<style type="text/css"> .cs_table { width: 90%; } .cs_table th, .cs_table td { border: 1px solid #ddd; font-size: 12px; line-height:1.6em; padding: 10px; font-weight: 400; text-align: center; } .cs_table th { background: #f7f7f7; } .cs_table th:nth-child(1) { width:20%; } .cs_table th:nth-child(2) { width:40%; } .cs_table th:nth-child(3) { width:20%; } .cs_table th:nth-child(4) { width:20%; } .cs_table td.small { width:40px; white-space: nowrap;} .cs_table td.more { max-width: 150px; } .align-l { text-align: left; } .cs_table2 { width: 60%; } .cs_table2 th, .cs_table2 td { border: 1px solid #ddd; font-size: 12px; line-height:1.6em; padding: 10px; font-weight: 400; text-align: center; } .cs_table2 th { background: #f7f7f7; } .cs_table2 th:nth-child(1) { width:35%; } .cs_table2 th:nth-child(2) { width:45%; } .cs_table2 th:nth-child(3) { width:20%; } .cs_table3 { width: 60%; } .cs_table3 th, .cs_table3 td { border: 1px solid #ddd; font-size: 12px; line-height:1.6em; padding: 10px; font-weight: 400; text-align: center; } .cs_table3 th { background: #f7f7f7; } .cs_table3 th:nth-child(1) { width:10%; } .cs_table3 th:nth-child(2) { width:45%; } .cs_table3 th:nth-child(3) { width:45%; } .cs_table4 { width: 60%; } .cs_table4 th, .cs_table4 td { border: 1px solid #ddd; font-size: 12px; line-height:1.6em; padding: 10px; font-weight: 400; text-align: center; } .cs_table4 th { background: #f7f7f7; } .cs_table4 th:nth-child(1) { width:100%; } </style>

MAKINOCHAYA Co., Ltd. (hereinafter the “Company”) has established this Privacy Policy in accordance with relevant laws and regulations to protect the personal information and rights of customers using the website operated by the Company (www.makinochaya.co.kr, hereinafter the “Website”) and to handle related complaints smoothly. The Company has set out the procedures necessary for the continuous improvement of this Privacy Policy, and any amendment to this Privacy Policy will be announced through a notice on the Website (or an individual notice).

Article 1. Purpose of Collecting and Using Personal Information

The Company collects personal information for the following purposes. Collected personal information will not be used for any purpose other than those listed below, and prior consent will be obtained if the purpose of use changes.

①Website membership registration and management

Personal information is collected for identity verification, real-name confirmation, confirmation of intent to join, prevention of fraudulent and unauthorized use by abusive members, confirmation of legal guardian consent when collecting personal information of children under 14, various notices and notifications, and complaint handling in connection with the use of services.

②Provision of goods or services

Personal information is collected for issuing membership cards, accruing and settling points, online reservation services, and similar purposes.

③Use for marketing and advertising

Personal information is collected for providing information on new services and other updates, materials for personalized services, event and marketing planning and management, research and surveys for service development, marketing by phone, SMS, email and DM related to all marketing activities (including those conducted by agents) for products and services of the Company and its partners, and notices of promotions, events and customer appreciation events.

Article 2. Items of Personal Information Collected and Collection Methods

①Information collected when necessary, such as during membership registration and online reservations

Category		Items Collected		Purpose of Collection	Retention Period
Members	Membership Members	Required	Membership card number, CI/DI, I-PIN number, name, ID, password, gender, date of birth, mobile phone number, email address	Use of membership services and identity verification	Until membership withdrawal/withdrawal of consent, or for the legally required period
		Optional	Address
	Website Members	Required	CI/DI, I-PIN number, name, ID, password, gender, date of birth, mobile phone number, email address	Use of membership services and identity verification
		Optional	Address
	SNS Quick Sign-up (Kakao, Naver, Facebook)	Required	Name, gender, age, profile photo	Quick membership sign-up via Kakao, Naver or Facebook account
		Optional	Date of birth, mobile phone number, email address
	Marketing Use	Optional	Name, mobile phone number, email address, address	Notices of benefits and events by phone, SMS, email and DM	Until membership withdrawal/withdrawal of consent, or for the legally required period
Non-members	Online Reservation	Required	Name, mobile phone number	Provision of online reservation services via phone, the Website, Naver Booking and Daily Hotel	Retained for 3 years, then destroyed
Information generated during use of services		Required	Service usage records, access logs, cookies, access IP information, registered branch information, etc.	Service usage statistics, etc.	Until membership withdrawal/withdrawal of consent, or for the legally required period - For cookies, until the browser is closed or the user logs out

②Methods of collecting personal information

- Collected online, such as through membership registration and online reservations on the Website

- Provided by identity verification agencies or partners

- Collected through tools for collecting generated information

Article 3. Retention and Use Period of Personal Information

①The Company retains and uses personal information within the period consented to by the user at the time of collection. However, where retention is required under relevant laws and regulations, the information is retained in accordance with those laws.

②The retention periods of personal information under relevant laws are as follows.

