1. (1)The Company collects and uses only the minimum personal information necessary to provide its services. Additionally, the collected personal information will not be used for any purpose other than those for which consent was obtained. If the purpose of use changes after consent is given, the Company will take necessary measures, such as obtaining additional consent.

   Category	Collected Items	Purpose of Collection and Use	Retention and Usage Period
   Contact Us	(Required) Name, Email Address, Mobile Phone Number (Optional) Affiliation(Company), Country Name	Use of the Contact Us service, receipt and handling of inquiries, notification of processing results, and response to related inquiries	One (1) month from the completion of the inquiry process

2. (2)In addition, the following information may be generated and collected in the process of service use or handling inquiries to provide personalized services:
   1. ①Frequency of use, service usage time, and usage records
   2. ②Access log and access IP information, cookies, usage records, session information
3. (3)The Company may collect the following information during the service use or handling process. If the user clicks the consent button or enters additional personal information for collection and saves it, it will be considered as consent to the collection of personal information:
   1. ①Collection of information through the use of PC web and mobile web services
   2. ②Collection of generated information through log analysis programs
   3. ③Collection of information via cookies
4. (4)The Company may process personal information in a pseudonymized manner for purposes such as statistical analysis, scientific research, and public record preservation.

1. (1)The Company processes and retains personal information within the retention and usage period agreed upon by the data subject at the time of collection. However, if the user has given separate consent for a different retention period, or if laws and regulations impose an obligation to retain information for a certain period, the Company will securely store the personal information for the specified period.
2. (2)In cases where retention is required by applicable laws and regulations, the Company will retain member information for the period stipulated by the relevant laws, as outlined below.

   Relevant Law	Retained Items	Retention Period
   Telecommunications Privacy Protection Act	Service visit records	3 months

The Company utilizes the personal information provided by users only for the purpose of providing services and handling inquiries, within the retention period agreed upon by the user.

1. (1)Retention and Storage Period of Personal Information
   The Company retains personal information for the period consented to by the user or as required by applicable laws and regulations.
   • Records of visitor access (logs) and location-tracking data of communication devices: 3 months (Telecommunications Privacy Protection Act)
   • Other communication confirmation data as stipulated in Article 15-2 of the Telecommunications Privacy Protection Act and Article 41 of its Enforcement Decree
   • Other retention periods: If separate consent is obtained from the user, personal information will be retained for the agreed-upon period.
2. (2)Procedures and Methods for Disposal of Personal Information
   1. A.Disposal Procedure
      Personal information provided by users for service use, upon achieving its intended purpose, will be transferred to a separate database (DB) and stored for the period specified in (1) Retention and Storage Period of Personal Information. Once the retention period has expired, it will be disposed of using the methods outlined in C. Disposal Methods. Personal information stored in a separate database will not be used for any other purpose unless permitted by law.
   2. B.Information Subject to Disposal
      Personal information that has exceeded the retention period outlined in (1) Retention and Storage Period of Personal Information.
   3. C. Disposal Methods
      
      • Personal information recorded or printed on paper: Shredded or incinerated.
      • Personal information stored in electronic files (e.g., databases): Deleted using technical methods that make it irrecoverable.

Cookies, records of service usage, and information accessed from the connected device may be generated automatically and collected in the process of using Company services and handling user inquiries. Cookies are data that websites send to the users’ web browsers (Internet Explorer, Chrome, Firefox, etc.). When a user visits the Company's website and uses its service through a cookie, the Company reads the details of the cookies stored in the user’s PC and analyzes information such as visit records and services used, service connection time and frequency, and information generated or provided (entered) in the process of using the service to improve services, prevent illegal use, and check user errors

1. (1)Strictly necessary cookies

   Cookies	Purpose	About	Expiration	Deployer date
   CookieConsent	Stores the user's cookie consent status	HTTPcookies	1 day	ocean.cjenm.com
   _ga	Registers a unique ID that is used to generate statistical data about how visitors use the website	HTTPcookies	2 year	google
   _gat	GUsed by Google Analytics to control the request speed	HTTPcookies	1 day	google
   _gid	Registers a unique ID that is used to generate statistical data about how visitors use the website.	HTTPcookies	1 day	google

2. (2)Notice of Cookies, Effective Scope, Third-Party Cookies
   Notice of cookies is only valid in https://ocean.cjenm.com. The user may also receive third-party cookies from the Company’s service providers when using the website. However, the cookies collected by the Company are not provided to third parties. The Company will notify the user when it collects cookies and provide an option to decline cookies. However, if the user declines cookies, there may be limitations in using some services.
3. (3)Right to decline cookies
   1. ①For Chrome: Settings > Security and Privacy > Cookies and other site data
   2. ②For Internet Explorer: Tools > Internet Options > Privacy > Advanced
   3. ③For Microsoft Edge: Settings > Cookies and Site Permissions > Manage and delete cookies and site data

1. (1)Users may exercise their rights (hereinafter referred to as “Rights Exercise”) at any time through the Company website to request access, correction, deletion, suspension of processing, or withdrawal of their stored personal information.
2. (2)Rights Exercise may also be carried out through a delegate. In such cases, the delegate must submit a power of attorney (POA) in accordance with Annex No. 11 of the “Public Notice on the Methods of Processing Personal Information.”
3. (3)Requests for access to or suspension of processing personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act. Additionally, requests for correction or deletion of personal information may not be granted if the information is designated for mandatory collection under other laws and regulations.
4. (4)The Company operates a dedicated customer service center to handle related inquiries and consultations. Users may also contact the Personal Information Protection Officer, who will take prompt action upon request.

