KONG STUDIOS Inc. (hereinafter referred
to as the "Company") establishes and discloses this Privacy Policy in
accordance with Article 30 of the Personal Information Protection Act to
protect customers' personal information and promptly resolve related
grievances.
Under this Privacy Policy, “Personal
Information” refers to information relating to a living individual that falls
under any of the following categories:
The Company may amend this Privacy
Policy pursuant to changes in applicable laws, regulations, governmental
guidelines, or internal operational policies. Amendments, including the
effective dates, may be reviewed at any time via the Privacy Policy notices
section.
The Company collects and uses personal
information by distinguishing between “Mandatory Information” necessary for
providing the Services and “Optional Information” used to deliver services
customized to customer preferences and needs. Customers may still use the
Services even if they withhold consent to the collection and use of Optional
Information.
The Company may collect customer
personal information and use it within the scope of the collection purposes
under any of the following circumstances:
●
a. Where consent has been obtained from the
customer;
●
b. Where special provisions exist in laws or
where it is inevitable to comply with statutory obligations;
●
c. Where necessary for executing or performing
a contract concluded with the customer, or implementing measures requested by
the customer in the course of entering into a contract;
●
d. Where manifestly deemed necessary for the
urgent benefit of the life, physical safety, or property of the customer or a
third party;
●
e. Where necessary to attain the legitimate
interests of the Company, which manifestly override the rights of the customer
(limited to instances related to the Company’s legitimate interests and not
exceeding a reasonable scope);
●
f. Where urgently required for public safety
and well-being, such as public health.
Furthermore, pursuant to applicable laws
and regulations, personal information may be used without the customer’s
consent within a scope reasonably related to the initial purpose of collection.
In such circumstances, comprehensive
consideration shall be given to: whether it is related to the initial purpose
of collection; whether it is predictable in light of the circumstances of
collection or customary processing practices; whether it infringes upon the
interests of the customer unjustifiably; and whether necessary measures to
ensure safety, such as pseudonymization or encryption, have been implemented.
The Company collects and uses personal
information for the following purposes:
○
Detection of and response to abnormal gameplay
(illegal software/unauthorized programs, etc.);
○
Analysis of customer support (CS) inquiries and
improvement of customized response efficiency.
|
Service Name |
Category |
Legal Basis |
Collected Items |
|
KONG STUDIOS Inc. |
Guest Login |
Article 15(1)(4) of
the PIPA (Conclusion and Performance of a Contract) |
Nickname, Device ID ※ Generated
Information: Game Account No. |
|
KONG STUDIOS Inc. -
Customer Support |
1:1 Inquiry |
Article 15(1)(4) of
the PIPA (Conclusion and Performance of a Contract) |
Email address, Game
Account No. (Not collected for non-member logins) |
|
KONG STUDIOS Inc. -
Customer Support |
App Market Developer
Email Inquiry |
Article 15(1)(4) of
the PIPA (Conclusion and Performance of a Contract) |
Nickname, Email
address, Server Info, Attached Files |
|
KONG STUDIOS Inc. |
Automatically
Collected Information |
Article 15(1)(4) of
the PIPA (Conclusion and Performance of a Contract) |
Game and service
usage records, App ID, Device info (Model, OS version, Unique Device
Identifier), Registration date, Login/Logout timestamps, Telecom carrier
info, Country code, Payment records, Purchase time, Purchased items,
Promotion/Event participation records, IP address, Store info, Adult
verification status (for adult-only content) |
|
Service Name |
Legal Basis |
Collected Items |
|
KONG STUDIOS Inc. -
Customer Support |
Article 15(1)(1) of
the PIPA (Consent) |
Character Name, Order
Number (Google), Receipt Screenshot (Apple) |
Mandatory personal information necessary
for service provision is collected during the account registration process or
by providing advance notice and obtaining user consent. Where optional personal
information is collected, the Company, in principle, notifies the user and
obtains consent through the following methods:
The Company executes data entrustment
agreements governing: the prohibition of processing personal information
outside the purpose of the entrusted tasks; technical and administrative
safeguards; the purpose and scope of entrustment; restrictions on re-entrustment;
access controls and other measures to ensure security; supervision and
inspection of personal information management; allocation of liabilities in the
event of personal information breaches; and the obligation to return or destroy
personal information upon termination of processing.
