This English translation is provided for convenience only. The Korean version is the official text, and in case of any discrepancy, the Korean version prevails.

👋 TheSoby Co., Ltd. ((주)더소비) (hereinafter “TheSoby”) processes users’ personal information lawfully and securely in compliance with applicable laws, including the Personal Information Protection Act (개인정보 보호법) and the Act on Promotion of Information and Communications Network Utilization and Information Protection (정보통신망 이용촉진 및 정보보호 등에 관한 법률). Accordingly, pursuant to Article 30 of the Personal Information Protection Act, TheSoby establishes and discloses this Privacy Policy as follows, in order to inform users of the procedures and standards for the processing and protection of personal information and to handle related grievances promptly and smoothly.

01 Purposes of Processing Personal Information

ZILM processes personal information for the following purposes. Personal information being processed is not used for any purpose other than those stated below, and if the purpose of use changes, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Membership Registration and Management

   Personal information is processed for purposes such as confirming intent to sign up for or withdraw from membership, verifying age, verifying the identity of users and legal representatives, confirming consent of legal representatives, identifying and authenticating users for the provision of membership-based services, preventing duplicate registration, maintaining and managing membership status, delivering various notices and notifications, mediating disputes, and handling grievances.

2. Provision of Goods or Services

   Personal information is processed for purposes such as delivering goods, providing services, providing event information and participation opportunities, sending contracts and invoices, providing content based on interests and preferences, identity and age verification, and payment and settlement of fees.

3. Service Improvement and Development of New Services

   Personal information is processed to enhance service features and improve the user experience through analysis of service usage records, demographic analysis, and analysis based on users’ interests. Artificial intelligence (AI) technology may be applied in this process, and such information is used to improve service quality and develop new services through content creation, provision, and recommendation. However, chat contents are not used for service improvement or new service development purposes, including the application of artificial intelligence technology.

4. Establishing and Managing a Safe Service Environment

   Personal information is processed for purposes such as preventing fraudulent use of the service, blocking exposure to inappropriate content, and imposing restrictions on users who violate applicable laws or the ZILM Terms of Service.

02 Items of Personal Information Processed

ZILM collects and uses personal information to the minimum extent necessary to provide the service.

1. Items of personal information processed without the consent of the data subject
   ZILM processes the following items of personal information without the consent of the data subject pursuant to Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act (‘performance of a contract’).
   
   1) Order and payment processing
   - Items collected and used: payment ID, order history, payment information

2. Items of personal information processed with the consent of the data subject
   ZILM processes the following items of personal information with the consent of the data subject pursuant to Article 15, Paragraph 1, Item 1 and Article 22, Paragraph 1, Item 7 of the Personal Information Protection Act. In addition, users may register a profile photo, complete additional identity verification, and more in their member information, and when using individual services (or features) such as shopping, content monetization, and secondhand trading, additional collection of personal information may occur. In such cases, the company faithfully informs users of the items of personal information collected, the purposes of collection and use, the retention period, and other matters in accordance with applicable laws, and obtains separate consent. The personal information processed for each service (or feature) is as follows.
   
   1) Membership registration and management
   - Mobile phone number, nickname, user identification value, name, date of birth, gender, mobile carrier, encrypted Connecting Information (CI), encrypted Duplication Information (DI), domestic/foreign national status, identity verification history, profile photo, passport-related information (optional identity verification), ID card-related information (optional identity verification)
   
   2) Customer center
   - Consultation records, mobile phone number if necessary
   
   3) Person-to-person transactions
   - Name, mobile phone number, date of birth, CI, DI, passport (or ID card)-related information
   
   4) Commerce service
   - Delivery information such as name, address, and contact information; communal entrance door passcode (if applicable)
   
   5) Brokerage service
   - Delivery information such as name, address, and contact information; communal entrance door passcode (if applicable)
   
   6) Chat service
   - Chat contents
   
   7) Event and survey participation
   - Prize delivery address, contact information, email, survey participation information

3. Information automatically generated and collected during service use
   During the use of the service, service usage records such as search history, transaction records, visit records, and content creation, viewing, and recommendation history; device information such as IP address, operating system information, interface, and language settings; and advertising identifiers may be generated and collected.

03 Processing and Retention Period of Personal Information

ZILM processes and retains personal information within the retention and use period prescribed by applicable laws or the period consented to by the data subject at the time of collection. The processing and retention period for each category of personal information is as follows.

