To protect your personal information, CJ Olive Young Corporation(hereafter, ‘Olive Young’) complies with any applicable law such as 「the Personal Information Protection Act (PIPA)」 and 「the Act on Promotion of Information and communications Network Utilization and Information Protection」, General Data Protection Regulation(GDPR) etc.

Olive Young strives to prevent the leakage and damage of your personal information.

Article 1 (Purpose of Collecting and Processing Personal Information)

1. 1. Olive Young collects only basic personal information necessary to provide its services, and seeks your consent when collecting additional information for services tailored to your tastes and interests.
   If you are a registered user, not providing optional information will not restrict your use of services.
   If you are not a registered user, you may refuse to give your consent, in which case you will not able to purchase items at Olive Young.
2. 2. Olive Young does not collect any sensitive personal information such as your race or ethnicity, religion and philosophical beliefs, country of origin, political opinions, criminal record, medical information, and sexual orientation.

Article 2 (Personal Information Olive Young Collects and Methods of Collection)

Olive Young collects the following personal information.

(* Olive Young seeks your consent for optional information collected when you participate in an event, make an inquiry, and use specific services.)

Article 3 (Outsourcing of Personal Information Handling)

Olive Young outsources certain services to the following companies. In accordance with applicable laws, essential terms and conditions are stipulated in contract with the entrusted companies to safeguard your personal information

Article 4 (Sharing Personal Information with Third Parties)

1. 1. Olive Young processes your personal information only for the reasons specified on ‘Purpose of Collecting and Processing Personal Information’ and does not use the information or share with third parties for any other purpose.

   Sharing Personal Information with Third Parties

   Company Name (Service Provider)	Purpose	Sharing Information	Sharing Period
   Paypal	Application of Seller Protection Policy by Paypal	- Name(First name, Last name) - Detail Address, City, State/Province, Zip/Postal Code, Country,	Purpose of Collecting and Processing Personal Information is fulfilled

2. 2. However, your personal information can be shared for the following reasons.
   1. 1) When you give your consent.
   2. 2) When it is necessary to proceed with payment for service provision.
   3. 3) When personal information is shared in an unidentifiable form for statistics, academic, and market research.
   4. 4) When it is required by any applicable law.
   5. 5) When it is required by investigating authorities for investigation in compliance with any applicable law.

Article 5 (Retention, Processing Period, and Disposal of Personal Information)

1. 1. Once the purpose of collection is fulfilled, your personal information is immediately disposed of by Olive Young. However, if longer retention is required by any applicable law or you agree to extended retention and processing period of your information, the data is securely stored and used only for the intended purposes.
   1. 1) If longer retention and processing period are required by applicable laws (not limited to followings).
      • - Record of Contracts and Subscription Withdrawal: 5 Years
      • - Record of Payment and Provision of Goods: 5 Years
      • - Record of Customer Complaint and Dispute Resolution: 3 Years
      • - Date and Time of Visit: 3 Months (Excluding the date and time of your last visit to confirm the period of service)
   2. 2) To minimize any loss or damages from repetitious account withdrawal and re-registration and to enable you to reactivate your account as required, your data will be destroyed immediately after your account is withdrawn.
   3. 3) Valid commercial credit (such as reward points) is retained until it expires.
2. 2. Your information is disposed of or deleted by the following methods depending on its form.
   1. 1) Personal information stored on paper is shredded or incinerated.
   2. 2) Electronically stored personal information is securely disposed of and is not retrievable.

Article 6 (International Transfer of Personal Information)

Olive Young shares customer behavioral information and personal information with advertising providers for targeted advertising as follows. The details of personal information transferred to overseas countries are as follows

Article 7 (Children's Privacy)

Our website is not intended for or directed to children under the age of 13. We do not knowingly collect personal information directly from children under the age of 13 without parental consent. If we become aware that a child under the age of 13 has provided us with personal information, we will delete the information from our records.

Article 8 (Additional Information for California Residents)

Based on CCPA, The California Privacy Rights Act of 2020 or “CPRA” (Cal. Civ. Code § 1798.100 et seq.) has strengthened regulations on business operators by expanding consumer’s right to privacy to be closer to the European Union’s GDPR.