Relevant Law	Reason for Retention	Retention Period
Records of contracts or withdrawal of subscriptions, etc.	Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree	5 years
Records of payment and supply of goods, etc.		5 years
Records of consumer complaints or dispute resolution		3 years
Records of computer communications or internet access	Article 15-2 of the Protection of Communications Secrets Act and Article 41 of its Enforcement Decree	3 months

③As a rule, the Company and its partners destroy members' collected personal information without delay once the purpose of collection or provision has been achieved. However, in the following cases, all or part of the collected member information may be retained for a certain period as an exception.

Information Retained	Reason for Retention	Retention Period
Records of user information after membership withdrawal	Data recovery upon re-registration due to a change of mind; prevention of damage caused by indiscriminate withdrawal and re-registration	90 days
IDs of abusive members after termination of the user agreement	Prevention of repeated fraudulent use by abusive members	90 days

Article 4. Outsourcing of Personal Information Processing

①To provide smoother services to users, the Company outsources personal information processing tasks to external specialized companies as follows.

No	Contractor	Outsourced Tasks
1	PNC World Co., Ltd.	Use of POS services
2	Myelhub	Operation and management of the MAKINOCHAYA website
3	LG U+ Co., Ltd.	SMS sending services
4	WAD Co., Ltd.	Integrated online/offline reservations
5	NICE Information Service	Identity verification (mobile phone)
6	NICE Information Service	Identity verification (I-PIN)

②When entering into an outsourcing contract, the Company specifies in the contract or other documents matters regarding responsibilities, such as the prohibition of processing personal information for purposes other than performing the outsourced tasks, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the contractor, and compensation for damages, and manages and supervises whether the contractor processes personal information securely.

③If the outsourced tasks or the contractor change, the Company will notify users of the changes through this Privacy Policy and proceed with the consent process.

Article 5. Provision of Personal Information to Third Parties

①As a rule, the Company does not provide users' personal information to external parties. However, exceptions are made where there are special provisions in law or where it is unavoidable to comply with legal obligations, as follows.

1. Where the user has given prior consent

2. Where there is a basis in other laws, such as the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Telecommunications Business Act, the Electronic Financial Transactions Act, the Credit Information Use and Protection Act, and the Act on the Consumer Protection in Electronic Commerce, etc.

3. Where the information is provided for statistics, academic research, market research, information provision or notice emails, in a form that does not identify any specific

individual

4. Where the data subject or their legal representative is unable to express their intention, or prior consent cannot be obtained due to an unknown address, etc., and the provision is necessary for the urgent life, physical or property interests of the data subject or a third party

5. Where it is necessary for the investigation of crimes, the filing and maintenance of prosecutions, court trials and the execution of sentences, and due legal procedures have been followed

②To provide better services, users' personal information may be provided to or shared with partners. In such cases, the Company will notify users individually by email and in writing to obtain their consent, and will not provide or share the information with partners if the user does not consent.

③Withdrawal of consent to provision to third parties can be requested from the Operations Support Team of MAKINOCHAYA Co., Ltd. (02-6959-3657), and the information will be destroyed immediately upon withdrawal of consent.

Article 6. Procedures and Methods for Destroying Personal Information

The Company destroys personal information when the purpose of its collection and use has been achieved or the retention period has expired. The procedures and methods of destruction are as follows. However, cases where the personal information must be retained under other laws are an exception.

①Destruction procedure

Information entered by users for membership registration, etc. is stored for a certain period after the purpose has been achieved, for information protection reasons in accordance with internal policies and other relevant laws, and is then destroyed.

②Destruction deadline

Users' personal information is destroyed within 5 business days from the end of the retention period when the retention period has elapsed, and within 5 business days from the date on which processing of the personal information is deemed unnecessary when the information becomes unnecessary, such as when the purpose of processing has been achieved, the relevant service has been discontinued, or the business has ended.

③Destruction method

Personal information printed on paper is destroyed by shredding or incineration. Personal information stored in electronic files is deleted using technical methods that make the records unrecoverable.

Article 7. Rights of Users and Legal Representatives and How to Exercise Them

①Users may withdraw their consent to the collection, use and provision of personal information from the Company at any time. Upon withdrawal of consent, the Company will take necessary measures without delay, such as destroying the collected personal information.

②Users can view and modify their personal information through ‘My Page - Edit My Information’ on the Website, and to cancel their membership (withdraw consent), they can click ‘Withdraw Membership’ and directly view, correct or withdraw after completing the identity verification process. Alternatively, if users contact the Chief Privacy Officer in writing, by phone or by email, the Company will take action without delay after verifying their identity.

③Users may request the Company to view, provide or correct the following matters concerning themselves.

1. Users' personal information held by the Company

2. Status of the use of users' personal information and provision to third parties

3. Status of consents given to the Company for the collection, use and provision of personal information

④If a user requests correction or deletion of errors in their personal information, the Company will not use or provide the personal information until the correction or deletion is completed. In addition, if incorrect personal information has already been provided to a third party, the Company will notify the third party of the correction result without delay so that the correction can be made.

