Supplemental Korean Privacy Statement

English

Effective Date: December 4, 2025

We, Dream Games Dijital Teknolojiler A.Ş., address this Supplemental Korean Privacy Statement only to residents of the Republic of Korea. This document supplements our Dream Games Privacy Policy (“Core Privacy Policy”).

Purpose of Personal Information Processing, Processing Items, Retention and Use Period

Legal Ground Category Processing Purpose Processed Data Retention and Use Period
Personal Information Protection Act Article 15(1)(iv) (Conclusion and Performance of Contract) Provision of Member Services
  • Personalization of in-game profiles
  • Provision of game services (including team play, competitions, and social elements)
  • Activation of payment services
  • Provision of player support
  • Verification of identity and service usage qualifications
  • Contact information (country/region, name, surname, email address, username)
  • Profile and gameplay information (screen name, avatar or profile picture, game progress, scores, achievements, payment information, competition participation information, team membership information)
  • Parent information (when child protection settings are enabled: parent email address, PIN)
 Until membership withdrawal (However, payment information is retained for 5 years in accordance with the Electronic Commerce Act)
Personal Information Protection Act Article 15(1)(iv) (Conclusion and Performance of Contract) Service Optimization
  • Optimization of games tailored to devices
  • Improvement of user experience of service
  • Analysis data (detailed information on game playing and interaction, user ID, event data, device information, IP address, OS/browser information, device performance data)
  • Device data (IDFA, Google Ad ID, IDFV, app settings ID, game center ID)
  • Location data (IP address-based location)
 Until membership withdrawal (However, IP addresses are retained for 3 months in accordance with the Protection of Communications Secrets Act)
Personal Information Protection Act Article 15(1)(iv) (Conclusion and Performance of Contract) Customer Support and Communication
  • Responding to opinions and inquiries
  • Providing customer support services
  • Delivering essential service-related information (confirmation, technical notifications, updates, security alerts, administrative messages)
  • Supporting in-game/social media communication between players
  • Contact information
  • User-generated content (uploaded/sent files, documents, videos, images, data)
  • Social media information (name, profile picture, friend list)
  • Authentication service information (name, email, user ID, profile picture, friend information through third-party social networks/authentication services)
 Until membership withdrawal (However, records of consumer complaints or dispute resolution are retained for 3 years in accordance with the Electronic Commerce Act)
Personal Information Protection Act Article 15(1)(iv) (Conclusion and Performance of Contract) Service Operation and Quality Management
  • Organizational and daily operational management
  • Game and service operation
  • Internal quality management
  • Analysis data
  • Device data
  • Commercial information (payment/acquisition products and service information)
  • App marketplace information (device, account, payment-related personal data)
 Until membership withdrawal (except that transaction-related accounting books and supporting documents are retained for 5 years under the Framework Act on National Taxes, etc., and payment information for 5 years under the Electronic Commerce Act)
Personal Information Protection Act Article 15(1)(iv) (Conclusion and Performance of Contract) Security and Legal Compliance
  • Maintaining asset, service, technology, business safety/security/integrity
  • Preventing cheating, fraud, and illegal activities
  • Player protection
  • Compliance with applicable laws
  • Ensuring compliance with service terms
  • Defense/exercise/establishment of legal rights
  • Enabling/confirming/applying child protection settings
  • Performance of contractual and legal obligations
  • Analysis data
  • Device data
  • Location data
  • Contact information
  • Parent information (related to child protection settings)
 Until membership withdrawal (However, IP address is retained for 3 months in accordance with the Protection of Communications Secrets Act)
Personal Information Protection Act Article 15(1)(i) (Consent of Data Subject) Service Personalization and Provision of Customized Content
  • Providing customized in-game events, offers, promotions
  • Service personalization and understanding user preferences
  • Requesting participation in surveys
  • Analysis data (website browsing history, conversion data)
  • Inference data (predicted interests and preferences)
  • Survey information (feedback and evaluation)
  • Commercial information (products and services considered, consumption trends)
 Until consent withdrawal or membership withdrawal
Personal Information Protection Act Article 15(1)(i) (Consent of Data Subject) Service Improvement and Analysis
  • Improving and optimizing games and services
  • Internal research and analysis
  • Measuring service engagement
  • Analysis data
  • Device data
  • Commercial information
 Until consent withdrawal or membership withdrawal
Personal Information Protection Act Article 15(1)(i) (Consent of Data Subject) Ad Performance Measurement
  • Evaluating ad campaign effectiveness
  • Cohort analysis
  • Providing internal business intelligence
  • Mobile measurement data through Meta AMM services (event-level interactions, device identifiers)
 Until consent withdrawal or membership withdrawal (However, display/advertising records are retained for 6 months in accordance with the Electronic Commerce Act)
Personal Information Protection Act Article 15(1)(i) (Consent of Data Subject) Business Transactions
  • Assessment and conclusion of business or asset reorganization, restructuring, merger, acquisition, sale, or transfer
  • Publicly available source information
  • Information collected from third parties with consent
  • Information collected through transactions
 Until consent withdrawal or membership withdrawal (However, contract-related records are retained for 5 years in accordance with the Electronic Commerce Act)
Personal Information Protection Act Article 15(1)(i) (Consent of Data Subject) Marketing
  • Performing marketing activities
  • Contact information
  • Inference information
  • Analysis data
  • Social media information
 Until consent withdrawal or membership withdrawal (However, display/advertising records are retained for 6 months in accordance with the Electronic Commerce Act)

Personal Data Destruction Procedures and Methods: When personal data becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose, we follow strict procedures to destroy the relevant personal data promptly and securely.

