This Privacy Policy (hereinafter referred to as the "Policy") applies to the Fannuri application (hereinafter referred to as the "Service") operated by FANNURI (hereinafter referred to as the "Company") and explains how users' personal information is collected, used, and protected.[cite: 391]
This Policy has been prepared in reflection of global privacy standards such as the Personal Information Protection Act, GDPR, and CCPA.[cite: 392]
The term "personal information" used in this Policy has the following meanings.[cite: 393]
The Company processes members' personal information for the following purposes in accordance with relevant laws and regulations:[cite: 395]
The personal information of members processed by the Company is as follows.[cite: 414]
Legal Basis: Please check the "Legal Basis" content for each processing timing below.[cite: 419]
| Service Name | Processing Timing / Legal Basis | Items Processed | Retention and Use Period |
|---|---|---|---|
| Fannuri[cite: 420] | When using paid services / PIPA Article 15 (1) 4 (Execution of Contract)[cite: 420] | (For In-app purchases) Receipt number[cite: 420] | 3 months after membership withdrawal or the period prescribed by relevant laws[cite: 420] |
| Common Service[cite: 420] | During events / PIPA Article 15 (1) 4 (Performance of Contract)[cite: 420] | Participation in community events: Fannuri account (email), name and membership number for membership members[cite: 420] | 1 year after the event ends; however, non-winning participation info is kept for up to 6 months after the winner announcement[cite: 420] |
| Common Service[cite: 420] | On-site/Online Performance Events[cite: 420] | On-site events (fan meetings, public broadcasts): (Recorded on-site) Video information Online events (video fan meetings): (Recorded during the event) Video information[cite: 420] |
Within 7 days after the event ends or the retention period under relevant laws[cite: 420] |
| Common Service[cite: 420] | Upon receiving customer consultations / PIPA Article 15 (1) 4 (Performance of Contract)[cite: 420] | General inquiries: Email, inquiry content Purchase-related inquiries: Email, consultation details, phone number[cite: 420] |
Retained for 3 years after inquiry registration in accordance with relevant laws[cite: 420] |
Legal Basis: PIPA Article 15 (1) 1 (When the consent of the data subject is obtained)[cite: 422]
| Service Name | Processing Timing | Items Processed | Retention and Use Period |
|---|---|---|---|
| Fannuri Account[cite: 423] | When signing up for a new account[cite: 423] | General members: ID (email), password, nickname SNS (Google, Twitter, Apple) linked members: ID (email), nickname[cite: 423] |
3 months after membership withdrawal or the period prescribed by relevant laws[cite: 423] |
| Fannuri Account[cite: 423] | When signing up before '25.04.17[cite: 423] | General members: ID (email), password, name, domestic/foreigner status SNS linked members: ID (email)[cite: 423] |
3 months after membership withdrawal or the period prescribed by relevant laws[cite: 423] |
| Fannuri[cite: 423] | When signing up for the service[cite: 423] | User authentication information (linked with Fannuri account)[cite: 423] | 3 months after service withdrawal or the period prescribed by relevant laws[cite: 423] |
| Fannuri[cite: 423] | When using community services[cite: 423] | Nickname, profile image[cite: 423] | 3 months after membership withdrawal or the period prescribed by relevant laws[cite: 423] |
| Fannuri[cite: 423] | Receipt of customer refund requests[cite: 423] | Fannuri account ID (email), name (last name/first name), bank name, account number, address[cite: 423] | Retained for 5 years after refund processing in accordance with relevant laws[cite: 423] |
| Fannuri[cite: 423] | When reporting illegal recordings[cite: 423] | Name, mobile phone number (phone number), email[cite: 423] | Retained for 3 years from the time of receipt in accordance with relevant laws[cite: 423] |
| Fannuri[cite: 423] | When reserving Fannuri Concert services[cite: 423] | Mobile phone number, email, ticket number[cite: 423] | Within 3 months after achieving the purpose of service use[cite: 423] |
| Fannuri[cite: 423] | When linking streaming platforms (Spotify, Apple Music, etc.)[cite: 423] | (Based on the relevant service) Email, subscription info, service usage history[cite: 423] | Immediately upon completion of service use[cite: 423] |
| Fannuri Concert[cite: 423] | When providing performance content services[cite: 423] | Email, user authentication info (linked with Fannuri account), status of linked product purchase[cite: 423] | 90 days after the performance (concert, showcase, fan event, etc.) ends[cite: 423] |
| Common Service[cite: 423] | During events (Prize delivery)[cite: 423] | Email, delivery address information (name, phone number, address)[cite: 423] | 1 year after the event ends; however, non-winning participation info is kept for up to 6 months after the winner announcement[cite: 423] |
| Common Service[cite: 423] | During performance events[cite: 423] | On-site events: Email, name, date of birth, phone number Online events: Email, name, date of birth, phone number, SNS account (KakaoTalk ID or LINE ID)[cite: 423] |
