Privacy Policy

The Company uses members' personal data solely for the following purposes and does not use it for any purpose other than those disclosed in advance. If the purpose of processing changes, the Company will take necessary measures in accordance with applicable laws, such as obtaining separate consent.

1. Member Management: To verify the intention to register as a member, identify individuals, maintain and manage membership status, prevent unauthorized use of services, and prevent crimes (including prevention of property crimes, identity theft, money laundering, terrorist financing, and sanctions violations).
2. Provision and Management of Services: To process multinational product payments and disbursement of sales proceeds, deliver products and other items, provide transaction status updates, handle refunds and compensation, and issue coupons.
3. Development of New Services and Use in Marketing/Advertising: To develop new services and provide personalized services, offer services and place advertisements tailored to statistical characteristics, verify the effectiveness of services, provide event and promotional information and opportunities for participation, analyze access frequency, and generate statistics on members’ use of services.
4. Provision of Review Services: To collect and publish user reviews (transaction feedback) submitted by members within the Service, and to provide such reviews as reference information for other users. In this process, the member’s identification information will be de-identified (e.g., partially masked or replaced with a display name) before being displayed alongside the review content within the Service.

By registering as a member, you can access a wider range of services provided by the Company.
When collecting personal data, the Company will inform you in advance of the relevant details and obtain your consent in accordance with Article 15(1)(1) of the Personal Information Protection Act.

The Company complies with the following principles when collecting your personal data:

1. The Company collects only the minimum amount of personal data necessary to provide its services.
2. The Company does not collect sensitive personal data.
   1. Personal data that may infringe upon your fundamental human rights—such as information on race, ideology, beliefs, or health status—will not be collected.
   2. However, if the collection of such data is unavoidably required by law, the Company will inform you of the necessity and obtain your prior consent.
3. With your consent, the Company collects personal data through the following methods:
   1. Website, written forms, fax, telephone, customer service center consultations, email, event entries, and delivery requests
   2. Provision from partner companies
   3. Collection through data generation tools

The Company will provide the most up-to-date list of personal data collected as of the time you access the page below.

1. Items Collected: ID (email), last name, first name, password, country of residence, phone number, shipping address, and social login information.

   Categories of personal data, items collected, and purposes.

   Category	Items Collected	Purpose of Collection
   Basic Information	ID (email), last name, first name, password, country of residence, and phone number	To identify members and provide services.
   Social Login Information	Social login account details (Google, Apple, LINE)	To simplify login and authentication processes.
   Email Verification Status	Email verification status (whether verified and the date and time of verification)	To enhance account security and ensure transaction reliability.
   Shipping Information	Overseas shipping address, recipient information (name and contact details), and arrival schedule (for office pickup)	To deliver products and confirm transaction completion
   Automatically Collected Information	IP address, cookies, date and time of visits, service usage records, and records of improper use	To analyze service usage and ensure security
   Transaction Information	Purchase history, sales history, payment method details, and refund requests and processing history	To manage transaction history, process payments and refunds, prevent fraud, and respond to customer disputes.
   Authentication Information	Verification status and records of email or mobile phone authentication for identity verification	To prevent account theft and enhance transaction security.
   Customer Support Chat Information	Chat conversation content and attachments, device and browser information during chat sessions, page URL at time of chat initiation, chat session timestamps and duration, and member ID linked to chat history (if logged in)	To provide real-time customer support, maintain conversation continuity, improve service quality, and resolve customer inquiries and disputes.
   Review Information	Member ID, review content (text), rating, date and time of submission, related product category information	To provide transaction reviews to other users, enhance service reliability, and support informed purchasing decisions

   When you log in using a social media account, information such as your email address and name provided by the platform may be collected.

   Email verification is used during membership registration or in the course of transactions, and the verification status is stored as essential information for service use.

2. In the course of using the service, the following information may be automatically generated and collected:

   - IP address, cookies, date and time of visits, service usage records, records of improper use

3. During the use of electronic payment services, the following information may be collected:
   • PayPal ID, whether a credit card is linked
   • Alipay ID, whether a credit card is linked
   • WeChat Pay ID, whether a credit card is linked
4. When using the customer support chat service (Channel Talk), the following information may be collected:
   • Chat messages, attachments, and files submitted during the conversation
   • Device type, operating system, and browser information at the time of chat
   • The page URL from which the chat was initiated
   • Chat session start time, end time, and duration
   • Member ID and name (if logged in at the time of chat)

The personal data collected by the Company will be retained only until the purpose of collection or provision is fulfilled. If you request to withdraw from membership or revoke your consent, the data will be promptly destroyed. However, any information required to be retained under applicable laws will be stored in accordance with the relevant legal provisions (Please note that even if you delete the app, the Company may still retain your personal data. To request deletion of your personal data, you must either withdraw your membership or contact the customer service center.)

