Privacy Policy

General Provisions

WooriIBook Co., Ltd. (the "Company") values users' personal information and complies with the Republic of Korea's Personal Information Protection Act (PIPA) and related laws. Through this Privacy Policy, the Company explains for what purposes and by what means users' personal information is processed in "Friends Club Plus" and related services (the "Service"), and what measures are taken to protect personal information.

Friends Club Plus is provided under agreements with educational institutions such as schools and academies (each an "Institution"), and User accounts (for teachers, students, etc.) are, as a rule, issued or granted by the Institution or its designated Administrator. In such cases, the Institution warrants that it has fulfilled the procedures required under applicable law — including obtaining consent for the collection of Users' personal information (and, for Children under 14, the consent of a legal guardian). The roles and responsibilities regarding personal information processing between the Company and the Institution (including whether processing is entrusted) shall be as provided by applicable law and the separate agreement.

Student accounts are issued on the premise that they are managed and used by a guardian, and Children use the learning features under the guardian's supervision.

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information is not used for purposes other than those below, and where the purpose of use changes, the Company will take necessary measures in accordance with applicable law.

1. User authentication and account management — identification of members and Users, verification of identity and age, account issuance and use management, verification of legal guardian consent for children's accounts.
2. Service provision — provision of learning content, grading and feedback, management of learning status and achievement and provision of learning reports, class management tools and personalized learning features, management of learning rewards (coins).
3. Attendance management and notification — recording of attendance and notification of attendance to guardians.
4. Communication and sharing — delivery of notices and confirmation of delivery, communication between guardians and teachers, sharing of class activity photos.
5. Sending notifications — sending service notifications through in-app notifications and push notifications.
6. Service operation — operational notices and service update announcements and distribution, handling of inquiries.
7. Security and quality management — prevention of unauthorized access and misuse, service quality improvement and error detection, statistical analysis.
8. Compliance with legal obligations and handling of disputes.

2. Personal Information Items Processed and Methods of Collection

(1) Items collected, purposes, and retention periods

Note: The Company collects only the minimum personal information necessary to provide the Service. Sensitive information and resident registration numbers are not collected in principle; where unavoidable, they are processed only with a legal basis and separate consent.

Note: Teachers and administrators who post a notice can check whether each recipient has read it.

Note: Conversations in Messages can be viewed only by the student's guardian and the teachers·administrators of that class; other guardians cannot view them.

Note: Some features may not be available depending on the app version in use; where a feature is not used, the related items are not collected.

(2) About free-text fields

Messages and attendance notes are free-text fields, so the author may enter sensitive content such as health conditions. The Company does not require sensitive information as a collection item; entered content can be viewed only by the student's guardian and the teachers·administrators of the student's class, and is destroyed once the retention period expires. Where possible, please communicate sensitive matters such as health through other channels, such as by phone.

(3) Methods of collection

• Account issuance and User information registration by the Institution or Administrator
• Direct entry by the User upon registration/login
• Direct creation·registration by the User during service use (Messages, photos, etc.)
• Automatic collection during service use (logs, cookies, device information, etc.)
• Collection upon inquiry to customer support (email, etc.)

3. Retention and Use Period

1. As a rule, the Company retains and uses personal information during the User's service usage period; the retention period for each item is as set out in "Items collected, purposes, and retention periods" above.
2. Personal information whose retention period has expired is destroyed without delay. However, for class activity photos, the destruction process may take some time after the retention period expires.
3. Upon a User's request for account deletion (withdrawal), termination of the service agreement, or discontinuation of the Service, the Company destroys the relevant personal information without delay (no later than within 30 days), except as otherwise provided by applicable law.
4. Where retention is required under applicable law, the information is retained for the relevant period, and the legal basis and items are separately disclosed.

4. Provision to Third Parties

As a rule, the Company does not provide users' personal information to third parties. The following are exceptions:

1. Where the User (or legal guardian) has given explicit consent;
2. Where there is a special provision in law, or where necessary to comply with legal obligations such as a lawful request from an investigative authority.

Where provision is necessary, the Company will give prior notice of the recipient, purpose, items, and retention·use period, and obtain consent.

5. Entrustment of Personal Information Processing

To provide a stable service, the Company entrusts part of its personal information processing to external specialized providers. In accordance with applicable law, the Company discloses the trustees and the scope of entrusted work in this policy, and ensures safe management of personal information through contracts.

6. Overseas Transfer of Personal Information

The Company transfers personal information overseas as follows to provide the Service.

1. The title and content of push notifications do not include the Child's name.
2. Information entrusted to Supabase, Inc. and Amazon Web Services, Inc. is stored in the Republic of Korea (Seoul) region. However, as foreign corporations, these two trustees may access it from overseas for service operation and maintenance.
3. Users may refuse the overseas transfer by contacting the Chief Privacy Officer. However, transfers for app updates and for providing the administration screens are essential to the Service, and refusing them may limit use of the Service.
4. Transfers for push notifications can be refused by not allowing, or by turning off, notification permission in the device settings. In this case, push notifications cannot be received, but in-app notifications and other use of the Service are not affected.