⑤As a rule, the Company does not accept membership registration from children under 14, which requires the consent of a legal representative.

⑥Users may submit requests to view their personal information, etc. to the department below. The Company will make every effort to process such requests promptly.

Inquiries about Viewing Personal Information
Department	Operations Support Team
Main Number	02-6959-3657
Email	hjbv@makinochaya.co.kr

Article 8. Installation, Operation and Refusal of Devices that Automatically Collect Personal Information

①The Company installs and operates devices that automatically collect personal information, such as ‘cookies’, which store and retrieve users' information from time to time. Cookies are small amounts of information sent by the website server to the user's web browser and are stored on the hard disk of the user's computer.

②Users have a choice regarding the installation of cookies. Through their web browser settings, users can allow or refuse all cookies, or require confirmation each time a cookie is stored.

However, if users refuse to store cookies, some services provided by the Company, such as personalized services, may be difficult to use.

-How to refuse cookies

1) Internet Explorer: Tools at the top of the web browser> Internet Options> Privacy> Settings

2) Chrome: Settings on the right of the web browser> Advanced settings at the bottom of the Settings page> Content settings under Privacy and security > Cookies

Article 9. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act and Article 28 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Company takes the following technical, administrative and physical measures necessary to ensure security.

①Personal information processing:

Minimization and training of staff: The Company designates employees who process personal information and limits them to the persons in charge, implementing measures to manage personal information with a minimal number of staff.

②Establishment and implementation of an internal management plan:

The Company has established and implemented an internal management plan for the safe processing of personal information.

③Encryption of personal information:

Users' passwords are encrypted when stored and managed so that only the user knows them, and important data is protected with separate security functions, such as encrypting files and transmitted data or using file lock functions.

④Technical measures against hacking, etc.:

To prevent leakage and damage of personal information caused by hacking or computer viruses, the Company installs security programs and updates and checks them regularly, installs systems in areas where external access is controlled, and monitors and blocks access technically and physically.

⑤Restriction of access to personal information:

The Company takes necessary measures to control access to personal information by granting, changing and revoking access rights to the database systems that process personal information, and controls unauthorized external access using an intrusion prevention system.

⑥Retention of access records and prevention of forgery and alteration:

The Company retains and manages records of access to the personal information processing system for at least 1 year and takes measures to prevent access records from being forged, altered, stolen or lost.

⑦Use of locking devices for document security:

Documents and auxiliary storage media containing personal information are kept in a secure place with a locking device.

⑧Access control for unauthorized persons:

The Company maintains a separate physical storage location for personal information and has established and operates access control procedures for it.

Article 10. Chief Privacy Officer

Users may direct all inquiries, complaints and requests for remedies related to personal information protection arising from the use of the Company's services to the Chief Privacy Officer and the department in charge.

Category	Chief Privacy Officer	Privacy Manager
Name	Han Man-woong	Hwang Jeong-bae
Department	MAKINOCHAYA Co., Ltd. CEO	Operations Support Team
Position	CEO	Deputy General Manager
Email	Coffist.yh@makinochaya.co.kr	hjbv@makinochaya.co.kr
Phone	02-6959-3682	02-6959-3657

Article 11. Remedies for Infringement of Rights

Users may contact the following organizations for remedies and consultation regarding infringement of personal information. (Please use these organizations if you are not satisfied with the results of the Company's own handling of personal information complaints and remedies, or if you need more detailed assistance.)

①Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency)

–Responsibilities: Reporting personal information infringement, applying for consultation

–Website: privacy.or.kr

–Phone: (no area code) 118

-Address: Korea Internet & Security Agency, 9 Jinheung-gil, Naju-si, Jeollanam-do

②Personal Information Dispute Mediation Committee

–Responsibilities: Applications for personal information dispute mediation, collective dispute mediation (civil resolution)

–Website: www.kopico.go.kr

–Phone: 1833-6972

-Address: 12F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul

③Cyber Investigation Division, Supreme Prosecutors' Office

(no area code) 1301, privacy@spo.go.kr (www.spo.go.kr)

④Cyber Bureau, Korean National Police Agency

(no area code) 182 (cyberbureau.police.go.kr)

Article 12. Notice of Changes to the Privacy Policy

This Privacy Policy may be changed due to government policies, laws and regulations, or the Company's needs. If any content is added, deleted or corrected, the Company will give prior notice through a Website posting, email, etc. 7 days before the changes take effect, and if prior notice is difficult, notice will be given as soon as possible. However, if important matters such as the purpose of collecting and using personal information or the recipients of third-party provision are added, deleted or corrected, prior notice will be given 30 days in advance.

View Previous Privacy Policies

LF Food Co., Ltd. Effective 2007.12.15 ~ 2019.01.21

LF Food Co., Ltd. Effective 2019.01.22 ~ 2019.06.30

LF Food Co., Ltd. Effective 2019.07.01 ~ 2021.04.19

[Addendum] Effective date of the Privacy Policy: April 20, 2021