Privacy Policy of NOL World
Nol Universe Co., Ltd. (the “Company”) complies with all applicable laws and regulations to protect your personal information, and makes its best efforts to protect your personal information. The Company informs you of the purpose and method of using your personal information and of the measures taken to protect your personal information by disclosing this Privacy Policy. This Privacy Policy may be modified by amendments to applicable laws and regulations or the Company’s internal policy. Please check this Privacy Policy from time to time when you sign up for membership or use our website.
1. Personal Information to be Collected
The Company collects and processes the minimum personal information necessary for the usage of the services from users.
| Legal Basis | Purpose of Collection and Use | Items of Personal Information to be Collected | Period of Retention and Use |
|---|---|---|---|
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | Sign up for membership | when using email ▫ ID (email), password, and name (nickname) when using another service account such as Google, LINE, Apple ▫ ID and name (nickname), public profile information (photo and email) | To be destroyed immediately upon withdrawal from membership |
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | When a child under 14 years of age signs up for membership, confirming the consent of his/her guardian | Name, Date of birth, and email of his/her guardian | To be destroyed immediately upon withdrawal from membership |
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | Customer consultation, receipt and processing of complaints | Name, Reservation number, email and details of consultation | 3 years |
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | User identification and verification of identity for accommodation reservation | Reservation name, email, (if required) Guest name | To be destroyed immediately upon withdrawal from membership |
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | User identification and verification of identity for ticket (and accommodation) reservation | Name, Date of birth, Email, (if required) Passport expiration date, Nationality, Photo, Mobile phone number | To be destroyed immediately upon withdrawal from membership |
| Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act | User identification and verification of identity for tours and activities reservation | Name, Email, Nationality Code, Mobile phone number, (if required) Date of birth, Messenger ID(WhatsApp, LINE, KakaoTalk, WeChat, Facebook, Telegram), Nationality, Mobile phone model, Gender | To be destroyed immediately upon withdrawal from membership |
| Article 24, Paragraph 1, Item 1 of the Personal Information Protection Act | User identification and verification of identity for Play&Stay、T&A reservation | Passport number | To be destroyed immediately upon withdrawal from membership, or until the end of the service. |
| Article 15, Paragraph 1, Item 1 of the Personal Information Protection Act | Provision of other marketing information | Name, email | To be destroyed immediately upon withdrawal from membership or Until the consent is withdrawn |
| Article 15, Paragraph 1, Item 1 of the Personal Information Protection Act | Provision of Location Information-Based Services | Location Information | To be destroyed immediately after checking the current location |
As the Company collects the minimum amount of information in the course of membership sign-up use of the services, additional personal information may be collected only from the users of the relevant services in the course of using individual services, joining events and applying for prizes. When collecting additional personal information, the Company informs users of the “items of personal information to be collected, purpose of collection and use of personal information, and retention period of personal information” at the time of collection of such personal information and obtains consent from them.
We collect and use personal information to the minimum extent possible, even when users use the service without separate registration.
| Legal Basis | Purpose of Collection and Use | Items of Personal Information to be Collected | Period of Retention and Use |
|---|---|---|---|
| Article 15, Paragraph 1, Item 1 of the Personal Information Protection Act | Reviewing partnership proposals and communicating with partners, responding to and replying to related inquiries | Contact Person's Name and Title, Contact Person's Email | 3 months |
| Article 15, Paragraph 1, Item 1 of the Personal Information Protection Act | Customer consultation, receipt and processing of complaints | Name, Reservation number, email and details of consultation | 3 years |
2. Method of Collection of Personal Information
The Company collects the minimum personal information necessary in the course of signing up for membership and using the services by way of direct input from users, and collects additional information in the course of using paid services such as product reservation. Such information may also be collected through webpage, e-mail, fax, phone call, etc. in the process of consulting with the customer center.
In the event of collection of personal information, the Company obtains the user’s prior consent to “collection and use of personal information”; provided, however, that IP address, cookies, device information, etc. may be automatically generated and collected in the process of using the services via PC web or mobile web/app.
3. Use of Personal Information Collected
The Company uses personal information only for the following purposes, including membership management, development, provision and improvement of services, and establishment of safe environment for use of services:
- Personal information is used for the purpose of confirming intention to join membership, verifying age, obtaining consent from legal representative, verifying identity of the user and his/her legal representative, identifying the user, confirming intention to withdraw from membership and managing members.