1 year after the event ends; however, non-winning participation info is kept for up to 3 months after the event ends[cite: 423] |
| Common Service[cite: 423] | Upon receiving customer consultations[cite: 423] | General inquiries: Email, inquiry content Purchase-related inquiries: Email, consultation details, phone number[cite: 423] |
Retained for 3 years after inquiry registration in accordance with relevant laws[cite: 423] |
| Common Service[cite: 423] | During SMS possession authentication[cite: 423] | Country code, mobile phone number[cite: 423] | Within 1 year after membership withdrawal or the period prescribed by relevant laws[cite: 423] |
| Common Service[cite: 423] | During marketing and promotions (providing advertising info, etc.)[cite: 423] | Email, automatically generated information (app push identifier, device info, etc.)[cite: 423] | 3 months after membership withdrawal or the period prescribed by relevant laws[cite: 423] |
| Common Service[cite: 423] | When accessing/using service, or providing reward services[cite: 423] | Automatically generated information by cookies, service utilization records (visit date/time, IP address, bad utilization records, etc.), device info (unique device identifier, OS version), connection country[cite: 423] | 3 months after service withdrawal or the period prescribed by relevant laws[cite: 423] |
The Service operated by the Company is not intended for children (under 14 years of age for domestic residents and under 14 years of age for foreigners).[cite: 424] If the Company becomes aware that it has collected personal information from a child, the Company will delete such information and terminate the member's account.[cite: 425] If you believe the Company has collected information from a child, please contact the address in "Article 13".[cite: 426]
The Company does not provide members' personal information to third parties unless the member consents or there are special provisions in relevant laws.[cite: 428] Furthermore, the Company may provide personal information without the member's consent within the scope reasonably related to the purpose of collection in accordance with relevant laws.[cite: 429]
The Company entrusts personal information processing to specialized companies or utilizes specialized platforms within the scope disclosed in this Policy when necessary for service utilization, contract execution, and member convenience.[cite: 431] The Company strictly monitors trustees to ensure safe processing through binding contracts.[cite: 432]
All personal information of the Company is stored within the region of the Republic of Korea.[cite: 434] For the purpose of providing services and enhancing member convenience, the Company may transfer or manage members' information overseas.[cite: 435] Members have the right to refuse the overseas transfer of their personal information;[cite: 436] however, in such cases, access to services that require the overseas transfer of personal information may be restricted.[cite: 437] If you do not wish for your information to be transferred overseas, you may withdraw from the service by logging into your FANNURI account, or you may request the suspension of your personal information processing through the Company’s Chief Privacy Officer (CPO) or the customer grievance department.[cite: 438]
In principle, when the Company collects personal information from a member, it uses and retains the personal information during the service utilization period.[cite: 440] The Company destroys personal information without delay when it becomes unnecessary, such as the expiration of the retention period or achievement of the processing purpose.[cite: 441]
When the purpose of collecting and using members' personal information is achieved, the Company destroys it in accordance with internal policies and other laws.[cite: 443] Electronic files are deleted using technical methods that cannot regenerate records, and paper printouts are shredded or incinerated.[cite: 444]
Members (data subjects) may exercise the following rights regarding their personal information managed by the Company in accordance with applicable laws:[cite: 446]
Inquiries and exercises of rights can be made through the contact details in Article 13, and the Company will process them without delay after verifying the requester's identity.[cite: 451] This service may also use web analytics tools such as Google Analytics to improve services and user experience.[cite: 452]
The Company may take reasonable measures to ensure safety so that members' personal information is not lost, stolen, leaked, altered, or damaged in processing members' personal information.[cite: 454] The technical measures for this purpose are as follows:[cite: 455]
