Privacy Policy

• Membership registration (required): email address, password (for self-registration), name, mobile phone number, date of birth (age verification), gender.
• Athlete registration: name, email, mobile number, and gender of each of the two team members.
• Payment: payment method information (processed by the payment gateway), order and transaction records.
• Competition photographs and video (portrait/likeness information): photos, video, and audio of athletes, spectators, and other participants may be captured during the competition. Purposes include providing athlete photo packages and promoting/documenting the competition. Athletes must provide mandatory consent to the use of their likeness and media at the time of registration (Competition Terms §8); spectators and other on-site visitors are notified via posted signage at the venue.
• Optional: marketing consent information, consent to provision to third parties (sponsors).
• Automatically collected: access logs, cookies, etc.

Cookies are used to maintain login sessions and to analyze service usage statistics. Users may refuse the storage of cookies through their web browser settings; however, doing so may limit the use of certain services, such as login.

Member identification and management; competition registration and ticket issuance (QR); payment and refunds; customer support; competition operations and safety notifications; competition photography/videography and provision of athlete photo packages, competition promotion and documentation; (upon consent) marketing and provision to third parties.

• General rule: until membership withdrawal or consent is revoked.
• Statutory retention (Act on Consumer Protection in Electronic Commerce, etc.): records of contracts and order cancellations — 5 years; records of payment and supply of goods — 5 years; records of consumer complaints and dispute resolution — 3 years; records of advertising — 6 months.

Each category of data is destroyed without delay once the retention period above has elapsed. Where retention is required by applicable law, such data is stored separately from other personal data for the corresponding period.

The Company delegates personal data processing to the following parties to facilitate service delivery: Toss Payments (payment processing), PayPal (overseas USD payment processing), AWS (email delivery and infrastructure operation), Solapi (KakaoTalk notification delivery), Kakao (social login), and OurSymbol (competition photography and AI face-classification-based personal photo delivery).

Because OurSymbol's AI face-classification-based photo delivery involves processing facial-feature information, the Company obtains separate consent from the data subject for such processing.

The Company transfers personal data outside Korea as follows (recipient / destination country / categories transferred / date and method of transfer / purpose of use).

• PayPal: United States / payment identification data (email, transaction records) / transmitted over the network at the time of overseas (USD) payment / overseas payment processing.
• AWS (Amazon Web Services): United States and others / email and service usage records / transmitted over the network for email delivery and infrastructure operation / cloud infrastructure operation and email delivery.

Data subjects may refuse consent to cross-border transfer; however, refusal may limit the use of certain services, such as overseas payment.

The Company provides personal data to third parties solely where the data subject has given separate, explicit consent. There is currently no third party that receives personal data; if the Company enters into a partnership with a sponsor or similar party in the future, it will obtain the data subject's consent before any provision and will disclose in advance the recipient, the purpose, the categories of data, and the retention period.

Data subjects may at any time request access to, correction of, deletion of, or suspension of processing of their personal data. The Company will take action without undue delay in accordance with applicable law.

The Company will promptly destroy personal data once the retention period has elapsed or the purpose of processing has been fulfilled.

Information in electronic file form is permanently deleted using a method that renders it irrecoverable, and information recorded on paper is shredded or incinerated.

The Company implements administrative and technical measures to ensure the secure processing of personal data, including access controls, encryption, and access-log management.

• Name: Jaeseong Park
• Title: SW Engineer
• Contact: jason.park@pnutbtr.com

Data subjects may direct any inquiries, complaints, or requests for remedy regarding personal data to the Data Protection Officer, and the Company will respond and take action without undue delay.

Any additions, deletions, or modifications to this Policy will be announced via the Service interface prior to taking effect.