If you reside in California, this section applies to you and describes our data practices today and in the preceding 12 months.

1. 1. Categories of Personal Data
   We collect the following categories of personal data: identifiers (such as your name, email, or IP address); commercial information (such as records of products you purchased); characteristics of protected classifications under California or U.S. federal law (such as your age or gender); internet or electronic network activity (such as information about your activity on our website); geolocation data (such as your city of residence); audio, electronic, visual, or similar information (such as phone recordings when you call our customer service channels); and inferences drawn from your personal data to create a profile (such as your shopping preferences). For examples of the precise data points we collect and the sources of such collection, please see the Information We Collect section above. We use personal data for the business or commercial purposes described in the Use of Information section above. We disclose personal data for the business purposes described in the Disclosure of Information section above. Additionally, in the preceding 12 months, we have disclosed the following categories of personal data for business purposes to the following categories of recipients:

   Categories of Personal Data

   Category of Personal Data	Categories of Recipients
   Identifiers	Partners that provide advertising and marketing services, data analytics providers, payment processors, fulfillment partners, customer support partners, Internet service providers, operating systems and platforms, other users, cloud service providers, technical maintenance and system security providers
   Commercial Information	Data analytics providers, partners that provide advertising and marketing services, payment processors, fulfillment partners, customer support partners, fraud prevention partners, and cloud service providers
   Characteristics of Protected Classifications under California or U.S. federal law	Partners that provide advertising and marketing services, other users, and customer feedback platforms
   Internet or other electronic network activity information	Partners that provide advertising and marketing services, data analytics providers, Internet service providers, operating systems and platforms, cloud service providers, and technical maintenance and system security providers
   Geolocation data	Partners that provide advertising and marketing services, data analytics providers, Internet service providers, and operating systems and platforms

2. 2. Your Privacy Rights
   1. 1) Right to Know(Access) about Personal Information Collected and Disclosed
      You have the right to request that we disclose certain information to you about our collection, use, and disclosure your Personal Information.
   2. 2) Right to Request Correction of Inaccurate Personal Information
      You have the right to request we correct any inaccuracies of your Personal Information we maintain about you. Once we receive and confirm your verifiable Consumer request, we will correct (and direct our Services Providers and/or Third Parties to correct) the Personal Information we maintain about you.
   3. 3) Right to Request Deletion of Personal Information
      You have the right to request that we delete the Personal Information that we have collected and retained about you. Once we receive and confirm your Consumer request, we will delete (and direct our Services Providers and/or Third Parties to correct) your Personal Information from our records, unless an exception applies.
   4. 4) Right to Opt-Out of the Sharing of Personal Information
      The CPRA defines "sell" as the disclosure of Personal Information to a Third Party for monetary or other valuable consideration. The CPRA defines "share" as the disclosure of Personal Information to a Third Party for cross-context behavioral advertising.
      We do not sell Personal Information and will not sell Personal Information without providing you with prior notice and an opportunity to opt-out, as required by law.
      We use services that provide interest-based advertising to you, and our websites and applications use cookies or similar technologies to share personal information, including information about your behavior, with our advertising partners to do so. Olive Young only allows our advertising partners to collect your personal information in this way with your consent.
   5. 5) Right to Request Non-discrimination
      You have the right not to receive discriminatory treatment for exercising any of your rights.

Article 9 (Additional Information for EEA residents)

Pursuant to the General Data Protection Regulation or “GDPR”, if you are a resident of the European Economic Area (“EEA”), this section applies to you and we process your Personal Information under the following lawful bases:

• • Your consent
• • The performance of the contract between you and the Site
• • Compliance with our legal obligations
• • To protect your vital interests
• • To perform a task carried out in the public interest
• • For our legitimate interests, which do not override your fundamental rights and freedoms

Where we have collected and processed your personal information with your consent, you may withdraw your consent at any time.