7. Protection of Children's Personal Information

1. The Service may be used by Children (students) under 14 years of age, and the collection and use of a Child's personal information requires the consent of a legal guardian.
2. Where accounts are issued through an Institution such as a school or academy, the Institution warrants that it has fulfilled all consents and procedures required under applicable law, including the consent of legal guardians, with respect to Child Users.
3. The Company protects Children's personal information with special care in accordance with applicable law; the specific items and consent matters for Children's personal information are governed by the [Appendix] Consent to Collection and Use of Children's Personal Information at the end of this policy.
4. A legal guardian may at any time request access to, correction, deletion, or suspension of processing of the Child's personal information, and may withdraw consent.

(1) Information entered by guardians

Because student accounts are issued on the premise that they are managed and used by a guardian, the following information is treated as information entered by the guardian:

• Conversations, comments, and attached photos written in Messages
• Messages lock number (PIN) — used to hide the screen so that the Child cannot view the guardian's Messages; it is not a means of identity authentication. The guardian sets it initially, and if it is lost, the Institution's Administrator resets it.
• Guardian contact (registered by the Institution)

(2) Class activity photos

1. Class activity photos are uploaded by teachers·administrators and are shown only to the guardians of that class and its teachers·administrators.
2. Class activity photos may include other children in the same class. If you would like a photo that includes a particular child to be hidden or deleted, please make a request to the Institution, and the photo will be taken down.
3. The legal guardian's consent to the taking and posting of class activity photos is obtained by the Institution.
4. Photos are stored at reduced resolution when uploaded. Guardians of the class and teachers/administrators can save photos to their own devices using the app's save feature, and photos saved to a device are managed by that user. Please use photos that include other children only within your household and do not post or share them externally.

8. Rights of Data Subjects and Legal Guardians, and How to Exercise Them

1. A User (or, for Children under 14, the legal guardian) may at any time request access, correction·deletion, suspension of processing, transfer of personal information, and withdrawal of consent with respect to their (or the Child's) personal information.
2. Rights may be exercised through the Administrator of the affiliated Institution or through the Chief Privacy Officer·department indicated in the Service, and the Company will act without delay.
3. Where there is a legitimate ground for refusal, the Company will explain the ground and how to object. When rights are exercised through an agent, the Company may verify the delegation.
4. Users must keep their personal information up to date; the User bears responsibility for entering inaccurate information.

9. Notice on Automated Processing

1. To support learning, the Service may provide certain features — such as grading and feedback — in a partially automated (assistive) manner. However, the results are reviewed and finalized by a teacher, and the Company does not make decisions producing legal or similarly significant effects on users solely by automated processing.
2. The handwriting recognition feature is processed on the User's device, and handwriting data is not transmitted to an external recognition service for recognition. Submitted answers are stored on the Company's servers for grading and feedback.
3. Users (or legal guardians) may request an explanation, raise an objection, and request human involvement regarding such processing.

10. Installation·Operation of Automatic Collection Devices such as Cookies, and Refusal

1. The Company may use automatic collection devices such as cookies for service provision, user convenience, and security.
2. Users may refuse or delete cookie storage through their web browser or device settings; in this case, some features of the Service may be limited.

11. Procedures and Methods of Destruction

1. When personal information becomes unnecessary — for example, upon expiration of the retention period or achievement of the processing purpose — the Company destroys it without delay.
2. Information in electronic file form is permanently deleted by technical means that make recovery·reproduction impossible; paper documents are shredded or incinerated.
3. Copies that the app temporarily stores on the device for display are removed when the app is deleted.
4. Photos that a user saves to their own device using the app's save feature are outside the Company's processing and are therefore not subject to destruction under this Policy.

12. Measures to Ensure the Security of Personal Information

The Company implements the following technical, administrative, and physical measures to protect personal information from unauthorized access, leakage, alteration, or destruction:

1. Establishment and implementation of an internal management plan and regular staff training;
2. Minimization of access rights to personal information, role-based access control, and retention·review of access logs;
3. Encryption of personal information (passwords and important data) and encrypted data transmission (TLS);
4. Installation·updating of security programs and regular security inspection·monitoring;
5. Use of secure server infrastructure managed by certified cloud providers and physical access control;
6. Imposition of confidentiality obligations on personnel who access personal information.

13. Chief Privacy Officer (CPO) and Responsible Department

The Company designates a Chief Privacy Officer and responsible department to oversee personal information processing and to handle related inquiries, complaints, and remedies:

• Chief Privacy Officer (CPO): Sim Seung-hwan Contact: info@ownabee.com
• Complaints and access-request department: Customer Support Team Contact: info@ownabee.com

14. Remedies for Infringement of Rights

Data subjects may apply for counseling or dispute mediation to the following organizations to obtain relief for personal information infringement:

• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301)
• National Police Agency Cybercrime Reporting System (ecrm.police.go.kr / 182)

15. Notification and Reporting of Personal Information Breaches

If a personal information breach occurs, the Company will, within the period prescribed by applicable law, notify the affected data subjects (including legal guardians in the case of Children under 14) and the affiliated Institution, and will report to the relevant authorities where the case meets the legal thresholds.

16. Changes to the Privacy Policy

1. The Company may revise this policy in accordance with changes in law or the Service.
2. When revising this policy, the Company will publish the revised content and the effective date without delay. Publication is made through an in-Service notice or by posting this policy.
3. For changes that materially affect users' rights, the Company will give notice before the effective date.
4. Where items or purposes of collection and use of personal information are added, the Company will separately obtain the consent of the User (or, for Children under 14, the legal guardian) for those matters.
5. The revision history will be provided upon request through the Chief Privacy Officer's contact.