1. Membership registration and management: until 6 months after membership withdrawal
   ※ However, in any of the following cases, the information is processed and retained until the relevant cause has been resolved.
   
   1) Where an investigation or inquiry into a violation of applicable laws is in progress, until the conclusion of such investigation or inquiry
   2) Where identification of the same person and prevention of fraudulent use are necessary due to service use sanctions under the ZILM Terms of Service
   - Mobile phone number, fraudulent use records, and device information of users with fraudulent use records: until the end of the sanction (up to 5 years)

2. Chat service (chat contents): retained until 6 months after membership withdrawal, and upon expiration of the period, destroyed without delay in accordance with “05 Procedures and Methods for Destroying Personal Information”.
   ※ However, in any of the following cases, the information is processed and retained until the relevant cause has been resolved.
   
   1) Where dispute resolution regarding a person-to-person transaction is necessary
   -- Transaction records (sales posts and chat contents): 5 years
   
   2) Where an investigation or inquiry into a violation of applicable laws is in progress
   - Until the conclusion of such investigation or inquiry

3. Provision of goods or services: until completion of the supply of goods or services, payment and settlement of fees, and completion of customer service (CS) handling related to service provision
   ※ However, in any of the following cases, the information is processed and retained until the relevant cause has been resolved.
   
   1) Where dispute resolution regarding a person-to-person transaction is necessary
   - Transaction records (sales posts and chat contents): 5 years
   
   2) Where identification of the same person and prevention of fraudulent use are necessary due to service use sanctions under the ZILM Terms of Service
   - Fraudulent use records, device information, Duplication Information (DI), and transaction account information associated with fraudulent use records: until the end of the sanction (up to 5 years)
   
   3) Records concerning transactions such as labeling and advertising, and contract details and performance, pursuant to Article 6 (Preservation of Transaction Records, etc.) of the Act on the Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률)
   - Records concerning labeling and advertising: 6 months
   - Records concerning consumer complaints or dispute handling: 3 years
   - Records concerning contracts or withdrawal of offers, payment, and supply of goods, etc.: 5 years
   
   4) Article 15-2 (Duty of Telecommunications Business Operators to Cooperate) of the Protection of Communications Secrets Act (통신비밀보호법)
   - Computer communications and internet log records, access location tracking data: 3 months
   
   5) Article 85-3 (Keeping and Preservation of Books, etc.) of the Framework Act on National Taxes (국세기본법)
   - Books and supporting documents for all transactions prescribed by tax law: 5 years
   
   6) Article 22 (Generation, Preservation, and Destruction of Electronic Financial Transaction Records) of the Electronic Financial Transactions Act (전자금융거래법)
   - Records concerning electronic financial transactions: 5 years

04 Processing of Personal Information of Children Under 14

ZILM does not, in principle, collect or use the personal information of children under the age of 14. However, as there is no separate age verification procedure at the membership registration stage, ZILM may request identity verification if an account is subsequently suspected of belonging to a child under the age of 14. Failure to complete identity verification may result in suspension of the account.

05 Procedures and Methods for Destroying Personal Information

ZILM destroys personal information without delay when the retention period has expired or the purpose of processing has been achieved and the personal information is no longer needed. However, where a retention period is prescribed by internal company policy or applicable laws, the information is retained for that period and then destroyed.

• Destruction procedure: Personal information that has reached the destruction criteria is deleted through automated procedures, and the process is reported to the administrator through the computer system. In addition, non-electronic materials such as paper documents are manually and securely destroyed, and all processing steps are recorded and managed.

• Destruction method: Personal information printed on paper is destroyed by shredding or incineration, and personal information stored in electronic file format is deleted using technical methods that render it unrecoverable.

06 Provision of Personal Information to Third Parties

ZILM processes the personal information of data subjects only within the scope specified in “01 Purposes of Processing Personal Information”, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of law. In all other cases, personal information is not provided to third parties.

1. Cases where personal information is provided to third parties with the consent of the data subject

2. In cases prescribed by applicable laws such as the Personal Information Protection Act, or in accordance with the Rules for Personal Information Processing and Protection in Emergency Situations (긴급상황 시 개인정보 처리 및 보호 수칙) jointly announced by relevant government ministries, the company may provide personal information to relevant authorities without the consent of the data subject in the event of an emergency such as a disaster, infectious disease, imminent danger to life or body, or loss of property. Details of the Rules for Personal Information Processing and Protection in Emergency Situations can be found here.

