SUPPLEMENTAL PRIVACY POLICY FOR SOUTH KOREA

This Supplemental Privacy Policy for South Korea applies to the processing of personal information in South Korea (“Korea”) or processing of personal information of residents in Korea and is read in conjunction with our Privacy Policy.

[Contents]
1. Purpose of Processing Personal Information
2. Types of Personal Information Processed and Period of Processing and Retention;
3. Delegation of Personal Information Processing Within Korea
4. Provision of Personal Information to Third Parties Within Korea
5. Matters Concerning Overseas Transfer of Personal Information;
6. Installation, Operation, and Refusal of Automatic Personal Information Collecting Tools
7. Measures to Ensure Security of Personal Information
8. Procedure and Method of Destruction of Personal Information
9. Rights and Obligations of Data Subjects and Method of Exercise
10. Matters Concerning Processing of Personal Information of Children;
11. Personal Information Protection Officer
12. Remedies for Infringement of Rights and Interests
13. Effective Date of this Policy

 

1. Purpose of Processing Personal Information

Walt Disney Company Korea LLC (“TWDC Korea”) processes personal information for the following purposes.

(1) Provision and management of services and products of Walt Disney Family of Companies, including Disney+ services
Personal information will be processed for the purpose of providing access and/or subscription to services and products offered by The Walt Disney Family of Companies in Korea, as applicable, including the Disney+ services, and for identification, verification, maintenance and management of subscription eligibility, prevention of fraudulent use of services, and user authentication and confirmation. For example, retrieval/re-setting of account username or password, various notifications and complaints.

(2) Provision and operation of Disney+ services
Process personal information for the purpose of operating and providing the services, including providing content and functionality, personalizing, customizing, securing and preventing inappropriate use, obtaining, developing, maintaining and improving content.

(3) Manage payment for subscription services
Personal information is processed for the purpose of billing, processing, re-subscribing after cancellation or cancellation, or processing payments including refunds for subscription services.

(4) Customer Service (CS) and customer chat inquiry service
Personal information is processed for the purpose of identifying customers and resolving customer inquiries in the course of customer consultation, including through chat.

(5) Authentication of adults to access certain content
Personal information is processed for the purpose of determining whether to restrict subscription to the services and access to certain content by verifying identity and age.

(6) Marketing and advertising
Processing personal information for marketing and advertising purposes such as email marketing, push notifications and the provision of in-app messages, to support targeted advertising, to identify and acquiring new customers, marketing analytics, enhancing statistical models to better understand customer preferences, and excluding specific users from certain marketing campaigns.

(7) Research and analysis
Process personal information to obtain and analyze data for the purpose of research and to improve services and the user experience.

(8) Subscriber selection management
We process personal information to manage subscriber content, rating and marketing preferences as selected by subscriber and to provide our services to the subscriber in accordance with such selections.

If the purpose of use of personal information changes, to the extent necessary, we will establish a legal basis for the processing personal information for such changed purpose in accordance with the Personal Information Protection Act of Korea (“PIPA”).

2. Types of Personal Information Processed and Period of Processing and Retention

TWDC Korea processes the following personal information items with the consent of the data subject pursuant to Article 15, Paragraph (1), Item 1 of the PIPA. Consent for the processing of the following items of personal information for their respective purposes is required to access the services, except for the processing of personal information for direct marketing purposes. Consent for the processing of personal information for direct marketing purposes is optional.

