Privacy

1. Scope of this Privacy Policy

This policy applies to personal information that Blueberry Bee (the “Company”) processes through:

1. The Blueberry Bee website and services operated by the Company;
2. Mobile and web applications;
3. Mobile wedding invitations and other digital production services;
4. Image restoration and editing services;
5. Website, application, and software development and maintenance;
6. Consultations, estimates, contracts, payments, and customer support;
7. Communications by email, telephone, messenger, inquiry form, or similar means; and
8. Other online or offline services directly operated by the Company.

Personal information collected independently by an external platform or third-party service may be subject to that provider’s privacy policy.

2. Principles for Processing Personal Information

The Company follows these principles:

1. Process only the personal information necessary to provide its services.
2. Identify the purpose of processing and use information within that purpose.
3. Do not collect unnecessary high-risk information, such as resident registration numbers, bank-account passwords, or certificate passwords.
4. Destroy information promptly when its retention period ends or its purpose has been fulfilled.
5. Keep information that must be retained by law separately.
6. Respect individuals’ rights and handle related requests as required by law.
7. Manage and supervise service providers entrusted with personal-information processing.
8. Meet applicable legal requirements before transferring personal information overseas.

3. Purposes of Processing

The Company may process personal information for the following purposes.

3.1 Inquiries and consultations

• Receiving service inquiries;
• Providing consultations and responses;
• Preparing estimates;
• Confirming requirements before a contract;
• Managing consultation history; and
• Handling disputes and inquiries.

3.2 Contract formation and performance

• Identifying the customer or contact person;
• Entering into orders and contracts;
• Confirming the scope of work;
• Providing services and delivering work;
• Handling revisions, reviews, and approvals;
• Sending contract-related notices; and
• Billing and settling contract payments.

3.3 Production and development by service

• Reflecting customer requirements;
• Creating customized content;
• Developing websites, applications, and software;
• Processing images, documents, and media;
• Testing and quality review;
• Delivering work; and
• Operating and maintaining services.

3.4 Payments and accounting

• Receiving service payments;
• Handling refunds and cancellations;
• Issuing tax invoices, cash receipts, and other records;
• Accounting and tax administration; and
• Retaining transaction records required by law.

3.5 Customer support and disputes

• Receiving reports of outages, errors, and complaints;
• Providing technical support;
• Checking contract history;
• Preventing misuse;
• Responding to legal disputes; and
• Handling reports of rights violations.

3.6 Security and quality improvement

• Detecting unusual access;
• Maintaining service stability;
• Analyzing errors and logs;
• Producing statistics and improving quality; and
• Responding to security incidents.

3.7 Marketing and updates

Only with separate consent, the Company may process optional personal information to provide news about new services, events, promotions, newsletters, or personalized advertising. Marketing consent is not required to use the services and may be withdrawn at any time.

4. Categories of Personal Information and Grounds for Processing

Depending on the service and the choices made by the individual, the Company may process the following information.

Important

1. The Company does not request personal information that a service does not need.
2. The information actually collected for each service can be checked again on the relevant application or order screen.
3. Before processing information not already disclosed here for a new service, the Company will provide notice or obtain consent as required by law and update this policy.

5. Unique Identification and Sensitive Information

1. As a rule, the Company does not collect unique identification information such as resident registration numbers.
2. As a rule, the Company does not collect sensitive information such as health information, beliefs, union membership, or information about sexual life.
3. If processing such information is unavoidable for a service, the Company will confirm the legal basis and apply any required separate consent and safeguards.
4. Users should not send sensitive or unique identification information that the Company has not requested.

6. Personal Information About Third Parties Supplied by Customers

1. A customer may provide names, photos, contact details, or other personal information about family members, employees, customers, wedding guests, models, or other third parties for a project.
2. The customer must have the lawful authority or consent needed to provide that information to the Company for processing under the contract.
3. The Company processes such information only within the purposes of the contract.
4. If third-party information is unnecessary, the Company may ask that it be masked, deleted, or replaced.
5. If a dispute arises because the customer provided such information without the required authority or consent, the customer is responsible to the extent attributable to them.

7. Information Entrusted by Business Customers

1. When the Company handles a business customer’s customer database, member information, or other personal information for development or maintenance, it may act as that customer’s personal-information processing service provider.
2. The purpose and scope of processing, security measures, subcontracting, and destruction may be set out in a separate processing agreement or individual contract.
3. The business customer must have a lawful basis to entrust the information to the Company.
4. The Company does not use entrusted information outside the entrusted purpose.