07 Criteria for Additional Use and Provision

ZILM processes personal information only within the scope consented to by users or the scope prescribed by applicable laws, and does not additionally use or provide personal information without consent. If additional processing becomes necessary in the future, ZILM will inform users of the details in advance.

08 Outsourcing of Personal Information Processing

ZILM outsources part of its personal information processing to the extent necessary for the smooth provision of the service. Details of such outsourcing can be found via the link below.

• Status of Outsourced Personal Information Processing (Domestic)

When outsourcing personal information processing, ZILM thoroughly manages and supervises the outsourced companies to ensure compliance with relevant laws. To this end, personal information protection clauses are included in contracts, and the status of personal information processing is continuously reviewed through regular audits and evaluations. ZILM also supports outsourced companies in implementing the technical, administrative, and physical measures necessary for personal information protection, and does its utmost to ensure that customers’ personal information is processed securely.

Cases where personal information processing is outsourced overseas are described in “09 Overseas Transfer of Personal Information”.

09 Overseas Transfer of Personal Information

ZILM outsources the personal information collected from users overseas as described below in order to provide the service. Since tasks essential to service provision, such as data storage and infrastructure operation, are performed through overseas transfer, the service cannot be used if you do not consent to the overseas transfer. If you do not wish to have your information transferred overseas, please withdraw your membership in the app (My Page > Settings > Withdraw) or contact the customer center.

• Status of Outsourced Personal Information Processing (Overseas)

10 Measures to Ensure the Security of Personal Information

Pursuant to Article 29 of the Personal Information Protection Act, ZILM establishes and operates the following technical, administrative, and physical safeguards to ensure the security of personal information.

1. Management of personal information handlers ◦ The number of employees who process personal information is minimized, and regular training and campaigns on personal information protection obligations and security are conducted for all executives and employees.

2. Restriction of access to personal information ◦ Procedures for granting, changing, and revoking access rights to personal information processing systems are established and operated. ◦ Intrusion detection systems are used to control unauthorized access from outside.

3. Management of access records ◦ Access records of personal information processing systems (web logs, summary information, etc.) are retained and managed for at least 2 years. ◦ Security features are applied to prevent access records from being forged, altered, stolen, or lost.

4. Encryption of personal information ◦ Important information required to be encrypted by law is stored and managed in encrypted form. ◦ Separate security features, such as encryption during storage and transmission, are applied to important data.

5. Preparedness against hacking and other breaches ◦ Security programs are installed and periodically updated and inspected to prevent the leakage or damage of personal information by hacking or malicious code. ◦ Systems are installed in areas with controlled external access and are technically and physically monitored and protected. ◦ Network traffic is controlled and monitored, and attempts at unlawful alteration of information are detected.

11 Installation and Operation of Automatic Personal Information Collection Devices and Refusal Thereof

ZILM uses ‘cookies’, an automatic personal information collection device that stores and retrieves usage information from time to time, in order to provide customized services to data subjects. If users do not wish this, they may block cookies by following the guidance below.

• Cookies are small amounts of information that the server (http) sends to the user’s browser for website operation, and are stored on the user’s PC or mobile device.

• The data subject has the right to choose whether to allow the installation of cookies, and may directly configure whether to allow or block cookies through web browser settings. However, refusing to store cookies may prevent some service features from functioning properly.

ZILM collects the following behavioral information, without identifying individuals, in order to provide data subjects with optimized customized services and benefits, online behavioral advertising, and the like during service use.

• ZILM collects only the minimum behavioral information necessary for online behavioral advertising and the like, and does not collect sensitive behavioral information that may infringe on an individual’s rights, interests, or privacy, such as ideology or beliefs, family and relative relationships, academic or medical history, or social activity history.

Data subjects may direct questions, exercise their right of refusal, and file damage reports through the contact information below.