(1) Provision and management of services and products of The Walt Disney Family of Companies, including Disney+ services

  • Collected/Used Items: Email address, username (profile name), password, IP address and related Internet transaction data, device and browser identifier and related information, date of birth, billing address, home address and telephone number (including mobile phone number)
  • Processing and retention period: 90 days from the end of a subscription when a Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(2) Provision and operation of Disney+ service

  • Collected/Used Items: Email address, username (profile name), IP address and related Internet transaction data, browser and device identifiers and related information, general location information, date of birth, user activity and playback data (information about what a subscriber has watched for user session logs to facilitate features like resume, continue watching watch again), subscription and eligibility information, service settings and configuration
  • Processing and retention period: 90 days from the date of the end of a subscription when Disney+ account or a MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(3) Manage payment for Disney+ subscription services

  • Collected/Used Items: Name, credit card or other payment method number, location information, payment information including security code and expiration date, date of birth, first 2 digits of PIN code, transaction history and related data, subscription and eligibility information
  • Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(4) Customer Service (CS)/Customer service chat for Disney+

  • Collected/Used Items: Email address, username (profile name), name, browser, device type, account identifier and related information, general location information, user activity and playback data, subscription and eligibility information, payment and transaction information, service settings and configuration, home address, billing address, phone number (including mobile phone number)
  • Processing and retention period: five years from the date of resolution of dispute or request or in accordance with applicable laws and regulations as described below.

(5) Authentication of adults for Disney+ subscription and access to certain content

  • Collected/Used Items: Name, date of birth, nationality, mobile phone number, telecommunications service provider, encrypted linkage information (CI), ID information (DI)
  • Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(6) Marketing and advertising

  • Collected/Used Items: Email address, IP address and related Internet transaction data, browser and device identifiers and related information, user activity and playback data, subscription and eligibility information
  • Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(7) Research and analytics

  • Collected/Used Items: Email address, username (profile name), IP address and related Internet transaction data, browser and device identifier and related information, general location information, user activity and playback data, subscription and eligibility information, service settings and configuration, and date of birth.
  • Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

(8) Subscriber selection management for Disney+

  • Collected/Used Items: IP address, Internet transaction data, cookies, device and browser identifiers and related information, user activity data, and date of birth.
  • Processing and retention period: 90 days from the end of a subscription when Disney+ account or MyDisney account deletion is requested by the data subject, two years from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion, or in accordance with applicable laws and regulations as described below.

TWDC Korea will retain personal information when required to do so under applicable laws and regulations, including:

  • Records on contract or withdrawal of subscription: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)2 of the Enforcement Decree of the same Act requires retention for a a period of 5 years
  • Records on payment and supply of goods, etc.: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)3 of the Enforcement Decree of the same Act requires retention for a period of 5 years
  • Records on settlement of consumer complaints or disputes: Act on the Consumer Protection in Electronic Commerce, Etc., Article 6(1)4 of the Enforcement Decree of the same Act requires retention for a period of 3 years
  • Website Login Records: Article 15-2(2) of the Protection of Communications Secrets Act requires retention for a period of 3 months
  • Commercial books and important documents related to business: Article 33(1) of the Commercial Act requires retention for a period of 10 years
  • Supporting documents related to transactions: Article 116(1) of the Corporate Tax Act requires retention for a period of 5 years

3. Delegation of Personal Information Processing Within Korea

To provide the Disney+ Service, TWDC Korea delegates the processing of personal information to third parties within Korea as follows:

(1) Korea Credit Bureau

  • Delegated services: Support of adult authentication and identification services

(2) NHN KCP Co., Ltds

  • Delegated services: Online payment and support of validity verification service for credit card information

(3) Kakao Corporation, Naver Corporation

  • Delegated services: Support customized/targeted ads based on user behavior, user browser cookies or mobile ad IDs (e.g., ADID, IDFA)

(4) AdQUA Interactive Inc., Zestad Corp., PreM Company Co., Ltd., Webs Creative Co., Ltd., The Ruah Inc.

  • Delegated services: Management of marketing events, execution/advancement of marketing events, delivery of prizes and products, planning of marketing events and handling of related tasks

(5) Naver Financial Corp. (Naver Pay)

  • Delegated services: Transaction processing related services, which includes the processing of payments, fraud detection and other related services; and involves the receipt of transaction information from Boku Inc.

Section “5. Matters Concerning the Overseas Transfer of Personal Information” discloses the delegation of processing of personal information overseas.

