Chatterbox Learning Korea LLC (“Company”) complies with the Personal Information Protection Act and is committed to protecting the rights and interests of its “Members” by establishing and disclosing this Privacy Policy in accordance with relevant laws.

This Privacy Policy has been established and made public to ensure the safe and smooth handling of personal data in accordance with Article 30 of the Personal Information Protection Act. If any revisions are made to this policy, the Company will immediately post the updated version on the official website (www.englishchatter.com) or notify Members via email.

Article 1. Purpose of Personal Information Processing

The Company does not use personal information for any purpose beyond those specified below, unless the Member has provided prior consent or as otherwise required by law. The personal information collected is used for the following purposes:

• Member Management: identity verification, confirmation of registration intent, personal identification, prevention of illegal or unauthorized use, age verification, dispute resolution record keeping, handling of complaints, and notifications
• Service Delivery and Billing: video lessons, learning content provision, payment processing, refunds, and collection of fees
• Marketing and Advertising: new service development, promotion/event notifications, statistical analysis and service improvement
• Incident Response and Legal Matters: securing evidence and supporting legal procedures in case of disputes between tutors and members
• Service Improvement and Research: enhancing AI features, analyzing learning patterns, algorithm design, etc.

Article 2. Items of Personal Information Collected

• At Registration: Name, email (ID), password, mobile phone number (for users under 14, legal guardian information is also collected)
• Optional: English name, time zone, learning goals, preferences for receiving updates and promotions, self-introduction video, etc.
• Automatically Collected During Service Use: IP address, cookies, payment history, access logs, device information, class recordings, class feedback
• For Paid Services: Credit card company name, card number, expiration date, bank name, bank account number, and other payment-related information

Article 3. Retention and Use Period of Personal Information

The Company retains and uses personal data for as long as the Member maintains an active account, or as permitted by law and/or agreed upon by the Member during data collection. Upon withdrawal or loss of membership, personal data is deleted and destroyed without separate request. However, certain data may be retained as follows:

1. Internal Policy-Based Retention

• Items Retained: Name, email (ID), phone number, class logs, payment records
• Purpose: Duplicate registration checks, payment verification, refund request handling
• Retention Period: 5 years from the date of account withdrawal

2. Retention Based on Relevant Laws

In accordance with applicable laws such as the Commercial Act and the Act on Consumer Protection in Electronic Commerce, the Company may retain certain information for a specified period:

• Records on contract or withdrawal of subscription: 5 years
• Records on payment and provision of services: 5 years
• Records on consumer complaints or dispute resolution: 3 years
• Records on advertising and labeling: 6 months
• Electronic financial transaction records (Article 22 of the Electronic Financial Transactions Act): 5 years
• Internet log records, IP address, etc. (per the Communications Privacy Protection Act): 3 months

3. Class Recordings and AI-Related Personal Data

• Class recordings are created only with explicit consent and used solely for review, quality improvement, or dispute resolution. These recordings are restricted and securely deleted within 1 year.
• AI-related data is processed using pseudonymization and data minimization principles for the sole purpose of service quality improvement and will not be used for marketing or profiling unless separately agreed.

Article 4. Provision of Personal Data to Third Parties

The Company does not provide personal information to third parties without prior consent, unless required by law. Anonymized or de-identified data may be used for research and service improvement purposes.

Article 5. Outsourcing of Personal Data Processing

To provide seamless service, the Company may outsource certain operations such as payment processing, messaging, video lessons, and data storage. In such cases, appropriate legal contracts and oversight are ensured. Only the minimum necessary information is shared. (e.g., AWS, Zoom, Toss Payments, Kakao, PayPal)

Examples of outsourced services:

• Payment processing (PG): ○○Pay – transaction handling and refunds
• Cloud/Hosting: ○○ Cloud – service infrastructure
• Notification/Email Delivery: ○○ Sender – announcements, verification, optional marketing
• Video Lesson Platform: ○○ RTC – real-time class connection

Article 6. Member and Legal Guardian Rights and How to Exercise Them

Members may access, modify, delete, or request suspension of their personal information at any time. If a Member does not consent to the handling of their data, they may withdraw consent or request account termination.

Users aged 14 and older may register without guardian consent. Data from children under 14 is not collected without prior guardian approval.

Article 7. Right to Refuse Consent and Possible Disadvantages

Members have the right to refuse consent to the collection and use of personal data. However:

• If a Member refuses to provide essential data required for service, they may not be able to access or use the Company’s content or services.
• Refusing optional data collection (e.g., for marketing) may result in missing out on promotions or discounts.

Article 8. Destruction of Personal Data

The Company promptly destroys personal information once its use purpose is fulfilled.

• Electronic files: permanently deleted using irrecoverable methods
• Paper documents: shredded or incinerated

Article 9. Measures to Ensure Data Security

The Company implements the following safeguards to prevent unauthorized access, leakage, loss, or damage:

• Password encryption
• Installation and regular update of security software
• Minimization of access rights and internal staff training
• Access control and intrusion prevention for personal data processing systems

However, the Company is not responsible for issues resulting from user negligence (e.g., leaking login credentials).

Article 10. Cookies and How to Manage Them

To provide personalized services, the Company may use cookies. Users may disable cookies via their browser settings, but this may affect some features.

• Purpose of Cookies: Analyze user behavior (visit frequency, duration, interests) to optimize service experience
• Managing Cookies: Users can allow all cookies, require confirmation before storage, or block all cookies. Blocking cookies may limit access to login-required services.

Article 11. Data Protection Officer

The Company has appointed the following person to oversee personal data protection and handle user inquiries and complaints:

• Data Protection Officer (CPO): Timothy Andrew Smith
• Responsible Department: Customer Support Team
• Contact: [email protected]

Article 12. Remedies for Rights Infringement

If you need to report or consult about personal data breaches, contact the following institutions:

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Korea Internet & Security Agency (Privacy Center): privacy.kisa.or.kr / 118
• Supreme Prosecutors’ Office (Cyber Investigation): www.spo.go.kr / 1301
• Cyber Bureau of the National Police Agency: www.ctrc.go.kr / 182

Article 13. Changes to This Policy

This Privacy Policy shall be effective as of September 25, 2025.