Privacy Policy

1. Personal Information We Collect

The Company collects the following information during organization registration, login, quotation/payment, and inquiry processes.

For card payments, payment instrument information such as card number, expiration date, and password is collected and processed directly by the payment gateway (PG). The Company does not receive or store it. The Company stores only the minimum information needed to confirm transactions, such as payment method (card/bank transfer/deferred), authorization number, approved amount, and timestamp.

The Company does not collect information such as ideology or beliefs, labor-union membership, political opinions, health information, or information about sexual life — sensitive information is not collected. The Company also does not collect unique identification information such as resident registration numbers. A business registration number identifies a corporation or organization and is not treated as unique identification information.

2. Purposes of Collection and Use

• Organization verification · member management — verify organization eligibility (apply youth-organization pricing), identify administrators, prevent misuse
• Service provision — provision and apply software licenses, create and migrate accounts, issue quotations, provision and operate Google Workspace
• Payment · settlement — process purchase and renewal payments, issue tax invoices and transaction documents
• Notices · support — expiration and renewal guidance, service notices, inquiries and incident response
• Service improvement — improve functionality by analyzing usage statistics (processed after removing identifying information)

3. Retention and Use Period

The Company destroys personal information without delay once the collection/use purpose has been achieved. However, the following information is retained for the periods required by applicable law.

4. Provision of Personal Information to Third Parties

The Company does not use personal information beyond the purposes stated in this Policy or provide it to third parties, except in the following cases:

• The data subject has separately consented in advance
• License provisioning request to a software Vendor — due to the nature of procurement, the email address of the user receiving the license and the organization name are provided to the relevant Vendor. The provided items, purpose, and retention period are disclosed by product when the quotation is finalized. If the data subject does not consent, provisioning of that product may be restricted.
• Where specifically permitted by law or requested by an investigative authority in accordance with procedures and methods prescribed by law

5. Outsourcing of Personal Information Processing

The Company outsources personal information processing as follows to provide Services smoothly and specifies responsibilities for secure management, restrictions on sub-processing, damages, and related matters in outsourcing agreements.

Card payment is not offered yet, so no work is outsourced to a payment gateway. When card payment starts, the gateway will be added to this table before it is used. Changes to processors or outsourced work will be disclosed through this Policy.

6. Overseas Transfers of Personal Information

Many software products handled by the Company are supplied by overseas businesses. Personal information may be transferred overseas as follows for license provisioning.

Transfers to Cloudflare and Resend are necessary to operate the site and accounts, so if you refuse them you cannot use sign-up, sign-in, inquiries or quotations. You can refuse by contacting the privacy officer. For software Vendors, the recipient's legal name and contact information, destination country, transfer timing, and transfer method are specifically disclosed by product at the quotation stage when the purchased product is finalized. Data subjects may refuse overseas transfer. However, refusal may make it impossible to provision a license for the relevant product. In accordance with Article 28-8 of the Personal Information Protection Act, the Company ensures through contracts and other measures that recipients implement necessary protections for personal information.

7. Personal Information of Children Under 14

The Company does not directly collect personal information of children under 14 from the data subject. However, organizations using the Youth Organization Edition may request account provisioning for program participants (youth). In such cases, the following standards apply.

• Responsibility for obtaining consent to collect and use participant personal information rests with the relevant organization. For children under 14, the organization must obtain consent from a legal representative in advance.
• The Company processes only the minimum information required for account provisioning (name or identification ID, affiliated organization) and does not separately collect information beyond the roster submitted by the organization.
• When an account is no longer needed because a program has ended or for another reason, the Company deletes the account and related information without delay at the organization's request.
• Legal representatives may request access, correction, deletion, or suspension of processing of the child's personal information.

8. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Data subjects may exercise the following rights regarding their personal information at any time:

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing

Rights may be exercised in writing or by email (privacy@youthon.kr), and the Company will act without delay. Requests may also be made through a legal representative or authorized agent. However, requests may be restricted where information must be retained by law or where the request may unjustly infringe another person's life, body, or property; in such cases, the Company will promptly notify the data subject of the reason. After logging in to My Page, users can directly view and delete organization/administrator information, issued quotation history, and organization verification status.

9. Destruction Procedures and Methods

• Destruction procedure — personal information whose processing purpose has been fulfilled or retention period has expired is destroyed through procedures established by internal policy and applicable law. Where retention is required by law, the information is moved to a separate database or stored in a different location.
• Destruction method — electronic files are permanently deleted in a manner that prevents recovery or restoration, and paper documents are shredded or incinerated.

10. Measures to Ensure Security of Personal Information

• Administrative measures — establish and implement internal management plans, minimize personnel handling personal information and provide regular training, manage access permissions
• Technical measures — TLS encryption on every connection, one-way hashing of passwords (PBKDF2-SHA-256), hashing of sign-in link and session values, separate-key encryption of provisioned account passwords (AES-256-GCM), two-factor authentication for the admin console, private storage for verification documents, and retention of access logs
• Physical measures — access control for data-storage systems and physical document-storage locations

11. Cookies and Other Automatic Collection Technologies

The Company uses cookies only to keep you signed in and to protect the sign-in process. Cookies are small pieces of information stored in the browser. Users can refuse or delete cookies through browser settings; if cookies are refused, functions that require sign-in cannot be used.

Visit statistics are collected without cookies (Cloudflare Web Analytics). Cart and quotation settings and the language choice are kept only in the browser's storage and are sent to the server when a quotation is issued.

The Company does not collect behavioral information for personalized advertising and does not use third-party tracking tools for advertising purposes.

12. Automated Decisions

The Company does not use personal information to make automated decisions that have legal effects or similarly significant effects on data subjects. If such decisions are introduced in the future, the Company will disclose in advance the criteria, procedures, and methods for refusing or requesting an explanation through this Policy.

13. Privacy Officer and Access Requests

The Company designates the following privacy officer to oversee personal information processing and handle complaints and remedies relating to personal information.

Data subjects may contact the privacy officer regarding any privacy-related inquiry, complaint, or request for remedy arising from use of the Services, and the Company will respond and act without delay.

14. Remedies for Rights Violations

Data subjects may request dispute resolution or counseling from the following organizations for remedies relating to personal-information infringement.

In addition, if rights or interests are infringed by an administrative disposition or omission of a personal-information controller, an administrative appeal may be filed under the Administrative Appeals Act.

15. Changes to This Privacy Policy

This Policy applies from its effective date. If additions, deletions, or amendments are made because of changes in law, policy, or security technology, notice will be provided at the top of this page and to registered administrator emails beginning 7 days before the effective date of the change ( 30 days before changes that materially affect data-subject rights). Previous versions will be retained and made available on request.

Revision history

• Version 1.1 (October 6, 2026) — Sales opened. Removed Amazon Web Services from the processor and overseas-transfer lists (hosting consolidated on Cloudflare), designated the privacy officer, added refund account information, and corrected cookies and technical measures to what is actually applied.
• Version 1.0 (August 22, 2026) — Draft before sales opened.