0050

- Email: hello@concontown.com

Article 12 (Remedies for Rights Infringement)

Data subjects may apply for dispute resolution or consultation with the following organizations to seek remedies for personal information infringement:

Personal Information Infringement Reporting Center: +82-2-405-5118 (privacy.kisa.or.kr)
Personal Information Dispute Mediation Committee: +82-2-1833-6972 (www.koprc.go.kr)

Article 13 (Changes to the Privacy Policy)

This Privacy Policy is effective as of May 28, 2026.