POLICY
NEXON Korea Corporation (hereinafter "NEXON") complies with the Personal Information Protection Act of the Republic of Korea ("Personal Information Protection Act") and related laws to protect the freedom and rights of users, lawfully processing and safely managing personal information.
Accordingly, pursuant to Article 30 of the Personal Information Protection Act, NEXON establishes and discloses the following Privacy Policy to inform users of the procedures and standards regarding personal information processing and to ensure that related grievances are handled promptly and smoothly.
This Privacy Policy applies to the NYPC services provided by NEXON.
Table of Contents
Items of Personal Information Collected
Purpose of Processing Personal Information
Matters Concerning the Processing of Personal Information of Children Under 14
Outsourcing of Personal Information Processing
Cross-Border Transfer of Personal Information
Criteria for Additional Use or Provision of Personal Information
Retention Period and Destruction of Personal Information
Rights of Users and Legal Representatives
Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
Nexon's Efforts to Protect Personal Information
Chief Privacy Officer and Report Center
Miscellaneous
1. Items of Personal Information Collected
NEXON collects only the personal information necessary for using the service and provides detailed information to users about the items of personal information collected.
What is Required Information?
Personal information collected to provide basic services.
What is Optional information?
Personal information collected to provide additional services other than the basic services.
Personal Information Items Processed with User Consent
NEXON processes the following personal information items with the user's consent in accordance with Article 15, Paragraph 1, Item 1 and Article 22, Paragraph 1, Item 7 of the Personal Information Protection Act.
Member Registration: [Required Information] ID, nickname, password, name, date of birth, nationality, email address, mobile phone number
Participation Application and Competition Operation: [Required Information] ID, nickname, name, date of birth, nationality, email address, mobile phone number, affiliation, address, top size of clothes
Delivery of Notices: [Required Information] email address, mobile phone number
Prize Payment and Delivery: [Required Information] name, mobile phone number, address
Scholarship Payment: [Required Information] account holder name, bank name, account number
NYPC News Information: [Optional Information] email address, mobile phone number
Personal Information Items Processed without User Consent
NEXON processes the following personal information items without the user's consent in accordance with Article 15, Paragraph 1, Item 2 of the Personal Information Protection Act.
Processing of Taxes and Public Utility Charges: [Required Information] Resident registration number, address, name, mobile phone number
Legal Basis: Articles 21, 127, and 164 of the Income Tax Act of the Republic of Korea
Information automatically generated during the course of using the service (IP, access logs, service usage records, download records, cookies) and information that can identify the device (OS information, hardware information, MAC Address) may be collected for purposes such as securing service stability, preventing fraudulent users, protecting accounts, and restricting acts that violate laws and NYPC Terms and Conditions.
2. Purpose of Processing Personal Information
NEXON uses personal information for the following purposes. If the purpose changes, NEXON will implement necessary measures such as obtaining separate consent from the user.
To manage members, such as identifying users and verifying their identity.
To operate the competition, including selecting participants and winners, managing award history and grades, issuing competition-related documents, providing prizes and scholarships, and processing taxes and public utility charges.
To provide various services and news related to NYPC.
To confirm intention to participate in events, provide prizes to event participants, and process taxes and public utility charges.
To deliver notices for the operation of the NYPC service.
To respond to inquiries, handle complaints, and improve user services.
To create a safe service environment and prevent fraudulent use.
To conduct analysis for improving the NYPC service and securing its stability.
3. Matters Concerning the Processing of Personal Information of Children Under 14
NEXON does not collect or process the personal information of children under 14 years of age on the NYPC website. If we become aware that the personal information of a child under 14 has been provided on the site, we will take immediate measures to delete it.
4. Outsourcing of Personal Information Processing
NEXON manages and supervises companies entrusted with NEXON's work to ensure they safely process users' valuable personal information, and restricts them from re-entrusting it to another company without NEXON's prior approval.
To provide better services, NEXON entrusts personal information processing tasks as follows:
RESPACE COMPANY Co., Ltd. . (subcontractor: Jsonepick . (Inquiry Response))
Purpose: Competition operation, inquiry response, delivery of notices, prize money payment, prize delivery, processing of taxes and public utility charges
PRONE Co., Ltd (subcontractor: Coulink (Prize Delivery), PETA AD TECH Co., Ltd. (Event Item Production))
Purpose: Delivery of notices, inquiry response, prize delivery, processing of taxes and public utility charges, event item production
DAOU TECHNOLOGY INC.
Purpose: Sending text messages and Kakao Biz messages, inquiry response
5. Cross-Border Transfer of Personal Information
To provide smooth and stable services, Nexon transfers personal information to recipients located outside the Republic of Korea.