8. Personal Information of Children Under 14

1. The Company generally does not intend children under 14 to be direct contracting customers.
2. If a service requires direct collection of a child’s personal information, the Company will follow applicable procedures, including consent from a legal guardian where required.
3. A customer providing a child’s photo or other information for a project must obtain the necessary authority and consent.

9. Processing and Retention Periods

The Company generally retains personal information until its collection or use purpose has been fulfilled, unless a law requires further retention.

9.1 General retention standards set by the Company

9.2 Statutory retention for e-commerce records

The following records may be retained under laws governing electronic commerce.

9.3 Tax and accounting records

Tax invoices, transaction evidence, and other necessary records may be retained for the statutory periods under tax and other applicable laws.

9.4 Separation of legally retained information

Personal information retained under another law is not used for other purposes and, where possible, is kept separately from general operational information.

10. Destruction Procedures and Methods

1. The Company destroys personal information promptly when it is no longer needed because a retention period has ended or its purpose has been fulfilled.
2. Information that must be retained by law is kept separately for the required period and then destroyed.
3. Electronic files are deleted using methods that make recovery or reproduction difficult.
4. Paper documents are shredded, incinerated, or otherwise appropriately destroyed.
5. Where an external service provider processed the information, the Company may request and verify destruction under the contract and applicable law.
6. Merely hiding information from a service screen does not constitute destruction.

11. Disclosure to Third Parties

1. As a rule, the Company does not disclose personal information to third parties beyond the purpose of processing.
2. Disclosure may occur where permitted by law, including when the individual separately consents, a law specifically provides for it, a lawful basis supports disclosure needed for contract performance, or a court, investigative agency, or administrative authority makes a lawful request.
3. Where disclosure is necessary, the Company will provide notice of, or obtain consent for, the recipient, purpose, categories, retention period, and other details required by law.
4. Entrusting processing to a service provider is distinguished from disclosure to a third party and is described below.

12. Entrusted Processing

The Company may entrust part of the processing needed to provide its services to external providers.

The following table must be revised to match actual operations before publication.

When entrusting processing, the Company manages restrictions on use outside the entrusted purpose, technical and administrative safeguards, subcontracting, access controls, supervision, and return or destruction after the purpose ends. Changes to service providers will be disclosed in this policy.

13. Overseas Transfer of Personal Information

13.1 General principle

The Company complies with the lawful grounds and procedures under the Personal Information Protection Act when transferring personal information overseas.

13.2 Information to disclose if an overseas transfer occurs

If personal information is stored or processed overseas through a foreign cloud, analytics, AI, email, or collaboration provider, the following details must reflect actual operations.

13.3 Operational notes

1. If there is no overseas transfer, remove the table and state the actual position accordingly.
2. Overseas processing or storage needed for contract performance still requires the disclosures or notices prescribed by law.
3. Where an individual may refuse an overseas transfer, the method of refusal and its effects must also be explained.

14. Payment Information

1. Where possible, core payment details such as full card numbers and bank-account information are processed directly by a payment processor or financial institution.
2. The Company generally does not store full card numbers, card passwords, or similar details that it does not need to retain.
3. The Company may process payment status, approval number, amount, date and time, and other information needed for transaction management and settlement.
4. Payment processors actually used are disclosed in the entrusted-processing section of this policy.

15. Automatically Collected Information, Cookies, and Similar Technologies

The following information may be generated or collected when a service is used: IP address, access date and time, browser and operating system, device details, pages visited, error or security logs, and cookies or similar identifiers.

The Company may use this information to provide services and maintain sessions, detect unusual use, prevent security incidents, analyze errors, produce usage statistics, and improve services.

Rejecting cookies

Individuals can restrict or delete cookies through browser settings. Blocking necessary cookies may affect some features.

Analytics and advertising tools

If tools such as Google Analytics, Naver Analytics, or Meta Pixel are used, the Company discloses the actual tools, categories collected, purposes, and opt-out methods here or in a separate notice.

[Confirm and list any analytics or advertising tools actually used.]

16. Processing with AI and Automation Tools

1. The Company may use AI or automation tools to provide services, develop software, create content, analyze information, automate work, or improve quality.
2. If personal information must be entered into an external AI service, the Company limits it to the minimum necessary and confirms a lawful basis.
3. As a rule, the Company does not enter sensitive information, unique identification information, or unnecessary confidential information into external AI services.
4. Where an external AI provider is an entrusted processor, the Company discloses the entrusted processing and any required overseas-transfer information.
5. The Company does not provide customer personal information to an unrelated third party for model training without authorization. Any separate use requires a lawful basis.

