Rotonda Co., Ltd.(hereinafter the “Company”) has established the privacy policy as follows(the “Policy”) in accordance with the Personal Information Protection Act and Act on Promotion of Information and Communication Network Utilisation and Information Protection to protect the rights and interests of the users of the Company’s services and to handle any problems that the users may face in respect of their personal information. ## Article 1(Purpose of Personal Information Management) The Company processes user’s personal information for the following purposes. Processed information will not be used for any purposes other than for the following purposes. The Company will seek prior consent of the persons who are the subject of the personal information (the “Users”) before any change to the intended use is implemented. 1. Membership Registration and Management 1. To confirm the User’s intention to be a registered member; 2. To identify or certify User identity in relation to its provision of membership services; 3. To maintain or manage membership status; 4. To prevent unauthorized use of service; 5. To give public announcement or notice;
2. Provision of Goods and Services 1. Personal Preference; 2. Establish virtual asset wallet address 3. Check virtual asset transfer history; 4. Use of virtual asset trading service; 5. Check exchange asset; 6. Virtual asset deposit and withdrawal settlement; 7. Friends and Virtual asset transmission; 8. Chat with friend; 9. Intermediary of virtual asset exchange services 10. Secure safety and provision safe service; 11. Partner contact service for business partnership; 12. Restriction on violations of law and terms of use;
3. Providing information of event 1. To provide any event-related or advertising information; 2. To develop new services and provide advanced services;
4. Complaint handling 1. To verify the complaining person’s identification; 2. To review complaints; 3. To contact or notify the complaining persons to investigate the cause of the complaints; 4. To notify complaint review results 5. To damage control; 6. To verity the member’s information; 7. To release account inactivated;
5. Recruitment 1. To inform about recruitment and notice; 2. To contact applicant; 3. To examine appointment; 4. To use personnel database; 5. To manage duplicate applicants ;
6. Provision of data for fulfilling statutory obligations 1. Providing data at the request of investigative agencies, courts, taxation authorities, etc. and providing data at the request of damage reports ## Article 2(Personal Information Processing and Retention Period) ① The Company processes and retains personal information during the period permitted by law or agreed by the subject of the information upon collection of his/her personal information. ② Personal information processing and retention periods are as follow: 1. Membership Registration and Management : until User withdraws his/her membership **※ In order to prevent illegal use and damage caused by membership withdrawal and re-registration, user’s personal information is retained for 30 days after membership withdrawal.** 2. Provision of Goods and Services : Until the completion of the provision of goods or services and the completion of payment/settlement in case of expenses(In case of partnership inquiry service for business alliance, 3 months from the date of receipt of inquiry) 3. Information of event : 3 months from the end of the event(In case of notice for marketing information, until the withdrawal of consent to receive marketing) 4. Handling Complaints : during the required period in accordance with the law 5. Recruitment : 2 years from the application(the personal information will be destroyed without delay if there is request of disposal) 6. Provision of data for fulfilling statutory obligations: by the time the case is closed ③ The user's personal information will be destroyed without delay when the purpose of processing under Article 1 and the processing and retaining period under Article 2 (2) are achieved However, in any of the following cases, personal information may be processed and retained until the end of the relevant reason, and if the personal information processing and retaining period is different, the longest period will be applied. 1. Despite the User’s withdrawal of consent, his/her person information may continue to be processed and retained in accordance with applicable laws, including but not limited to the following: | **Items** | **Relevant law** | **Retain period** | | ----- | ------------ | ------------- | | Record of cancellation of contracts or offers to enter into contract | @rows=4:Act on Consumer Protection in Electronic Commerce, Etc. | 5years | | Record of payment and provision of goods and services | 5 years | | Records of customer complaints and dispute settlement | 3 years | | Record of advertisement | 6months | | Records of Electronic Financial Transactions | Electronic Financial Transaction Act | 5 years | | login, contact tracing history | Protection of Communications Secrets Act | More than 3months | | Record of Tax and utility payment | Framework Act on National Taxes | 5 years | 2\. If an investigation/investigation\, etc\. is in progress due to violation of relevant laws and regulations\, until the end of the relevant investigation/investigation 3\. If the bond/debt remains due to the use of the service\, until the settlement of the relevant bond/debt 4\. In case that a legal dispute between the user and the Company\, until the end of the dispute is confirmed ## Article 3(Types of Personal Information Collected) The Company processes the following types of personal information, which are essential for the provision of its services. | @cols=2:**Purpose of collecting and processing of information** | **Personal information to be collected** | **Collect timing** | | --------------------------------------------------- | --------------------------------------------------- | ------------------------------------ | -------------- | | @rows=2:Membership Registration and Management | Registration | (required items) cell phone number, nickname, Burrito ID, password