For smooth business operations and to
provide enhanced services and customer convenience, the Company entrusts the
processing of personal information to specialized external contractors as set
forth below. The list of entrusted entities (trustees) may be subject to change
depending on service updates and contract periods. In such cases, notice will
be provided via the methods designated for each service or through general
announcements.
|
Service Name |
Sub-processor
(Entrusted Entity) |
Purpose of
Entrustment |
Retention and Use
Period |
|
KONG STUDIOS Inc. |
ELITE GAMES Inc. |
Customer Support
operation and consultation |
Until membership
withdrawal or termination of the entrustment contract |
|
KONG STUDIOS Inc. |
Zendesk Korea |
Infrastructure
operation/management for Customer Support |
Until membership
withdrawal or termination of the entrustment contract |
The Company uses personal information
solely within the scope consented to by the customer or permitted by law, and
does not use or disclose it to third parties beyond such scope.
However, pursuant to applicable laws,
personal information may be provided to third parties without customer consent
within a scope reasonably related to the initial purpose of collection. In such
circumstances, the Company comprehensively evaluates: whether it is related to
the initial purpose of collection; whether it is predictable in light of the
circumstances of collection or customary processing practices; whether it
unjustifiably infringes upon the interests of the customer; and whether
necessary measures to ensure safety, such as pseudonymization or encryption,
have been implemented.
Specifically, personal information may
be provided within the aforementioned scope under the following circumstances:
●
a. Business Partnerships: The Company may
provide or share personal information with affiliates to deliver enhanced
services. Prior to doing so, the Company will notify the customer in writing or
via email regarding the identity of the affiliate, the categories of data
provided, the purpose, and the retention period, and obtain individual consent.
If consent is refused, the information will not be provided or shared.
●
b. Mergers, Acquisitions, and Business
Transfers: In the event of a full or partial business transfer, merger, or
succession of rights and obligations, the Company will notify customers to
guarantee their statutory rights regarding personal data protection.
●
c. Statutory Obligations: Where required under
special provisions of other laws, such as the Framework Act on National Taxes
or the Criminal Procedure Act. (Note: Personal information will not be
disclosed unconditionally upon the administrative or investigative request of
authorities; it will be provided strictly in accordance with lawful statutory
procedures, such as upon presentation of a valid judicial warrant or official
document bearing the seal of an agency head.)
●
d. Emergency Situations: In the event of
disasters, infectious diseases, incidents posing imminent danger to life or
physical safety, or imminent property loss. (Note: Data provision is strictly
confined to the minimum necessary extent based on relevant statutory
authority.)
|
Legal Basis |
Third-Party Recipient |
Purpose of Provision |
Provided Items |
Recipient's Retention
and Use Period |
Exercise of Rights |
Additional Use /
Provision |
|
Article 17(4) of the
PIPA |
Apple Inc. |
App Store payment
transaction verification, refund request processing support, purchase/refund
dispute resolution, verification of item provision and usage, prevention of
fraudulent refunds |
Status of successful
provision and usage of game content products |
Until the purposes of
refund processing, dispute resolution, and fraudulent transaction prevention
are achieved, or until the retention period required by Apple's laws and
policies expires |
In-game Customer
Support |
Evaluated in
accordance with Article 17(4) of the PIPA |
The Company processes personal
information within the retention and use period consented to by the user upon
registration and service use. When a user withdraws consent, or upon
achievement of the purpose of collection and use or expiration of the retention
period, the personal information is destroyed without delay.
When account deletion is requested, game
data is retained for 7 days to prepare for unintended withdrawals. The scope of
retention follows each game's operational policy. In addition, fraudulent use
records are retained for 5 years pursuant to internal policy.
The Company destroys personal
information without delay when it becomes unnecessary, such as upon the
expiration of the retention period or fulfillment of the processing purpose.
●
Electronic Files: Permanently deleted using
technical methods that render the records irrecoverable. Where technical
limitations preclude permanent deletion, the data is processed into anonymous
information to prevent restoration.
●
Paper Documents: Shredded using a paper
shredder or incinerated.
Where retention is mandated by
applicable statutory provisions, the Company stores personal information in an
isolated, separate database (DB) for the duration prescribed by such laws:
●
Records on display and advertising
(Subparagraph 1): 6 months
●
Records on contracts or withdrawal of
subscription, etc. (Subparagraph 2): 5 years
○
Retained Items: Purchaser information (Customer
No./Game Account No.), product purchase, cancellation, exchange, and refund
records
●
Records on payment and supply of goods, etc.
(Subparagraph 3): 5 years
○
Retained Items: Payment details (transaction
ID, purchase type, payment amount, payment gateway/carrier, payment timestamp),
delivery/tracking number
●
Records on consumer complaints or dispute
settlements (Subparagraph 4): 3 years
○
Retained Items: Customer No./Game Account No.,
contact information, email address, consultation logs (inquiry contents,
consultation timestamps, voice recordings), inquiry contents and processing
outcomes
●
Account books and supporting documents for
transactions governed by tax laws: 5 years
○
Retained Items: Name, resident registration
number (limited strictly to processing for public taxes and levies),
transaction dates, transaction amounts, payment history
Customers may access or obtain copies of
their personal information held by the Company, records regarding the use or
third-party provision of their personal information, and records of consent
granted for collection, use, and provision.
