BPMG Website Privacy Policy

BPMG Co., Ltd. (the “Company”) takes the protection of users’ personal information seriously and complies with applicable privacy laws and regulations. This Privacy Policy applies to personal information processed through the official BPMG website operated by the Company (the “Site”).

Individual games and services introduced on or linked from the Site may be subject to separate privacy policies posted for those games or services.

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information to the extent necessary for the following purposes. If the purposes of processing change, the Company will take the measures required under applicable laws and regulations.

Receiving user inquiries, verifying users’ identities or contact information, and reviewing and responding to inquiries.
Analyzing Site usage and visitor statistics.
Improving the Site’s functionality, content, and user experience.
Identifying errors and service disruptions, maintaining security, and preventing unauthorized or fraudulent use.
Serving advertisements, managing ad frequency, measuring ad performance, and providing personalized advertisements in accordance with users’ choices.
Handling disputes and fulfilling obligations under applicable laws and regulations.

Article 2 (Categories of Personal Information Processed, Purposes, and Retention Periods)

1. Email Inquiries

Apart from login functionality for individual games, the Site does not currently offer its own separate account registration. If a Site-specific account system is introduced in the future, the categories of personal information to be collected and the purposes of collection will be incorporated into this Privacy Policy in advance. The inquiry feature uses a mailto link that opens the user’s email application or links to the Company’s email address.

Category	Personal Information Processed	Purposes of Processing	Retention and Use Period
Email inquiries	Email address, inquiry subject and content, and any name, contact details, attachments, or other information voluntarily included by the user	Receiving, reviewing, and responding to inquiries; handling disputes	For one year from the date on which handling of the inquiry is completed. However, if a dispute is ongoing or retention is required under applicable laws and regulations, the information will be retained until the relevant grounds for retention no longer apply.

Users must not include sensitive or important personal information that is unnecessary for their inquiries, such as resident registration numbers, financial information, or account passwords.

2. Information That May Be Automatically Processed During Use of the Site

Category	Personal Information Processed	Purposes of Processing	Retention and Use Period
Access and security logs	IP address, date and time of access, requested URL, browser and operating system information, device information, and error and security logs	Providing the Site, responding to service disruptions, maintaining security, and preventing unauthorized or fraudulent use	Up to three months from the date of creation. However, if retention is necessary for a security incident investigation or is required under applicable laws and regulations, the information will be retained until the relevant grounds for retention no longer apply.
Google Analytics	Cookie identifiers, device and browser information, date and time of access, visit and usage history, referral sources, and approximate location information	Analyzing visitor statistics and improving the Site	In accordance with the retention period configured by the Company in Google Analytics and Google’s policies.
Google AdSense	Cookie and advertising identifiers, device and browser information, IP address, visit history, ad impression and click records, and approximate location information	Serving advertisements, managing ad frequency, measuring ad performance, and providing personalized advertisements in accordance with users’ choices	Until the user withdraws consent or the cookies are deleted. The retention periods applied by Google and advertising technology providers are governed by each provider’s policies.

The Company does not transmit information that directly identifies users, such as their names or email addresses, to Google Analytics. However, IP addresses, cookie identifiers, and similar information may be processed by Google or relevant service providers.

Article 3 (Methods of Collecting Personal Information)

The Company processes personal information through the following methods.

Inquiries sent directly by users to the Company’s email address.
Automatic generation and transmission through web servers, cookies, tags, scripts, and similar technologies when users access or use the Site.
Processing through external providers of services such as Google Analytics, Google AdSense, and cloud infrastructure.

Article 4 (Disclosure of Personal Information to Third Parties)

As a general rule, the Company does not disclose users’ personal information to third parties.
The Company discloses personal information only in the following circumstances and to the extent permitted by applicable laws and regulations.
Where the user has given prior consent.
Where specifically provided for by law or necessary to comply with a legal obligation.
Where requested by an investigative authority or other relevant authority in accordance with the procedures and methods prescribed by law.
When advertisements are served through Google AdSense, Google and advertising technology providers for which the user has provided consent may directly process cookie and advertising identifiers and Site usage information. The Company allows users to identify these providers and review related information through the cookie consent interface or a separate linked page.

Article 5 (Outsourcing of Personal Information Processing)

The Company outsources the processing of personal information as follows to operate the Site.