Pursuant to Article 28 (8) Paragraph 1, Subparagraph 3 of the Personal Information Protection Act, NEXON stores and entrusts personal information overseas as set out below, to the extent necessary for the conclusion and performance of contracts. Users may refuse the cross-border transfer of their personal information by contacting the Chief Privacy Officer or the customer service center. Please note, however, that in such cases, the use of services involving cross-border transfer of personal information may be restricted.
Items: Nickname
Country: Japan
Transfer Timing and Method: Transmitted via network at the time of service use
Recipient: Amazon Web Services Inc. (aws-korea-privacy@amazon.com)
Purpose: Operation and management of cloud servers
Retention and Use Period: 1 year from the end of the competition
Items: Email address, mobile phone number
Country: Germany
Transfer Timing and Method: Transmitted via network upon message dispatch
Recipient: Infobip (data-protection-officer@infobip.com)
Purpose: Sending messages
Retention and Use Period: 1 year after message dispatch
6. Criteria for Additional Use or Provision of Personal Information
NEXON may additionally use or provide personal information without the user's consent in accordance with relevant laws.
NEXON considers the following criteria when determining additional use or provision without the user's consent:
Whether it is relevant to the original purpose of collection.
Whether there is predictability of additional use or provision of personal information in light of the circumstances under which it was collected or the processing practices.
Whether it unfairly infringes on the interests of the user.
Whether necessary safety measures, such as pseudonymization or encryption, have been taken.
7. Retention Period and Destruction of Personal Information
NEXON destroys personal information without delay when it becomes unnecessary, such as upon the expiration of the retention period or achievement of the processing purpose.
Cases where personal information is destroyed after being stored for a certain period in accordance with relevant laws of the Republic of Korea are as follows:
Act on Protection of Communication Secrets, Article 15(2)
Records regarding logins: 3 months
Framework Act on National Taxes Article 85(3), Income Tax Act Article 160 (2)
Records regarding processing prescribed by tax laws: 5 years
Cases where personal information is destroyed due to the expiration of the retention period or achievement of the processing purpose are as follows:
In case of membership withdrawal, information collected for service provision is stored for 30 days from the withdrawal date for the purpose of resolving consumer complaints and disputes, and then deleted.
Information collected for participation applications, competition operations, and inquiry responses is stored for 1 year from the end date of the competition and then deleted.
Fraudulent use records are stored for 1 year from the end date of the competition to prevent fraudulent use, and then deleted.
Information collected for events and related matters, is stored for up to 1 year; however, this may vary by event, and the period stated on the individual event page takes precedence.
Text message/email transmission history is stored for 1 year from the date of transmission and then deleted.
The method of destroying personal information is as follows:
Personal information recorded and stored in the form of electronic files is destroyed in a way that the records cannot be reproduced.
Personal information recorded and stored in paper documents is destroyed by shredding or incineration.
8. Rights of Users and Legal Representatives
Users have the right to view, correct, delete, suspend the processing of, and withdraw consent for their personal information, and NEXON proactively takes necessary measures to guarantee these rights.
Users can directly view, correct, or delete their personal information at any time at [NYPC Website] > [My Page] > [Edit My Information].
Users can withdraw consent for collection and use or withdraw their membership at any time at [NYPC Website] > [My Page] > [Edit My Information] > [Withdraw Membership].
Users can request the viewing, correction, deletion, suspension of processing, or withdrawal of consent for personal information from the Chief Privacy Officer at any time via phone, email.
9. Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
Nexon uses cookies and analyzes web logs to provide smooth services and improvements, and users have the right to refuse this.
Cookies
A cookie is a small text file sent by the server (http) used to operate the website to the user's browser, which is stored on the user's computer or mobile device.
NEXON uses cookies to provide users with a convenient website usage environment and to improve services by identifying users' connection records and usage patterns.
Users can set their web browser and mobile device settings to allow or block cookies.
Allow/Block Cookies in Web Browsers
Chrome: Select the 'three dots' at the top right of the web browser (Shortcut: Alt+F) > New Incognito window (Shortcut: Ctrl+Shift+N)
Edge: Select the 'three dots' at the top right of the web browser (Shortcut: Alt+F) > New InPrivate window (Shortcut: Ctrl+Shift+N)
Allow/Block Cookies in Mobile Browsers
Chrome: Select the 'three dots' at the top right of the mobile browser > New Incognito tab
Safari: Mobile device Settings > Safari > Advanced > Block All Cookies
Samsung Internet: Select the 'Tabs' icon at the bottom of the mobile browser > Turn on Secret mode > Start
10. NEXON's Efforts to Protect Personal Information
NEXON is actively making efforts to protect users' valuable personal information.