Upon a customer's request for access,
provision, rectification, erasure, or data portability, the Company will
respond faithfully without undue delay. Where personal information is
determined to contain errors or the retention period has lapsed, the Company
will rectify or erase the data immediately.
Customers may withdraw consent
(terminate membership) regarding the collection, use, or provision of personal
information at any time, and the Company will take necessary actions
immediately. However, withdrawal of consent for information mandatory for membership
registration and essential service delivery will result in account termination
and service cancellation, precluding access to the Services.
Customers may exercise their rights
through the methods below:
●
Reception & Processing Department: KONG
STUDIOS Inc. Infrastructure Dept.
●
Contact: 02-532-2063, Contact Us
(support@gdtskr.zendesk.com)
When a customer requests access to their
personal information, the Company shall take prompt measures to enable
inspection and verification.
Customers must ensure their personal
information is entered accurately and kept up to date to prevent unforeseen
incidents. Customers bear sole responsibility for incidents arising from
inaccurate information provided. Any misappropriation of third-party
information or submission of false data may result in membership forfeiture and
penalties under the Terms of Service.
Customers must exercise reasonable care,
including logging out from public devices, to prevent credentials (ID,
password, etc.) and personal information from leaking. Customers should avoid
easily inferable passwords and update passwords periodically. Customers must
respect the personal data and rights of third parties and refrain from
infringing or defaming them in public posts.
The Company utilizes AI technology to
enhance service efficiency and maintain operational fairness. Where an
automated decision made by an AI system produces legal effects or significantly
affects rights or obligations, customers have the right to request an
explanation, request human review, or reject the automated decision. Please
note that final decisions by the Company undergo human review by operational
staff and do not constitute purely automated decisions.
As a rule, the Company does not collect
personal information of children under the age of 14 (hereinafter referred to
as "Children").
If a legal representative requests
withdrawal from the Company's service on behalf of a child, instructions for
account deletion will be provided. If processing a child's information is
unavoidably required upon user request, consent from the legal representative
will be obtained, and the relevant information will be destroyed without delay
upon completion of the task.
The Company may deploy and operate
cookies and mobile advertising identifiers (Advertising ID / ADID) that store
and retrieve customer information to remember preferences and provide efficient
services.
Information collected via cookies and
advertising identifiers may be used for the following purposes:
●
Delivering differentiated information based on
areas of individual interest;
●
Analyzing navigation trails to provide
personalized services on subsequent visits;
●
Displaying subscription periods when using paid
services;
●
Analyzing user habits as metrics for service
reorganization and improvement.
Browser Configuration:
●
Chrome: Settings > Privacy and Security >
Cookies and other site data > Select preference.
●
Edge: Settings > Cookies and site
permissions > Manage and delete cookies and site data > Select
preference.
●
Safari: Preferences > Privacy > Select
cookie blocking preferences.
●
Internet Explorer: Tools > Internet Options
> Privacy > Settings.
○
Android: Settings > Google > Ads > Opt
out of Ads Personalization (or Delete advertising ID).
○
iOS: Settings > Privacy & Security >
Tracking > Toggle off "Allow Apps to Request to Track".
Pursuant to Article 29 of the PIPA, the
Company implements the following technical, administrative, and physical
safeguards to prevent loss, theft, leakage, alteration, or damage of personal
information:
●
a. Formulation and Execution of Internal
Management Plans: The Company establishes, implements, and annually reviews an
Internal Management Plan setting forth necessary standards for secure data
processing.
●
b. Encryption of Personal Information: User
personal information is transmitted over encrypted communication networks
(SSL/TLS), and critical data, such as passwords, is encrypted at rest.
●
c. Protection Against Hacking and Malware:
Systems are deployed within access-controlled physical areas to prevent
breaches caused by hacking or viruses. Intrusion detection and prevention
systems operate 24/7, and endpoint antivirus software is updated continuously
to block malicious code.
●
d. Minimization and Training of Authorized
Personnel: Access to personal information is restricted to the minimum
necessary personnel. Work PCs are segregated from external internet services to
prevent data leaks. Access rights to database systems are governed by strict
credential policies and subjected to ongoing audits.
●
e. Regular Employee Training: Regular privacy
and data security education and compliance campaigns are conducted for all
personnel handling personal information.
