SUNCYAN Inc. Privacy Policy

‘SUNCYAN Inc.’ (hereinafter referred to as the ‘Company’) complies with the Personal Information Protection Act and relevant laws and regulations to protect the freedoms and rights of data subjects, processing personal information lawfully and managing it securely.

Accordingly, in accordance with Article 30 of the 「Personal Information Protection Act」, the Company establishes and discloses the following Privacy Policy to guide data subjects through the procedures and standards concerning the processing and protection of personal information, and to ensure that related grievances are handled promptly and smoothly.

Article 1 Purpose of Processing Personal Information, Processing Items, and Period of Retention and Use

1.The Company collects personal information within the minimum necessary scope to provide services in accordance with Article 15, Paragraph 1, Item 1 (Consent of Data Subject) of the 「Personal Information Protection Act」.

The Company collects personal information from sources other than the data subject as follows.

2.For purposes such as providing stable services, protecting accounts and items, complying with laws, and preventing fraudulent users, the following information may be generated and collected during the course of service use.

• Information such as game data generated during game play (nickname), device information (model name, OS information, mobile firmware version), PC information (browser information, OS information), IP address, cookies, access records, location and country information (derived from IP address), records of fraudulent use, and service usage records

Article 2 Period of Processing and Retention of Personal Information

1.In principle, the Company destroys personal information after 30 days of retention upon achievement of the purpose of collection and use, expiration of the retention period, or membership withdrawal. (However, in cases where storage for a certain period is prescribed by laws and regulations or in accordance with internal Company policies, personal information will be stored securely for the relevant period and then destroyed.)

Article 3 Protection of Personal Information of Children Under 14 Years of Age

In cases where consent is required to process the personal information of children under 14 years of age, the Company shall obtain consent from the child’s legal representative. When obtaining the consent of a legal representative, consent is obtained after verifying/authenticating the legal representative during the sign-up stage on the external service platforms (Google, Apple, Steam) through which the child joined.

Article 4 Procedures and Methods for Destruction of Personal Information

1.The Company shall destroy the relevant personal information without delay when it becomes unnecessary, such as upon the expiration of the personal information retention period or the achievement of the purpose of processing, in accordance with internal policies and relevant laws and regulations. However, for the purpose of preventing withdrawal due to user error and resolving consumer complaints and disputes, personal information will be destroyed immediately after a 30-day grace period from the date of withdrawal.

2.The methods for destroying personal information are as follows.

• Personal information stored in the form of electronic files is deleted using technical methods that make it impossible to restore.
• Personal information printed on paper and received documents are destroyed through shredding or incineration.

Article 5 Provision of Personal Information to Third Parties

1.The Company does not provide the personal information of the data subjects to third parties. However, in the following cases, personal information may be provided without the consent of the data subject.

• Where there are special provisions in other laws
• Where it is clearly recognized as necessary for the immediate interest of the life, physical safety, or property of the data subject or a third party
• Where it is urgently necessary for public safety and well-being, such as public health

Article 6 Entrustment of Processing of Personal Information

1.To provide customers with smoother services, the Company entrusts the processing of personal information as set forth below and provides the following information in accordance with Article 28-8, Paragraph 2 of the Personal Information Protection Act.

※ None of the current processors subcontracts these services.

2.When entering into an entrustment contract, the Company specifies in documents such as contracts matters regarding the prohibition of processing personal information for purposes other than the performance of the entrusted tasks, technical and managerial protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability such as damages in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the trustee processes personal information safely.

3.In the event that the contents of the entrusted tasks or the trustee change, we will disclose such changes through this ‘Privacy Policy’ without delay.

Article 7 Overseas Transfer of Personal Information

The Company transfers personal information collected from service users overseas as described below and provides the following information regarding these transfers in accordance with Article 28-8, Paragraph 2 of the Personal Information Protection Act.

※ Service use is not possible if you refuse the overseas transfer. If you do not wish for overseas transfer, you can proceed with membership withdrawal on mobile (Settings – Account – Withdrawal) or request membership withdrawal through Article 10 (Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise).

Article 8 Measures to Ensure the Safety of Personal Information

1.The Company establishes and implements an internal management plan for the safe processing of personal information, and designates a personal information protection officer.

2.The Company limits the right of access to customers' personal information to the minimum number of personnel, and conducts periodic personal information protection training for the safe processing of personal information.

3.The Company adopts a security device (SSL) to safely transmit personal information over the network using encryption algorithms and encrypts communication channels when sending and receiving information, while also encrypting the personal information it processes before storing it.

4.The Company stores, backs up, and monitors the access records of the personal information processing system to prevent forgery or alteration of the access records.