4. Provision of Personal Information to Third Parties Within Korea

TWDC Korea processes personal information of data subjects only within the scope specified in the purposes of processing the personal information, and provides personal information of data subjects to a third party, such as when the data subject has given consent and where there are special provisions of laws. TWDC Korea do not otherwise provide the personal information of data subjects to third parties.

To facilitate the provision of services, TWDC Korea provides personal information only to the minimum extent necessary, after obtaining consent of the data subject in accordance with Article 17(1)1 of the PIPA in the following cases.

  • Recipients: Credit card companies (1. KB Kookmin Card, 2. BC Card, 3. Lotte Card, 4. Nonghyup Bank, 5. Hyundai Card, 6. Shinhan Card, 7. Hana Card, 8. Samsung Card, 9. Woori Card, 10. IBK B.C., 11. KDB Industrial Bank, 12. Saemaeul Geumgo, 13. Shinhan, 14. Toss Bank, 15. Gwangju Bank)
  • Purpose of Provision: The purpose of providing personal information is to check whether the credit card information used for payment services is valid and to proceed with payment for Disney+ services.
  • Personal information to be provided: Verification of validity of credit card information: credit card number, validity period, date of birth, first two digits of PIN number,
  • Retention period: The personal information provided is already retained by the relevant service provider, so it is processed for the purposes set out in this policy and is not stored by a third party.

The provision of personal information to third parties outside of Korea is provided in “5. Matters Concerning Overseas Transfer of Personal Information.”

5. Matters Concerning Overseas Transfer of Personal Information

TWDC Korea provides and delegates the processing of personal information collected from Disney+ Service users/ subscribers overseas as follows. A data subject has the right to refuse the cross-border transfer of their personal information by refusing to consent to the processing by TWDC Korea. However, if the data subject refuses to consent, they may not be able to use the products or services of The Walt Disney Family of Companies, including Disney+, or may be restricted from subscribing to the service.

If after a data subject has subscribed to the Service, the data subject wants to withdraw their consent to the transfer of their personal information to a foreign country, they can cancel their subscription on the website (information in the menu – subscription cancellation) or request such cancellation through the customer center (☎080-822-1416), and thereafter request deletion of their Disney+ account or their MyDisney account within the applicable platform.

A. Provision of Personal Information to Overseas Third Parties

We provide personal information to The Walt Disney Family of Companies as follows:

  • Legal ground: Article 28-8 (1) 1 (Consent of Data Subject) of the PIPA
  • Items of personal information to be provided: e-mail address, username (profile name), name, password, IP address and related Internet transaction data, date of birth, billing address, home address, device and browser identifiers and related information, general location information, user activity and playback data, subscription and eligibility information, service settings and configuration
  • Country to which it transfers: United States, Canada, United Kingdom, Netherlands, France, Germany, Ireland, Spain, Portugal, Austria, South Africa, Greece, Israel, Italy, Sweden, Denmark, Finland, Norway, Poland, Switzerland, Turkey, Hungary, Belgium, Bulgaria, Russia, United Arab Emirates, Mauritius, Japan, China, Hong Kong, Singapore, Taiwan, Australia, New Zealand, India, Vietnam, Mexico, Brazil, Argentina, Colombia
  • Transfer date/method: electronic transfer when a data subject uses the service
  • Purpose of use: Creation of MyDisney Account if you do not already have one, or the use of existing MyDisney Account credentials to create a Disney+ account; Subscription/subscription to and access to The Walt Disney Family of Companies’ products and services; provision and operation of services; processing of payments; customer support services; marketing and advertising, research and development, work processing, and other purposes necessary for the operation and management of such products and services.
  • Period of use and retention of personal information: 90 days from the end of a subscription when Disney+ account deletion or MyDisney account deletion is requested by the data subject, two years from the from the later of the end of a subscription or the last date of subscriber activity when a data subject has not requested a Disney+ account or MyDisney account deletion or in accordance with applicable laws and regulations as described above.
  • Right to Refuse Consent and Disadvantages Resulting from Refusal to Consent: You may refuse to provide consent to the transfer of personal information to a third party and overseas as set forth above by not subscribing to the products and services of The Walt Disney Family of Companies or by cancelling your subscription and requesting to permanently deleting your Disney+ account. However, if you do not consent, you may not be able to create or log in to a Disney account, or access the products and services offered by The Walt Disney Family of Companies.