Even if the personal data processing and retention period has expired, if it is necessary to continue to retain personal data in order to fulfill legal obligations under other relevant laws, we will carefully review the relevance between the applicable personal data items and their processing purposes and continue to retain only the necessary personal data.

The procedures and methods for destroying personal data are as follows.

Destruction Procedures: When a reason for disposal arises, we identify the personal data to be destroyed. After obtaining the approval of our Data Protection Officer, we will proceed with the secure destruction of the identified personal data.

Destruction Methods: We store your personal data primarily in an electronic environment. To ensure comprehensive data protection, we use methods that guarantee the irreversible destruction of electronic records.

Overseas Collection of Personal Data: We collect and process your personal data overseas. Your personal data is collected and processed in countries including Türkiye, the United Kingdom, the United States, Belgium, Ireland and Israel.

1. Overseas Outsourcing and Storage of Personal Data

Legal Ground: Personal Information Protection Act Article 28-8(1)(iii) (Outsourcing and storage of processing for the performance of contracts)

Recipient of personal data Personal data transferred Country of transfer Time/method of transfer Purpose of use of personal data by recipient Retention/use period of personal data by recipient
Google Cloud EMEA Limited (Contact: googlekrsupport@google.com)
  • Username
  • Register Device ID & Last online device ID
  • User Device (model & OS) (only if the user has enabled push notifications)
  • User timezone & language (only if the user has enabled push notifications)
  • Facebook ID (provided by facebook for game usage only) / Apple ID (provided by apple for game usage only) / Android ID (provided by android for game usage only) / Google ID (provided by google for game usage only)
  • Registered IP Address
  • Registered country/state
  • Email (only if the user enabled parental control)
 United States Continuously over the Internet network Storage of user data using the cloud Within the retention period specified in this Privacy Statement, until the contract with us is terminated
Amazon Web Services, Inc. (Contact: aws-korea-privacy@amazon.com)
  • Username
  • Register Device ID & Last online device ID
  • User Device (model & OS) (only if the user has enabled push notifications)
  • User timezone & language (only if the user has enabled push notifications)
  • Facebook ID (provided by facebook for game usage only) / Apple ID (provided by apple for game usage only) / Android ID (provided by android for game usage only) / Google ID (provided by google for game usage only)
  • Registered IP Address
  • Registered country/state
  • Email (only if the user enabled parental control)
 United States Continuously over the Internet network Storage of user data using the cloud Within the retention period specified in this Privacy Statement, until the contract with us is terminated
AppsFlyer Ltd. (Contact: privacy@appsflyer.com) Device ID and IDFV/IDFA Belgium and Ireland Continuously over the Internet network Finding similar users (This transfer will only take place if you give your consent via your operating system settings) Until you change the settings in your operating system

2. Overseas Disclosure of Personal Data to Third Parties

Legal Ground: Personal Information Protection Act Articles 17(1)(i) and 28-8(1)(i) (Consent of data subjects)

Recipient of personal data Personal data transferred Country of transfer Time/method of transfer Purpose of use of personal data by recipient Retention/use period of personal data by recipient
Meta Platforms, Inc. (Contact: korealocalagent@support.facebook.com)

• Identifier For Advertisers (IDFA)

• IP address

• What Services of ours they have used

• Date and time of when they used our Services

• Inferred interests

 USA Continuously over the Internet network Delivering interest-based targeted advertising to data subjects Until you toggle your cookie settings in-game. For more information, please see our Cookie Policy.
Google Ireland Limited (Contact: googlekrsupport@google.com) Ireland
AppsFlyer UK Ltd. (Contact: privacy@appsflyer.com) UK
Pecan AI Ltd. (Contact: info@pecan.ai) Israel
Unity Technologies (Contact: DPO@unity3d.com) USA

Right to Refuse and Effects of Refusal: If you do not want your personal data to be transferred overseas, you can opt out by refusing to allow the transfer of your personal data or by asking us to stop the transfer overseas. However, if you refuse, you may not be able to use our services.

Withdrawing Consent to the Collection and Use of Personal Data: You have the right to withdraw your consent to the collection and use of personal data at any time. To do so, you may contact us using any of the methods described in the "Contact Us" section of our Core Privacy Policy.

Legal Grounds for Use of Cookies: The personal data collected through essential cookies and tracking technologies is processed based on the following legal grounds: (i) It is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract per Article 15(1)(iv) of the Personal Information Protection Act; or (ii) It is necessary for us to realize a legitimate interest, where such interest clearly takes precedence over your rights, provided that the processing is substantially relevant to our legitimate interest and does not exceed a reasonable scope, per Article 15(1)(vi) of the Personal Information Protection Act. Your consent is relied upon to process your personal data through optional tracking technologies (i.e., performance and marketing technologies).

Designation of Domestic Agent: Our agent in the Republic of Korea for the purposes of (i) Article 31-2 of the Personal Information Protection Act, (ii) Article 32-5 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, and (iii) Article 31-2 of the Game Industry Promotion Act is as follows:

  • KL Partners

Managing Partner Beomsu Kim