1. (1)The Company has designated a Chief Privacy Officer and a department in charge as provided below and operates a consultation counter for smooth communication with users in relation to personal information inquiries and requests.
   2. ①Chief Privacy Officer
      • Department/Name: CJ ENM Entertainment Division, Information Security Officer, Jihoon Kim
      • Contact: +82-2-371-5501
   3. ②Personal Information Protection Department
      • Department: CJ ENM Customer Center
      • Contact: +82-2-371-5501

2. Please contact the Chief Privacy Officer by phone or contact any of the institutions below for any advice on, or to report any instance of, infringement of personal information.

   Name of institutions	URL	Contact information
   KISA Personal Information Infringement Report Center	https://privacy.kisa.or.kr	118 without area code
   Supreme Prosecutor's Office Cyber Crime Investigation Team	https://www.spo.go.kr	1301 without area code
   Korean National Police Agency Cyber Bureau	https://ecrm.cyber.go.kr	182 without area code
   Personal Information Dispute Mediation Committee	https://kopico.go.kr	1833-6972 without area code

The Company uses a user’s personal information only within the scope specified in the Privacy Policy and does not use personal information beyond the specified scope nor provide it to a third party. However, personal information may be provided in exceptional cases such as when the user gives prior consent or when a request is made pursuant to the provisions and procedures set forth by related laws and regulations.

The Company consigns personal information processing work to the consignment companies listed below for purposes including the operation and maintenance of services and provision and management of user convenience. The Company manages the consignment companies by entering into service agreements which require the consignment companies to be and remain in compliance with related laws, regulations, and guidelines, protect personal information and comply with confidentiality provisions, and return and destroy personal information immediately upon the expiration or termination of the service agreement.

1. (1)In principle, the Company does not collect personal information of children under the age of 14. However, in the inevitable case of collecting personal information for the purpose of providing services, the Company requests the consent of the LAR (legally authorized representative) of the child as a mandatory procedure.
2. (2) In order to obtain the consent of the LAR (e.g. parent), the Company collects from the child a minimum amount of personal information such as the name and phone number of the LAR. The LAR may view, correct, and delete the child’s personal information, and if they wish to do any of the foregoing, the LAR can make a request to the Chief Privacy Officer by phone or email and the Company will take necessary measures.

The Company is preparing the following technical and administrative safety measures to ensure that users’ personal information is not lost, stolen, leaked, altered, or damaged.

1. (1)Technical protection measures
   1. ①Personal information is protected by a password, and important data is protected by using separate security features such as encrypting files and transmitted data or setting a lock on the file.
   2. ②The Company is taking measures to prevent damage caused by computer viruses by using an antivirus program. Antivirus programs are updated regularly, and in the event a virus unexpectedly appears, the Company applies the antivirus program immediately to prevent infringement of personal information.
   3. ③The Company uses a Secure Sockets Layer (SSL) device to safely transmit personal information in the network.
   4. ④The Company has installed the antivirus program in an area where access is restricted from outside users and is using a device that blocks attacks and unauthorized access to prevent leakage of users’ personal information from events such as hacking.
2. (2)Administrative protection measures
   1. ①The Company has prepared the necessary procedures for managing and accessing users’ personal information so that officers and employees become familiar and comply with such procedures. The Company periodically conducts compliance checks to ensure compliance of such procedures.
   2. ②The Company limits the number of people who can process users’ personal information to a minimum and manages access rights, and ensures compliance with laws and policies through internal trainings. The people who process users’ personal information is as follows.
      • Person whose work involves direct or indirect communication with users
      • Person whose work involves the management and protection of personal information, such as the Chief Privacy Officer
      • Person whose work involves inevitable access to personal
   3. ③The Company prevents any leakage of information (including personal information) by requiring new hires and employees to sign the information protection pledge, reminding them of their obligations to protect personal information as often as necessary, and preparing internal procedures for compliance auditing.
   4. ④The handover of work by the personal information manager is carried out securely, and the responsibility of each onboarding and offboarding employee for any case of personal information infringement is clearly provided in the Company’s internal policy.

In the event of any amendments to this Privacy Policy due to changes in Company policies, government policies, or security technology, the Company post a notice on the website prior to such amendment.

• Current Privacy Policy Version: v1.3 (See previous policy)
• Notification date: February 27, 2025 / Implementation date: March 6, 2025