B. Provision of Personal Information to Overseas Delagatees

We provide personal information to the following overseas delagatees:

Legal Grounds: Article 28-8(1)3(a) of the PIPA (Overseas Delegation of Processing (Retention) for Performance of Contract)

(1) Akamai

  • Contact Information: privacy@akamai.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; browser and device identifiers and information; user activity data
  • Purpose: content delivery, cache busting (to ensure data subjects see the most updated version of the services) and other related services
  • Country: Multiple countries. See the global network information here.
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(2) Fastly

  • Contact Information: abuse@fastly.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; browser and device identifiers and information; user activity data
  • Purpose: Content transfer and other related services
  • Country: Multiple countries. See the global network information here.
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(3) Century Link

  • Contact Information: Privacy@CenturyLink.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; browser and device identifiers and information; user activity data
  • Purpose: Content transfer and other related services
  • Country: Multiple countries. See the global network information here.
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(4) Conviva

  • Contact Information: privacy@conviva.com
  • Personal information to be transferred: IP addresses, and related Internet transaction data, cookies, device and browser identifiers and information, user activity and playback data (information about what a subscriber has watched for user session logs to facilitate features like resume, continue watching watch again).
  • Purpose: Analysis of video playback and other components of how data subjects engaged with the Service, and other related analyses.
  • Country: United States
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(5) Braze

  • Contact Information: Request for Personal Information
  • Personal information to be transferred: email address, username (profile name), IP addresses and related Internet transaction data; geographical location; device identifiers; User activity and other account data
  • Purpose: In-App and push marketing and service alarms
  • Country: United States, Singapore, Germany, Japan, United Kingdom
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(6) Google Double Click, Floodlight

  • Contact Information: Privacy Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing (including paid media optimization and advertising tracking)
  • Country: Multiple countries. See the global network information here.
  • Date and time/method of transfer: In case of using the service/ Electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(7) Flashtalking

  • Contact Information: privacy@flashtalking.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attribution)
  • Country: United States, United Kingdom, Germany, Netherlands, France, Italy, Poland, Australia, Singapore, Hong Kong
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(8) Microsoft

  • Contact Information: Privacy Help
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attraction)
  • Country: United States, United Kingdom, Germany, Netherlands, France, Italy, Poland, Australia, Singapore, Hong Kong
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(9) New Relic

  • Contact Information: privacy@newlic.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity and playback data
  • Purpose: Analytics, application and service quality and status measurement
  • Country: United States, European Union
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(10) Optimizely

  • Contact Information: privacy@optimizely.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity and playback data
  • Purpose: A/B testing (when two or more versions of the Service are tested to determine which is better) & multivariable testing (when multiple variables simultaneously across different combinations to determine the ideal combination for optimal performance)
  • Country: US, EU, Vietnam, Australia, South Africa
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(11) Amazon Web Services

  • Contact Information: aws-korea-privacy@amazon.com
  • Personal information to be transferred: Email address, username (profile name), password, IP address and related internet transaction data, date of birth, billing address, home address, device and browser identifiers and related information, general location information, user activity and playback data, subscription and eligibility information, service settings and configuration.
  • Purpose: Infrastructure and IT support and related services (including data storage and management)
  • Country: Multiple countries. See network information worldwide here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(12) SnowFlake