Members' personal information is protected by passwords and encrypted information.[cite: 456] However, since a member's password or personal information is highly likely to be disclosed to others through various methods, such as using the internet in public places, it is of the utmost importance to thoroughly protect it.[cite: 457] Therefore, members must not leak or provide their personal information to others and must manage their own personal information responsibly.[cite: 458] The Company shall not be held liable for problems arising from such personal errors of members or the inherent risks of the internet.[cite: 459]
Members' personal information is basically protected by passwords and encrypted information, and important data is protected through separate security functions by encrypting files and transmitted data.[cite: 460] The Company takes measures to prevent damage caused by computer viruses using vaccine programs, and the vaccine programs are updated periodically.[cite: 461] To prevent members' personal information from being leaked or damaged due to hacking or viruses, the Company installs and operates intrusion detection and intrusion prevention systems from the outside, monitoring and managing them 24 hours a day.[cite: 462]
The Company recognizes the importance of protecting members' personal information, reasonably limits the number of staff members handling personal information for this purpose, and the Chief Privacy Officer (CPO) periodically conducts training for the handling staff to do their best to protect personal information.[cite: 463] In addition, the Company regularly checks the implementation matters specified in this policy and compliance by relevant employees to correct or improve violations, if any, and take other necessary measures.[cite: 464]
The Company uses cookies that store and frequently retrieve information about members.[cite: 466] A cookie is a small string of text information sent by a website server to a user's computer browser (Internet Explorer, Safari, Chrome, Firefox, etc.).[cite: 467] Cookies identify the member's computer but do not identify the member personally.[cite: 468] The Company uses the Google Analytics (Link to Terms) and Firebase (Link to Terms) APIs provided by Google (Link to Privacy Policy) for the purpose of service provision and statistical analysis.[cite: 469]
By adjusting your web browser, you can accept all cookies, receive a notification when a cookie is installed, or refuse all cookies.[cite: 476] However, if you refuse to store cookies, you may not be able to use some services that require a login.[cite: 477]
The method to specify whether to allow cookie installation (in the case of Internet Explorer) is as follows:[cite: 478]
(3) Cookies expire when closing the browser or logging out.[cite: 482]
(4) The Company collects and uses the minimum amount of online behavioral information to provide optimized services, such as customized advertisements, to users.[cite: 483, 484] Behavioral information refers to online activity information from which an individual's interest, preference, and disposition can be inferred or analyzed, such as website/app visit history, purchase, and search history.[cite: 485]
When providing services using behavioral information, such as customized advertisements, the Company collects only the minimum behavioral information and does not collect sensitive behavioral information that is likely to clearly infringe on an individual's rights, interests, or privacy, such as thoughts, beliefs, family and relative relationships, academic background, medical history, and other social activity history.[cite: 487] The Company does not collect behavioral information for the purpose of customized advertisements from online services whose primary users are children under the age of 14, and does not provide customized advertisements to them.[cite: 488]
The Company collects behavioral information from the services it operates as follows, and allows online customized advertising business operators to collect and process behavioral information.[cite: 490]
In accordance with Article 15 (3) and Article 17 (4) of the 「Personal Information Protection Act」, the Company may additionally use or provide personal information without the member's consent, taking into account the matters under Article 14-2 of the Enforcement Decree of the 「Personal Information Protection Act」.[cite: 492]
Accordingly, the Company considered the following items to make additional use or provision without the member's consent:[cite: 506]
The Company designates a personal information protection officer to protect members' personal information and handle complaints:[cite: 512]
The Company operates a customer counseling desk to address opinions and complaints raised by members regarding personal information protection, ensuring smooth communication and resolution.[cite: 518]
In the case of South Korea, if a dispute arises between a member and the Company regarding personal information protection and counseling on personal information infringement is required, you may contact the Personal Information Infringement Report Center of the Korea Internet & Security Agency, the Cyber Log-In (Cyber Bureau) of the National Police Agency, etc.[cite: 519]
This Privacy Policy is effective from April 17, 2025.[cite: 534]