1. 1. Your Privacy Rights
   1. 1) Right to Access your Personal Information
      You have the right to access to your personal data so that you can verify the processing of your personal data and its lawfulness.
   2. 2) Right to Request Data Portability
      You have the right to request a copy of your Personal Information in electronic form and to transfer that use on a third party’s services.
   3. 3) Right to Request Correction of Inaccurate Personal Information
      You have the right to request we correct any inaccuracies of your Personal Information we maintain about you. Once we receive and confirm your verifiable Consumer request, we will correct (and direct our Services Providers and/or Third Parties to correct) the Personal Information we maintain about you.
   4. 4) Right to Request Erased of Personal Information
      You have the right to demand that the Data Controller erase the Personal Data relating to you without delay.
      We shall delete personal information in the event of the achievement of the purpose of personal information processing, withdrawal of consent by the information subject, etc.
   5. 5) Right to Request Restriction of Data Processing
      You have the right to restrict the processing of personal information about you if any of the following applies to you. If you request a restriction on data processing, the controller can only keep your data.
      • • You have challenged the accuracy of the personal data
      • • If the processing is unlawful and you request the restriction of processing of your personal data instead of objecting to erasure.
      • • We no longer need the Personal Data, but you need the Personal Data for the exercise or defense of legal claims.
      • • Until we determine whether the legitimate interests of the controller are overridden by the legitimate interests of the data subject.
   6. 6) Right to Object to Processing of Personal Data(including automated decision-making)
      You have the right to object at any time to the processing of your personal data, including automated decision-making (including profiling), and also include processing for marketing.

Article 10 (How to Request Your rights)

1. 1. You may exercise your rights by:
   • • Email us : Team, Digital Global Business Team l oycs.global@cj.net
   Please note that we need to verify your identity based on your email and name before we can process your CPRA and GDPR related request. We will send you a confirmation of your identity via the email address you provide in the form below, so please include the email address you actually use (we do not accept requests for representation).
   If you are a verifiable California resident, you may only request your rights twice within a 12-month period.
   Registered user can raise a complaint to the supervisory authority about the processing personal information of Olive Young.
   ► Download "Request Your rights" (CPRA)
   ► Download "Request Your rights" (GDPR)
   Please do not include any Personal or Sensitive information beyond what is requested in the email or associated form.
2. 2. Registered customers can always correct and delete their information.
   1. 1) Personal Information Inquiry and Revision
      1. - To Inquiry and Revision your Personal Information : My Account > My Profile > Edit My Profile
   2. 2) You can always Consent or Withdraw Optional Consent
      1. - To Consent or Withdraw your Optional Consent : My Account > My Profile
   3. 3) You can always Close your Account
      • - To Close your Account : Account > Edit My profile > Close Account or My Account > Deactivate Account > Close Account
      • - When you close your account, Olive Young will immediately take any necessary action such as prompt disposal of personal information.
3. 3. Responses to your rights requests and reply statistics
   Under the CPRA, Olive Young is required to annually disclose its processing of personal information for the preceding 12 months. Olive Young provides these reports once a year based on the previous 12 months.
   Currently, there have been no guarantee claims submitted to OLIVE YOUNG Global.
   * As a request under the GDPR only.
   ** Requests that cannot be validated due to failed identity verification or that cannot be processed under applicable law. These requests are not included in the totals above.

Article 11 (Notice of Financial Incentives)

We offer various financial incentives. For example, we may provide discounts or other benefits to customers who sign up to receive our marketing emails. When you participate in a financial incentive, we collect personal data from you, such as identifiers like your name and email address. You can opt in to a financial incentive by following the sign-up instructions, and you have the ability to opt out of the program by contacting us at oycs.global@cj.net. In some cases, we may provide additional terms and conditions for a financial incentive, which we will provide to you when you sign up. The value of your personal data is reasonably related to the value of the offer or discount presented to you.

Article 12 (Your Rights as a Registered User)

1. 1. Registered customers can always view, revise, and request their personal information.
   1. 1) Personal Information Inquiry and Revision

      Personal Information Inquiry and Revision

      Team: Digital Global Business Team	Inquiry: Customer Service Center
      Via e-mail	Via Olive Young online
      oycs.global@cj.net	+82)2-6970-8666