In principle, your personal data will be promptly destroyed once the purpose of its collection and use has been achieved. However, data that must be retained under applicable laws will be handled in accordance with those laws. In such cases, personal data that is separately stored and managed will not be used for any purpose other than as required by law.

The procedures and methods for destruction are as follows:

1. Destruction Procedures
   • Information entered by the user for purposes such as membership registration will be transferred to a separate database (or stored in a separate filing cabinet in the case of paper documents) after the intended purpose is fulfilled. It will then be retained for a certain period in accordance with internal policies and other applicable laws (refer to the "Processing and Retention Period of Personal Data"), and subsequently destroyed.
   • Such personal data will not be used for any purpose other than retention, unless required by law.
2. Destruction Methods
   • Personal data printed on paper will be destroyed by means of shredding or incineration.
   • Personal information stored in electronic file format will be deleted using technical methods that render the records unrecoverable.

The Company processes your personal data only within the scope specified in Article 1 (Purpose of Use of Personal Data) of this Privacy Policy. Personal data is provided to third parties only with your consent, or in cases permitted under Articles 17 and 18 of the Personal Information Protection Act, such as where required by special provisions of applicable law.

However, the following cases are exceptions:

1. When requested by a relevant authority for administrative or investigative purposes in accordance with applicable laws and regulations
2. When providing data in a de-identified format that does not allow the identification of any specific individual, for purposes such as the compilation of statistics, academic research, or market surveys, to parties including advertisers, partners, or research institutions.
3. When a transaction is concluded through the services provided by the Company, and transaction-related information needs to be shared with both parties to the extent necessary to ensure transaction security.
4. When otherwise required pursuant to procedures stipulated by relevant laws and regulations
5. When a user chooses to log in through a third-party social login provider (Google, Apple, or LINE), the user’s basic profile information (such as email address and name) may be received from the respective provider in accordance with the user’s consent granted during the social login process.
6. Public Disclosure of User Reviews: Reviews (transaction feedback) submitted by members are publicly displayed within the Service along with the member’s identification information (masked ID or display name) and are accessible to all users of the Service. Such disclosure is processed based on the separate consent provided by the member at the time of submitting the review. Members may withdraw their consent at any time by deleting their review, upon which the review will be immediately removed from the Service.

The Company entrusts the processing of a minimum amount of personal data to external service providers for the purpose of carrying out certain tasks necessary to provide smooth and improved services to you. While such external providers are entrusted with the processing of personal data, the Company takes necessary measures to ensure that your personal data is securely protected and manages and supervises the processing to prevent any violation of applicable laws and regulations.

If there are any changes to the details of outsourced tasks or to the service providers themselves, the Company will promptly disclose such changes through this Privacy Policy, thereby ensuring that the most up-to-date information regarding outsourced personal data processing and entrusted service providers is available at the time you review this policy.

The Company uses cookies to store and retrieve usage information from time to time in order to provide individualized services and convenience to you. A cookie is a small piece of data sent from the server (HTTP) used to operate the website to your browser, and it is stored on your computer or mobile device. Upon accessing the website, the cookie is automatically transmitted from your browser to the server. You can manage cookie settings such as allowing or blocking cookies through browser options.

For Chrome
- Click the icon at the top right of the web browser > select “Settings” > scroll down and click “Advanced” > under the “Privacy and security” section, click “Content settings” > adjust settings in the “Cookies” section manually

The Company processes behavioral data by identifying individuals through the use of cookies in order to provide users with optimized and personalized services during their use of the services. Behavioral data refers to online activity information that can be used to infer or analyze an individual’s interests, preferences, inclinations, or tendencies—such as website or app visit history, purchase history, and search history. The Company collects behavioral data as described below. If you have any questions regarding behavioral data, wish to exercise your right to refuse its collection, or would like to file a complaint, you may contact the Company’s personal data protection department.