The following items are additional provisions applied depending on the member's location or nationality.[cite: 538] In the event of any conflict between the following items and the main body of this Privacy Policy, the following items shall prevail.[cite: 539]
For the purposes of this section, the term "Personal Information" used in the main body of this Policy has the same meaning as "Personal Information" defined in "Article 1: Overview of Privacy Policy."[cite: 541] The following text is added as the last paragraph to "Article 1: Overview of Privacy Policy" in the main body.[cite: 542]
For the purposes of the GDPR and the UK Data Protection Act 2018, the data controller that determines how and why your personal information is processed and has primary responsibility for complying with applicable data protection laws is FANNURI.[cite: 544]
"Article 2" of the main body is replaced with the item below.[cite: 545]
Utilization for Marketing and Promotional Purposes: Individual sending of advertising information (events, promotions, etc.) via email and app notifications (conducted with the separate consent of the user)[cite: 547, 550, 551]
The Company processes members' personal information for the following purposes in accordance with relevant laws and regulations.[cite: 549]
The Company processes personal information to contact members via email, telephone, direct mail, or other communication methods to provide information about websites, apps, or services that members may be interested in. In addition, the Company processes personal information for the purpose of displaying content tailored to the member's use of the Company's website, app, or services.[cite: 583] When the Company provides a website, app, or service to a member, on the premise that prior opt-in consent from the member is always obtained to the extent required by relevant laws and regulations, the Company may use the contact information provided by the member or other appropriate means to send or display information about the Company's website, app, or services, upcoming promotions, and other information that the member may be interested in.[cite: 584]
Members can choose to be removed from the Company's promotional email list at any time simply by clicking the unsubscribe link included in all promotional electronic communications sent by the Company.[cite: 585] Please note that it may take up to 2 weeks to process a member's unsubscribe request, and communications may continue to be received from the Company during that period.[cite: 586] After a member unsubscribes, the Company will not send additional promotional emails, but in certain situations, the Company may continue to contact the member within the limit necessary for the purpose of the website, app, or service requested by the member.[cite: 587]
"Article 4" of the main body is replaced with the item below.[cite: 588]
The Company discloses personal information to other companies in accordance with relevant laws and regulations for legitimate business purposes and for the purpose of operating and providing the Company's website, app, or services to members.[cite: 590] Personal information is also disclosed to the following entities:[cite: 591]
When the Company enters into a contract with a third-party processor to process members' personal information, the following binding contractual obligations apply to the processor, along with additional requirements under relevant laws and regulations: (i) An obligation to process the personal information only in accordance with the prior written instructions of the Company (ii) An obligation to take measures to protect the confidentiality and security of the personal information.[cite: 602] For additional information regarding the third-party processors utilized by the Company, please refer to Article 5 of the Personal Information.[cite: 603]
"Article 6" of the main body is replaced with the item below.[cite: 604]
Due to the international nature of the Company's business, the Company transfers personal information to entities within the FANNURI group and third parties in connection with the purposes set forth in this Policy, as further specified in Article 6. For this reason, the Company transfers personal information to other countries, including South Korea, Japan, and the United States, where different laws and requirements may apply than the laws and data protection compliance requirements applicable in the country where the member is located.[cite: 606] Where an exemption or exception applies (e.g., where the transfer is necessary to establish, exercise, or defend a legal claim), the Company may rely on such exemption or exception as applicable.[cite: 607] If no exemption or exception applies and your personal information is transferred from the EEA or the UK to a recipient located outside the EEA or the UK, in a country not officially designated by the European Commission or the UK government as providing an adequate level of data protection, the Company transfers personal information based on standard contractual clauses adopted by the European Commission, adopted by a data protection supervisory authority and approved by the European Commission, or adopted by the UK government, as applicable.[cite: 608]
