Kebijakan Privasi

1. Personal Data Processed

The Company processes the items below at each point of use. At sign-up it takes only the items needed to open an account; the items needed to register a brand are taken separately at the registration stage.

a. Prospective-owner sign-up

b. Franchise sign-up

c. Brand registration (franchise members)

The brand name, industry, brand description, main products, logo and store photographs, number of domestic stores, investment range, franchise type, target countries and overseas expansion history are information about a corporation and a brand and are not included in the tables above. Where such information is registered with content by which an individual can be identified, that part is likewise treated as personal data and processed under this policy.

d. Inquiries (available to non-members as well)

e. Information generated automatically during use

• An authentication cookie that keeps the user logged in. It is issued by the authentication service and expires on logout or when its validity period passes.
• A language cookie that remembers the display language
• Records kept per account by the authentication service, such as the time of sign-up and the time of the most recent login
• A hash of the connecting IP address, generated when an inquiry is received. The original IP address is not stored. Section 6 sets this out in detail.
• The time and content of any error, recorded in the server operation log

The Company has not placed any separate analytics tool in the Service that collects advertising identifiers or behavioural data.

2. Purposes of Processing

The Company does not use personal data beyond the purposes above, and where a purpose changes it obtains separate consent.

3. Retention Periods and Destruction

Where applicable law requires retention for a set period, the data is kept for the period that law prescribes and is not used for any purpose other than retention during that period.

When a member account is deleted, the profile, registered brands and saved-brand records linked to that account are deleted with it. Inquiry records already received are not deleted; they remain with the link to the sender's account identifier and to the brand severed.

The method of destruction is as follows. Information held in the database is deleted as a record; files such as business registration certificates and photographs are deleted from storage. Copies held in backups operated by an entrusted provider are removed progressively according to that provider's backup cycle.

4. Provision to Third Parties

As a rule the Company does not provide personal data to third parties. Given the nature of the Service, however, it provides data in the two cases below with the consent of the data subject.

a. Provision to the brand an inquiry names

The provision below occurs at the moment an inquiry is received.

An inquiry is relayed to the business operator that registered the brand as soon as it is received. The Company does not operate a step in which it reviews the content first and approves the relay, because naming a particular brand in an inquiry is itself a request to contact that brand. The scope of the relay is not a promise in prose but a database access rule, so an inquiry cannot be retrieved from the account of any business operator other than the one that registered the brand named in it.

Provision is limited to brands whose registration the Company has approved. An inquiry addressed to a brand that is under review or has been rejected is not relayed to that brand's business operator.

The Company may block a received inquiry that is spam or does not fit the purpose of the Service. A blocked inquiry can no longer be retrieved from the brand operator's account from that moment on, although content already relayed before the block is not recalled. Whether or not an inquiry is blocked, the record of receipt is kept for the retention period in section 3.

At the moment of receipt the same notification also goes to the Company's operations staff. That is internal processing and does not constitute provision to a third party. The sending of that notification email is entrusted as set out in section 5.

The notification email sent to the brand business operator does not carry the inquirer's contact details. The inquiry content, including contact details, is viewed by that business operator after signing in to their own account.

A general inquiry that does not name a particular brand is relayed only to the Company's operational address, and no provision to a third party occurs.

b. Provision to partner companies

The Company issues viewing accounts to partner companies that support overseas expansion consulting and local execution. A partner company can see only the items the Company has designated for that account. That scope is not a promise in prose but a database query rule, so items that have not been designated cannot be retrieved at all.

A partner company may ask the Company to add items, and those items open only where the Company approves. A request alone opens nothing, and the decision and its time are kept as a record.

Items by which an individual can be identified and contacted directly, such as name, email address and telephone number, are designated only where the data subject has consented. Those items are not provided to partner companies for a data subject who has not consented.

The Company may provide personal data to the extent required where an investigative authority or similar body requests it through lawful procedure under applicable law.

5. Entrustment of Processing

The Company entrusts the processing of personal data as set out below in order to operate the Service. Each entrustment agreement includes provisions on the safe management of personal data, and the Company manages its processors so that they do not process personal data beyond the entrusted purpose.

Where the content of the entrusted work or the processor changes, the Company gives notice through this policy.

6. Overseas Transfer of Personal Data

Every system provider the Company uses is headquartered outside Korea. Using the Service therefore transfers personal data overseas as set out below. A data subject may refuse this transfer, but on refusal cannot use the main functions of the Service, such as signing up and sending inquiries.

a. Supabase, Inc.

b. Resend, Inc.

c. Google LLC (planned, not currently in use)

The Company plans to introduce machine translation so that registered content and interface text can be offered in several languages. That feature is not yet in use on the Service, so the transfer described below does not currently occur. This policy will be amended to give notice of the date it takes effect before the feature is applied.

Once the hosting provider is finalised, the overseas transfer relating to that provider must also be added to this section.

7. Automatically Collected Information and Cookies

The Company uses cookies to keep users logged in and to retain the display language. A data subject may refuse the storage of cookies in their browser settings, but on refusing the authentication cookie cannot use features that require a login.

