Fandora Privacy Policy

Article 1 (Purpose)

4PLANET Corp. (hereinafter the "Company") values the personal information of its users and complies with the Personal Information Protection Act and other relevant laws and regulations.

Article 2 (Personal Information Items Collected and Methods of Collection)

1. The app Service is provided on a device basis without a separate membership registration procedure. In connection with the use of the app Service, the Company does not collect users' email addresses, telephone numbers, real names, dates of birth, gender, addresses, payment method information (card numbers, bank account numbers, etc.), or identity verification information. However, where a user places an order for goods on the Company's goods store, the Company collects the information set out in Paragraph 5.
2. The Company automatically collects the following information while the user runs the app or uses the Service:
   • Device identification information: device identifier (on Android, a unique value provided by the device; on iOS, a random value generated by the app and stored in the device keychain), device model name, operating system version, app version
   • Network information: IP address, country/region/city of access estimated from the IP address, internet service provider (ISP) and network operator name, whether a VPN or proxy is used, whether the connection passes through a data center
   • Device environment information: time zone, device locale setting, SIM card country code, network country code, app language
   • Push notification token
   • Device integrity verification information: the raw verdict and the failure reason returned by Google Play Integrity (Android) and Firebase App Check (iOS)
   • Information collected directly on the user's device by the third-party SDKs listed in Article 10 (advertising identifiers, etc.). The items collected and the methods of refusal are as set out in Article 10.
3. The following information is collected when the user directly enters or submits it, and the user chooses whether to provide it:
   • Nickname, profile image
   • Posts and fan chat messages written by the user
   • The reason for a report and the subject of the report, when the user files a report
   • Whether the user has consented to receive marketing information
   • The sender address and the content of an inquiry email sent by the user. Inquiry emails are not stored in the Company's database and are handled in the mailbox of the mail service used by the Company.
4. The following information is generated and stored in the course of using the Service:
   • Voting history; records of the accumulation, use and expiry of points; check-in and rewarded advertisement records; records of participation in events such as the roulette
   • Login history, most recent access time, cumulative number of logins
   • In-app purchase records: store transaction identifier, product ID, purchase token, and the raw receipt issued by the store
   • Friend relationships, friend request and gift records, invitation code
   • Nickname change history (nickname before and after the change)
   • Account migration and linkage history between devices (device identifiers and user codes before and after the migration)
   • Fraudulent use detection and blocking records: sign-up and login blocking history and the reasons therefor, and IP addresses and device identifiers registered on the block list
5. Where a user places an order for goods on the goods store operated by the Company (which is distinct from the in-app purchase stores of the app marketplaces), the Company collects the following information in order to process that order. That store may be used without membership registration, and the information below is entered directly by the user on the order form. The information below is not collected where the user uses only the app Service.
   • Orderer information: name, mobile telephone number, email address
   • Recipient information: name, contact number, postal code, delivery address, delivery request notes
   • Order and payment information: order number, ordered goods and quantity, type of payment method, payment approval information. Details of the payment method, such as credit card numbers, are handled by the electronic payment gateway, and the Company neither collects nor stores them.
   • Refund information: the refund bank account details designated by the user, only where a refund cannot be made through the original payment method
   • The order number and mobile telephone number entered by the user when looking up an order
   The purposes of use are the receipt and processing of orders, delivery of goods, payment and refund of the price, order lookup, customer response and dispute resolution. Pursuant to Article 6 of the Act on Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree, records of contracts or withdrawal of subscription are retained for five years, records of payment and the supply of goods for five years, and records of consumer complaints or dispute resolution for three years; after those periods, the information is destroyed in accordance with the procedure set out in Article 7.
6. The Company does not request location permissions (GPS, etc.), and the country, region and city referred to in Paragraph 2 are values estimated from the IP address.

Article 3 (Purposes of Use of Personal Information)

The Company uses the collected information for the following purposes:

1. Provision of the Service and account linkage
2. Management of voting history and the accumulation and use of points
3. Prevention of fraudulent use and strengthening of security
4. Service improvement and customer support

Article 4 (Retention and Use Period of Personal Information)

