1. General Provisions

Dream Security Co., Ltd. (hereinafter referred to as the "Company") complies with all applicable personal information protection laws and regulations that the "Company" must observe, including the "Act on Promotion of Information and Communications Network Utilization and Information Protection" and the "Personal Information Protection Act," in relation to TimeeC (www.timee-app.com, hereinafter referred to as the "Service").

This Privacy Policy is established and disclosed to inform you that the personal information of subscribers collected and used through the "Service" provided by the "Company" is being securely managed. It also aims to protect the personal information of data subjects and to promptly and efficiently handle any related inquiries or grievances as follows.

Article 1 (Purpose, Items, and Retention Period of Personal Information)

1. The "Company" collects and uses personal information to the minimum extent necessary to provide the "Service," and processes the personal information of data subjects based on the following legal grounds.
2. The personal information processed by the "Company" will not be used for any purposes other than those specified above. If the purpose of use changes, the "Company" will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1.Items of personal information processed without the data subject's consent

Items of personal information processed without the data subject's consent

Legal Basis	Category	Purpose of Processing	Items Processed	Processing and retention period
「Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act (Conclusion and Performance of a Contract)	Provision of subscription (paid services)	Payment, settlement, and purchase restoration	[Required] Store information (Google or Apple), Account ID, Payment and transaction history (Order number, Transaction ID, Purchase token), Subscription product information (Product name, Subscription period, Subscription status, Renewal history)	Until cancellation of the subscription

2. Categories of Personal Information Processed Based on the Data Subject's Consent

Categories of Personal Information Processed Based on the Data Subject's Consent

Legal basis	Category	Purpose of Processing	Items Processed	Processing and retention period
Article 15(1)1 of the Personal Information Protection Act (Consent of Data Subject)	Provision of "Service", membership registration and management	Identity verification and authentication for providing membership services, and maintenance/management of membership status	[Required] Profile information (name or nickname), email, external platform identifier (Google or Apple)	Until membership withdrawal
	Receipt and Utilization of Advertising Information	Sending news on new features and updates, running events/promotions (delivering information on discounts, benefits, and campaigns), providing personalized advertisements (offering tailored information based on user interests), and conducting surveys to gather feedback for service improvement.	[Required] Email, Device information (PUSH token)	Until membership withdrawal or revocation of consent

3. The "Company" shall retain personal information for a specified period pursuant to separate statutes, as detailed below.

Personal Data Retention Period Required by Applicable Laws and Regulations

Details	Legal Basis	Retention period
Records regarding withdrawal of contract or offer, etc.	Article 6, Paragraph 1, Subparagraph 2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.	5 years
Records regarding payment settlement and supply of goods, etc.	Article 6, Paragraph 1, Subparagraph 3 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.	5 years
Records regarding the handling of consumer complaints or disputes	Article 6, Paragraph 1, Subparagraph 4 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.	3 years
Records regarding labeling and advertising	Article 6, Paragraph 1, Subparagraph 1 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.	6 months
Log records, IP address	Article 41 , Paragraph 2, Subparagraph 2 of the Enforcement Decree of the Communications Secret Protection Act	3 months

Article 2 (Provision of Personal Information to Third Parties)

The "Company" has no separate matters regarding the provision of personal information to third parties.

Article 3 (Outsourcing of Personal Information Processing)

“ Company ” does not entrust the processing of personal information regarding the service.

Article 4 (Cross-Border Transfer of Personal Information)

1. In principle, the "Company" shall not transfer personal information to third-party operators overseas without obtaining the prior consent of the data subject.
2. The "Company" transfers personal information collected from users of the "Service" abroad as specified below, and hereby provides notice concerning such overseas transfer pursuant to Article 28-8(2) of the Personal Information Protection Act.
3. If you refuse the overseas transfer of your personal information, you will not be able to use the service. If you do not wish for your information to be transferred overseas, you may request membership withdrawal through 'Delete Account' within the mobile app.