Legal Basis: Whether and how your personal data is processed depends on how you interact with the Company’s website, your location, and whether one or more of the following applies:

1. You have given consent for one or more specific purposes. However, this does not apply where the processing of personal data is subject to the California Consumer Privacy Act (CCPA) or the General Data Protection Regulation (GDPR).
2. The provision of information is necessary for the performance of a contract with you and/or for measures to be taken prior to entering into a contract.
3. Processing is necessary for compliance with a legal obligation to which you are subject.
4. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company.
5. Processing is necessary for the purposes of legitimate interests pursued by the Company or by a third party.

In certain jurisdictions, personal data may be processed without your consent or other legal grounds mentioned above, unless you opt out. In any case, the Company will clearly inform you whether the provision of your personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract.

Items Collected: Order information, saved user ID, recently viewed products, language preference settings

Retention and Use Period:

• Order information: Deleted upon page exit or completion of payment
• Saved user ID: 30 days
• Recently viewed products: 7 days
• Language preference settings: 1 year

Purpose of Use of Collected Information

The Company uses the information collected through service usage for the following purposes:

• To create, manage, and identify user accounts
• To fulfill and manage orders
• To provide products or services
• To handle marketing inquiries and promotional communications
• To assist with inquiries
• To improve user feedback and user experience
• To operate advertising campaigns, prize draws, and contests
• To enforce terms and conditions, and policies
• To update users on changes to the Company’s website, applications, or terms.
• To protect against abuse and malicious users
• To respond to legal requests and prevent harm
• To operate the Company’s website and services

The Company implements the following measures to ensure the security of personal data:

1. Administrative Measures: Establishment and implementation of internal management plans, regular employee training, and operation of a dedicated department
2. Technical Measures: Management of access rights to personal data processing systems, installation of access control systems and other related protective measures, measures to block internet access, encryption of personal data, retention and inspection of access logs, installation and updating of security programs, and assessment and remediation of system vulnerabilities
3. Physical Measures: Access control for server rooms and data storage rooms, storage of documents and auxiliary storage media in secure locations with locking mechanisms, safety measures against disasters and emergencies, and control over the removal or insertion of auxiliary storage media

1. You may access and correct your registered personal data at any time.
2. If you wish to access or correct your personal data, you may do so directly through the online website, or by contacting the Company’s customer service center in writing or by email. In such cases, the Company will promptly take appropriate action.
3. The rights described in paragraph a above may also be exercised by your legal representative or an authorized agent. In this case, please submit a power of attorney using Form No. 11 of the Enforcement Rules of the Personal Information Protection Act.
4. If you request correction of your personal data, the Company will not use or provide the relevant data to any third party until the correction is completed. If the data has already been provided to a third party, the Company will promptly notify the third party of the correction request and take necessary measures to ensure the correction.
5. You may withdraw your consent to the provision, use, and collection of personal data through membership registration or other means at any time.
6. If the Company confirms your withdrawal of consent and takes measures such as destruction of personal data, it will promptly notify you of such actions.
7. To protect the personal data of children under the age of 17, the Company does not permit individuals in this age group to register as members, as doing so would require the consent of their legal representative. If the Company becomes aware that it has collected personal data from a child under the age of 17, it will take reasonable steps to delete the relevant account. If you believe Ticketbay has collected personal data from a child under the age of 17, please send a request for deletion to [help@ticketbayglobal.com].
8. Members may modify or delete their reviews at any time. Upon deletion, the member’s identification information and review content publicly displayed within the Service will be immediately removed. However, if retention is required under applicable laws (such as the Act on the Consumer Protection in Electronic Commerce, etc.), the data will be stored separately for the period prescribed by the relevant law and subsequently destroyed.

As a data subject, the user (or their legal representative) has the following rights regarding the personal data collected, used, and provided by the Company:

1. Right of Access to Personal Data

   The user or their legal representative may, in accordance with applicable laws, access their personal data and obtain information about how their personal data has been collected, used, and provided.

2. Right to Rectification of Personal Data

   The user or their legal representative may request the correction of inaccurate or incomplete personal data.

3. Right to Erasure of Personal Data (Right to Be Forgotten)

   The user or their legal representative may request the deletion of personal data if the purpose of collection has been fulfilled or if consent has been withdrawn.