1. In principle, the Company retains and uses personal information during the period in which the user uses the Service, and destroys it in accordance with the procedures set out in Article 7 once the purpose of processing has been achieved or the retention period set out below has elapsed.
2. Where a user requests withdrawal from the Service (deletion of the User Code), the Company processes it as follows:
   • The account is immediately switched to a withdrawn state so that the Service can no longer be used, the push notification token and the device identifier are deleted, and any points held are extinguished.
   • However, in order to prevent fraudulent use in the form of repeated re-registration immediately after withdrawal, the Company separately retains a withdrawal record consisting of the device identifier, the User Code and the date and time of withdrawal at the time of withdrawal. This record is retained for the same purpose even after the re-registration restriction period set out in Paragraph 3 has elapsed.
   • Records generated in the course of using the Service, such as voting history, point transaction history, in-app purchase records and access records, are not deleted upon withdrawal and are retained until the end of the retention periods set out in Paragraph 4.
3. The Company restricts re-registration from a withdrawn device for a certain period of time. The length of the restriction is determined by the Company's operational policy and is subject to change.
4. The retention period for each type of record is as follows:
   • Information retained without an automatic deletion period for the operation of the Service and the prevention of fraudulent use: account information, pick information, withdrawal records, voting history, access location and network information, in-app purchase records, block lists, device integrity verification records, nickname change history
   • 730 days: daily login statistics records
   • 365 days: point transaction history, advertisement viewing records, report records, notification dispatch records, raw payment records, device account migration history, automation detection records
   • 180 days: store payment status change notification records
   • 90 days: roulette usage records
   • 30 days: friend gift records, app integrity token usage records, replay prevention records
   • 7 days: sign-up and login blocking records
   • 3 days: pending push dispatch records
   • 24 hours: friend request records
5. Information that must be preserved for a certain period under relevant laws and regulations is retained for the period prescribed by such laws and regulations and is then destroyed.
6. Inquiry emails are stored not in the Company's database but in the mail service used by the Company, and their retention period follows the retention policy of that service.

Article 5 (Provision of Personal Information to Third Parties)

1. The Company does not provide the user's personal information to third parties without the user's consent. However, this does not apply in any of the following cases:
   • where the user has given prior consent;
   • where there are special provisions in laws and regulations, or where it is unavoidable in order to comply with legal obligations;
   • where an investigative agency makes a request in accordance with the procedures and methods prescribed by laws and regulations.
2. Where a user places an order for goods at the Company's product sales store, the information of the purchaser and of the recipient is transferred, to the extent necessary to perform that order, to the operators responsible for the delivery of the goods and for the settlement of payment. The parties receiving such transfer and the content of their work are as set out in Article 6, and where the delivery address is in a country or region outside the Republic of Korea, Article 12 also applies.
3. Where the delivery address is in a country or region outside the Republic of Korea, the recipient's name, address and contact details, the identification number used for customs clearance, and the description, quantity and value of the goods may be submitted to the customs authorities or other competent agencies of the destination country, to the extent required by the laws of that country.
4. Except in the cases set out in Paragraphs 2 and 3, the Company does not provide or sell the user's personal information to third parties for commercial purposes such as advertising or marketing.

Article 6 (Outsourcing of Personal Information Processing)

1. The Company outsources personal information processing tasks as follows in order to provide the Service:
   • Google LLC — dispatch of push notifications; analysis and storage of app usage statistics; app error diagnostics; storage of image files uploaded by users; device integrity verification; verification and processing of Google Play in-app purchases; sending, receiving and storage of customer inquiry emails; multilingual translation of posts, fan chat messages, reports and inquiries written by users
   • Apple Inc. — verification of iOS in-app purchase transactions and confirmation of refunds
   • Cloudflare, Inc. — relaying and optimization of the connection path to the Service, and security (blocking of attacks such as DDoS)
2. When entering into an outsourcing agreement, the Company stipulates, through documents such as the data processing terms provided by each trustee, the matters required by Article 26 of the Personal Information Protection Act, including the prohibition of processing personal information beyond the purpose of performing the outsourced work, technical and administrative safeguards, restrictions on sub-outsourcing, supervision of the trustee, and liability such as compensation for damages.
3. The items of information collected directly on the user's device by the advertising and analytics software development kits (SDKs) included in the app and transmitted to the relevant providers, and the methods of refusing such collection, are as set out in Article 10.
4. Where the transfer of personal information to any of the above trustees constitutes a transfer abroad, the details of the country of transfer, the items transferred, the purpose and the retention period are as set out in Article 12.
5. If the content of the outsourced work or the trustee changes, the Company will disclose such change through this Privacy Policy.
6. Where a user places an order for goods at the Company's product sales store, the Company outsources the following tasks in order to perform that order. The name and contact details of the trustee performing each task will be entered in the list in Paragraph 1 and also displayed on the order screen at the time the outsourcing commences.
   • payment gateway services, including the settlement of payment and the processing of payment cancellations and refunds
   • delivery of the goods and inquiry into the delivery status
   • where the delivery address is in a country or region outside the Republic of Korea, the international transportation of the goods and agency services for export and import customs clearance. Article 12, Paragraph 2 also applies to the cross-border transfer in such case.

Article 7 (Destruction Procedures and Methods)

1. When the retention period has elapsed or the purpose of use has been achieved, the Company deletes the relevant information without delay.
2. Information in the form of electronic files is destroyed by technical methods that make recovery impossible.