Article 5 (Destruction Procedures and Methods for Personal Information)

1. The "Company" destroys personal information without delay when it becomes unnecessary, such as upon the expiration of the retention period or the achievement of the purpose of processing.
2. If personal information must continue to be retained in accordance with other laws and regulations, despite the expiration of the retention period consented to by the data subject or the achievement of the purpose of processing, the relevant personal information shall be transferred to a separate database (DB) or preserved in a different storage location.
3. The procedures and methods of personal information destruction are subject to each of the following items.

• 1. Destruction Procedure
  • a. The "Company" selects the personal information for which reasons for destruction have occurred, and destroys the personal information upon receiving approval from the "Company's" Chief Privacy Officer (CPO).
• 2. Method of destruction
  • a. Information in the form of electronic files shall be destroyed using technical methods that render the records irrecoverable.
  • b. Personal information printed on paper shall be destroyed by shredding it with a shredder or through incineration..

Article 6 (Rights, Duties, and Exercise Methods of Data Subjects and Legal Representatives)

1. The data subject may exercise their rights against the "Company" at any time, such as requesting access to, correction, deletion, or suspension of processing of their personal information.
2. Rights under Paragraph 1 may be exercised against the "Company" through written documents, electronic mail, facsimile (FAX), or other similar means pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the "Company" shall take necessary measures in response without delay.
3. The rights under Paragraph 1 may be exercised through a representative, such as a legal guardian of the data subject or an authorized attorney-in-fact. In such cases, you must submit a power of attorney pursuant to Form No. 11 of the "Public Notice on the Method of Processing Personal Information (No. 2025-5)."
4. The rights of the data subject may be limited in accordance with Article 35(4) and Article 37(2) of the Personal Information Protection Act regarding requests for the inspection and suspension of processing of personal information.
5. If personal information is explicitly prescribed as a subject of collection under other statutes, the deletion thereof may not be requested, notwithstanding a request for the correction or deletion of personal information.
6. The “Company” verifies whether the person making the request for access, correction/deletion, or suspension of processing in accordance with the rights of the data subject is the principal or a legitimate representative.

Article 7 (Measures to Ensure Safety of Personal Information)

1. “ Company ” takes the following measures to ensure the security of personal information.

• 1. Administrative measures
  • a. Establishment, implementation , and inspection of internal management plans
  • b. Minimization of authority to process personal information and regular employee training: Restricting access authority exclusively to designated personal information handlers to minimize access permissions, and conducting regular (annual) personal information protection training

• 2. Technical measures
  • a. Management of Access Rights to Personal Information Processing Systems : Implementing necessary measures to control access to personal information through the granting, modification, and revocation of access rights to personal information processing systems, and preventing falsification or alteration of access logs.
  • b. Encryption of Personal Information: Personal information is stored and managed in encrypted form, and data is encrypted during transmission to ensure secure transmission.
  • c. Technical measures against hacking, etc.: Install security programs to prevent the leakage and damage of personal information caused by hacking or computer viruses, perform periodic updates and checks, and monitor and block technically and physically.

• 3. Physical measures
  • a. Access control to restricted and controlled areas: Implementation of physical measures, such as providing storage facilities and installing locking devices for safe storage.

Article 8 (Installation, Operation, and Refusal of Automatic Collection Devices)

