Privacy Policy

Lasker Inc. (hereinafter the “Company”) establishes this Privacy Policy (hereinafter this “Policy”) in order to protect the information (hereinafter “Personal Information”) of individuals who use the services the Company provides (hereinafter the “Company Service”), to comply with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter the “Information and Communications Network Act”) and other applicable law, and to handle privacy-related grievances of service users promptly and smoothly.

Under privacy legislation and this Policy, the Company may collect Users’ Personal Information, and the information collected may be provided to a third party only with the individual’s consent. However, where lawfully compelled by statute or otherwise, the Company may provide collected Personal Information to a third party without the individual’s prior consent.

1. The Company publishes this Policy on the first screen of its website, or on a screen linked from it, so that Users can check it easily at any time.
2. When publishing this Policy under Paragraph 1, the Company uses font size, colour and similar means so that Users can read it easily.

1. This Policy may be amended in line with changes to privacy legislation, guidelines or public notices, or to government policy or the policy or content of the Company Service.
2. Where the Company amends this Policy under Paragraph 1, it gives notice by one or more of the following methods.
   a.By notice in the announcements section of the first screen of the website operated by the Company, or through a separate window

   b.By notifying Users in writing, by fax, by email or by a comparable method
3. The Company gives the notice under Paragraph 2 at least 7 days before the effective date of the amendment. Where there is a material change to Users’ rights, notice is given at least 30 days in advance.

The Company collects the following information in order for Users to register as members of the Company Service.

1. Required information: email address, password, name and nickname

The Company collects the following information in order to provide its payment services to Users.

1. Required information: card number, card password, expiry date, six-digit date of birth (yy/mm/dd) and bank name

The Company collects the following information in order to issue cash receipts to Users.

1. Required information: name of the cash receipt recipient, date of birth of the cash receipt recipient, mobile telephone number and cash receipt card number

The Company collects the following information in order to provide its services to Users.

1. Required information: ID, email address, name and contact details

The Company collects the following information for statistics and analysis relating to Users’ use of the Service and for the identification and analysis of abuse. (“Abuse” means conduct such as repeatedly withdrawing and re-registering, or purchasing and then cancelling purchases, in order to obtain economic benefits such as discount coupons and event rewards provided by the Company by improper or irregular means; conduct prohibited by the terms of service; and improper or irregular conduct such as identity theft.)

1. Required information: service usage records, cookies, connection location information and device information

The Company collects Users’ Personal Information by the following methods.

1. Where the User enters their Personal Information on the Company’s website
2. Where the User enters their Personal Information through a service provided by the Company other than the website, such as an application
3. Where the User receives an email sent by the Company and enters Personal Information
4. Where the User enters information in the course of using the Company Service, such as customer support consultations or activity on message boards

The Company uses Personal Information in the following cases.

1. Where necessary for the operation of the Company, such as delivering announcements
2. For improving the service to Users, such as replying to enquiries and handling complaints
3. For providing the Company Service
4. For preventing and sanctioning conduct that interferes with the smooth operation of the Service, including measures restricting use by members who violate applicable law or the Company’s terms, and abusive conduct
5. For developing new services
6. For marketing, such as notice of events and promotions
7. For demographic analysis and analysis of service visits and usage records

1. The Company retains and uses Users’ Personal Information for the period necessary to achieve the purposes for which it was collected and used.
2. Notwithstanding the preceding paragraph, under its internal policy the Company retains records of service abuse for up to one year from the date of withdrawal of membership, in order to prevent fraudulent registration and use.

The Company retains and uses Personal Information under applicable law as follows.

1. Information retained and retention period under the Act on Consumer Protection in Electronic Commerce
   a.Records of contracts and withdrawal of subscription: 5 years

   b.Records of payment and of the supply of goods: 5 years

   c.Records of consumer complaints or dispute handling: 3 years

   d.Records of labelling and advertising: 6 months
2. Information retained and retention period under the Protection of Communications Secrets Act
   a.Website log records: 3 months
3. Information retained and retention period under the Electronic Financial Transactions Act
   a.Records of electronic financial transactions: 5 years
4. Act on the Protection and Use of Location Information
   a.Records of personal location information: 6 months

As a matter of principle, where Personal Information is no longer required — because the purpose of processing has been achieved, the retention and use period has elapsed or for a similar reason — the Company destroys it without delay.

1. Information entered by a User for membership registration and similar purposes is, once the purpose of processing has been achieved, moved to a separate database (or, in the case of paper, a separate filing cabinet), stored for a certain period in accordance with internal policy and the information-protection grounds under other applicable law (see the retention and use period), and then destroyed.
2. The Company destroys Personal Information for which grounds for destruction have arisen following an approval procedure by the Chief Privacy Officer.

Personal Information stored in electronic file form is deleted using a technical method that makes the records irrecoverable, and Personal Information printed on paper is destroyed by shredding or incineration.