Article 8 (Rights of Users)

Users may at any time request access to, correction of, or deletion of their personal information. Requests are handled through the in-app customer center or by email.

Article 9 (Processing of Personal Information of Children Under 14 Years of Age)

1. The Service is intended for users aged 14 years or older, and a child under 14 years of age may not register for or use the Service without the consent of his or her legal representative.
2. Where the Company becomes aware that the personal information of a child under 14 years of age has been collected without the consent of the child's legal representative, the Company destroys such personal information without delay.
3. A legal representative may request access to, correction or deletion of, or suspension of the processing of the relevant child's personal information through the contact details set out in Article 13, and the Company takes the necessary measures immediately upon receipt of such a request.
4. When the Company notifies a child under 14 years of age of matters relating to the processing of personal information, it uses a readily understandable format and clear, plain language.

Article 10 (Automatic Collection of Personal Information through Advertising Identifiers and Third-Party SDKs)

1. In order to provide the Service free of charge, the Company displays advertisements within the app, and includes the following third-party software development kits (SDKs) in the app for the purposes of ad delivery and measurement, app error diagnostics, push notification delivery, and prevention of fraudulent use. Each SDK collects the following information directly from the user's device and transmits it to the relevant provider.
   • Google AdMob (provider: Google LLC) — Advertising identifiers (Android advertising ID, App set ID, iOS advertising identifier), IP address, device information, app and advertisement interaction records, diagnostic information / Purpose: ad delivery and measurement, and prevention of fraudulent clicks
   • Pangle (provider: Bytedance Pte. Ltd.) — Advertising identifier, IP address and the city-level location inferred therefrom, device information (model, operating system, language, region, time zone, network type, screen resolution, etc.), advertisement interaction records, diagnostic information / Purpose: ad delivery and measurement
   • Meta Audience Network (provider: Meta Platforms, Inc.) — Advertising identifier, IP address, device information, advertisement interaction records / Purpose: ad delivery and measurement. This applies only where advertisements are delivered through the mediation of AdMob above.
   • Google Analytics for Firebase (provider: Google LLC) — Firebase installation ID, app usage records (screen transitions, events, etc.), device information. On iOS, the advertising identifier is included only where the user has permitted tracking. / Purpose: statistical analysis and improvement of Service usage
   • Firebase Crashlytics (provider: Google LLC) — Crashlytics installation UUID, Firebase installation ID, error (crash) occurrence records, device status information (model, operating system, memory, storage, CPU type) / Purpose: app error diagnostics and stability improvement
   • Firebase Cloud Messaging (FCM) (provider: Google LLC) — Firebase installation ID, push notification token / Purpose: push notification delivery
   • Google Play Integrity (Android) and Firebase App Check (iOS) (provider: Google LLC) — Integrity assessment information for the app and the device / Purpose: prevention of fraudulent use through tampered or forged apps, automation tools, and the like
2. With respect to the processing of personal information by each of the above providers, the privacy policy published by the relevant provider applies in addition to this Policy.
3. The user may refuse the collection of advertising identifiers or reset the advertising identifier by the following methods.
   • Android: Settings > Google > Ads > Delete (or reset) advertising ID
   • iOS: Settings > Privacy & Security > Tracking > Turn off "Allow Apps to Request to Track"
   • In regions where an in-app advertising consent setting is provided, the user may change the personalized advertising setting on the app's settings screen.
4. Even if the user refuses the collection of advertising identifiers, there is no restriction on the use of the Service; however, advertisements that do not reflect the user's interests may be displayed.

Article 11 (Operation and Refusal of Cookies and Other Internet Access Information Files)

1. The Company does not collect the user's personal information by means of cookies in the app Service. When web documents such as notices, terms of service, or this Policy are displayed within the app, the device's built-in browser may store cookies; however, the Company does not use such cookies to collect the user's behavioral information or for personalized advertising.
2. Among the websites operated by the Company, the administrator pages use essential cookies for maintaining login status and for security. These cookies are intended solely for the Company's operators and are not used for general users.
3. The user may refuse the storage of cookies or delete stored cookies through the settings of the device's operating system or browser. However, if the user refuses the storage of cookies, some web documents may not be displayed properly.
4. Usage records automatically generated and collected in the course of using the app are collected not through cookies but through the analytics SDKs referred to in Article 10, and the method of refusal is the same as that set out in Article 10, Paragraph 3.