Establishing and implementing an internal management plan for personal information protection.
We establish and implement an internal management plan that includes procedures for designating a Chief Privacy Officer, access control, security measures, and inspections.
Encrypting personal information.
Important personal information, such as passwords, unique identification information, and email addresses, is encrypted and stored. Such encrypted personal information is safely transmitted using encrypted communication.
Continually taking an interest in technologies to protect personal information.
We detect and block intrusions by hackers 24 hours a day. In addition, we install and operate anti-virus programs to prevent infection by malicious code or viruses.
Minimizing the number of employees handling personal information.
Only a minimum number of employees handle personal information, and PCs that process personal information are blocked from using the external internet or are subject to equivalent protective measures to reduce the risk of personal information leakage.
Safely managing the locations where personal information is stored.
We establish and operate access control procedure standards so that only authorized persons can access locations where personal information is stored.
Conducting regular training and campaigns.
We emphasize the importance of personal information through regular training and campaigns focused on personal information protection.
Receiving verification for information security activities from domestic and international certification bodies.
We acquire certifications for our information security activities every year from domestic and international information security certification bodies.
11. Chief Privacy Officer and Report Center
NEXON designates a Chief Privacy Officer and a department in charge of personal information to protect users' personal information and handle related complaints.
Users may inquire about matters related to personal information protection, complaint handling, and damage relief to the Chief Privacy Officer and the responsible department.
Chief Privacy Officer
Name: Jae-in Lee
Position: Head of Global Security Division
Phone Number: 0502-258-9872
Email Address: privacy@nexon.co.kr
Department Receiving/Processing Requests for Viewing Personal Information: Privacy Protection Department
For other damage relief and counseling regarding personal information infringement, you can contact the following organizations:
Personal Information Infringement Report Center
Phone Number: 118 (without area code)
Website: https://privacy.kisa.or.kr
Personal Information Dispute Mediation Committee
Phone Number: 1833-6972 (without area code)
Website: https://www.kopico.go.kr
Supreme Prosecutors' Office Cyber Investigation Division
Phone Number: 1301 (without area code)
Website: https://www.spo.go.kr
National Police Agency Cyber Investigation Bureau
Phone Number: 182 (without area code)
Website: https://ecrm.police.go.kr
12. Miscellaneous
If there is any change in the content of the Privacy Policy, we will notify you at least 7 days before the revision. However, if there is a significant change in user rights, we will notify you at least 30 days in advance.
Supplemental terms – Jurisdiction-specific
VIETNAM
If you are accessing or using our services from Vietnam, the following additional terms apply. In the event of any conflict between the following additional terms and the provisions of the main body of this policy, the following terms shall prevail.
Processing of sensitive personal information
Among the information listed in Section 1(1) above, sensitive personal data includes the following: ID password, bank account holder name, bank name, and account number.
Processing without consent
To the extent permitted by Vietnamese laws, NEXON may process the following personal data without your consent where such processing is necessary to:
serve the activities of competent state authorities and state management activities in accordance with the laws, including compliance with applicable tax, accounting and reporting obligations – Relevant personal data in this regard includes: resident registration number or equivalent data, name, address, and mobile phone number; or
perform the service agreement with you, specifically maintaining service stability, protect accounts, prevent fraudulent users during our service provision – This may include processing of information automatically generated during your use of the service (including IP address, access logs, service usage records, download records and cookies) and device-identifying information (including OS information, hardware information and MAC address).
Data subject's rights and obligations
Subject to certain exceptions, you have statutory rights and obligations under applicable laws. In particular, you have the following statutory rights:
Right to know;
Right to consent and withdraw consent;
Right to access;
Right to delete data;
Right to restrict data processing;
Right to be provided with data;
Right to object data processing;
Right to complain, denounce or initiate lawsuits;
Right to claim for damages; and
Right to self-protection.
You have the following statutory obligations:
Protect your own personal data;
Request other relevant organizations and individuals to protect your personal data;
Respect and protect personal data of others;
Provide complete and accurate personal data upon giving consent to the processing of your personal data; and
Other obligations under applicable laws.
Additional processing purpose for finalists travelling to Korea
To arrange and support finalists’ travel to, entry into, stay in Korea in connection with their participation in the NYPC final round, Nexon, along with its designated agent, collect and process the following [Required Information]: name, date of birth, nationality, email address, mobile phone number, passport information, emergency contact information, and other information necessary for travel, entry, stay and logistics support. Where strictly necessary, health-related information may also be collected.
Nothing in this Privacy Policy shall be construed as a waiver or limitation to statutory consumer rights that cannot be contractually limited under applicable laws.
Announcement Date: June 04, 2026
Effective Date: June, 04, 2026