17. Pseudonymized or Anonymous Information and Statistics

1. The Company may use statistical information that does not directly identify a person to improve quality, produce statistics, or conduct internal analysis.
2. Anonymous information may be used when it has been appropriately processed so that individuals cannot be identified.
3. Where pseudonymized information is processed under law, the Company applies the safeguards required by law.
4. Statistical purposes do not justify retaining unnecessary directly identifying information for long periods.

18. Rights and How to Exercise Them

Individuals may exercise rights available under applicable law, including the right to confirm processing and request access, correction or deletion, suspension of processing, withdrawal of consent, transfer of personal information where recognized by law, and objection to processing.

Requests may be made through the customer inquiry email or the privacy contact listed below. The Company may take reasonable steps to verify the requester’s identity. Rights may be limited where another law requires retention, a request would unfairly harm a third party’s rights or interests, identity cannot be verified, or another lawful restriction applies.

19. Users’ Responsibilities for Personal Information

1. Users should protect their accounts, passwords, authentication methods, and personal information.
2. Users providing another person’s personal information to the Company must have lawful authority to do so.
3. Where users can control which information is public in a service, they should review those settings.
4. The Company may not be liable for damage outside its attributable responsibility caused by a user’s intentional or negligent disclosure.

20. Safeguards for Personal Information

The Company applies measures appropriate to its size, the nature of the information, and the level of risk.

20.1 Administrative measures

• Minimizing access privileges;
• Establishing standards for handling personal information;
• Training personnel where necessary;
• Managing and supervising service providers; and
• Maintaining security-incident response procedures.

20.2 Technical measures

• Managing accounts and access privileges;
• Using strong authentication for important accounts;
• Encrypting data in transit;
• Managing vulnerabilities and updates;
• Managing logs and security records reasonably; and
• Encrypting important information where necessary.

20.3 Physical measures

• Controlling access to equipment holding personal information; and
• Safely storing and destroying paper records and storage media.

The Company may continue to improve safeguards according to the scale and risks of processing.

21. Response to Personal-Information Incidents

1. If a leak, loss, theft, or damage is confirmed or suspected, the Company investigates and takes steps to limit further harm.
2. Where law requires notice or reporting, the Company informs affected individuals or authorities within the prescribed procedures and periods.
3. Where an incident occurs at an external provider, the Company cooperates with that provider as needed.

22. Consent to Marketing Communications

1. The Company obtains consent required by law before sending promotional information.
2. Marketing consent is optional where it is unrelated to the essential provision of a service.
3. Individuals may withdraw marketing consent at any time.
4. Essential transaction or service notices about delivery, contract performance, security, payment, or policy changes may be sent separately from marketing.

23. Privacy Officer and Contact Details

The Company designates the following person or contact point to oversee personal-information processing and handle inquiries, complaints, and requests for redress.

Privacy inquiries may be submitted through these contact details.

24. Requests for Access to Personal Information

Individuals may use the contact details in Section 23 to request access, correction, deletion, or suspension of processing. The Company verifies identity and the request, then responds under applicable law. An authorized representative may be asked to provide proof of authority.

25. Remedies for Privacy Violations

For advice or dispute resolution, individuals may contact the following independent bodies:

1. Personal Information Dispute Mediation Committee: 1833-6972 (within Korea);
2. Personal Information Infringement Report Center: 118 (within Korea); or
3. Korean National Police Agency Cybercrime Reporting System: 182 (within Korea).

For inquiries directly to the Company, use the contact details in Section 23.

26. External Sites and Links

1. Company services may link to websites, payment pages, social media, or other resources operated by third parties.
2. After a user leaves a Company service, that third party’s privacy policy applies to its processing.
3. The Company does not directly control the third party’s processing practices.

27. Changes to this Policy

1. The Company may revise this policy following changes to law, service structure, actual processing, or security policy.
2. For material changes, the Company provides notice of the effective date and changes on its website or by another appropriate method, in advance or at the time required by law.
3. Changes requiring separate consent under law, including changes to purposes, categories, third-party disclosures, or overseas transfers, are not authorized merely by changing this policy.
4. Earlier versions may be retained for access where necessary.

Supplementary Provision

Effective date

This Privacy Policy takes effect on September 26, 2026.