      • - Contact No., E-mail Address, Password: My Account > My Profile > Edit My Profile
      • - Contact the customer service center or specified team above.
   2. 2) information which you can request Olive Young to provide.
      • - your personal information which Olive Young retains.
      • - status of your consents for collecting, processing and sharing your personal information.
      • - status of sharing your personal information with service provider and third parties
   3. 3) When you make a request to correct erroneous information on your profile, the relevant personal information will not be used or provided until corrections are applied. In case incorrect information is provided to third parties, Olive Young will immediately notify them of the correct information and instruct them to apply to their services.
   4. 4) If you are a registered user, you may request Olive Young to provide or get access to your personal information, in which case Olive Young will reply your request within 10 days.
2. 2. You can always withdraw your consent to the Privacy Policy on collecting, processing, and sharing your personal information.
   When you close your account, Olive Young will immediately take any necessary action such as prompt disposal of personal information.
   • - To close your account: Account > Edit My profile > Close Account or My Account > Deactivate Account > Close Account
3. 3. Notwithstanding Articles 1 and 2 above, requests to view or correct your personal information cmay be restricted for the following reasons.
   1. 1) In case of threats to the life, rights, interests, or assets of you or a third party
   2. 2) In case of significant disruptions to the service providers
   3. 3) In case of breaches of applicable laws
4. 4. Olive Young restricts membership and its service for children under 16 years of age.
5. 5. Registered user can raise a complaint to the EU supervisory authority about the processing personal information of Olive Young

Article 13 (Personal Information Manager and Team)

To protect your personal information and deal with any relevant issues, Olive Young has designated an officer in order to protect your personal information. Feel free to contact us with any inquiries regarding personal information. The officer will immediately and sincerely reply to your inquiries. For inquiries other than personal information, please contact oycs.global@cj.net

Article 14 (Matters on the operation of automatic collection devices and opt-out thereof)

1. 1. Automatic Cookie collection
   Olive Young uses collected ‘cookies’ to provide a more personalized experience on the website.
   Cookies are small text files sent to your browser by the web server you visit and stored in the hard disk of your device (such as your desktop, smartphone, tablet PC, etc.) when you use services on Olive Young’s website or mobile app. Cookies identify the device you are using but not you as an individual. Cookies expire when you close the browser or sign out.
   The data collected by cookies can be used for the following purposes:
   1. 1) To analyze the frequency and time of your visits, figure out your interests and patterns of use, and target your visits and events you participate in
   2. 2) To track your most viewed items and provide services tailored to your interests for a more personalized experience on the website
   3. 3) To analyze customer behavior for service improvement initiatives
   You have a right to accept or disable cookies. You can accept all cookies, choose to be notified every time a cookie is issued, or disable all cookies.
   Block/allow personalized ads via web browser
   1. 1) Internet Explorer (Internet Explorer 11 for Windows 10)
      • - In Internet Explorer, select the Tools button, then select Internet Options
      • - Select the Privacy tab, select Advanced under Settings, then Block or Allow Cookies
   2. 2) Microsoft Edge
      • - In Edge, click the "…" mark in the upper right corner, then click Settings.
      • - After clicking "Privacy, Search and Services" on the left side of the settings page, select whether to prevent tracking and the level in the [Tracking Prevention] section.
      • - Choose whether to “Always use ‘Strict’ Tracking Protection when browsing InPrivate.”
      • - In the [Privacy] section below, choose whether to “Send a ‘do not track’ request.”
   3. 3) Chrome
      • - In Chrome, click the top right "⋮" mark (Customize and control Chrome), then click the Settings.
      • - Click “Show advanced settings” at the bottom of the Settings page and click Content Settings in the [Privacy] section.
      • - In the Cookies section, check the box for “Block third-party cookies and site data.”
2. 2. Weblogs analytics using Google Analytics
   CJ Olive Young Corporation uses Google Analytics, a weblog analysis tool provided by Google, Inc. (“Google”). Weblog analysis refers to the analysis of the customer’s use of website services. Google processes the information on behalf of CJ Olive Young Corporation and analyzes your website usage. CJ Olive Young Corporation does not process any personally identifiable information in this process. If you do not want Google to process your data, you can opt out of this by downloading and installing add-ons for your web browser at tools.google.com/dlpage/gaoptout.
   [How to opt out]
   • - For Chrome: Click [Download Browser Add-on to block Google Analytics] > Click [Add to Chrome] > When pop-up window is displayed, click [Add Extension] > Click Done.
   • - For IE (Internet Explorer): Click [Download Browser Add-on to block Google Analytics] > Click [Agree and Install] > Click [Run] or [Save] on the window displayed at the bottom > Click [Restart Later] or [Restart Now], as the changed setting will only be applied after restarting the browser > Upon clicking [Restart Now], the pop-up on how to use the add-on will appear. Then, click [Use] > Done.
   For more information on Google Analytics’ processing of information, please visit support.google.com/analytics/answer/6004245
   If you want to stop log analysis through an external analysis tool, you can cancel the setting through the guidance page below.
   https://support.google.com/analytics/answer/181881?hl=en