1. The "Company" may install and operate "cookies" to provide efficient services, and data subjects can choose whether to allow cookie installation at any time through their web browser settings.
• • 1. "Cookies" refer to tiny text files that the "Company's" website stores on the data subject's PC through their web browser. At this time, a cookie is a small amount of information sent to the data subject's browser by the server (HTTP) used to operate the website, which is stored on the data subject's computer or mobile device and automatically transmitted from the data subject's browser to the server when accessing the website.
  • 2. The "Company" uses cookies and similar technologies for targeted marketing and to provide personalized services by analyzing website usage patterns, understanding the data subject's areas of interest, and tracking participation in various events.
  • 3. By configuring their web browser options, data subjects can choose to allow all cookies, receive a confirmation prompt each time a cookie is saved, or refuse to store any cookies at all.
  • 4. However, if you refuse to store cookies, you may experience difficulties using some features provided by the company, such as personalized services.
2. “ The Company ” analyzes customers’ website and mobile app usage using Google Analytics, a log analysis tool provided by Google, to improve the service.
• • 1. Google Analytics collects behavioral information of data subjects through cookies, and in this case, information that can identify an individual is not processed.
  • 2. The non-identifiable behavioral information collected in this way may be used for online advertising purposes through the Google Analytics advertising service.
  • 3. Data subjects may opt out of data processing by Google Analytics by installing a web browser add-on available at tools.google.com/dlpage/gaoptout.
  • 4. Data subjects may opt out of the Google Analytics advertising features by adjusting the settings of their web browsers and mobile devices.
3. Data subjects can configure settings such as allowing or blocking cookies through browser option settings.
• • 1. Allow/Block Cookies in Web Browser
  • a. Chrome: Select “ : ” at the top right of the web browser → New Incognito window (Shortcut: Ctrl+Shift+N)
  • b. Edge: Select “…” at the top right of the web browser → New InPrivate Window (Shortcut: Ctrl+Shift+N)
  • 2. Allowing / Blocking Cookies via Mobile Devices
  • a. Chrome: Select “ : ” at the top right of the mobile browser → New Incognito Tab
  • b. Safari: Mobile Device Settings → Safari → Block All Cookies
  • c. Samsung Internet: Select the ' Tab ' icon at the bottom of the mobile browser → Turn on Incognito Mode → Start

Article 9 (Collection, Use, Provision, and Refusal of Behavioral Information)

1. "The Company" collects and uses online behavioral information during the use of the "Service" to provide users with optimized, customized services and benefits, as well as online tailored advertisements.
   ※ "Behavioral information" refers to online user activity information—such as app usage history, purchase and search history—that can be used to understand and analyze users' interests, preferences, and tendencies.
2. The “Company” collects only the minimum amount of behavioral information and does not collect sensitive behavioral information that poses a significant risk of infringing upon an individual’s rights, interests, or privacy, such as thoughts, beliefs, family and kinship relationships, educational background, medical history, other social activities, or career history.
3. The “ Company ” generates information regarding users through automated methods, stores (collects) information entered by users, or collects unique information of users’ devices by securely converting it so that the original value cannot be verified. Information collected in this manner may or may not constitute personal information depending on whether it is linked to personal information, etc.

1. In the case where behavioral information is processed without identifying the data subject:

1. In the case where behavioral information is processed without identifying the data subject:

Third Party Collecting and Processing Behavioral Information	Categories of Behavioral Information Collected	Method of Collecting Behavioral Information	Purpose of collecting behavioral information	Retention and Use Period
Meta Platforms , Inc	Installation, execution, in-app purchase	Automatically collected when visiting, launching, or using websites and apps	Ad conversion measurement and app performance analysis , Custom Audience configuration and retargeting for customized ad optimization	Destroyed 2 years after the date of collection
AppsFlyer	Verification and sign-up information, subscription and revenue information, offerwall participation records		Collection of behavior logs and statistical analysis, verification of offerwall mission participation history, analysis of ROI after free trials for actual payment conversions, and establishment of grounds for media settlement and reward payment.	Destroyed 2 years after the date of collection
Google LLC - Google Analytics (GA4)	User's website/app service usage records, such as visit history, searches, and clicks , and user behavior information (app launch frequency, screen navigation, events, etc.)		Provision of personalized services and advertisements based on user behavior data, analysis of web/app usage status, measurement of service performance, analysis of usage patterns	Destroyed 2 years after the date of collection
Google LLC - Google ADS	Ad impression and click history, web/app visit history, conversion event information		Service usage statistics analysis, ad conversion performance measurement, and custom targeting integration	Up to 540 days(Google Ad System Policy)