- In addition to the provision of content and services (including advertising), personal information is used to analyze demographics, analyze service visits and usage records, create user-to-user relationship based on personal information and interests, provide customized services based on acquaintances and interests, identify new service elements and improve existing services.
- Personal information is used for protection of users and operation of services, by means including measures to restrict use against users who violate the laws and regulations and NOL World Terms of Service, prevention of and sanctions against acts that interfere with smooth operation of services, including fraudulent use, prevention of account theft and fraudulent transactions, communication of notices such as amendment of the terms and conditions, record preservation for dispute resolution and handling of complaints.
- Personal information is used to perform contracts on the provision of services and settle fees for the provision of services, reserve travel products, provide content, make purchases and payments, send notices of reservation details, verify identity for financial transactions and provide financial services.
- Personal information is used for marketing and promotion purposes such as provision of event information and opportunities to participate and provision of advertising information.
- Personal information is used for analysis of service usage records and access frequency, statistics on service usage, provision of customized services and advertising based on service analysis and statistics.
- Personal information is used to establish a service usage environment where users feel at ease when using in terms of security, privacy and safety.
4. Installation, Operation and Refusal of Automatic Personal Information Collecting Device
What is a cookie?
- The Company uses “cookies” that frequently store and retrieve the user’s information to provide personalized and customized services.
- Cookies are very small text files sent from a server used to operate a website to the user’s browser and stored on the hard disk of the user’s computer. If the user visits the website again, the website server reads the contents of the cookies stored in the user’s hard disk to maintain the user’s settings and provide customized services.
- Cookies do not collect personally identifiable information automatically or actively, and users can refuse or delete the storing of cookies at any time.
Purposes for which the Company uses cookies
- The Company stores settings, etc. preferred by the user through cookies to support a faster web environment for users and to improve the service for convenient use.
- The Company uses cookies to analyze the records of service usage, such as access frequency, visit time and number of visits, to identify the user’s preferences and interests, and to use them for providing the services.
Installation, operation and refusal of cookies
- Users may refuse to store cookies through web browser settings; provided, however, that if users refuse to store cookies, they will be required to enter member ID and password again when using services that require log in.
- Please refer to [5. Matters Concerning Collection, Use, Provision, Refusal, etc. of Behavioral Information] for methods to determine whether or not to allow the installation of cookies.
5. Matters Concerning Collection, Use, Provision, Refusal, etc. of Behavioral Information
- Behavioral information refers to information on online user activities that enables the identification and analysis of the user’s concern, interest, preferences, preferences, etc., such as website visit history, app use history and purchase and search history.
- The Company collects and uses behavioral information as follows:
| Items of Behavioral Information Collected | User’s history of visits to and use of web/app services, search history, purchase history, and advertisement identifiers |
|---|---|
| Method of Behavioral Information Collection | Automatically collected through log information analysis tool (Google Analytics, Firebase) at the time of user’s usage of the services |
| Purpose of Collection of Behavioral Information | Development of products and services, improvement of products and services, and provision of customized advertising and services |
| Period of Retention and Use and Method of Data Processing Thereafter | Retained and used until membership withdrawal, and retained and used only for statistical purposes by taking de-identification measures after the expiration of the retention period |
- Users have an option to block the Company’s collection and use of behavioral information, which can be done in the following methods:
- The menu or the methods may vary depending on the mobile OS version.
[Web browser]
- Chrome: "⋮" > New Secret Window (short key: Ctrl+Shift+N)
- Edge: "…" > New InPrivate Window (short key: Ctrl+Shift+N)
- Safari: "File" > New Privacy Window (short key: shift+command+N)
[Smartphone]
- Chrome: "⋮" > New Secret tab
- Edge: "≡" > New InPrivate tab
- Safari: "Start Page" > Private
Samsung Internet: "Tap" > Turn on Secret Mode
Inquiry method and damage relief with respect to behavioral information
- If you have any inquiries or complaints regarding the processing of behavioral information, please contact us below and we will actively respond.
[Complaint Handling Center]
- E-mail: help.global@nol-universe.com
- Tel: 02-3483-0224
6. Provision and Entrustment of Personal Information
[Provision]
- The Company uses personal information within the scope notified in Collection/Use of Personal Information.