Members have the right to request a copy of these clauses using the contact information provided in "Article 13" below.[cite: 609] Please note that if a member directly transfers personal information to a FANNURI entity established outside the EEA or the UK, the Company is not responsible for the transfer of the member's personal information.[cite: 610] However, from the moment the Company receives the relevant personal information, it will process the member's personal information in accordance with the provisions of this Policy.[cite: 611]
"Article 8" of the main body is replaced with the item below.[cite: 612]
When a data subject exercises their rights, the Company may request identity verification procedures, such as email verification or a copy of an ID, to confirm identity.[cite: 614, 616] The Company destroys members' personal information in accordance with internal regulations and other relevant laws and regulations.[cite: 615]
The following text is added to the end of "Article 9" in the main body.[cite: 617]
In addition, this service may use web analytics tools, such as Google Analytics, to improve the service and enhance the user experience.[cite: 619, 621] In addition to the above rights, members possess all other legal rights.[cite: 620] Members may also hold the following additional rights regarding the processing of their personal information:[cite: 622]
"Article 11" of the main body does not apply.[cite: 626]
When a member uses the Company's website or app, the Company normally stores cookies on the member's device or checks cookies already stored, always after obtaining the member's prior consent if required by relevant laws and regulations.[cite: 628] For details, please check the Company's Cookie Policy.[cite: 629]
"Article 13" of the main body is replaced with the item below.[cite: 630]
Members may contact the DPO [privacy@fannuri.com] if they wish to exercise their rights in relation to this Policy or their personal information.[cite: 632] Members may also contact the representative.[cite: 633] Email: Fannuri Account: privacy@fannuri.com[cite: 634, 635]
"Article 14" of the main body does not apply.[cite: 636]
"Article 7" of the main body is replaced with the item below.[cite: 638]
The Company takes all reasonable measures to ensure that members' personal information is processed only for the minimum period necessary to achieve the purposes specified in this Policy.[cite: 640] The Company retains members' personal information in a form that permits identification of members only in any of the following cases: (1) Where the relationship between the Company and the member is ongoing (2) Where a valid legal basis exists for the Company to retain the member's personal information in accordance with the necessities related to the lawful purposes specified in this Policy.[cite: 641]
"Article 9" of the main body is replaced with the item below.[cite: 642]
In addition, this service may use web analytics tools, such as Google Analytics, to improve the service and enhance the user experience.[cite: 644, 646] When the Company collects, uses, and discloses personal information of California residents (hereinafter referred to as "California Consumers"), the Company is obligated under the CCPA to disclose the performance methods of each data processing activity described above.[cite: 645]
The categories of personal information that the Company has collected to date and will collect in the future regarding California Consumers are generally as follows:[cite: 648]
The services operated by the Company are not intended for children (under 14 years of age for domestic residents, and under 16 years of age for foreigners).[cite: 653] If the Company becomes aware that it has collected personal information from a child, the Company will delete such information and terminate the member's account.[cite: 654] If you believe that the Company has collected information from a child, please contact us using the contact information in "Article 13."[cite: 655]
The Company may use each of the above categories of personal information for all of the following business or commercial purposes:[cite: 657]
The sources from which the Company collects or acquires personal information of California Consumers are as follows:[cite: 674]
The Company does not sell (Sell) anyone's personal information to third parties, especially including the personal information of minors under the age of 16. The categories of personal information disclosed by the Company during the preceding 12 months and the categories of recipients who received the disclosed personal information are as follows:[cite: 686]
"Article 11" of the main body is replaced with the item below.[cite: 708]