5.The Company is doing its best to protect the personal information provided by customers by using antivirus software, firewalls, and intrusion detection/prevention systems and updating them periodically. The personal information is being protected through the stable use of a system verified by a security certification company.

6.The Company periodically checks emergency measures in case of disasters through security mock training.

7.The Company physically and completely destroys personal information once the purpose of the personal information is achieved.

Article 9 Matters Concerning the Installation, Operation, and Refusal of Automatic Behavioral Information Collection Devices

1.The Company uses ‘cookies’ that store and frequently retrieve usage information to provide individualized services and convenience to data subjects.

※ Cookies are a small amount of information sent to the data subject's internet browser by the server used to operate the website and are stored on the data subject's PC or mobile device.

2.Data subjects can set options such as allowing or blocking cookies through web browser option settings. However, if you refuse to store cookies, you may experience difficulties in using customized services.

Allowing/blocking cookies in a web browser

• Chrome: Select ‘⋮’ at the top right of the web browser > New Incognito window (Shortcut key: Ctrl+Shift+N)
• Edge: Select ‘…’ at the top right of the web browser > New InPrivate window (Shortcut key: Ctrl+Shift+N)

Allowing/blocking cookies in a mobile browser

• Chrome: Select ‘⋮’ at the top right of the mobile browser > New Incognito tab
• Safari: Mobile device settings > Safari > Advanced > Block all cookies
• Samsung Internet: Select ‘Tabs’ icon at the bottom of the mobile browser > Turn on Secret mode > Start

3.The Company collects and uses advertising identifiers in its app to provide personalized advertisements. Data subjects may block or allow personalized advertisements in the app by changing their mobile device settings.

• Android: Settings > Security and privacy > Privacy > Other privacy settings > Ads > Reset advertising ID or Delete advertising ID
• iOS: Settings > Privacy & Security > Tracking > Turn off ‘Allow Apps to Request to Track’

※ Menus and methods may vary depending on the mobile OS version.

Article 10 Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise

1.Customers may exercise their rights, such as requesting access to, correction, deletion, or suspension of processing of personal information, against the Company at any time.

2.Rights under Paragraph 1 may be exercised directly through the Company email (support@suncyan.com).

3.Rights under Paragraph 1 may be exercised through writing, telephone, email, internet, etc., to the relevant department listed in Article 11 (Privacy Officer), and the Company will take action without delay.

4.Rights under Paragraph 1 may be exercised through a representative, such as the customer's legal representative or a person who has been delegated. In this case, you must submit a power of attorney in accordance with Form No. 11 of the [Notification on the Method of Processing Personal Information].

5.A customer's request for ‘access’ to personal information may be limited or refused in accordance with Article 35, Paragraph 4 of the Personal Information Protection Act, and a request for ‘suspension of processing’ may be limited by the proviso of Article 37, Paragraph 2 of the Personal Information Protection Act.

6.Deletion of personal information cannot be requested if its collection is explicitly required by other laws and regulations.

7.The Company verifies whether the person making the request is the individual or a legitimate representative upon requests for access, correction/deletion, or suspension of processing according to the customer's rights.

Article 11 Personal Information Protection Officer

1.The Company manages and takes overall responsibility for the processing of personal information, and has designated a Personal Information Protection Officer as follows to handle complaints and provide remedial measures for information subjects related to the processing of personal information.

2.Information subjects may direct all inquiries related to personal information protection, complaint handling, and remedial measures arising from the use of the Company's services to the Personal Information Protection Officer and the Personal Information Protection Department. The Company will respond to and process inquiries from information subjects without delay.

Article 12 Remedial Measures for Infringement of Rights and Interests of Information Subjects

1.Information subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, etc., in order to receive remedial measures for personal information infringement. For other reports and consultations on personal information infringement, please contact the organizations below.

• Personal Information Dispute Mediation Committee: (no area code needed) 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: (no area code needed) 118 (privacy.kisa.or.kr)
• Cyber Investigation Division, Supreme Prosecutors' Office: (no area code needed) 1301 (www.spo.go.kr)
• National Police Agency: (no area code needed) 182 (ecrm.police.go.kr)

Article 13 Obligation to Notify the Privacy Policy

1.The current Privacy Policy takes effect on October 20, 2026.

• Privacy Policy version number: v1.4
• Effective date of the Privacy Policy: October 20, 2026

2.Previous privacy policies can be viewed by checking the effective date at the top of this page.

SUNCYAN Fixed Video Information Processing Device Operation and Management Policy

SUNCYAN Inc. (hereinafter referred to as the “Company”) establishes the following Video Information Processing Device Operation and Management Policy. By installing and operating video information processing devices in areas where accidents may occur, the Company aims to prevent accidents, provide evidence when needed, protect customers’ rights and interests, and facilitate its operations.