●
f. Privacy-Centric AI Operations:
Pseudonymization techniques are applied during AI model training and analysis
to minimize personal data exposure. Data is destroyed without delay once
training/analysis objectives are attained, and isolated processing environments
are maintained to prevent unauthorized data exfiltration.
The Company does not transmit commercial
advertising information for for-profit purposes without the customer's prior
consent.
Where advertising information is
transmitted for marketing purposes (such as new title releases or event
notifications), the Company obtains prior express consent and implements
identification labels across transmission channels as follows:
●
Email: The word (광고) or (Ad) is placed at the beginning of the
subject line without spacing, followed by the main message body. Where
technical constraints preclude displaying advertising labels in subject
headers, necessary identification measures, including the sender's name, are
displayed.
●
Mobile Messengers / SMS: The sender's corporate
identity and opt-out mechanisms are clearly displayed.
The Company notifies the customer via
pop-up or electronic confirmation upon consent acquisition, opt-out, or
withdrawal of consent. Furthermore, pursuant to applicable regulations, the
Company re-confirms the customer's consent status every two (2) years from the
date consent was granted.
Where
necessary, the Company entrusts the processing or storage of customer personal
information overseas as follows. Refusal of overseas transfer can be exercised
through game withdrawal (In-game Settings → Delete Account or Customer
Support). Please note that game services cannot be utilized upon withdrawal.
|
Legal Basis |
Transferred Items |
Destination Country,
Timing, and Method of Transfer |
Recipient |
Recipient's Purpose
of Use and Retention Period |
Method, Procedure,
and Effect of Refusing Cross-Border Transfer |
|
Entrustment and
Storage of Cross-Border Processing for Contract Performance (Article 28-8(1)(3)
of the PIPA) |
Game Nickname, Game
Account No., Service usage records |
Japan, USA,
Singapore, Germany Transmitted via
encrypted API communication at the time of service use |
Amazon Web Services
Inc. (Contact: https://aws.amazon.com/compliance/contact) |
Entrustment of game
infrastructure management tasks Until game account
withdrawal or termination of the game service |
Refusal of
cross-border transfer can be exercised by withdrawing from the game service
via the in-game withdrawal function or the membership withdrawal page.
Service use is prohibited after withdrawal. |
|
Entrustment and
Storage of Cross-Border Processing for Contract Performance (Article 28-8(1)(3)
of the PIPA) |
Status of successful
provision of game content products |
USA Transmitted via
encrypted API communication when the market operator requests verification of
successful item provision and usage |
Amazon Web Services
Inc. (Contact: https://aws.amazon.com/compliance/contact) |
Storage for
processing the market operator's requests to verify the provision of game
content products User inquiries and
disputes (3 years) |
Requests to halt
cross-border transfers can be made to Customer Support. The Company will
verify identity and notify the outcome of the refund/dispute review. However,
halting the transfer may pause the market operator's refund review or delay
refund processing. If Terms of Service violations such as fraudulent refunds
are identified, usage restrictions may be applied in accordance with the
Terms. |
The Company may process personal
information in the form of pseudonymous information (which cannot identify a
specific individual without additional data) for statistical purposes and
scientific research. Pseudonymous information is stored and managed separately
from additional data, with necessary technical, administrative, and physical
safeguards applied to prevent re-identification.
○
Administrative Measures: Establishment and
execution of internal management plans; periodic employee training.
○
Technical Measures: Access authority management
for processing systems; intrusion prevention systems; separate storage and
management of source datasets; installation of security programs.
○
Physical Measures: Access controls for data
storage facilities.
The Company values customer feedback.
Contact info:
●
Phone: 02-532-2063
●
Inquiry: support@gdtskr.zendesk.com
For consultations or dispute mediation
regarding personal data infringement, users may contact the following statutory
agencies:
|
Agency |
Telephone |
Website |
|
Personal Information
Dispute Mediation Committee |
(Without area code)
1833-6972 |
www.kopico.go.kr |
|
Personal Information
Infringement Report Center (KISA) |
(Without area code)
118 |
privacy.kisa.or.kr |
|
Supreme Prosecutors'
Office (Cybercrime Investigation Division) |
(Without area code)
1301 |
www.spo.go.kr |
|
National Police
Agency (Cyber Bureau) |
(Without area code)
182 |
ecrm.police.go.kr |
The Company Privacy Officer and
responsible department provisions have been updated as follows:
●
Data Protection Officer: Jinsoo Baik (Executive
Director)
●
Department: Infrastructure Dept.
●
Contact: 02-532-2063, Contact Us
(support@gdtskr.zendesk.com)
This Privacy Policy shall take effect on
October 27, 2026.