- The Company may share personal information with third parties after informing the user for the smooth provision of services. The types of information shared are as follows:
<Domestic>
| Legal Basis | Recipient | Purpose of Use by Recipient | Items of Personal Information to be Provided | Period of Retention and Use |
|---|---|---|---|---|
| Article 17, Paragraph 4 of the Personal Information Protection Act | Accommodation service provider [List] | Provision of reserved or purchased goods and services and fulfillment of contracts (verification of user and usage information), handling of complaints, etc., consumer dispute resolution | Reservation number, Reservation name, email (if required) Guest name | 5 years (Article 6 (1) 2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.) |
| Article 17, Paragraph 4 of the Personal Information Protection Act | Tour partners [List] | Confirmation of intent, payment refund, and customer service regarding tour/ticket reservation processing and withdrawal | Name, Email, Nationality Code, Mobile phone number, (if required) Date of birth, Messenger ID(WhatsApp, LINE, KakaoTalk, WeChat, Facebook, Telegram), Nationality, Mobile phone model, Gender | 5 years (Article 6 (1) 2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.) |
| Article 24, Paragraph 1, Item 1 of the Personal Information Protection Act | Tour partners [List] | User identification | Passport number ※ Only for select products | 5 years (Article 6 (1) 2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.) |
| Article 17, Paragraph 4 of the Personal Information Protection Act | Ticket partners [List] | Customer guidance regarding on-site ticket issuance, change of casting, and cancellation of performance, To identify legitimate ticket reservations and execute related tasks, etc. | Name, ID, Mobile Phone No., Email, Date of birth, Order/Delivery History, Reservation number | 5 years (Article 6 (1) 2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc.) |
| Article 17, Paragraph 4 of the Personal Information Protection Act | VivaRepublica Inc. | Inquiry on the target of FacePass service, responding to customer inquiries | membership number, name, phone number, email | Retained for 5 days from the date of provision |
| Article 17, Paragraph 4 of the Personal Information Protection Act | VivaRepublica Inc. | Prevention of duplicate registration/unauthorized use and response to civil complaints | membership number | Retention for one year after withdrawal of membership or withdrawal of service |
| Article 17, Paragraph 1, Item 1 of the Personal Information Protection Act | VivaRepublica Inc. | Identifying FacePass users, verifying the accuracy of event information, providing essential notices and updates, and responding to customer inquiries. | Membership number, name, mobile phone number, email, reservation details (event name, event date and time, gate information, reservation number, ticket number, reservation status, seat grade, price category, seat information, ticket validation type), ticket validation status, and gift eligibility. | Destroyed after the performance has taken place |
[Entrustment]
- In order to provide convenient and better services, the Company delegates part of the work to a third party.
- The Company delegates part of the work required for the provision of the services to a third party, stipulates the required matters to ensure that the delegated entity processes personal information in a safe manner in accordance with the Personal Information Protection Act, and performs management and supervision thereof.
<Domestic>
| Entrusted Company | Entrusted Work | Re-entrusted work |
|---|---|---|
| Amazon Web Services Inc. (Seoul) | Use of AWS services | |
| (주)엑심베이 | Credit Card, WeChat Pay, Union Pay payment | |
| 한국정보통신 | Credit Card, WeChat Pay payment | |
| 주식회사 한결이엔씨 | Performance/event operation and management | |
| 주식회사 에스엘엑스 | Operation of distribution center | CJ대한통운: Delivery, CS support SLX택배: Delivery, CS support SLX네트웍스: SLX Delivery CS Business Support 우체국: International shipping, CS support |
| 한국고용정보, ㈜트랜스코스모스코리아 | Customer consultation | |
| ㈜이씨에스텔레콤 | Development, operation and maintenance of customer consultation system | 가띠 : Development and maintenance of consultation application |
| 주식회사 오내피플 | Personal Information Collection Questionnaire Maintenance | 네이버클라우드 주식회사 : SMS sending service (주)KG이니시스 : Identity Verification and Electronic Signature Amazon Web Service : Data storage, computer system operation/management, email sending services |
<Overseas>
| Legal Basis | The recipient of personal information(the country and the contact) | Purpose of Use | Items to be Transferred | Date, Time and Method of Transfer | Retention Period |
|---|---|---|---|---|---|
| Article 28-8, Paragraph 1, Item 3 of the Personal Information Protection Act | Persona, lnc(United States of America, privacy@withpersona.com) | Use of passport identity verification service | Name, date of birth, nationality, Photo(selfie, Passport), Passport information (passport number, passport expiration date, nationality, country of issuance) | Transfer via network at the time of service use | Until the withdrawal of membership |
7. Retention Period and Destruction of Personal Information
The Company processes the user’s personal information until membership withdrawal or within the period of retention and use as consented at the time of collection of personal information from the user.