  • Contact Information: privacy@snowflake.com
  • Personal information to be transferred: Email address, username (profile name), IP address and related internet transaction data, browser and device identifiers and related information, user activity and playback data, subscription and eligibility information, service settings and configuration.
  • Purpose: Infrastructure and IT support and related services (including data storage and management)
  • Country: Multiple countries. See the global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(13) Salesforce

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: email address, username (profile name), name, phone number, eligibility information such as subscription and membership, payment and transaction information
  • Purpose: Marketing (including email marketing) and customer support
  • Country: Multiple countries. See the global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(14) Adobe

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Analysis and User Selection Management
  • Country: United States, Ireland
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(15) Qualtrics

  • Contact Information: privacy@qualtics.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; email addresses and other subscriber information
  • Purpose: Survey and user communication
  • Country: United States
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(16) Zendesk

  • Contact Information: privacy@zendesk.com
  • Personal information to be transferred: email address, username (profile name), name, eligibility information such as subscription and membership
  • Purpose: Customer service
  • Country: US, EEA, Japan, Australia
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(17) Facebook(Meta)

  • Contact: korealocalagent@support.facebook.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: Multiple countries. See the global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(18) Twitter

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States, Ireland
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(19) Google Ads

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: Multiple countries. See the global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(20) Microsoft Bing

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States, Australia, Austria, Brazil, Canada, Chile, Finland, France, Germany, Hong Kong, India, Ireland, Japan, Korea, Luxembourg, Malaysia, the Netherlands, Singapore, South Africa, United Kingdom
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(21) Yahoo Gemini

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(22) Apple Search Ads

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(23) Oath

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(24) Amazon DSP

  • Contact Information: Customer Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: Several countries. See global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(25) The Trade Desk

  • Contact Information: privacy@thetradedesk.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; encrypted email addresses and other subscriber information
  • Purpose: Digital advertising
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(26) Impact Radius

  • Contact Information: privacy@impact.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data; subscriber information
  • Purpose: Analysis and operation of alliance marketing
  • Country: United States
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(27) Validity (Return Path)

  • Contact Information: privacy@validity.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Email management
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(28) Movable Ink

  • Contact Information: privacy@movableink.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Email management
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(29) Litmus

  • Contact Information: privacy@litmus.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Email rendering to display the message optimally on the device, web clients, email clients that are used
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(30) Sentry.io

  • Contact Information: security@sentryio.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Analysis (including analyzing and reporting on software and application crash or other unexpected termination)
  • Country: United States, European Union
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(31) Apple

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; User activity data
  • Purpose: Platform operation
  • Country: United States
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(32) Google (Android TV, Phone, Tablet)

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Platform operation
  • Country: Multiple countries. See the global network information here
  • Date and time/method of transfer: in case of using the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(33) Amazon (fire TV, fire tablet)

  • Contact Information: aws-korea-privacy@amazon.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; User activity data
  • Purpose: Platform operation
  • Country: Multiple countries. See the global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(34) LG (TV)

  • Contact Information: caprivacy@lge.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Platform operation
  • Country: United States, Korea
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(35) Samsung (TV)

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Platform operation
  • Country: US, Korea, EU, Australia
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(36) Sony (PlayStation)

  • Contact Information: Customer Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Platform operation
  • Country: United States, United Kingdom, Japan
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(37) Microsoft Xbox

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; device and browser identifiers and information; user activity data
  • Purpose: Platform Operation
  • Country: United States, Australia, Austria, Brazil, Canada, Chile, Finland, France, Germany, Hong Kong, India, Ireland, Japan, Korea, Luxembourg, Malaysia, the Netherlands, Singapore, South Africa, United Kingdom
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(38) Adyen, N.V.

  • Contact Information: dpo@adyen.com
  • Personal information to be transferred: payment card information such as basic account number, card authentication code and cardholder name, related transaction data
  • Purpose: Services related to payment transactions, including processing of payment transactions, detection of abnormal financial transactions and other related services
  • Country: See global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(39) Tiktok Inc.

