Privacy Policy WEMIX PTE. LTD.

This Policy (hereinafter the “Policy”) explains the way of process of information provided or collected in the websites and/or services, including applications, on which this Policy is posted. In addition, the Policy also explains the information which is provided or collected in the course of using the applications of WEMIX PTE. LTD. (hereinafter, the “Company”) which exist in the websites or platforms of other companies.

The Company is the controller of the information provided or collected in : a. the services on which this Policy is posted, and b. the course of using the applications of the Company.

Through this Policy, the Company regards personal information of the users (hereinafter, the “user” or “you”) as important and informs them of the purpose and method of the use of personal information provided by the users and the measurement taken by the Company for protection of the personal information.

In case of modification, the Company will make public notice through posting on the bulletin board of Company's service (or individual notice through sending mails, fax or emails).

Article 1 : Information to be collected and method of collection

• (1) Personal information to be collected

  Personal information to be collected by the Company are as follows :

  • Information provided by the users

    The Company may collect the information directly from the users.

    Title of Service	Information to be collected
    WEMIX Wallet	Email address, WEMIX Wallet ID/address, Social network ID, One-way hashed password, Encrypted key
    Personalized Advertising	Website visit history of the user, Application usage history of the user, Search history of the user, Advertising ID
    Game	SNS ID, Email address, WEMIX Wallet address, Nickname, Equipment information
    WEMIX Auction	User name, Email address, WEMIX Wallet ID/Address, Phone number
    WEMIX Support Center	Email address, Device OS, Inquiry type, WEMIX Wallet ID, WEMIX Wallet address(Optional), personal information that user submitted for customer service(Optional)

  • Information collected during service usage of users

    Besides the information directly from the users, the Company may collect information in the course of service usage of the user

    List	Items to be collected (examples)
    Equipment information	Equipment identifier, operation system, hardware version, equipment set-up, type and set-up of browser, usage information of website or application and telephone number
    Log information	Log information IP address, log data, usage time, search word input by users, internet protocol address, cookie and web beacon
    Other information	Preference, advertisement environment, visited pages regarding service usage of users.

  • Optional information

    The user may reject the collection and use of optional information and, even in case of rejection, there is no limit on service usage.

    Purpose of Collection	Items to be collected (examples)
    Provision of customized ad	Contents and result of marketing activities and event participation
    Delivery of urgent notice	Information provided by the users regarding the management of other agreements, maintenance, implementation and event participation.
    Marketing	Preference, advertisement environment, visited pages regarding service usage of users.

• (2) Method of collection

  The Company collects the information of users in a way of the followings:

  • Webpage, written form, fax, telephone calling, emailing, tools for collection of created information
  • Provided by partner companies
• (3) Assignment of collected personal information

  For carrying out services, the Company assigns external professional companies (subcontractors) to process personal information as follows. This assigning task of processing works only if necessary for providing the services.

  When assigning the task of processing personal information to the subcontractors, the Company supervises the subcontractors and ensures the requirements in the agreement with subcontractors in order to secure safety of personal information. The requirements include, but are not limited to, strict compliance with directions regarding personal information protection, confidentiality of personal information, prohibition of disclosure to 3rd party, accountability for accidents, responsibility of returning or destruction of personal information upon termination of assignment agreement or completion of processing.

  Name of subcontractors	Description of assigned works (services)
  Wemade Co., Ltd.	Operation management, agency
  Appsflyer Ltd., Google LLC	Provision of customized advertisement based on user interests, user analysis
  Amazon Web Services, Naver Cloud Platform, SSangYong Information & Communications	Cloud service, including user data storage
  Zendesk, Inc. , Glohow Holdings Pte. Ltd. , Qroad Inc.	Customer service

• (4) Details of provision of personal information to 3rd Party

  Except for the following cases, the Company does not disclose or provide personal information of the users to a 3rd party:

  Recipient of information	Purpose of use of recipient	Items to be provided	Period of retention and use of recipient
  None

• (5) Period of retention and use of personal information

  In principle, the Company destructs personal information of users without delay when: the purpose of its collection and use has been achieved; the legal or management needs are satisfied; or users request.

  The Company will retain the information if it is required to retain the information by relevant laws and regulations. The information to be retained as required by the relevant laws and regulations are as follows :

  Relevant laws and regulations	Personal Information	Retention period
  The Act on Consumer Protection in Electronic Commerce	Record regarding contract or withdrawal of subscription	5 years
  	Record on payment and supply of goods	5 years
  	Record on consumer complaint or dispute treatment	3 years
  	Record on labeling and advertising	6 months
  The Act on Use and Protection of Credit Information	Record on collection/process, and use of credit information	3 years
  The Protection of Communications Secrets Act	Log record of users such as internet/data detecting the place of user connection	3 months

• (6) Procedure and method of destruction of personal information
  In principle, the Company destructs the information immediately after the purposes of its collection and use have been achieved: Provided that, if any information is to be retained as required by relevant laws and regulations, the Company retains it for the period as required by those laws and regulations before destruction and, in such event, the personal information which is stored and managed separately will not be used for other purposes. The Company destructs: hard copies of personal information by shredding with a pulverizer or incineration; and deletes personal information stored in the form of electronic file by using technological methods, ensuring that the personal information is impossible to be restored.
• (7) Technical, managerial and physical measures for protection of personal information