Article 15 (Matters on Collection, Use, Provision and Rejection of Behavioral Information)

1. 1. CJ OLIVE YOUNG collects and uses behavioral information in order to provide customized services and benefits optimized to information subjects, online customized advertisements, etc. during the service use process.
2. 2. CJ OLIVE YOUNG collects behavioral information as follows.

   CJ OLIVE YOUNG collects behavioral information

   Items of collected behavioral information	How to collect behavioral information	Purpose of collecting behavioral information	Retention/use period and subsequent information processing method
   Number of views on Join, Product Info, Shopping Bag, Place Order, and Purchase Completion pages	Automatic collection and transmission when using user website/app service	Collect customer activity information and provide customized recommendations	Destroy after storage until membership withdrawal

3. 3. CJ OLIVE YOUNG allows online customized advertisement operators to collect and process behavioral information as follows.
   • - Advertisers who wish to collect and process behavioral information: Google Ads, Facebook, Twitter, Snapchat, TikTok, Amazon Ads
   • - How to collect behavioral information: Automatic collection and transmission when users visit our website or run our apps
   • - Items of behavioral information collected and processed: User's web/app visit history, search history, purchase history
   • - Retention/use period: Until membership withdrawal and consignment contract termination
   If you wish to opt-in or opt-out, you can adjust your preferences by accessing the cookie settings link below:
   • • Google Ads : https://support.google.com/adsense/answer/142293?hl=en
   • • Facebook : https://www.facebook.com/settings/?tab=ads
   • • Twitter : https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads
   • • Snapchat : https://values.snap.com/privacy/privacy-policy
   • • TikTok : https://www.tiktok.com/legal/privacy-policy
   • • Amazon Ads : https://advertising.amazon.com/legal/privacy-notice
4. 4. The information subject can inquire about behavioral information, exercise the right to refuse, and complaints of damage through the contact information below.
   The information subject can inquire about behavioral information, exercise the right to refuse, and complaints of damage through the contact information below.
   Privacy Officer (CPO/DPO): Junsung Park
   Contact: CJ OLIVE YOUNG Customer Service Center

Article 16 (Measures to Protect Personal Information)

Olive Young establishes the following technical/organizational measures to ensure the security of your personal information and prevent the loss, leakage, theft, and damage of your personal information due to cyberattack.

1. 1. Technical Measures
   • - Your personal information is protected by your password. Important personal data and your password are encrypted before storage.
   • - To prevent any damage from computer viruses and intrusion of personal information, vaccine programs are employed and updated on a regular basis.
   • - Encryption algorithms are used to safely transfer your personal data over networks.
   • - To prevent the leakage of your personal information due to cyberattack and to detect illegal intrusion, vulnerability assessments are conducted on a regular basis and intrusion detection systems are installed.
2. 2. Organizational Measures
   • - The number of individuals who deal with personal information is limited to a minimum extent and periodic trainings are provided to the relevant employees.
   • - The authority to access personal data is provided in accordance to the procedures of the personal information processing system and is periodically examined and withdrawn if needed.
   • - Internal procedures are established to conduct inspections on compliance with the Privacy Policy.
   • - Olive Young manages and supervises the entrusted companies that process your personal data.

Article 17 (Report and Consultation of Intrusion of Personal Information)

You may be assisted by the following organizations in case you need to consult or report any violation of use of personal information.

Article 18 (Notice and Changes to the Privacy Policy)

The privacy policy stated above may be revised in compliance with government policies, applicable laws, and due to the security system update., and we will put out a notification online of all changes such as the addition, removal, or amendment of privacy policy with the reasons

(Privacy Policy v.3.1 Published on April 1st, 2024)
Implementation Privacy Policy: April 1st, 2024