- Contact for personal information-related customer inquiries

- Email: support@zilm.io

- Customer center inquiries: My Page > Contact Customer Center

12 Use of Service Usage Statistics Analysis Tools

1. ZILM uses the following analytics tools to analyze service usage and improve the service.

2. The following information is automatically collected through the above tools. This information is used only for statistical purposes and is not used to identify individual users.
   - Service usage records (visit and screen navigation history, access date and time, usage duration)
   - Device and browser information (device model, operating system version, language and country settings)
   - App instance identifier, cookies (web only), approximate location based on IP address (country/city level)

3. The collected information is stored and processed on the servers of Google LLC (located in the United States), and the retention period is up to 14 months. For details on Google’s processing of personal information, please refer to the Google Privacy Policy (https://policies.google.com/privacy).

4. Users may refuse collection by the following methods.
   - Web: block cookies in browser settings or use the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)
   - App: request suspension of collection through the customer center (or in-app inquiry)

13 Rights and Obligations of Users and Legal Representatives and How to Exercise Them

ZILM respects users’ rights, and users may exercise rights (hereinafter “exercise of rights”) such as requesting access to, correction of, deletion of, or suspension of processing of personal information, withdrawing consent, and refusing or requesting an explanation of automated decisions. Please refer to the details below.

1. Rights may be exercised against ZILM in writing, by email, by facsimile (FAX), or other means pursuant to Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and ZILM will take action without delay.
   
   1) Data subjects may directly view and change their personal information through the settings feature within the service, and may follow the path below to terminate membership (withdraw consent).
   - View & change personal information: My Page > Settings
   - Withdraw consent: My Page > Settings > Withdraw
   
   2) If you contact the operator through the customer center, we will take action without delay.

2. Rights may also be exercised through an agent, such as the data subject’s legal representative or an authorized person. In such cases, a power of attorney in the form of Annex Form No. 11 of the Notification on Personal Information Processing Methods (개인정보 처리 방법에 관한 고시) must be submitted.

3. Requests for access to personal information or suspension of processing may be restricted pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act, and requests for correction or deletion of personal information cannot be granted where the personal information is specified as subject to collection under other laws.

4. Data subjects may refuse or request an explanation of automated decisions. However, ZILM does not make automated decisions. If automated decisions occur, ZILM will disclose the criteria and procedures, the manner in which personal information is processed, and the procedures for refusal or requesting an explanation.

5. When a request for access, correction, deletion, or suspension of processing is made in accordance with the rights of the data subject, ZILM verifies that the person making the request is the data subject or their agent.

6. Data subjects may exercise their rights directly through the methods described above or through the contact information below. ZILM will strive to ensure that the exercise of data subjects’ rights is handled promptly.
   - Contact for personal information-related customer inquiries
   - Email: support@zilm.io
   - Customer center inquiries: My Page > Contact Customer Center

14 Chief Privacy Officer and Responsible Department

For all inquiries, complaints, advice, or other matters related to personal information protection arising from the use of the service, please contact the Chief Privacy Officer and responsible department. ZILM will listen to users and do its best to provide prompt and sufficient answers.

• Name: Seungbeom Jeon

• Position: Chief Privacy Officer

• Contact: support@zilm.io

15 Remedies for Infringement of the Rights and Interests of Data Subjects

Users may request reporting, consultation, and remedies for personal information infringement through the organizations below.

1. Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency)

   • Responsibilities: reporting of personal information infringement, requests for consultation

   • Website: privacy.kisa.or.kr

   • Phone: 118 (no area code)

   • Address: Korea Internet & Security Agency, 9 Jinheung-gil, Naju-si, Jeollanam-do

2. Personal Information Dispute Mediation Committee

   • Responsibilities: applications for personal information dispute mediation, collective dispute mediation (civil resolution)

   • Website: www.kopico.go.kr

   • Phone: 1833-6972

   • Address: 12F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul

3. Cyber Investigation Division, Supreme Prosecutors’ Office

   • Phone: 1301 (no area code)

   • Email: privacy@spo.go.kr

   • Website: www.spo.go.kr

4. National Police Agency Cyber Investigation Bureau

   • Phone: 182 (no area code)

   • Website: Electronic Cybercrime Report & Management System (ECRM)

ZILM guarantees data subjects’ right to informational self-determination and does its utmost to provide consultation and remedies for damage caused by personal information infringement. If you need to file a report or seek consultation, please contact the customer consultation department in charge of personal information.

16 Implementation and Amendment of the Privacy Policy

ZILM may amend this Privacy Policy to reflect government policies, applicable laws, or changes to the service, in which case the changes will be announced through notices at least 7 days in advance.

This Privacy Policy takes effect on September 18, 2026.