1. The purpose of collecting and using the personal information

The personal information collected will not be processed for any purpose other than the following purposes. If any changes occur, we will inform you in advance and ensure you agree with them.

• Membership registration and management
  The personal information you provide shall be used to verify the membership registration, give various notification, and handle complaints.
• Deal with complaints
  The personal information you provide shall be used to identify individuals, verify complaints, and to contact and notify the results for an in-depth investigation.
• Provision of services or products
  The personal information you provide shall be used for shipping the products, providing service including game, repairing the products, certifying the genuine product, etc., providing contents (newsletter, notification for stock), sending invoice, and making payments.
• Prescription Glasses Services
  The personal information you provide shall be used to verify your prescription information, manufacture prescription lenses, process your order (including shipping and payments), process insurance claims where applicable, provide customer support for prescription-related inquiries, and comply with applicable legal obligations. In addition, to improve user convenience, your vision-related and prescription information is securely stored and used to allow you to reuse previously provided information for future purchases.
• Insurance Claim Services
  If you choose to use our insurance claim service for prescription (RX) orders, we may collect additional information necessary to process insurance claims, including insurance provider details, member identification numbers, and relevant prescription information. This information is used solely to submit insurance claims on your behalf and to facilitate reimbursement or the application of insurance benefits related to your purchase. Providing insurance information is optional. You may choose to complete your purchase without using insurance. Insurance-related information is retained only for as long as necessary to complete the claim process or to comply with applicable legal, accounting, or regulatory requirements.
• Marketing and advertising
  The personal information you provide, as well as inferences drawn from the personal information we collect, shall be used for new service(product) development and provision of customized service, advertising information including event and offer opportunity to participate as well as understanding the frequency of access or statistics on the use of services by members, personalized advertising and behavioral targeting, retargeting through third-party advertising platforms, customer segmentation through profiling, and cross-device tracking for advertising optimization.
• AI Agent Customer Services (Gen)
  The personal information you provide shall be used for operating our AI Agent customer service ("Gen"), including: responding to customer inquiries and resolving related issues, managing consultation records and supporting service operations, improving customer experience (CX) and the quality of responses, training AI models and improving response accuracy, enhancing service operation efficiency and conducting internal analytics, managing customers through integration with CRM systems such as Salesforce Service Cloud and escalating to human customer service representatives when necessary.
• Purposes permitted or required by law

2. Current state of personal information data

• Items of personal information
  

  Purpose	Items	Remarks
  Membership registration	[Standard] Name, E-mail address, Phone number, Password and Resident country	required
  	[Registered through Google or Apple] Log-in ID, Name, E-mail address and Phone number	required
  Provision of services or products	Name, E-mail address, Phone number, Shipping and billing address and Order No.	required
  Prescription Glasses Services	Vision-related Information Prescription details, sphere, cylinder, axis, pupillary distance(PD), and other optical health data Prescription Information The prescribing optometrist’s identification and information including professional name, address, telephone number, license number, and signature where required The patient’s name and other identification information as needed The appropriate refractive information Prescription issue date and expiry date	required
  Insurance Claim Services	Insurance-related Information First Name, Last Name, Date of Birth, Zip Code, Insured Sex, Insured SSN Last 4 Digits	optional
  Deal with complaints	Name, E-mail address, Phone number, Shipping and billing address, Resident country, Shopping (service usage) history, Payment history and Inquiries	required
  AI Agent Customer Services (Gen)	Chat/conversation logs, Interaction timestamps, Session data, IP address, Device information, AI-generated response records [For registered members, additionally linked:] Log-in ID, E-mail address, Service usage information (orders, shipping, repair history)	required
  Product Services	Name, E-mail address, Phone number, Shipping address	required
  Payment	Credit card details, Bank account details	required
  Restock notification	E-mail address	required
  Personal Information automatically generated and collected on our website	IP address, Cookies, device information, service usage records, access logs, payment records, account suspension records, and other behavioral data	required
  Refund	Name, Shipping and billing history and Bank account details	required
  Marketing and advertising	Name, E-mail address, Phone number, Registration date/time, Cookies, IP address, Device information (device type, OS, browser), Advertising identifiers (ADID/IDFA), Service usage information (orders, shipping, repair history), Browsing history (interest categories, wishlist and cart data, product view/click history), Marketing preferences and engagement history	optional

• Sensitive information items collected

  We collect sensitive information in the following circumstances:

  Some of our services, like Prescription Glasses Services, require us to collect (or result in us collecting) your ‘sensitive information’ from you. ‘Sensitive information’ includes information like health information. We only collect sensitive information when you provide consent to the collection, or if the collection is permitted by law.