Service Provider	Outsourced Services	Processing Location	Retention and Use Period
Amazon Web Services, Inc. and AWS entities under contract with the Company	Site hosting, server and data storage, security, and infrastructure operations	Republic of Korea (AWS Seoul Region)	Until the outsourcing agreement ends or the purpose of processing has been fulfilled. However, where retention is required under applicable laws and regulations, the information will be retained for the required period.
Google LLC	Website usage analytics and related technical support (Google Analytics)	Outside the Republic of Korea	For the period specified in Article 7.

When entering into outsourcing agreements, the Company includes provisions necessary to protect personal information in accordance with applicable laws and regulations, and manages and supervises service providers’ processing of personal information. Any changes to the service providers or outsourced services will be disclosed in this Privacy Policy.

Article 6 (Use and Management of Cookies)

The Company may use cookies and similar technologies to provide the Site, analyze usage, and serve advertisements. Cookies are small data files that a website stores in a user’s browser.
Cookies used on the Site are classified as follows.
Essential cookies: Cookies necessary for the Site’s basic functionality, security, and storage of users’ cookie preferences.
Analytics cookies: Cookies used to analyze visits to and usage of the Site.
Advertising cookies: Cookies used to serve advertisements, manage ad frequency, measure ad performance, and provide personalized advertisements.
Where required by applicable laws and regulations or applicable platform policies, the Company obtains users’ consent before activating analytics or advertising cookies.
Users may refuse or withdraw consent to optional cookies through the Site’s cookie settings interface. Users may also configure their browser settings to block the storage of cookies or delete cookies that have already been stored.
Users can continue to use the Site’s basic functionality even if they reject optional cookies. However, visitor analytics may be limited, or general or limited advertisements may be displayed instead of personalized advertisements.

Article 7 (Processing of Behavioral Information and Personalized Advertising)

The Company may process online behavioral information as described below to analyze Site usage and serve advertisements based on users’ interests.

Category	Details
Parties collecting and processing behavioral information	The Company, Google LLC, and advertising technology providers for which the user has provided consent
Behavioral information collected	Pages visited, times of access and use, referral sources, ad impression and click records, cookie and advertising identifiers, device and browser information, and approximate location information inferred from IP addresses
Collection methods	Automatic collection through cookies, Google tags, scripts, and similar technologies installed on the Site
Purposes of use	Analyzing Site usage statistics, improving services, serving advertisements, managing ad frequency, measuring ad performance, and providing personalized advertisements
Retention and use period	Google Analytics information: for the period configured by the Company. Advertising-related information: until the user withdraws consent or for the retention period specified in each advertising technology provider’s policies.

Users may use the Site’s cookie settings or the following methods to restrict personalized advertising and the processing of behavioral information.

Google Ad Settings: https://myadcenter.google.com
Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout
Browser-specific settings for blocking or deleting cookies.

Article 8 (Cross-Border Transfers of Personal Information)

When the Site uses Google Analytics and Google AdSense, users’ information may be transferred to or processed in other countries as follows.

Recipient	Destination Countries	Personal Information Transferred	Purposes of Transfer	Timing and Method of Transfer	Retention and Use Period
Google LLC and Google advertising technology providers for which the user has provided consent	The United States and countries in which Google or the relevant provider processes personal information	Cookie and advertising identifiers, IP address, device and browser information, access and usage records, referral sources, ad impression and click records, and approximate location information	Website usage analytics, ad serving, ad performance measurement, security, and provision of related services	Transmitted from time to time over encrypted networks when users access or use the Site	Google Analytics information: for the period configured by the Company. Advertising-related information: until the user withdraws consent or for the retention period specified in each provider’s policies.

Further details about cross-border transfers and recipients’ contact information are available in the Google Privacy Policy (https://policies.google.com/privacy) and through the Site’s cookie settings interface.
Users may refuse cross-border transfers for Google Analytics and personalized advertising purposes by rejecting optional cookies or withdrawing their consent.
Users can continue to use the Site’s basic functionality even if they refuse cross-border transfers. However, visitor analytics may be limited, or general or limited advertisements may be displayed instead of personalized advertisements.
AWS servers are not included in the scope of cross-border transfers under this Article, on the assumption that they are located in an AWS region in the Republic of Korea. If personal information is processed outside the Republic of Korea in the future through overseas backups, the use of overseas regions, or technical support from abroad, the Company will update this Privacy Policy accordingly and follow the necessary procedures.

Article 9 (Retention and Use Periods for Personal Information)

The Company destroys personal information without delay once the purpose of processing has been fulfilled or the retention period has expired.
If a user requests deletion of their personal information, the Company will take action without delay in accordance with applicable laws and regulations.
Where retention of personal information is required under applicable laws and regulations, the Company stores such information separately from other personal information for the period prescribed by law.
Retention periods for information processed independently by external service providers may be governed by the relevant providers’ policies and users’ settings.

