1. Purpose of Processing Personal Information

Walt Disney Company Korea LLC (“TWDC Korea”) processes personal information for the following purposes.

(1) Provision and management of services and products of Walt Disney Family of Companies, including Disney+ services
Personal information will be processed for the purpose of providing access and/or subscription to services and products offered by The Walt Disney Family of Companies in Korea, as applicable, including the Disney+ services, and for identification, verification, maintenance and management of subscription eligibility, prevention of fraudulent use of services, and user authentication and confirmation. For example, retrieval/re-setting of account username or password, various notifications and complaints.

(2) Provision and operation of Disney+ services
Process personal information for the purpose of operating and providing the services, including providing content and functionality, personalizing, customizing, securing and preventing inappropriate use, obtaining, developing, maintaining and improving content.

(3) Manage payment for subscription services
Personal information is processed for the purpose of billing, processing, re-subscribing after cancellation or cancellation, or processing payments including refunds for subscription services.

(4) Customer Service (CS) and customer chat inquiry service
Personal information is processed for the purpose of identifying customers and resolving customer inquiries in the course of customer consultation, including through chat.

(5) Authentication of adults to access certain content
Personal information is processed for the purpose of determining whether to restrict subscription to the services and access to certain content by verifying identity and age.

(6) Marketing and advertising
Processing personal information for marketing and advertising purposes such as email marketing, push notifications and the provision of in-app messages, to support targeted advertising, to identify and acquiring new customers, marketing analytics, enhancing statistical models to better understand customer preferences, and excluding specific users from certain marketing campaigns.

(7) Research and analysis
Process personal information to obtain and analyze data for the purpose of research and to improve services and the user experience.

(8) Subscriber selection management
We process personal information to manage subscriber content, rating and marketing preferences as selected by subscriber and to provide our services to the subscriber in accordance with such selections.

If the purpose of use of personal information changes, to the extent necessary, we will establish a legal basis for the processing personal information for such changed purpose in accordance with the Personal Information Protection Act of Korea (“PIPA”).

2. Types of Personal Information Processed and Period of Processing and Retention

TWDC Korea processes the following personal information items with the consent of the data subject pursuant to Article 15, Paragraph (1), Item 1 of the PIPA. Consent for the processing of the following items of personal information for their respective purposes is required to access the services, except for the processing of personal information for direct marketing purposes. Consent for the processing of personal information for direct marketing purposes is optional.

(1) Provision and management of services and products of The Walt Disney Family of Companies, including Disney+ services

• Collected/Used Items: Email address, username (profile name), password, IP address and related Internet transaction data, device and browser identifier and related information, date of birth, billing address, home address and telephone number (including mobile phone number)
• Processing and retention period: 90 days from the end of a subscription when a Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(2) Provision and operation of Disney+ service

• Collected/Used Items: Email address, username (profile name), IP address and related Internet transaction data, browser and device identifiers and related information, general location information, date of birth, user activity and playback data (information about what a subscriber has watched for user session logs to facilitate features like resume, continue watching watch again), subscription and eligibility information, service settings and configuration
• Processing and retention period: 90 days from the date of the end of a subscription when Disney+ account or a MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or a MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(3) Manage payment for Disney+ subscription services

• Collected/Used Items: Name, credit card or other payment method number, location information, payment information including security code and expiration date, date of birth, first 2 digits of PIN code, transaction history and related data, subscription and eligibility information
• Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(4) Customer Service (CS)/Customer service chat for Disney+

• Collected/Used Items: Email address, username (profile name), name, browser, device type, account identifier and related information, general location information, user activity and playback data, subscription and eligibility information, payment and transaction information, service settings and configuration, home address, billing address, phone number (including mobile phone number)
• Processing and retention period: five years from the date of resolution of dispute or request or in accordance with applicable laws and regulations as described below.

(5) Authentication of adults for Disney+ subscription and access to certain content

• Collected/Used Items: Name, date of birth, nationality, mobile phone number, telecommunications service provider, encrypted linkage information (CI), ID information (DI)
• Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(6) Marketing and advertising

• Collected/Used Items: Email address, IP address and related Internet transaction data, browser and device identifiers and related information, user activity and playback data, subscription and eligibility information
• Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(7) Research and analytics

• Collected/Used Items: Email address, username (profile name), IP address and related Internet transaction data, browser and device identifier and related information, general location information, user activity and playback data, subscription and eligibility information, service settings and configuration and date of birth.
• Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(8) Subscriber selection management for Disney+

• Collected/Used Items: IP address, Internet transaction data, cookies, device and browser identifiers and related information, user activity data and date of birth.
• Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

TWDC Korea will retain personal information when required to do so under applicable laws and regulations, including:

• Records on contract or withdrawal of subscription: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)2 of the Enforcement Decree of the same Act requires retention for a a period of 5 years
• Records on payment and supply of goods, etc.: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)3 of the Enforcement Decree of the same Act requires retention for a period of 5 years
• Records on settlement of consumer complaints or disputes: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)4 of the Enforcement Decree of the same Act requires retention for a period of 3 years
• Website Login Records: Article 15-2(2) of the Protection of Communications Secrets Act requires retention for a period of 3 months
• Commercial books and important documents related to business: Article 33(1) of the Commercial Act requires retention for a period of 10 years
• Supporting documents related to transactions: Article 116(1) of the Corporate Tax Act requires retention for a period of 5 years

3. Right to Refuse Consent and Disadvantages Resulting from Refusal to Consent:

You may refuse to provide consent to collect and use your personal information as set forth above by not subscribing to the products and services of The Walt Disney Family of Companies or by cancelling your subscription and requesting to permanently deleting your Disney+ account. However, if you do not consent, you may not be able to create or log in to a Disney account, or access the products and services offered by The Walt Disney Family of Companies.