  In order to prevent the loss, theft, leakage, alteration or damage of personal information of the users, the Company takes technical, managerial and physical measures for securing safety as follows:

  Items	Examples
  Technical measures	Utilize security servers for transmitting encryption of personal information Take measures of encryption for confidential information Install and operate vaccine software Install and operate access control devices and equipments Establish and execute internal management plan
  Managerial measures	Appoint a staff responsible for protecting personal information Provide education and training for staffs treating personal information Establish and execute internal management plan Establish rules for writing passwords which is hard to be estimated Ensure safe storage of record of access to personal information processing system Classify the level of authority to access to personal information processing system
  Physical measures	Establish and operate the procedure for access control for the facilities for storing personal information Store documents and external storage device that are containing personal information in safe places that have locking device

Article 2 : Use of collected information

The Company uses the collected information of users for the following purposes:

• User management and identification
• To detect and deter unauthorized or fraudulent use of or abuse of the Service
• Performance of contract, service fee payment and service fee settlement regarding provision of services demanded by the users
• Improvement of existing services and development of new services
• Making notice of function of company sites or applications or matters on policy amendment
• Use of information with prior consent of the users (for example, utilization of marketing advertisement)
• To make statistics on member’s service usage, to provide services and place advertisements based on statistical characteristics
• To provide information on promotional events as well as opportunity to participate
• To comply with applicable laws or legal obligation
• When necessary for uninterrupted provision of Service

The Company agrees that it will obtain a consent from the users, if the Company desires to use the information other than expressly stated in this Policy.

Article 3 : Disclosure of collected information

Except for the following cases, the Company will not disclose personal information with a 3rd party:

• 1) When the Company discloses the information with its affiliates, partners and service providers;
  • when the Company's affiliates, partners and service providers carry out services such as bill payment, execution of orders, products delivery and dispute resolution (including disputes on payment and delivery) for and on behalf of the Company
• 2) When the users consent to disclose in advance;
  • when the user selects to be provided by the information of products and services of certain companies by sharing his or her personal information with those companies
  • when the user selects to allow his or her personal information to be shared with the sites or platform of other companies such as social networking sites
  • other cases where the user gives prior consent for sharing his or her personal information
• 3) When disclosure is required by the laws:
  • if required to be disclosed by the laws and regulations; or
  • if required to be disclosed by the investigative agencies for detecting crimes in accordance with the procedure and method as prescribed in the laws and regulations

Article 4 : Cookies, Beacons and Similar Technologies

The Company may collect collective and impersonal information through 'cookies' or 'web beacons'. Cookies are very small text files to be sent to the browser of the users by the server used for operation of the websites of the Company and will be stored in hard-disks of the users' computer. Web beacon is a small quantity of code which exists on the websites and emails. By using web beacons, we may know whether an user has interacted with certain webs or the contents of email. These functions are used for evaluating, improving services and setting-up users' experiences so that much improved services can be provided by the Company to the users.

The items of cookies to be collected by the Company and the purpose of such collection are as follows:

The users have the choice for cookie installation. Thus, they may: 1) allow all cookies through settings in the web browser, 2) confirm each cookie save, or 3) refuse all cookies to be saved: Provided that, if the users reject the installation of cookies, use of certain services provided by the Company may be restricted.

Article 5 : User’s right

The users or their legal representatives, as main agents of the information, may exercise the following rights regarding the collection, use and sharing of personal information by the Company:

• exercise right to access personal information;
• make corrections or deletion;
• make temporary suspension of treatment of personal information; or
• request the withdrawal of their prior consent

If, in order to exercise the above rights, user uses the menu of 'edit member information’ or contact the Company by sending a document or email to the Company (or person in charge of management of personal information or a deputy), the Company will take measures without delay: However, the Company may reject the request of you only to the extent that there exists either proper cause as prescribed in the laws or equivalent cause.

Article 6 : Security

The Company regards the security of personal information of users as very important. The company constructs the following security measures to protect the users' personal information from any unauthorized access, release, use or modification :

• 1) Encryption of personal information
  • Transmit users' personal information by using encrypted communication zone
  • Store important information after encryption of such information.
• 2) Counter-measures against hacking
  • Install a system in the area to which external access is controlled so as to prevent leakage or damage of users' personal information by hacking or computer virus.
• 3) Establish and execute internal management plan
• 4) Install and operate access control system
• 5) Take measures to prevent forging or alteration of access record

Article 7 : Protection of personal information of Minor

In principle, the Company does not collect any information from the minor under 18 or equivalent minimum age as prescribed in the laws in relevant jurisdiction. In principle, the website, application, products and services of the Company are to be provided to ordinary people. The website or application of the Company prevents minors from use of service through consent to age restriction, and through the consent the Company intentionally does not collect any personal information of minors.