When an inquiry is received, the Company does not store the connecting IP address as it is. It combines the IP address with a random string held only on the server, produces a one-way hash and stores only that value. The value is used solely to check whether repeat requests come from the same place, and the original IP address cannot be recovered from the stored value. The Company does not accept more than three inquiries per hour from the same email address or the same hash value.

The Company has not placed any third-party tracking tool for advertising or behavioural analysis in the Service. Should one be introduced, this policy will be amended to give notice.

8. Rights of the Data Subject and How to Exercise Them

A data subject may exercise the following rights against the Company at any time.

1. Request access to personal data
2. Request correction where there is an error
3. Request deletion
4. Request suspension of processing
5. Withdraw consent to the processing of personal data

Rights may be exercised by writing to nick.choi@expandglobal.kr or through the inquiry form on the Service. The Company acts within ten days of receiving a request and reports the outcome. Where action is delayed, it gives notice of the reason and the expected period.

A data subject may also exercise these rights through a legal representative or a duly authorised agent. In that case the Company may request a written document evidencing the authorisation.

On receiving a request for access, correction or deletion, the Company verifies that the person making the request is the data subject or a legitimate representative. Where the law restricts access, or where there is a risk of unduly infringing the life or property of another person, the Company may restrict the request and gives notice of the reason.

Withdrawing consent or requesting deletion may restrict use of the Service or terminate the account.

9. Personal Data of Children Under 14

This Service is aimed at business operators and adults preparing to start a business, and does not accept sign-ups from children under 14. The sign-up process does not currently collect a date of birth or age, so no separate age-verification step is in place. Where the Company confirms that the personal data of a child under 14 has been collected without the consent of a legal representative, it destroys that data without delay.

10. Measures to Secure Personal Data

The Company takes the following measures to secure personal data. Only measures currently in place are listed below.

• Minimising access rights. Permissions are divided in the database at the item level and the record level, so the items non-members and members can each view are restricted at the database level. The name and contact details of a brand contact, the storage path of a business registration certificate and the review state are granted to no user role and are reachable only by the server.
• A record-level security policy is applied so that a member's own account information can be retrieved only by that member and by administrators.
• Business registration certificates and store photographs are held in storage that is not public and are served only to users with viewing rights, through addresses valid for a limited time. A business registration certificate may be viewed only by the member who submitted it and by administrators.
• Passwords are converted one-way by the authentication service before storage, so not even the Company can know the original password. Passwords must be at least eight characters and must combine letters, digits and special characters.
• For the connecting IP address recorded when an inquiry is received, only the hash is stored, not the original.
• Communication between the user's browser and the server takes place only over an encrypted connection.
• Administrator rights required for review and operations are granted through a separate role. The review state and the time of approval are controlled in the database so that only administrators can change them.
• A record-level security policy is applied so that a received inquiry can be read only by the Company and by the business operator that registered the brand named in it. That business operator cannot itself change the handling state or the content of an inquiry addressed to it, and the database enforces that restriction immediately before writing.

Encryption at the storage level and backup management follow the measures provided by the entrusted providers.

11. How Consent Is Obtained

On the sign-up screen the Company presents consent to the Terms of Service and consent to the processing of personal data as separate items, and sign-up completes only when both are agreed to. The Company records the time of each consent in the account information and keeps it so that the fact of consent can be evidenced.

On the prospective-owner sign-up screen, consent to provision to brands and partner companies is obtained as an item separate from the two above. Consent for the Company to use personal data and consent to provide it to another business are different things, so they are presented as separate items and the time of each is recorded separately. The name, email address and telephone number of an account without this consent are not provided to partner companies. This is not a promise in prose but a query rule, so even where the Company designates those items, they are not returned for that member.

In the inquiry form, consent to the collection and use of personal data and to the provision to a brand operator under section 4 is obtained at the moment the inquiry is submitted. Without that consent an inquiry cannot be submitted. The consent obtained is consent to provision, at the moment the inquiry is received, to the business operator of the brand named in it. No such provision arises for a general inquiry that does not name a brand.

The Service can be used without agreeing to optional items. Where a required item is not agreed to, the feature concerned cannot be used.

12. Data Protection Officer and Access Request Channel

The Company has designated a data protection officer to oversee work relating to the processing of personal data and to handle inquiries and complaints from data subjects.

A data subject may submit matters relating to the processing of personal data, complaint handling and remedy for harm to the channel above. The Company responds to submissions without delay.

13. Remedies for Infringement of Rights

To obtain a remedy for infringement of personal data rights, a data subject may apply to the bodies below for dispute mediation or advice. These bodies are separate from the Company and may be used where the data subject is not satisfied with the Company's handling or needs more detailed help.

Where a right or interest has been infringed by the disposition or omission of a public authority in respect of a request under Articles 35 to 37 of the Personal Information Protection Act, an administrative appeal may be brought under the Administrative Appeals Act.

14. Changes to this Privacy Policy

This Privacy Policy applies from 1 August 2026.

Where the content of this policy is added to, deleted or corrected in line with changes in the law or in the Service, the change and its effective date are announced on the Service from seven days before that date. Where a change materially affects the rights of data subjects, such as a change to the items collected, the purposes of use, entrustment or overseas transfer, the announcement is made from thirty days before the effective date and, where necessary, consent is obtained again.

The Company keeps a revision history so that earlier versions of this policy can be consulted.

15. Business Information