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attraction)
  • Country: United States
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(40) ROKT Corp.

  • Contact Information: privacy@rokt.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attribution)
  • Country: US, EU, Singapore, UK, Australia, Japan
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(41) Oracle America Inc. (Bluekai)

  • Contact Information: Personal Information Support Center
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attribution)
  • Country: United States, European Union
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(42) Concentrix Solutions Corporation

  • Contact: DPO@concentrix.com
  • Personal information to be transferred: Name; email address; payment method; last 4 digits of payment card; device types; order number and other information to handle customer service.
  • Purpose: Customer service support via phone and chat.
  • Country: South Korea, Malaysia.
  • Date and time of transfer/ method of transfer: if necessary for a purpose/ Electronic method.
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein.

(43) InMobi

  • Contact Information: privacy@inmobi.com
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attraction)
  • Country: US, EU, UK
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(44) Traffic Guard

  • Contact Information: privacy@trafficguard.ai
  • Personal information to be transferred: IP addresses and related Internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Marketing and advertising analysis (including tracking of ads for multi-touch attraction)
  • Country: See global network information here.
  • Date and time of transfer/ method of transfer: if necessary for purpose/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

(45) Data Dog

  • Contact Information: privacy@datadoghq.com.
  • Personal information to be transferred: IP address and related internet transaction data; cookies; device and browser identifiers and information; user activity data
  • Purpose: Analytics, measurement of application and services quality and health
  • Country: United States
  • Date and time of transfer/ method of transfer: When using the service/ Electronic method.
  • Retention period: For the period necessary to achieve the purpose.

(46) NICE CXone

  • Contact Information: Michael.Laughlin@nice.com
  • Personal information to be transferred: Name; email address; payment method; last 4 digits of payment card; device types; order number and other information to handle customer service.
  • Purpose: Customer service support via phone and chat.
  • Country: See global network information here.
  • Date and time of transfer/ method of transfer: if necessary for a purpose/ Electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein.

(47) Boku Inc.

  • Contact Information: privacy@boku.com
  • Personal information to be transferred: Transaction information such as billing amount, mobile number, unique identifiers and other payments account data such as payment account handler.
  • Purpose: Transaction processing related services, which includes the processing of payments, fraud detection and other related services.
  • Country: Various Countries (refer to Boku Network – https://www.boku.com/network )
  • Date and time of transfer/ method of transfer: if necessary for purpose/ Electronic Method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein.

(48) The Walt Disney Family of Companies

  • Contact Information: twdc.kr.dpo@disney.com
  • Personal information to be transferred: e-mail address, username (profile name), name, password, IP address and related Internet transaction data, date of birth, billing address, home address, payment method and related information, device and browser identifiers and related information, general location information, user activity and playback data, subscription and eligibility information, service settings and configuration
  • Purpose: To operate and provide Disney+ services, provide and manage access to services, manage security, process payments, support customers, communicate with subscribers, research and development, improve products and services, market and advertise (for email marketing, when necessary consents are collected), develop content, and comply with laws and regulations.
  • Country: See the data controller information for each region here.
  • Date and time of transfer/ method of transfer: if necessary for the use or purpose of the service/ electronic method
  • Retention period: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

6. Installation, Operation and Refusal of Automatic Personal Information Collecting Devices

(1) Collecting and permitting/blocking cookies

TWDC Korea uses “cookies” that store and retrieve usage data from time to time to provide individual services and convenience to users. Cookies are small amounts of information that the server (http) used to operate the website sends to the data subject’s browser and are stored on the data subject’s PC or mobile.

TWDC Korea collects cookies for the following purposes:

  • to provide features, analyze, and improve our services;
  • to personalize and deliver relevant content based on your preferences, usage patterns and location;
  • to monitor, evaluate, measure, and optimize the use and operation of our sites and applications; and
  • to target you with online advertising.

Data subjects can allow or block cookies by setting web browser options. However, if you refuse to store cookies, you may not be able to use customized services.