4. Right to Restriction of Processing of Personal Data

   Where there is a dispute regarding the accuracy of the personal data or the legal basis for processing, or where the data must be preserved, the user or their legal representative may request that the processing of personal data be temporarily suspended.

5. Right to Data Portability

   The user or their legal representative may request to receive their personal data or to have it transferred to another controller.

6. Right to Object to the Processing of Personal Data

   The user or their legal representative may object to the processing of personal data for purposes such as direct marketing, pursuit of legitimate interests, performance of public authority, or statistical and research purposes.

7. Right to Refuse Automated Decision-Making (Including Profiling)

   The user or their legal representative may request the suspension of automated processing of personal data, including profiling, where such processing produces legal effects or significantly affects the user.

8. Right to Erasure of Review Data

   Members may request the deletion of their review data at any time by withdrawing their consent. Upon deletion, the Company will also process requests for removal of the relevant data from search engine indices (Right to be Forgotten, Article 17(2) of GDPR).

Processing of Personal Data through Customer Support Chat (Channel Talk)

When you use our live chat service powered by Channel Talk (operated by Channel Corporation), the following applies under the GDPR:

• Legal Basis: Chat data is processed based on legitimate interest (Article 6(1)(f)) for customer support, and performance of a contract (Article 6) when chat is initiated by the user regarding an order or transaction.
• Data Processor: Channel Corporation acts as a data processor on behalf of TicketBay. Data is transferred to servers in South Korea pursuant to Standard Contractual Clauses (SCCs).
• Automated Processing: The Channel Talk chatbot provides automated initial responses. Users may request human agent support at any time. No profiling or automated decision-making with legal effects is performed.
• Data Subject Rights: You may request access to, correction of, or deletion of your chat history by contacting our DPO.

If you wish to exercise any of these rights, you may do so through the account information modification menu on the website, or by contacting the Company’s Data Protection Officer or their representative in writing, by email, or by phone. The Company will take prompt action in response to such requests. However, if there are valid grounds for refusal in accordance with applicable laws and regulations, the Company may deny the request.

Lawful Processing of Personal Data under the GDPR (General Data Protection Regulation)

When the Company processes personal data, the processing is lawful only if one or more of the following conditions are met:

1. The user has given consent to the processing of their personal data.
2. The processing is necessary for the performance of a contract to which the user is a party, or in order to take necessary measures at the request of the user prior to entering into a contract:
   1. Managing membership and identifying users
   2. Performing contractual obligations, including the provision of services requested by users, payment processing, and settlement
3. The processing is necessary for compliance with a legal obligation to which the Company is subject:
   1. Complying with relevant laws, regulations, legal proceedings, or government requests
4. The processing is necessary in order to protect the vital interests of the user or another natural person:
   1. Detecting, preventing, or responding to fraud, abuse, security threats, or technical issues
5. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company
6. The processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party
   (provided that such interests are not overridden by the rights and freedoms of the data subject. Special caution is required, in particular where the data subject is a child).
7. Processing of Review Data: Review data is processed on the basis of consent provided by the member at the time of submitting the review (Article 6(1)(a) of GDPR). Members may withdraw their consent and request deletion of their review at any time. Upon deletion, the Company will also process requests for the removal of indexed review data from search engines (Article 17(2) of GDPR, Right to be Forgotten).

The Company designates and operates a Personal Data Protection Officer and a Personal Data Protection Manager as follows, in order to protect and manage your personal data and to address complaints and inquiries. The Company will respond promptly and thoroughly to any inquiries you may have at any time.

The Company values your feedback. If you have any questions regarding your personal data, please contact our Customer Service Center as follows:

If you suffer harm due to the infringement of your personal data, you may request dispute resolution or consultation from the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center of the Korea Internet & Security Agency. For other reports or inquiries related to personal data infringement, please contact the following institutions:

• Personal Information Dispute Mediation Committee: (without area code) +82 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: (without area code) +82 118 (privacy.kisa.or.kr)
• Korean National Police Agency: (without area code) +82 182 (ecrm.police.go.kr)

In the event of additions, deletions, or modifications to this Privacy Policy, the Company will notify users via the “Notice” section on the official website at least 7 days prior to the effective date of the revision. However, if there are material changes that affect users’ rights, such as in the collection or third-party provision of personal data, the Company will provide notice at least 30 days in advance.