※ Some countries where an email address is required : (Required) E-mail address, Nickname, Burrito ID, Password | When register as a member | | Log-in, Member management | (optional) Email address
※ Some countries where an email address is required : (option) Phone number | When certificate the email address or phone number | | @rows=4:Provision of Goods and Services | Crypto Friend Transmission | Contacts on mobile device | Upon consent of access authority | | Check exchange asset | authentication information (access token) | When connect exchange accounts | | partnership inquiry for business alliance | (required items) name, email address, inquiry
(optional) name of company, address of homepage | When partner contact | | Establishment and management of wallet | User’s address of Burrito wallet(open key) | When establish wallet | | @rows=2:Event and Marketing | Notice of event and opportunity to participate, new service and marketing information | (optional) cell phone number, email address, specification of device, consent of receiving marketing information | When allow receive marketing information | | Participation and progress of event;
Select the winner and notice | cell phone number, email address, nickname, Burrito ID

Items subject to user consent may be changed depending on the purpose of the event, and if consent is obtained, it is notified.

| When
Participate the event | | Handling Complaints | Review and report the complaint | \*Member :
(required items) name, inquiry content, mobile phone number, e-mail, service usage record, poor or abnormal usage record
(optional) Burrito ID, personal identification information from written and attached by users
\*non-member :
(required items) name, inquiry content
(optional) personal identification information from written and attached by users | When receiving a complaint | | Recruitment | Inform about recruitment,
Contact applicant, examine appointment, use personnel database, manage duplicate applicants | (required items) name, contact, email address
(optional) education, career, personal information(emergency contact), foreign language certification score, qualifications, email address of in-house recommender, field of application, personal identification information from written and attached by applicant(If the consent for each item does not match, it is impossible to process the data, so items written directly or provided through attachments are treated as consent to selective personal information processing. If not, the content can be deleted) | When apply | | fulfilling statutory obligations | Providing data at the request of investigative agencies, courts, taxation authorities, etc. and providing data at the request of damage reports | Requested data | When requested | | Automatically Creation under the service | Service use, Prevention of abusive use | Device information (OS, UUID, language information), service usage history, transaction history, access log, access IP, cookies | When using the service | ## Article 4(Provision of Personal Information to Third Party) ① The Company provides personal information to a third party only when it is permitted by the Personal Information Protection Act; for example, where User gives consent or provision of personal information. ② However, if a user directly agrees to provide personal information to use the services of an external partner, the company is obliged to submit personal information under the relevant laws, and an emergency situation such as an emergency, an infectious disease, an accident, or an urgent loss of property, etc. may be provided to a third party. ## Article 5(Entrustment of Personal Information Processing) ① The Company entrusts certain affairs related to personal information processing as follows in order to smoothly handle such matters:. | **Entrusted party** | **Entrusted affairs** | **Retention and processing period** | | --------------- | ----------------- | ------------------------------- | | Amazon Web Services, Inc. | Data archiving and management | Until the end of the service
(However, in accordance with relevant laws and regulations, separately