Article 8 : Modification of Privacy Protection Policy

The Company retains the right to amend or modify this Policy. In such cases, the Company makes a public notice of such amendments or modifications through bulletin board of its website (or through individual notice such as written document, fax or email) and obtains consent from the users if required by relevant laws.

Article 9 : Lawful processing of personal information under PDPA, GDPR

The Company complies with the Singapore Personal Data Protection Act 2012 and the domestic laws of each member country.

• 1) Processing personal information by the Company shall be lawful only if and to the extent that at least one of the following applies :
  • 1. A user has given consent to the processing of his or her personal information.
  • 2. Processing is necessary for the performance of a contract to which a user is party or provision of Service, or in order to take steps at the request of a user prior to entering into a contract or use of Service :
    • Member management, identification, etc.
    • Performance of a contract in relation to providing the services required by users, payment and settlement of fees or provision of Service, etc.
  • 3. Processing is necessary for compliance with a legal obligation to which the Company is subject
    • Compliance with relevant law, regulations, legal proceedings, requests by the government
  • 4. Processing is necessary in order to protect the vital interests of users, or other natural persons
    • Detection of, prevention of, and response to fraud, abuse, security risks, and technical issues that may harm users or other natural persons
  • 5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company
  • 6. Processing is necessary for the purposes of the legitimate interests pursued by the Company or by a third party (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a minor)
• 2) User’s right under GDPR

  The users or their legal representatives, as main agents of the information, may exercise the following rights regarding the collection, use and sharing of personal information by the Company:

  • The right to access to personal information :
    The users or their legal representatives may access the information and check the records of the collection, use and sharing of the information under the applicable law.
  • The right to rectification :

    The users or their legal representatives may request to correct inaccurate or incomplete information.

  • The right to erasure:

    The users or their legal representatives may request the deletion of the information after the achievement of their purpose and the withdrawal of their consent.

  • The right to restriction of processing :

    The users or their legal representatives may make temporary suspension of treatment of personal information in case of the disputes over the accuracy of information and the legality of information treatment, or if necessary to retain the information.

  • The right to data portability :

    The users or their legal representatives may request to provide or transfer the information.

  • The right to object :

    The users or their legal representatives may suspend the treatment of personal information if the information is used for the purpose of direct marketing, reasonable interests, the exercise of official duties and authority, and research and statistics.

  • The right to automated individual decision-making, including profiling :

    The users or their legal representatives may request to cease the automated treatment of personal information, including profiling, which has critical impact or cause legal effect on them.

  If, in order to exercise the above rights, you, as an user, use the menu of 'edit member information” of service or contact the Company by sending a document or emails, or using telephone to the Company (or person in charge of management of personal information or a deputy), the Company will take measures without delay: Provided that the Company may reject the request of you only to the extent that there exists either proper cause as prescribed in the laws or equivalent cause.

• 3) Data transfer to other countries

  Considering that it engages in global businesses, the Company may provide the users' personal information to the companies located in other countries for the purpose as expressly stated in this Policy. For the places where the personal information is transmitted, retained or processed, the Company takes reasonable measures for protecting those personal information.

• 4) 3rd party’s sites and services

  The website, product or service of the Company may include the links to the ones of a 3rd party and the privacy protection policy of the site of 3rd party may be different from that of the Company. Thus, it is required for the users to additionally review the policy of a 3rd party site linked to the site of the Company.

• 5) Guide for users residing in California

  If the user resides in California, certain rights may be given. The Company prepares preventive measures for protecting personal information of members so that the Company can comply with online privacy protection laws of California.

  In case of leakage of personal information, an user may request the Company to examine the leakage. In addition, all the users in the website of the Company can modify their information at any time by using the menu for changing information by accessing their personal account.

  In addition, the Company does not trace the visitors of its website nor use any signals for 'tracing prevention'. The Company will not collect nor provide any personal identification information through advertisement services without consent of users.

Article 10 : Contact Information of Company

Please use one of the following methods to contact the Company should you have any inquiries in respect to this policy or wish to update your information:

• Company Name : WEMIX PTE. LTD.
• Address : 18 Cross Street, #02-101, Singapore 048423
• Tel. : +65.3174.0791
• email : customer@wemadetree.com.sg

The Company designates the following Data Protection Officer (DPO) in order to protect personal information of customers and resolve any related complaints.

• DPO : Jae Sung Park
• Address : 18 Cross Street, #02-101, Singapore 048423
• Tel. : +65.3174.0791
• email : dpo@wemadetree.com.sg

The company has a designated agent in the EU in case of GDPR, and the contact information of the EU agent is as below.

• Company Name : VeraSafe Netherlands BV
• Address : Keizersgracht 391 A 1016 EJ Amsterdam The Netherlands
• Contact : https://verasafe.com/public-resources/contact-data-protection-representative

The company has a designated agent in the UK in case of GDPR, and the contact information of the UK agent is as below.

• Company Name : VeraSafe United Kingdom Ltd.
• Address : 37 Albert Embankment London SE1 7TL United Kingdom
• Contact : https://verasafe.com/public-resources/contact-data-protection-representative

• Notification Date: July 1, 2022
• Enforcement Date: July 1, 2022

Revision History