Article 10 (Procedures and Methods for Destroying Personal Information)

The Company identifies personal information whose retention period has expired or whose processing purpose has been fulfilled for destruction, and destroys it in accordance with internal procedures.
Personal information that must be retained under other laws and regulations is kept in a separate database or storage location and destroyed when the applicable retention period ends.
Electronic files are securely deleted in a manner that makes recovery or reconstruction difficult, while paper records and other recording media are destroyed by shredding, incineration, or similar methods.

Article 11 (Rights of Users and Their Legal Representatives and How to Exercise Them)

Users may exercise the rights provided under applicable laws and regulations in relation to the Company’s processing of their personal information, including the rights to request access, rectification, deletion, or suspension of processing, to withdraw consent, and to opt out of communications.
Users may exercise the rights set out in paragraph 1 of this Article by contacting the Data Protection Officer identified in Article 15.
Where a user’s legal representative or duly authorized agent exercises these rights, the Company may request documentation verifying their authority to act, such as a power of attorney.
The Company may request the minimum information necessary to verify that the person exercising these rights is the user concerned or a duly authorized representative.
The Company may restrict or refuse all or part of a request to exercise rights where grounds for doing so exist under applicable laws and regulations. In such cases, the Company will provide the reasons and information on how to raise an objection.

Article 12 (Personal Information of Children Under the Age of 14)

The Company designs and operates its services so that they are not primarily directed at children, and does not knowingly collect personal information from children below the minimum age permitted under applicable laws and regulations without the required parental or guardian consent. The minimum age varies by country and is generally 13, although an age threshold of 14 or 16 applies in some countries.
If the Company confirms that personal information of a child below the minimum age permitted under applicable laws and regulations has been provided without the consent of the child’s legal representative, it will take the necessary measures, including deletion, in accordance with applicable laws and regulations.

Article 13 (Measures to Safeguard Personal Information)

The Company implements the following administrative, technical, and physical measures to safeguard personal information.

Minimizing the number of personnel who handle personal information and the scope of their access privileges, and regularly reviewing those privileges.
Implementing access controls and managing access logs for personal information processing systems.
Implementing encryption measures necessary to protect personal information, including encryption in transit.
Implementing safeguards against malware, intrusions, and security incidents.
Providing training to personnel who handle personal information and implementing an internal management plan.
Managing access to facilities and media where personal information is stored.

Article 14 (External Websites and Services)

The Site may contain links to external websites, app marketplaces, communities, or third-party services. The processing of personal information after a user follows such a link to an external service is governed by the privacy policy of the operator of that external service.

Article 15 (Data Protection Officer and Contact Information)

The Company has designated the following Data Protection Officer to oversee matters relating to the processing of personal information and to assist users with inquiries, complaint handling, and the exercise of their rights.

Data Protection Officer: Jong-ho Moon, Director
Position: DPO
Email: privacy@bpmg.biz
Address: 371 Sapyeong-daero, Seocho-gu, Seoul (Postal Code: 06541)

Article 16 (Jurisdiction-Specific Rights)

The Company complies with the privacy laws of the country in which a user is located, to the extent such laws apply, and users may exercise their rights under the terms and conditions to the extent recognized by the laws of their location. The specific scope of rights—including access, rectification, deletion, suspension of processing, withdrawal of consent, and data portability—as well as the procedures for exercising those rights and the Company’s response deadlines may vary depending on applicable law.

Users may exercise their rights or submit inquiries using the contact details in Article 15, and may lodge a complaint with the supervisory authority in their jurisdiction.

The Company does not sell personal information for monetary consideration. However, the Company may disclose advertising identifiers and similar information for personalized advertising purposes. In such cases, users may opt out through the customer support page or by email. The Company will not treat users less favorably with respect to service pricing because they opt out.

Article 17 (Changes to This Privacy Policy)

The Company may amend this Privacy Policy if applicable laws and regulations, the Site’s functionality, or the manner in which personal information is processed changes.
When this Privacy Policy is amended, the Company will provide notice on the Site of the effective date, the changes, and the reasons for the changes. Where a change materially affects users’ rights, the Company will provide sufficient advance notice.
Previous versions of this Privacy Policy will be retained and made available for users to review.

Article 18 (Effective Date)

This Privacy Policy is effective as of September 1, 2026.

This Privacy Policy becomes effective on September 1, 2026.