Exceptions to archived information) | ② When entering into an entrustment agreement, the Company specifies the following matters in the agreement or in any written form in accordance with Article 26 of the Personal Information Protection Act so that the Council can make sure that the entrusted party handles personal information with safety: · Prohibiting the entrusted party from processing personal information for any purpose other than for the performance of the entrusted affairs; · Technical and administrative measures to protect personal information; · Restricting re-entrustment of personal information processing; · Matters related to managing/supervising the entrusted party; · Liabilities of the entrusted party, including damage compensation. ③ Any change of the entrusted party or content of the entrusted affairs will be immediately disclosed through this Policy. ## Article 6(Data Transfer to Other Countries) ① Considering it engages in global business, the Company may provide the user’s personal information to the companies located in other countries for the purpose as expressly stated in this Policy. ② Company shall notify users of the following matters on privacy policy by Personal Information Protection Act Article 39-12(3). 1. Particulars of the personal information to be transferred; 2. The country to which the personal information is transferred, transfer date and method; 3. Name of the entity to which the personal information is transferred (referring to the name of a corporation and the contact information of the person responsible for the management of information, if the person is a corporation); 4. The purpose of using personal information by the entity to which the information is transferred and the period of retaining and using personal information. ③ For the places where the personal information is transmitted, retained or processed, the Company takes reasonable measures for protecting those personal information. ## Article 7( Disposal of Personal Information) ① When any of the personal information becomes no longer necessary, including by expiration of the retention period or fulfillment of its purposes, the Company disposes of such personal information without delay. ② In case the personal information should be preserved according to applicable laws, the Company will store such information in a separate database and preserve it for the required period of time in accordance with applicable law, and will dispose of it after the required period elapses ③ The Process of disposal of personal information are as follow : 1. The Company identifies personal information that needs to be destroyed, and after obtaining the approval of the Company’s personal information manager or the automatically delete system, destroys such information. 2. The method of disposal of personal information are as follow : Information in electronic form will be destroyed using technical tools so as to make sure that such information will not be reproduced. (However, if permanent deletion is significantly difficult due to technical characteristics, personal information is anonymized and measures are taken so that it cannot be restored) Information in paper form will be destroyed by shredding it with a paper shredder or incinerated. ## Article 8(Measures for disposal of personal information of users who have not use) ① The Company takes necessary measures as destruction to protect the personal information of users who have not used information and communications services for one year. ② Provided, it can be stored and managed separately from other users' personal information until the retention period prescribed by other statutes and regulations elapses. ③ The Company notify users of matters such as the fact that their personal information will be destroyed, the expiration date, and the particulars of personal information to be destroyed by a method such as e-mail, at least 30 days prior to the expiration of the above designated period. ④ If users don't want to destroy personal information, they can log in to the service before the expiration date. ## Article 9(Rights of the Users and legal agent, Method to Exercising such Rights) ① User may at any time exercise the following rights against the Company in order to protect his/her personal information: (1) Right to have access to personal information; (2) Right to request correction of any error; (3) Right to request deletion of information; (4) Right to request discontinuance of personal information processing. Provided, the right to suspend the processing of, and to request correction, deletion, and destruction of such personal information may be limited by Personal Information Protection Act article 35 (4), article 36(1), article 37(2). ② The rights referred to in Paragraph A above may be exercised by the Enforcement Regulation of the Personal Information Protection Act and submitting to the Company by email or phone call or facsimile. The Company will immediately take action upon receipt of such request. ③ The rights referred to in Paragraph A above may be exercised by a legal agent or an authorized representative of the User. In such a case, power of attorney as provided in Form 11 of the Enforcement Regulation of the Personal Information Protection Act must be submitted to the British Council. ④ Users and legal agent can view or correct personal information in Settings > Profile Management > Account Information after logging in to the service. ⑤ That the erasure is not permitted where the said personal information shall be collected by other statutes. ⑥ The Company checks whether the person who made the request for perusal, correction/deletion, and suspension of processing, etc. according to the user's rights is the person who is a legitimate agent. ## Article 10(Measures for protection of personal information) The Company is taking the following measures to ensure the safety of personal information. 