Kitform complies with relevant personal information protection regulations under the Act on Promotion of Information and Communications Network Utilization and the Personal Information Protection Act. We handle personal information lawfully and safely to protect the freedom and rights of data subjects. In accordance with Article 30 of the Personal Information Protection Act, we establish and disclose the following privacy policy to inform data subjects of the procedures and standards for processing and protecting personal information and to promptly handle related complaints.

Article 1 (Purpose of Personal Information Processing)

Kitform processes personal information for the following purposes, and the collected information is not used for any other purposes. If the purpose of use changes, necessary measures will be taken in accordance with Article 18 of the Personal Information Protection Act, such as obtaining separate consent.

• ① Service provision and contract fulfillment: We process personal information for providing the Kitform sharing platform service, content delivery, personalized services, user authentication, and service usage analysis.
• ② Member management: We process personal information for identity verification, managing membership status, preventing unauthorized use, delivering notices, and handling complaints.
• ③ Marketing usage: We process personal information for developing new services, providing personalized services, displaying ads based on statistical traits, verifying service effectiveness, and providing promotional or advertising content (including blocking profile-based ads when users clearly express refusal).
• ④ Service improvement: We process personal information for analyzing service usage, improving services, managing usage rights, responding to errors or disruptions, and statistical analysis.

Article 2 (Items of Personal Data Collected)

The following personal data items are collected by Kitform.

• ① Required Information: Email address, nickname, profile picture, and year of birth are collected during sign-up.
  This information is essential for using the service.
• ② Optional Information: Address information may be optionally collected and used for additional services with the user’s consent.
• ③ Automatically Collected Information: Cookies, IP address, user location information (temporary), service usage history, access logs, and device information may be automatically collected during service use.
• ④ Information Collected via Social Login: When using social login services such as Kakao or Google, email address, nickname, profile picture, and year of birth are collected from the respective social media platforms.

Article 3 (Methods of Collecting Personal Information)

Kitform collects personal information using the following methods.

• ① Provided by users during the sign-up and service usage process via social login services such as Kakao and Google.
• ② Automatically generated and collected during the use of the service.
• ③ Collected during participation in events or promotions (applicable for future events).

Article 4 (Use and Retention Period of Personal Information)

Kitform processes and retains personal information within the retention and usage period defined by law or agreed upon when collecting the information from the data subject.

• ① Personal information is retained until the user withdraws membership and is immediately deleted from the database upon withdrawal.
• ② Information of long-term inactive users is handled in the same manner as membership withdrawal.
• ③ Currently, there are no personal information items that must be retained under applicable laws.

Article 5 (Provision of Personal Information to Third Parties)

Kitform does not provide personal information to third parties except in the following cases:

• ① When the data subject has given separate consent
• ② When required by law or upon request by investigative agencies according to legal procedures and methods

Currently, Kitform does not provide personal information to any third parties.

Article 6 (Outsourcing of Personal Information Processing)

Kitform does not currently outsource personal information processing. However, for future operational efficiency and service quality improvement, such outsourcing may occur. In such cases, Kitform will stipulate necessary matters in contracts in accordance with relevant laws and ensure that the entrusted party safely manages the personal information.

Article 7 (Rights and Obligations of Data Subjects and Their Legal Representatives)

• ① Data subjects may exercise the following rights regarding personal information protection at any time:
  - Request access to personal information
  - Request correction in case of errors
  - Request deletion
  - Request suspension of processing
• ② The rights in Paragraph 1 may be exercised through writing, email, or fax in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. Kitform will respond without delay.
• ③ The rights in Paragraph 1 may also be exercised by a legal representative or authorized agent. In this case, a power of attorney in the form prescribed by the Enforcement Rules of the Personal Information Protection Act must be submitted.
• ④ Currently, users under the age of 14 can use the service, but the usage policy will be updated soon to restrict usage to those aged 14 and older.

Article 8 (Destruction of Personal Information)

When personal information becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose, Kitform will destroy the information without delay.

• ① Destruction procedure: A destruction plan will be established for the relevant personal information.
• ② Destruction method: Electronic files will be permanently deleted using technical methods, and printed materials will be shredded or incinerated.
• ③ Personal information is immediately deleted from the database upon withdrawal, and there is no temporary storage feature.

Article 9 (Measures to Ensure the Security of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, Kitform implements the following technical, administrative, and physical measures to ensure the security of personal information.

• ① Minimization and training of personal information handlers: Only designated staff handle personal information, and access is restricted to minimize exposure.
• ② Restriction of access to personal information: Access rights to personal information systems are granted, changed, and revoked through AWS security groups and IP restrictions. Intrusion prevention systems are used to block unauthorized access from outside.
• ③ Retention and prevention of tampering with access records: Access logs to personal information systems are kept for at least six months and protected from forgery, theft, or loss.
• ④ Encryption of personal information: No sensitive information currently requires encryption, but encryption measures will be implemented in the future if necessary.
• ⑤ Installation and update of security programs: Security programs are installed and regularly updated and inspected to prevent leakage or damage of personal information due to hacking or viruses.

Article 10 (Automatic Collection Devices for Personal Information)

• ① Kitform uses ‘cookies’ that save and retrieve usage information in order to provide personalized services to users.
• ② Purpose of cookies:
  - Used for login/logout processing
  - Block IP duplication
  - Analyze service usage statistics
• ③ Method to reject cookies: Kitform does not currently offer a dedicated method to reject cookies, but users can refuse cookie storage through their web browser settings.
• ④ If cookies are rejected, some features such as content posting, following users, and bookmarking content may be limited.

Article 11 (Personal Information Protection Officer)

• ① Kitform designates a personal information protection officer responsible for overall tasks related to personal information and for handling complaints and remedies from data subjects.
• ② Protection officer:
  - Name: Dahye Jang
  - Contact: 010-5092-9069
  - Email: Please contact customer support via the in-app inquiry feature
• ③ If you have any questions, complaints, or requests related to personal information while using Kitform services, you may contact the protection officer. Kitform will respond without delay.

Article 12 (Remedies for Infringement of Rights)

If you have suffered harm from personal information violations, you may request resolution or consultation from the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency (KISA). You may also contact the following institutions for other inquiries or complaints related to personal information.

• ① Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• ② Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• ③ Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• ④ National Police Agency: 182 (cyberbureau.police.go.kr)

Article 13 (Use of Location Information)

• ① Kitform temporarily uses location information with the user's consent during location-based content registration to help search for places.
• ② Location information is used only temporarily when needed during log registration and is not stored or retained.
• ③ Location information is not shared with any third parties.

Article 14 (Changes to the Privacy Policy)

• ① This Privacy Policy has been effective since June 9, 2025.
• ② If the Privacy Policy is amended, changes will be announced in the in-app notice section at least 7 days before they take effect.
• ③ In the case of significant changes, they will be announced at least 30 days in advance, and individual notification may be provided if necessary.