1. Where the Company transmits commercial advertising information using an electronic transmission medium, it obtains the User’s express prior consent. Prior consent is not obtained in either of the following cases.
   a.Where the Company has collected contact details directly from the recipient through a transaction in goods, and intends to transmit commercial advertising information about goods of the same kind as those it handled and transacted with the recipient, within 6 months of the date the transaction ended

   b.Where a telemarketer under the Act on Door-to-Door Sales notifies the recipient by voice of the source from which the personal information was collected and makes a telephone solicitation
2. Notwithstanding the preceding paragraph, where a recipient expresses refusal to receive or withdraws prior consent, the Company does not transmit commercial advertising information, and informs the recipient of the outcome of the refusal or withdrawal.
3. Where the Company transmits commercial advertising information using an electronic transmission medium between 9:00 p.m. and 8:00 a.m. the following day, it obtains separate prior consent from the recipient notwithstanding Paragraph 1.
4. Where the Company transmits commercial advertising information using an electronic transmission medium, it states the following specifically in the advertising information.
   a.The Company’s name and contact details

   b.A statement of the matters concerning refusal to receive, or withdrawal of consent to receive
5. Where the Company transmits commercial advertising information using an electronic transmission medium, it does not take any of the following measures.
   a.Measures that evade or obstruct a recipient’s refusal to receive advertising information or withdrawal of consent

   b.Measures that automatically generate a recipient’s contact details, such as a telephone number or email address, by combining numbers, symbols or characters

   c.Measures that automatically register telephone numbers or email addresses for the purpose of transmitting commercial advertising information

   d.Measures of any kind intended to conceal the identity of the sender of advertising information or the source of the advertisement

   e.Measures of any kind that deceive a recipient into responding, for the purpose of transmitting commercial advertising information

1. In order to protect the personal information of children under the age of 14, the Company permits membership registration only by Users aged 14 or over.
2. Notwithstanding Paragraph 1, where a User is a child under the age of 14, the Company obtains consent to the collection, use and provision of that child’s Personal Information from the child’s legal representative.
3. In the case of Paragraph 2, the Company additionally collects the legal representative’s name, date of birth, gender, duplicate-registration verification information (ID) and mobile telephone number.

1. Users shall keep their Personal Information up to date, and Users are themselves responsible for problems arising from their entry of inaccurate information.
2. Registering as a member using another person’s personal information may result in loss of User status or in punishment under applicable privacy legislation.
3. Users are responsible for maintaining the security of their email address, password and similar credentials, and may not transfer or lend them to a third party.

In processing Users’ Personal Information, the Company devises the technical and administrative protective measures necessary to secure safety so that Personal Information is not lost, stolen, leaked, altered or damaged.

Personal Information terminated or deleted at the request of a User or their legal representative is handled as stated in the “Retention and Use Period of Personal Information” collected by the Company, and is processed so that it cannot be viewed or used for any other purpose.

Users’ passwords are stored and managed using one-way encryption, and Personal Information can be checked and changed only by the individual who knows the password.

1. The Company does its utmost to prevent Users’ Personal Information from being leaked or damaged by intrusion into the information and communications network, such as hacking or computer viruses.
2. The Company uses up-to-date anti-virus software to prevent Users’ Personal Information and data from being leaked or damaged.
3. The Company uses an intrusion prevention system to do its utmost to maintain security against any eventuality.
4. Where it collects and holds sensitive Personal Information, the Company enables that information to be transmitted safely over the network by means such as encrypted communication.

The Company keeps the number of staff who handle Personal Information to a minimum, and emphasises compliance with applicable law and internal policy through administrative measures such as training for those who process Personal Information.

Where the Company becomes aware of the loss, theft or leakage of Personal Information (hereinafter a “Breach”), it notifies the affected User of all of the following without delay and reports the Breach to the Korea Communications Commission or the Korea Internet & Security Agency.

1. The items of Personal Information involved in the Breach
2. The time at which the Breach occurred
3. The measures the User can take
4. The measures taken in response by the information and communications service provider
5. The department and contact details through which the User can raise an enquiry

Notwithstanding the preceding Article, where there is a legitimate reason such as the User’s contact details being unknown, the Company may take the measure of posting the notice under the preceding Article on its website for 30 days or more in place of that notice.

1. The Company uses devices that automatically collect personal information (hereinafter “cookies”), which store and load usage information from time to time in order to provide individually tailored services to Users. A cookie is a small piece of information sent by the server (http) that operates the website to the User’s web browser (including on PC and mobile), and it may be stored in the User’s storage space.
2. Users have a choice as to the installation of cookies. A User may therefore set an option in their web browser to allow all cookies, to confirm each time a cookie is stored, or to refuse the storage of all cookies.
3. However, where a User refuses the storage of cookies, some Company services that require sign-in may be difficult to use.

Cookies can be allowed or blocked through your web browser’s settings.

1. Edge: Settings menu at the top right of the browser > Cookies and site permissions > Manage and delete cookies and site data
2. Chrome: Settings menu at the top right of the browser > Privacy and security > Cookies and other site data
3. Whale: Settings menu at the top right of the browser > Privacy > Cookies and other site data

1. In order to protect Users’ Personal Information and handle privacy-related complaints, the Company designates the relevant department and Chief Privacy Officer as follows.
   a.Chief Privacy Officer

   1)Name: Sujin Yoo

   2)Title: CEO

   3)Email: support@prepix.ai

1. A data subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency’s Personal Information Infringement Report Centre and similar bodies in order to obtain relief for infringement of personal information. For other reports of and consultations on personal information infringement, please contact the organisations below.
   a.Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

   b.Personal Information Infringement Report Centre: 118 (privacy.kisa.or.kr)

   c.Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)

   d.National Police Agency: 182 (ecrm.cyber.go.kr)
2. The Company works to guarantee data subjects’ right to control their own personal information and to provide consultation and relief for personal information infringement; if you need to make a report or seek consultation, please contact the department in Paragraph 1.
3. A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in respect of a request under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information) or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may request an administrative appeal as provided by the Administrative Appeals Act.
   a.Central Administrative Appeals Commission: 110 (www.simpan.go.kr)

Article 1 This Policy takes effect on July 15, 2026.

For enquiries about the processing of personal information, please contact us.