1. Administrative Measures 1. Appoint a staff responsible for protecting personal information 2. Establish and execute internal management plan 3. Provide education and training for staffs treating personal information 2. Technical Measures 1. Utilize security servers for transmitting encryption of personal information 2. Take measure of encryption for confidential information 3. Install and operate access control devices and equipment 4. Establish and execute internal management plan 3. Physical Measures 1. Store documents and backing storage containing personal information in safe places which have locking device 2. Establish and operate the procedure for access control for the facilities for storing personal information ## Article 11(Installation and operation of an automatic collection tool for personal information and the denial) ① The Company will operate cookies that will store and retrieve your information from time to time. ② Cookie is a very small text file sent by the Company’s website hosting server to user’s web browser and stored in user’s local computer disk. . 1. Purpose of use of cookies : Cookies on websites do lots of different jobs, like letting you navigate between pages efficiently, storing your preferences and generally improving your experience of a website. 2. Installation and operation of cookies : User have the option of installing cookies. User can opt in/out for cookie installation. User can allow all cookies to be installed, confirmed whenever cookies are stored, or refuse to allow all cookies to be stored by setting web browser options to user’s preference. If user refuses to consent to cookie installation, some services may not be available to user. 3. How to control cookies(Example) 1. PC Web browser 1. Chrome: Select Settings Menu > Select Indicate Advanced Settings> Select Personal Data-Content Setting > Set-Cookie Level 2. Microsoft edge: Go to Tools > Setting > Update and Security 3. Safari: Select Environmental Setting Menu > Click Personal Data Tab > Setting the Level of Cookie and Website Data 2. Mobile 1. Android OS : Click ‘Internet’ icon > ‘Menu’ > ‘Setting’ > Select Personal Data-Content Setting > Set-Cookie Level 2. IOS : ‘Setting’app > ‘Safari’ > ‘Click Personal Data Tab’ > Setting the Level of Cookie and Website Data ## Article 12(Management of Behavior Information) ① In the course of service use, Company collects and uses behavioral information to provide customized services and benefits optimized for information subject. Company does not provide online customized advertisement. 1. Company collects behavioral information as follows. 1. Personal information to be collected: service menu visit history 2. How we collect personal information: collect information when running the service through Google Analytics 3. Purpose of collecting and progressing of information : Service Improvement and Development Based on User Interest Analysis 4. Period of retention and usage : immediate disposal after withdraw the membership 2. Company collects only the minimum behavioral information necessary for service improvement and does not collect sensitive behavioral information that may clearly violate individual rights, interests or privacy, such as thoughts, beliefs, family and relatives, educational background, and other social activities. 3. User can refuse to use Google Analytics through unset Google Analytics ([https://tools.google.com/dlpage/gaoptout](https://tools.google.com/dlpage/gaoptout) ). 4. User can inquire about questions, vetoes, and reports of damage related to behavioral information at the contact information below. 1. Customer Service 1. Name : Lee, Gwanhee 2. Email Address : help@burritowallet.com 3. Homepage : Home > Support 4. App : Settings > Inquiring ## Article 13(Chief Privacy Officer and Request to Review Personal Information) ① The Company appoints a Chief Privacy Officer who is responsible for all affairs relating to personal information processing, and handling complaints raised by the Users and remedy of damages incurred in relation to personal information processing. * Chief Privacy Officer * Name : Lee, Kwansoo * Phone number : 02-6956-2504 * Email address : [kslee@burritowallet.com](mailto:kslee@burritowallet.com) ② User may request the following division to allow review of his/her personal information in accordance with Article 35 of the Personal Information Protection Act. The Company will do its best to handle such requests as promptly as possible. * Customer Service * Name : Lee, Gwanhee * Email Address : [help@burritowallet.com](mailto:help@burritowallet.com) * Homepage : Home > Support * App : Settings > Inquiring ③ User may direct all personal information related questions or complaints to the Personal Information Manager and the Management staff. The Company will promptly respond to such enquiries. ## Article 14(Remedy for Infringement on Rights and Interests of Users) User may inquire at the following institutions regarding remedy of damages arising from infringement of personal information, if not fully satisfied with the service of the Council in handling complaints related to personal information. 1. Personal Information Dispute Mediation Committee (operated by Korea Internet & Security Agency) : 1833-6972 ([www.kopico.go.kr](http://www.kopico.go.kr)) 2. Personal Information Protection Centre (operated by Korea Internet & Security Agency) : 118 ([privacy.kisa.or.kr](http://privacy.kisa.or.kr)) 3. Cybercrime Investigation Department of the Supreme Prosecutors’ Office : 1301 ([http://www.spo.go.kr](http://www.spo.go.kr)) 4. Korean National Police Agency Cyber Bureau : 182 ([http://ecrm.cyber.go.kr](http://ecrm.cyber.go.kr) ) ## Article 15(Changes in the Personal Information Management Policy) ① This personal information processing policy will be applied from 10. 31. in 2023. ② The previous privacy policy can be found at the top of the document.