Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes:

1. Membership Registration and Management

• Confirming intent to register as a Member
• Identifying and authenticating Members (email/password, as well as Google and Facebook social login)
• Maintaining and managing membership status
• Preventing fraudulent use of the Service
• Delivering notices and other announcements
• Handling customer inquiries and complaints

2. Providing the Service

• Providing basketball match and pickup game participation services
• Managing match participants and team formation
• Providing court booking and usage services
• Processing Booking Fee payments and refunds
• Calculating and administering Manner Scores based on post-match peer ratings
• Sending match- and booking-related notifications (email)
• Maintaining Service usage records

3. Processing Court Partner and Manager Applications and Engagements

• Receiving and reviewing court registration applications from Court Partners
• Receiving and reviewing Manager applications
• Communicating with, and managing agreements with, approved Court Partners and Managers
• Assigning Manager compensation for completed Matches and processing Manager payouts

4. Improving the Service and Developing New Services

• Analyzing Service usage statistics and usage patterns
• Improving the Service and developing new features

5. Customer Support

• Confirming and responding to inquiries
• Handling user complaints and disputes
• Providing guidance related to Service use

Article 2 (Items of Personal Information Processed)

1. At Membership Registration

Required

• Name
• Email address
• Password
• Mobile phone number

Optional

• Basketball skill level (Beginner / Amateur / Semi-Pro / Pro)
• Profile information (email, name, etc.) provided through Google or Facebook social login

2. When Using Matches and Bookings

• Match participation details and booking history (including booking reference numbers)
• Match participation records
• Manner Score (automatically calculated based on peer ratings after each Match)
• Access logs and IP address
• Authentication tokens stored in the browser to keep users logged in

3. When Making a Payment

When using a paid feature of the Service (such as a Match Booking Fee), the following information may be collected during payment: payment amount, date and time, and payment method (e.g., GCash); payment approval information; and refund information.

Note: The Company does not directly store a user's full card number or other complete payment credentials. Payments are processed by a licensed third-party payment service provider engaged by the Company.

4. Court Partner Applications

Applicant's name, mobile phone number, email address, Facebook page/Messenger link (optional), and court name, address, and facility details.

5. Manager Applications and Engagements

• At application: applicant's name, mobile phone number, email address, city/area of activity, basketball experience level, and reason for applying (including any optional free-text input)
• During active participation as a Manager: engagement history (Matches accepted and completed), performance-related feedback from Members, and payout account details (e.g., GCash or Maya mobile number) and payment history

Manager compensation (GCash payouts) is processed through the Company's designated payment service provider, in addition to that provider's processing of Booking Fee payments collected from Members. See Article 5 for the providers involved in each payment flow.

Article 3 (Retention and Use Period of Personal Information)

The Company destroys personal information without delay once the purpose of collection and use has been achieved, except that the Company may retain personal information for the following periods:

1. Upon Membership Withdrawal or End of a Manager Engagement

The Company destroys the relevant personal information without delay, except where retention for a certain period is required under applicable law, in which case it is retained for that period.

2. Retention Required by Applicable Law

Under the Act on Consumer Protection in Electronic Commerce and other applicable laws, the Company may retain the following records for the periods indicated:

Article 4 (Provision of Personal Information to Third Parties)

1. In principle, the Company does not provide users' personal information to third parties, except:
   • where the user has given prior consent;
   • where required by specific provisions of applicable law;
   • where necessary to provide the Service, within the scope for which the user's consent has been obtained (for example, sharing a Member's booking details with the Manager or Court Partner assigned to that Match, to the extent necessary to run the Match); or
   • where urgently necessary to protect the life, body, or property of a user.

Article 5 (Outsourcing of Personal Information Processing)

To provide the Service, the Company outsources the following personal information processing tasks to external providers:

Manager compensation payouts (via GCash) are processed through the same designated payment service provider used for Booking Fee collection, using that provider's disbursement/payout functionality.

When entering into an outsourcing agreement, the Company specifies the matters necessary to ensure personal information is managed securely in accordance with applicable law, and supervises and manages the provider accordingly. This table is updated as service providers change; the current version is always available at dribzi.com/privacy.

Article 6 (Cross-Border Transfer of Personal Information)

The Company processes personal information through servers located overseas, operated by the providers listed in Article 5, in order to provide the Service.

• Recipient: each provider listed in Article 5
• Countries of transfer: the United States, Singapore, and other countries where each provider's servers are located
• Items transferred: the items listed in Article 2 that are necessary to perform the relevant outsourced task
• Purpose of transfer: performance of the outsourced tasks described in Article 5
• Retention and use period: until the outsourcing agreement ends or the purpose of use is achieved
• Method of transfer: transmission over the network

Article 7 (Procedure and Method of Destroying Personal Information)

The Company destroys personal information without delay once the retention period has elapsed or the purpose of processing has been achieved.

• Electronic files: deleted using a method that prevents recovery
• Paper records: shredded or incinerated

Article 8 (Users' Rights and How to Exercise Them)

A user may, at any time:

• request access to their personal information;
• request correction of their personal information;
• request deletion of their personal information (membership withdrawal); or
• request suspension of processing of their personal information.

A user may exercise these rights through the "My Profile" section of the Service or through the contact information in Article 11. The Company processes such requests in accordance with the procedures prescribed by applicable law.

Article 9 (Measures to Ensure the Security of Personal Information)

Administrative Measures

• Minimizing the scope of personnel with access to personal information
• Managing and training personnel who handle personal information
• Establishing and implementing an internal management plan

Technical Measures

• Access control over the database (including Row Level Security)
• Encryption of passwords and similar credentials
• Processing payment information through a licensed payment service provider so that original card data is not retained by the Company
• Managing access rights to personal information and other sensitive data

Physical Measures

• Physical access to the servers on which personal information is stored is governed by each provider's own security policies (see Article 5)

Article 10 (Use of Cookies and Similar Technologies)

The Company does not currently use dedicated cookies for advertising or visitor-analytics purposes. The Service does store an authentication token in the browser to keep users logged in; a user may delete this through their browser settings, in which case they will need to log in again. If the Company introduces analytics or advertising cookies in the future, it will amend this Policy and provide advance notice.

Article 11 (Personal Information Protection Contact)

The Company operates the following contact channel to protect users' personal information and handle related complaints and inquiries:

• Email: support@dribzi.com

Please contact the Company at the address above for any inquiries, reports, or consultations related to personal information.

Article 12 (Reporting and Consultation on Personal Information Infringement)

If a user needs to report or consult regarding a violation of their personal information rights, they may contact:

• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118, no area code)
• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Cyber Investigation Bureau, Korean National Police Agency (ecrm.police.go.kr / 182, no area code)
• Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301, no area code)