4. "The Company" collects and uses advertising identifiers for the purpose of tailored advertising within mobile apps. "Data subjects" may block or allow tailored advertising within apps by adjusting the settings of their mobile devices.
• 1. Android Phone: ① Settings → ② Privacy → ③ Advertising → ④ Reset Ad ID or Delete Ad ID
• 2. iPhone: ① Settings → ② Privacy → ③ Tracking → ④ Allow apps to request tracking (Turn off)

※ Menus and methods may vary slightly depending on the mobile OS version.

Article 10 (Criteria for Additional Use and Provision of Personal Information)

1. “ company ” is In accordance with Article 15, Paragraph 3 and Article 17, Paragraph 4 of the Personal Information Protection Act, personal information may be additionally used or provided without the consent of the data subject, taking into consideration matters under Article 14-2 of the Enforcement Decree of the Personal Information Protection Act .
2. The “ Company ” has considered the following matters in order to make additional uses or provision without the consent of the data subject .
   1. Whether the purpose of additionally using or providing personal information is related to the original purpose of collection
   2. Whether the additional use or provision of personal information is foreseeable in light of the circumstances under which the personal information was collected or the processing practices;
   3. Whether the additional use or provision of personal information unduly infringes upon the interests of the data subject
   4. Whether necessary measures to ensure safety, such as pseudonymization or encryption, have been taken

Article 11 (Chief Privacy Officer and Responsible Department)

1. The “ Company ” assumes overall responsibility for business related to the processing of personal information and designates a Personal Information Protection Officer as follows to handle complaints and provide relief for damages of data subjects related to the processing of personal information.

▶ Chief Privacy Officer

• Department Name: IT Innovation Office
• Name : Lee Hyuk-jun Director
• Contact Information : 02-2233-5533
• Email: privacy@dreamsecurity.com

※ You will be connected to the Personal Information Protection Department.

2. Data subjects may contact the Chief Privacy Officer and the Personal Information Protection Department regarding all inquiries, complaints, and damage relief matters related to personal information protection arising from the use of the “Service” provided by the “Company . ” The “Company” shall respond to and process the data subject’s inquiries without delay. I will give it to you.

Article 12 (Contact for Personal Information Access Requests)

1. The data subject You may request access to personal information pursuant to Article 35 of the Personal Information Protection Act from the following department.
• Department Name : Information Security Team
• contact : 02-2233-5533
• Email : privacy@dreamsecurity.com
2. “ The Company ” will endeavor to ensure that requests for access to personal information by data subjects are processed promptly.

Article 13 (Remedies for Infringement of Rights and Interests of Data Subjects)

1. Data subjects may apply for dispute resolution or consultation with organizations such as the Personal Information Dispute Mediation Committee and the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA) in order to seek remedies for damages caused by personal information infringement. For other reports or consultations regarding personal information infringement, please contact the following organizations.

Remedies for Infringement of Rights and Interests of Data Subjects

Personal Information Dispute Mediation Committee	Homepage: https://www.kopico.go.kr Phone number: 1833-6972 (without area code)
Personal Information Infringement Reporting Center	Homepage: https://privacy.kisa.or.kr Phone number: 118 (without area code)
National Police Agency Cybercrime Reporting System	Homepage: https://ecrm.police.go.kr Phone number: 182 (without area code)

Article 14 (Amendments to the Privacy Policy)

This Privacy Policy is effective as of June 29 , 2026.

In the event of any additions, deletions, or modifications to this Privacy Policy, the Company will notify users through the "Notice" section on its website at least 7 days prior to the effective date of the changes. For significant changes affecting users' rights, including changes related to the collection and use of personal information or the provision of personal information to third parties, the Company will provide notice at least 30 days prior to the effective date.