Article 1 (Purpose)

UpGong (hereinafter "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

Article 2 (Personal Information Collected)

The Company collects the following personal information to provide services.

1. Required Information

2. Automatically Collected Information

3. Optional Information

• Exam Information (exam name, date, subjects): D-Day management feature
• Parent-Child Connection Information: Parent's access to child's study status
• Profile Photo: Profile display within service (optional)

Article 3 (Purpose of Processing Personal Information)

The Company processes collected personal information for the following purposes:

1. Member Management: Membership services, identity verification, fraud prevention
2. Service Provision: Attendance management, study time measurement, statistics and reports
3. AI Mentoring: Personalized motivational messages based on learning pattern analysis
4. Parent Services: Child's attendance and study status notifications, study reports
5. Service Improvement: Service usage analysis, new feature development
6. Customer Support: Inquiry handling, announcements

Article 4 (Retention Period)

The Company processes and retains personal information within the retention period required by law or agreed upon at the time of collection.

Article 5 (Disclosure to Third Parties)

The Company does not provide personal information to third parties. However, the following cases are exceptions:

1. When separate consent is obtained from the data subject
2. When there are special provisions in laws
3. When the data subject or legal representative cannot express consent, and it is clearly necessary for urgent life, body, or property interests

Parent-Child Connection Service

When a parent account is connected to a child (student) account, the following information is provided to the parent:

• Attendance status (check-in/check-out times)
• Study time and subject-specific study records
• Study statistics and reports

This is done through a connection code generated by the child (student) account and provided to the parent, with the child's consent.

Article 6 (Processing Delegation)

The Company delegates personal information processing as follows for smooth service provision:

When entering delegation contracts, the Company specifies in documents matters regarding prohibition of personal information processing beyond the delegated purpose, technical and administrative protection measures, restrictions on re-delegation, supervision of the delegated party, and liability for damages, in accordance with Article 26 of the Personal Information Protection Act.

Article 7 (Rights of Data Subjects)

Data subjects may exercise the following personal information protection rights against the Company at any time:

1. Request to access personal information
2. Request for correction of errors
3. Request for deletion
4. Request to suspend processing

How to Exercise Rights

• In-App Settings: You can view, modify, and delete your account through the 'Settings' menu in the app.
• Email Inquiry: You can request at support@upgong.app.

Rights may be exercised through a legal representative or authorized agent. In this case, a power of attorney according to Form No. 11 of the "Notice on Personal Information Processing Methods" must be submitted.

Article 8 (Destruction of Personal Information)

The Company destroys personal information without delay when it becomes unnecessary due to expiration of retention period or achievement of processing purpose.

Destruction Procedure

Information entered for membership registration is moved to a separate DB (or separate filing cabinet for paper documents) after the purpose is achieved, stored for a certain period according to internal policies and related laws, and then destroyed.

Destruction Method

• Electronic Files: Destroyed using methods such as low-level formatting to prevent reproduction
• Paper Documents: Destroyed by shredding or incineration

Article 9 (Security Measures)

The Company takes the following measures to ensure the security of personal information:

1. Encryption: Passwords (PINs) are encrypted and stored, and important data is transmitted encrypted.
2. Technical Measures Against Hacking: Security programs are installed and regularly updated and inspected.
3. Access Control: Access to personal information is limited to minimum personnel, and access records are managed.
4. Secure Servers: Personal information is transmitted securely through SSL and other secure servers.

Article 10 (Protection of Children's Personal Information)

The Company obtains consent from legal representatives when collecting personal information of children under 14 years of age.

• Children under 14 require consent from a legal representative (parent, etc.) to use the service.
• Legal representatives may request access, correction, or deletion of their child's personal information.
• Legal representatives can check their child's service usage through the parent-child connection feature.

Article 11 (Privacy Officer)

The Company has designated a Privacy Officer to oversee personal information processing and handle complaints and damage relief related to personal information processing.

Data subjects may contact the Privacy Officer for all inquiries, complaints, and damage relief related to personal information protection arising from using the Company's services. The Company will respond and process inquiries without delay.

Article 12 (Remedies for Rights Infringement)

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency Personal Information Infringement Report Center, etc., for relief from personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)

Article 13 (Changes to Privacy Policy)

This Privacy Policy is effective from the effective date, and any additions, deletions, or corrections due to changes in laws and policies will be announced through notices at least 7 days before the changes take effect.

Revision Details: Updated delegation company information, added payment-related provisions, specified free service study record retention period