Article 12 (Transfer of Personal Information Overseas)

1. The Company transfers the user's personal information overseas as set out below. Such transfer takes place through the information and communications network at the time the user uses the Service.
   • Google LLC / Countries of transfer: the United States and other countries in which Google operates data centers / Items transferred: advertising identifiers, IP address, device information, app and advertisement interaction records, error occurrence records, Firebase installation ID, push notification token, device integrity assessment information, in-app purchase tokens and transaction identification information, posts, chat messages, reports and inquiries written by the user (for translation purposes), and files uploaded by the user such as profile images / Purposes of use: ad delivery and measurement, statistical analysis of Service usage, app error diagnostics, push notification delivery, prevention of fraudulent use, in-app purchase verification, handling of inquiries and multilingual translation, and file storage / Retention and use period: until each purpose is achieved (in accordance with the retention policies published by Google for each service)
   • Bytedance Pte. Ltd. (Pangle) / Countries of transfer: the United States, Singapore / Items transferred: advertising identifier, IP address, device information, advertisement interaction records / Purposes of use: ad delivery and measurement / Retention and use period: until the purpose of ad delivery is achieved
   • Meta Platforms, Inc. / Country of transfer: the United States / Items transferred: advertising identifier, IP address, device information, advertisement interaction records / Purposes of use: ad delivery and measurement / Retention and use period: until the purpose of ad delivery is achieved. This applies only where advertisements are delivered through mediation.
   • Apple Inc. / Country of transfer: the United States / Items transferred: in-app purchase transaction identification information and receipt information / Purposes of use: verification of iOS in-app purchases and processing of refunds / Retention and use period: until the purpose of payment verification is achieved
   • Cloudflare, Inc. / Countries of transfer: the United States and other countries in which Cloudflare operates servers / Items transferred: IP address, access records, and other information processed in the course of communication / Purposes of use: optimization of Service access routes and security (blocking of attacks such as DDoS) / Retention and use period: until the purpose of processing is achieved
2. Where a user places an order for goods at the Company's product sales store designating a country or region outside the Republic of Korea as the delivery address, the Company transfers the recipient's personal information overseas as set out below, to the extent necessary to perform that order. This transfer does not take place where the user uses only the app service or designates a delivery address within the Republic of Korea.
   • Items of personal information transferred: the recipient's name, contact details, delivery address and delivery instructions, the recipient identification information required by the customs procedures of the destination country, the order number, and the description, quantity and value of the goods
   • Countries of transfer: the destination country designated by the user and the countries through which the goods transit
   • Time and method of transfer: transferred at the time of shipment through the information and communications network or through transport documents
   • Parties receiving the transfer: the carriers responsible for the international transportation of the goods and their local partner operators, and the operators handling export and import customs clearance in the destination country. The name and contact details of each operator are displayed on the order screen and the delivery tracking screen, and will also be entered in the list in Article 6, Paragraph 1 at the time the outsourcing commences.
   • Purposes of use and retention and use period of the parties receiving the transfer: the purposes are the international transportation of the goods, export and import customs clearance, and inquiry into the delivery status; the information is retained and used until the delivery is completed and the retention period prescribed by the relevant laws has elapsed.
   • Method and procedure for refusing the transfer and the effect of such refusal: the user may refuse this transfer by not consenting to the cross-border transfer on the order screen or by designating a delivery address within the Republic of Korea. If the user refuses, international delivery is not available.
3. The user may refuse the collection of advertising identifiers by the methods set out in Article 10, Paragraph 3, and may refuse the cross-border transfer under Paragraph 1 by withdrawing from the Service or deleting the app. In such case, however, the use of functions that require the relevant information, such as advertising rewards, push notifications, and in-app purchases, may be restricted. A user who has placed an order for goods without creating an account may refuse the cross-border transfer not by withdrawing from the Service or deleting the app, but by the method set out in the last item of Paragraph 2.

Article 13 (Personal Information Protection Officer)

Personal Information Protection Officer

Kim Ji-heon (김지헌)

Department and Position

Platform Business Division

Email

[email protected]

Article 14 (Remedies for Rights Infringement)

1. In order to obtain relief for damage caused by an infringement of personal information, the user may apply for dispute resolution or consultation to the following organizations.
   • Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회) — 1833-6972 (no area code required) / www.kopico.go.kr
   • Privacy Infringement Report Center (개인정보 침해신고센터, Korea Internet & Security Agency) — 118 (no area code required) / privacy.kisa.or.kr
   • Supreme Prosecutors' Office (대검찰청) — 1301 (no area code required) / www.spo.go.kr
   • Cyber Crime Report System of the National Police Agency (경찰청 사이버범죄 신고시스템) — 182 (no area code required) / ecrm.police.go.kr
2. A user whose rights or interests have been infringed by a disposition taken or an omission made by the Company in response to the user's request under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may request an administrative appeal as prescribed by the Administrative Appeals Act.
   • Central Administrative Appeals Commission (중앙행정심판위원회) — 110 (no area code required) / www.simpan.go.kr