Habitate

The Company collects and processes the minimum personal information necessary for the following purposes. Personal information shall not be used for any purpose other than the following, and if the purpose changes, necessary measures such as obtaining separate consent shall be taken in accordance with Article 18 of the Personal Information Protection Act.

The Company operates personal information files in accordance with Article 32 of the Personal Information Protection Act, with processing purposes and retention periods within the scope described in Article 1.

① The Company provides personal information to third parties only when applicable under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special legal provisions.

② Currently, the Company does not in principle provide users' personal information to third parties. However, exceptions apply in the following cases:

• When the user has given prior consent
• When required by law or when requested by investigative agencies following legally prescribed procedures for investigative purposes
• When necessary for fee settlement in connection with service provision (applicable upon introduction of paid services)

③ If third-party provision occurs in the future, the Company will immediately amend this policy and obtain prior consent.

When additionally using or providing personal information without the data subject's consent under Article 15(3) or Article 17(4) of the Personal Information Protection Act, the Company considers the following:

① The Company consigns personal information processing as follows for smooth service operation:

② Upon entering into consignment contracts, the Company specifies the following in the contract in accordance with Article 26 of the Personal Information Protection Act and supervises whether the consignee processes personal information safely:

• Prohibition of personal information processing beyond the purpose of consigned work
• Matters regarding safety measures
• Matters regarding restrictions on re-consignment
• Matters regarding management and supervision of the consignee
• Matters regarding liability for damages

③ If the content of consigned work or the consignee changes, the Company will promptly disclose this through this policy.

The Company transfers personal information overseas as follows for service operation. The relevant transfers meet the standards under Article 28-8 of the Personal Information Protection Act.

① The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has expired or the processing purpose has been achieved.

② If personal information must continue to be retained in accordance with other laws despite the expiration of the agreed retention period or achievement of the processing purpose, such personal information is transferred to a separate database (DB) or stored in a different location.

③ The procedures and methods for destroying personal information are as follows:

① Data subjects may exercise the following personal information protection rights against the Company at any time:

② Rights may be exercised through the following methods:

• Email: project.habitate@gmail.com
• In-app customer center: Settings > Customer Center (to be implemented)
• Identity verification procedures will be conducted, and requests will be processed within 10 days of receipt.

③ In the case of children under the age of 14, their legal representatives may request access, correction, deletion, and suspension of processing of personal information concerning the child under Article 38(2) of the Personal Information Protection Act. The Company in principle restricts membership registration for children under 14 years of age.

④ Rights may also be exercised through an agent such as the data subject's legal representative or a duly authorized person. In this case, a power of attorney and a copy of the agent's ID must be submitted.

The Company takes the following safety measures in accordance with Article 29 of the Personal Information Protection Act:

① The Company designates a Personal Information Protection Officer as follows to take overall responsibility for personal information processing and to handle complaints and provide remedies related to personal information processing:

② Data subjects may inquire about all matters related to personal information protection, complaints, and remedies arising from using the Company's services. The Company will respond and process data subjects' inquiries without delay.

① Data subjects may request access to personal information in accordance with Article 35 of the Personal Information Protection Act at the following department:

② If a data subject is dissatisfied with or has objections to the measures taken in response to a request, they may raise an objection, and the results of the measures will be notified within 10 days from the date the objection is received.

① Data subjects may apply to the following institutions for dispute resolution or consultation to obtain remedies for personal information infringement:

② Persons whose rights or interests have been infringed upon by a disposition or inaction regarding requests under Articles 35 (Access), 36 (Correction/Deletion), and 37 (Suspension of Processing, etc.) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

※ Central Administrative Appeals Commission: (without area code) 110 · www.simpan.go.kr

① This Privacy Policy is effective from May 1, 2026.

② When amending the Privacy Policy to reflect changes in laws or services, the Company will provide notice at least 7 days before the amendment through in-app notices or email. However, when significant changes occur to user rights, at least 30 days' notice will be provided.

③ Previous versions of this Privacy Policy can be confirmed through version management.