The Company will destroy the personal information without delay when it becomes unnecessary due to the expiration of the retention period, attainment of the purpose of processing, etc.
- However, if the Company obtained separate consent from the user for the retention period of the personal information, or is obliged to store such information for a certain period under applicable laws and regulations, the Company will retain the personal information safely for such period.
The Company obtains separate consent from the user for the retention period of the personal information in the following cases:
- In order to prevent unauthorized membership and use, the Company retains the records of unauthorized membership and disciplinary actions for six (6) months from the date of collection and destroys them.
Relevant laws and regulations, including the Act on the Consumer Protection in Electronic Commerce, the Electronic Financial Transactions Act, and the Protection of Communications Secrets Act, stipulate the requirements to retain information for a certain period as follows. The Company will retain personal information for such period in accordance with the laws and regulations, and will never use it for any other purposes.
Act on the Consumer Protection in Electronic Commerce
- Records on contracts or withdrawal of subscription: to be retained for five (5) years
- Records on payments and supply of goods, etc.: to be retained for five (5) years
- Records on handling of consumer complaints or disputes: to be retained for three (3) years
Electronic Financial Transactions Act
- Records on electronic finance: to be retained for five (5) years
Act on Promotion of Information and Communications Network Utilization and Information Protection
- Records on identity verification: to be retained for six (6) months
Protection of Communications Secrets Act
- Log-in records: to be retained for three (3) months
The Company destroys personal information in an irreproducible manner when the purpose of collection and use of personal information has been achieved, including by membership withdrawal, service termination, and the expiration of the retention period of personal information consented by the user.
The Company will destroy without delay the information required to be retained by the applicable laws and regulations in an irreproducible manner after the expiration of the relevant period.
- Electronic files will be safely deleted by using technical methods that render them irrecoverable and irreproducible, and printouts, etc. will be destroyed through shredding or incineration.
8. Rights of Users and Legal Representatives and Exercise Methods
Users may inspect or modify their personal information at any time at “My Information > Settings.”
Users may withdraw their consent to the collection and use of personal information at any time by means of withdrawal from membership, etc., and the collected personal information will be destroyed immediately upon such withdrawal.
- Users may withdraw from membership at “My Information ［≡］ > ［Settings］ > ［Service Withdrawal］.”
In case of a child under the age of 14, his/her legal guardian has the right to inspect or modify the child’s personal information and to withdraw his/her consent to the collection and use of the child’s personal information, and the collected personal information will be destroyed immediately upon withdrawal.
If the user requests for correction of any error in his/her personal information, the relevant personal information will not be used or provided until the correction is completed. In addition, if any incorrect personal information has been already provided to a third party, the correction processing result will be notified to the third party without delay so that the correction can be made.
However, withdrawal of consent, suspension of processing, correction, or deletion may not be possible in the following cases.
- When there are special provisions in laws or when such changes may prevent the fulfillment of legal obligations.
- When there is a possibility of causing harm to another person’s life or safety, or unfairly violating their property or interests.
- When personal information is necessary to provide the contracted service, and the user has not explicitly requested contract termination.
- When the personal information is specified as a collection target in other statutes.
Users have the right to have their personal information protected, as well as the responsibility to safeguard their own data and not infringe on others' personal information. Users must be cautious to prevent the leakage of their personal data, including their ID and password, and must not damage or misuse others' personal information, including posts.
Users must not transfer or lend their ID, password, or access credentials to others. If they register using someone else’s personal information or misuse another person’s ID, they may face membership disqualification and legal consequences under relevant laws.