  • To allow/block cookies in a web browser
    • Chrome: Delete web browser settings > Privacy and Security > Internet usage records
    • Edge: Web Browser Settings > Cookies and Site Privileges > Manage and Delete Cookies and Site Data
  • Accept/block cookies in a mobile browser
    • Chrome: Mobile browser settings > privacy and security > Internet use records deleted
    • Safari: Mobile Device Settings > Safari > High-end > Block all cookies
    • Samsung Internet: Set up Mobile Browser > Record of Internet Use > Delete Internet Usage Record

(2) Matters concerning the collection, use, provision, refusal, of behavioral information

TWDC Korea uses cookies to collect and use behavioral information in a form that can identify individuals to provide customized services and benefits optimized for users in the course of using the services and for purposes of targeted advertising on the third-party properties.

TWDC Korea collects behavioral information as follows:

  • Service Subscription History and Usage Analytics
    • Legal ground: Article 15(1)1 of the PIPA
    • Behavioral information collection method: To be automatically collected when a data subject visits a website or platform
    • Purpose of Collecting Behavioral Information: Provision of a customized service based on website/platform usage
    • Period of retention and use: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein
  • Analyze Traffic on Service and on Third-Party Properties for Targeted Advertising
    • Legal ground: Article 15(1)1 of the PIPA
    • Behavioral information collection method: To be automatically collected when a data subject visits a website or platform
    • Purpose of collection of behavioral information: Targeted advertising on third-party sites
    • Period of Retention and Use: as long as necessary to achieve the purposes set forth in Section 2 and in accordance with the retention periods disclosed therein

Please refer to Sections 3 through 6 of this Supplemental Privacy Policy for the legal grounds for providing the collected behavioral information to third parties, recipients, purpose of provision, and period of retention and use.

(3) Behavioral information collected by a third party through automatic collection devices

TWDC Korea uses cookies and tags, including SDKs, provided by other companies for effective use of services and advertising and marketing when you visit or use websites or apps.

Data subjects may set their behavioral information collected by third parties by allowing, blocking, of such information by changing the cookie settings of their browsers.

  • Permission/blocking of behavioral information collected by a third party by a web browser
    1. Chrome
      • Click on the top right, click on the `⋮` mark and click on the Settings mark.
      • Click Privacy and Security on the left side of the Settings page and click “Third-Party Cookies” to select “Block Third-Party Cookies.”
      • If you wish to allow a site, click “Addition” next to “Third-Party Cookies Are Allowed” at the bottom of “Third-Party Cookie” and enter the address of the site.
    2. Edge
      • Click “…” on the top right at Edge and click “Settings”.
      • Click “Personal Information, Search and Services” on the left side of the Settings page and select whether to “Anti-Track” and the level in the “Anti-Tracking” section.
      • If you wish to allow a specific Site, click the “Exception” section at the bottom of the “Anti-Tracking” section, select “Add Site” and enter your Site address.
  • Permission/blocking of behavioral information collected by a third party in a mobile browser
    1. Chrome
      • < Android>
        • Open the Chrome app on the device, click the ‘⋮’ mark on the top right, and click the ‘Setting’ mark.
        • Click on “Third-Party Cookies” in “Site Settings” and select whether to “Block Third-Party Cookies”.
        • If you wish to allow a specific Site, click “Add Site Exceptions” at the bottom of “Third Party Couty” and enter the address for that Site.
      • < iPhone/iPad Device >
        • Open the Chrome app on the device, click the ‘⋮’ mark on the top right, and click the ‘Setting’ mark.
        • Click Privacy and Security on the left side of the Settings page and Delete Internet Usage Records.
        • Select “Cookies, Site Data” among the options and click “Delete Internet Usage Record”.
    2. Safari
      • Open the Settings on the device and click Safari among the installed app items.
      • Click Advanced and select “Block All Cookies”
    3. Samsung Internet
      • Open the Samsung Internet app on the device, click the “block” mark at the bottom, and click the “Setting” mark.
      • Click “Delete Internet Usage Records” in the section of “Internet Usage Records”.
      • Select “Cookies and Site Data” among the options and click “Delete Data”.