Under California's so-called "Shine the Light" law, California residents have the right to request the Company to send a notice summarizing by category the customer information shared by the Company with third parties or affiliates of the Company in connection with direct marketing carried out by such third parties or affiliates.[cite: 710] The aforementioned notice not only describes the categories of information shared by the Company with third parties and affiliates but also includes a list of the names and addresses of those recipients.[cite: 711] If you are a California resident and need a copy of this notice, please submit a request for a copy of this notice to the email below. Email: Fannuri Account: privacy@fannuri.com[cite: 712, 713, 714]
Article 13 of the main body is replaced with the item below.[cite: 715]
If you are a California consumer, you have the rights listed below under the CCPA regarding your personal information.[cite: 717] When you or an authorized agent appointed by you makes a request to the Company to exercise the right to know and the right to delete as provided under the CCPA, the Company will generally receive certain personal information from you in the process of handling the request for the purpose of verifying your identity and compare it with the personal information collected by the Company to verify your identity ("Verifiable Consumer Request").[cite: 718] A verifiable consumer request for information disclosure or deletion may be submitted by any of the following methods: Phone Number: +82 70-7537-1338 | Email: privacy@fannuri.com[cite: 719, 720, 721, 722]
The Company provides consumers who provide personally identifiable information (name, address, email, etc.) and commercial information (purchase history, etc.) with the right to participate in FANNURI events.[cite: 742] As participants in these programs, consumers have the opportunity to win prizes.[cite: 743] The value of this personal information to the Company's business varies depending on the consumer's purchase history from FANNURI.[cite: 744] Consumers can participate in community events on an opt-in basis by signing up on the Company's website.[cite: 745] Consumers may withdraw participation from these events at any time.[cite: 746]
Under the CCPA, you may appoint an authorized agent to submit requests regarding the exercise of your rights on your behalf.[cite: 748] In this case, to protect the member and the Company, the Company requires the member's authorized agent to provide written permission signed by you proving that they have been granted the right to submit requests on your behalf.[cite: 749] Please be advised that if the authorized agent fails to submit such proof, the Company may deny the request.[cite: 750]
"Article 14" of the main body does not apply.[cite: 751]
For the purposes of this section, "relevant laws and regulations" and "related laws and regulations" in the main body are replaced with the Act on the Protection of Personal Information of Japan (Act No. 57 of 2003, as amended) and its related laws and regulations.[cite: 753]
The terms used in "Article 2" of the main body are replaced as follows.[cite: 754] The description in the main body is replaced with: "The purposes for which the Company uses members' personal information in each case in accordance with relevant laws and regulations are as follows."[cite: 755]
The following items are added to "Article 4 (Matters Concerning the Provision of Personal Information to Third Parties)" and "Article 5 (Entrustment of Personal Information Processing)" of the main body.[cite: 758]
In the status of third-party provision above, the following corporation corresponds to the Company's group enterprise.[cite: 760] The items of personal information to be jointly used, the scope of joint users, the purpose of use by the users, and the corporation responsible for the management of the relevant personal information data and the name of its representative are as follows:[cite: 761]
"Article 6 (Matters Concerning the Overseas Transfer of Personal Information)" of the main body is replaced as follows.[cite: 765]
Due to the international nature of the Company's business, the Company transfers personal information to entities within the FANNURI group and third parties in connection with the purposes set forth in this Policy, as further specified in Article 6. For this reason, the Company transfers personal information to other countries, including South Korea, Japan, and the United States, where different laws and requirements may apply than the laws and data protection compliance requirements applicable in the country where the member is located.[cite: 767]
Please check the "Current Status of Overseas Transfer of Personal Information" under "Article 6 (Matters Concerning the Overseas Transfer of Personal Information)" in the main body for the details of the Company's overseas transfer of personal information.[cite: 768] Please check the reference information below for the personal information protection systems applicable to the country or region where the recipient's business operator is located.[cite: 769]
※ Reference Information: Personal Information Protection Systems Outside of Japan where Personal Information is Provided[cite: 770]
"Article 12" of the main body does not apply.[cite: 771]
The following items are added to "Article 13" of the main body.[cite: 772]
"Article 14" of the main body does not apply.[cite: 776]