9. Information on Personal Information Protection Officer and Person in Charge
In order to handle inquiries and complaints related to personal information of users, the Company has designated a Personal Information Protection Officer and person in charge as follows:
| Personal Information Protection Officer |
|---|
| Name: Dong-U Kim Contact information: 02-3483-0224, help.global@nol-universe.com |
For any other reporting or consulting on infringement of personal information, please contact the institutions provided below:
- Personal Information Infringement Report Center: (https://privacy.kisa.or.kr / 118 without exchange code)
- Cyber Investigation Bureau of National Police Agency (https://ecrm.police.go.kr/minwon/main 182 without exchange code)
- Personal Information Dispute Mediation Committee (https://www.kopico.go.kr / 1833-6972 without exchange code)
10. Processing of Personal Location Information
The Company protects the user’s personal location information in compliance with the laws related to the protection and use of location information. Details of the processing of personal location information are specified in the Terms and Conditions of Use for Location-Based Service.
The Company uses personal location information to provide the following services but does not store location information in the system during the processing of personal location data.
- Providing search result using location information: When a user requests an information search or provides the location information of the personal location information principal or a mobile device, search results and nearby locations (such as partner stores) are presented based on that location information.
- Providing advertising information using user location: During the use of search results or other services, advertisements are displayed based on the location of the personal location information principal or mobile device.
Pursuant to Article 16, Paragraph 2 of the Act on the Protection and Use of Location Information, the Company will automatically record the evidentiary materials for the use and provision of location information of the personal location information principal in the location information system, and retain them for at least six (6) months.
The Company does not store personal location information, but if it is stored in the future, it will be securely destroyed in an irrecoverable manner once the purpose of processing personal location information has been fulfilled.
- Printed personal information: Destroyed through shredding or incineration.
- Personal information stored in electronic file format: Destroyed using technical methods that render them irrecoverable and irreproducible
The Company will not provide personal location information to a third party without the consent of the personal location information principal, and if the Company provides personal location information to a third party designated by the personal location information principal, the Company will take the following measures.
- The Company will immediately notify the recipient and purpose of the provision to the personal location information principal in advance, and obtain their consent.
- For each instance, the recipient, date and time of provision, and purpose of provision will be immediately notified to the personal location information principal via the communication terminal device from which the personal location information was collected.
- If the personal location information principal uses a communication terminal device that does not have the capability to receive text, voice, or video, or if they have specifically requested to be notified via a different communication terminal device, email, or electronic message, the Company will notify them through the designated method.
The rights, duties, and methods of exercise of the legal guardian of children under the age of 8 and others are as follows.
The Company will consider the consent of the personal location information principal to be valid when the legal guardian of a person falling under the following categories (the “Child Aged 8 or Younger, etc.”) consents to the use or provision of personal location information for the purpose of protecting the life or body of such individuals.
- Child Aged 8 or Younger,
- A person under adult guardianship,
- A person with a mental disability under Article 2, Paragraph 2, Item 2 of the Act on Welfare of Persons with Disabilities, who falls under a person with a severe disability under Article 2, Item 2 of the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities (limited to a person who has registered as a person with a disability under Article 32 of the Act on Welfare of Persons with Disabilities)
The legal guardian who wishes to consent to the use or provision of personal location information for the protection of the life or body of a Child Aged 8 or Younger, etc., must submit a written consent form along with a document proving their status as the legal guardian to the Company.
The legal guardian, upon consenting to the use or provision of personal location information for a Child Aged 8 or Younger, etc., may exercise all rights of the personal location information principal.
In order to handle complaints that arise in the course of using the services, the Company has designated a location information manager as follows:
- Location Information Manager: Dong-U Kim
- Tel.: 02-3483-0224
- E-mail address: help.global@nol-universe.com
11. Measures to Ensure Security of Personal Information
- The Company takes the following measures to ensure the safety of personal information:
- Managerial measures: Establishment and implementation of internal management plan, regular employee training, etc.
- Technical measures: Management of access rights to the personal information processing system, installation of access control system, encryption of unique identification information, installation of security programs
- Physical measures: Control of access to the computer room, data storage room, etc.
12. Applicability of this Privacy Policy
- This Privacy Policy applies to “NOL World” one of the Company’s brands, and all related services (including mobile web/app) and separate privacy policies may apply to the services provided under different brands.
- If the personal information is collected on another company’s website linked to NOL World, this Privacy Policy will not apply after the personal information is provided with the user’s consent.
13. Amendment of Privacy Policy and Notification
The Company will notify any modification to this Privacy Policy through a notice on our website, and will disclose such change so that the users can easily recognize it at any time.
- Notice Date : July 21, 2026
- Effective Date: July 28, 2026
Below is the previous version of Privacy Policy.