7. Measures to Ensure Security of Personal Information

As set out in the Privacy Policy, we take the security, integrity, and confidentiality of your information very seriously. To ensure the security and security of personal information, we take the following measures:

(1) Managerial measures: Establishment and implementation of an internal management plan, regular training on personal information protection
(2) Technical measures: Management of access rights to the personal information processing system, installation of an access control system, encryption of unique identification information, installation of security programs
(3) Physical Measures: Restrict access to personal information only to the Walt Disney Family of Companies or as set forth in the Privacy Policy. Those with access are subject to strict confidentiality obligations under the contract and may be sanctioned or terminated for breach of such obligations

8. Procedure and Method of Destruction of Personal Information

TWDC Korea shall destroy personal information without undue delay upon the expiration of the applicable retention period as set forth in Section 2 or in accordance with internal Record Information Management policy.

The procedures and methods of personal information destruction are as follows.

(1) Destruction procedure
TWDC Korea selects the personal information for which the reason for destruction occurred and destroys such data at the instruction of our Personal Information Protection Officer.

(2) Method of Destruction
Personal information recorded and stored in the form of an electronic file or hard copy will be destroyed by any reasonable manner so that the personal information cannot be reproduced.

9. Data Subject Rights and Obligations and Method of Exercise

Data subjects may request to access, correct, or delete personal information, to suspend the processing of your personal information, or may withdraw their consent to the processing of personal information.

If TWDC Korea, as a personal information controller, receives a request for access to personal information from a data subject; access to the personal information will be provided to the data subject within 10 days (Article 35(3) of the PIPA and Article 41(4) of the Enforcement Decree of the PIPA). If there is any reason for which such access is not possible within this period, the access may be postponed by notifying the data subject of the reason within such 10-day period. However, TWDC Korea may restrict or refuse to provide access after notifying the data subject of the reasons under any of the items of Paragraph (4) of Article 35 of the PIPA.

TWDC Korea shall cease processing personal information upon a data subject’s request to delete their personal information, within 10 days of receipt of a valid data subject deletion request; provided, however, that if the data subject has an active subscription, the data subject shall be prompted to cancel their subscription before their personal information may be deleted.

The exercise of the above rights may be carried out by a data subject via email to TWDC.KR.DPO@disney.com or by any other reasonable means under PIPA. The exercise of rights may also be conducted through a legal representative of the data subject or an authorized agent. In such cases, the requester must submit a power of attorney and TWDC Korea will verify whether the person exercising the rights is the data subject or a legitimate representative.

10. Matters Concerning the Processing of Personal Information of Children

An individual must be 19 years of age or older to subscribe to the Disney+ service. No one under the age of 19 may create a Disney+ account. Therefore, TWDC Korea’s services do not process the personal information of children under 19 years of age. (See Subscriber Agreement.)

11. Personal Information Protection Officer

If you have any comments or questions about this Supplemental Privacy Policy, please contact our Personal Information Protection Officer:

If you wish to file a complaint with us, please send an email to TWDC.KR.DPO@disney.com.

12. Remedies for Infringement of Rights and Interests

To seek remedies for personal information infringement, a data subject may file an application for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency’s Personal Information Infringement Reporting Center. If you have any other reports or consultations on personal information infringement, please contact the following agencies.

(1) Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
(2) Personal Information Infringement Reporting Center: 118 (privacy.kisa.or.kr)
(3) Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
(4) National Police Agency: 182 (ecrm.cyber.go.kr)

13. Effective Date of this Policy

The Supplemental Privacy Policy for South Korea is effective from August 1, 2025.

See Annex to Previous Supplemental Privacy Policies

Back to Top back-to-top