• Collecting methods

  We collect personal information in the following ways:

  • When you access and use the services on GENTLE MONSTER website
  • When you use Contact Us, download materials
  • When you register and sign in to your account with us via Google, Apple
  • Provided by the self-verification agency or an associate company
  • Through the tools and cookies that collect the generated information
  • When you use AI Agent Customer Services (Gen)
• Main consequences of not providing your personal information

  It is important for us to Process your Personal Information in order to provide our products and services to you. If you do not want your information to be Processed for the purposes set out in this Privacy Policy, you may need to cease using our Platforms, products or services or engaging with us.

  You can choose not to share your Personal Information with us. However, if you choose not to provide us with the necessary Personal Information, we may not be able to provide you with some or all of our products or services.

  We also require your Personal Information to meet our legal obligations. Where the legal basis for the Processing of your Personal Information is to comply with our legal obligations, a failure by you to provide us with certain Personal Information may cause us and/or you to be in breach of these legal obligations.

3. Processing and retention period of personal information

• We retain your Personal Information for as long as is necessary to fulfill the purposes for which it was collected and as set out in this Privacy Policy, or until you request us to delete your Personal Information or terminate your membership, after which we will take reasonable steps to delete your Personal Information (if required under applicable privacy laws).
• If any information is needed to be kept according to the pertinent legal provisions, it shall be kept during the period specified in the related laws.
• If an investigation is in progress due to a violation of related laws, the Company may retain personal information for a certain period of time until the investigation is completed according to the relevant laws.

4. Provision of personal information to third-party

We may share your personal information with third parties, or otherwise allow them to access it, only for the purposes stipulated in Clause 1 of this Privacy Policy and under the circumstances described below.

We may disclose personal information if we believe in good faith that: (i) such disclosure is required by law or legal process; (ii) we have received a valid request from a law enforcement or regulatory authority; (iii) such disclosure is necessary or appropriate to protect our rights, property, or safety, or the rights, property, or safety of our service providers, customers, or others; or (iv) such disclosure is necessary to resolve disputes, troubleshoot problems, prevent fraud, or otherwise enforce our Terms of Use.

Where you request us to submit insurance claims on your behalf for prescription eyewear services, we may share relevant personal information (including prescription details and health plan information) with vision insurance providers, third-party claims processors, and other parties involved in administering insurance benefits solely for the purpose of completing the insurance claim process. We do not use or share insurance-related information for purposes unrelated to insurance claim processing or as otherwise required by law.

We may also share personal information with our corporate affiliates, including IICOMBINED Co., Ltd. (our headquarters in the Republic of Korea), to provide goods and services, fulfill orders, operate the GENTLE MONSTER platform, and otherwise manage our business. Such transfers are subject to appropriate safeguards as described in Clause 5 of this Privacy Policy.

We may share personal information with third parties for marketing and advertising purposes. You have the right to opt-out of such sharing under applicable law. To opt out of the sale or sharing of your personal information, you can directly update your marketing preferences at any time by logging into your account and visiting [My Account > Profile] on our website, or contact us at privacy@gentlemonster.com.

5. Consignment of personal information processing

We consign personal information processing as described below to improve our services and stipulates the necessary matters to ensure that personal information is safely managed upon conclusion of consignment contracts (prohibiting the processing of personal information for purposes other than fulfilling the consignment contract, restricting re-consignment, taking measures to ensure stability) pursuant to the relevant laws. In the event of a change of the consignee, we will disclose the fact through this Privacy Policy without delay.

We transfer the following personal information processing activities overseas to provide you with better services.

6. Rights of the user and how to exercise them

Users have the right to exercise control over the personal information we hold about them, including access, correction, deletion, opt-out of certain processing, and other rights described below.

For certain information (such as name, e-mail address, password, phone number, shipping address, and marketing preferences), you can directly view and update your information at any time by logging into your account at [My Account] on our website. In addition, you may delete your account directly through your [My Account] page.

[Contact Information]

• E-mail: privacy@gentlemonster.com
• Contact number: +82 1600 2126 (Fax: +82 326 1696)

Users may contact us using the methods above to exercise any of the rights described in this Section. We will handle each request promptly after completing our identity verification procedure. Users may also designate an authorized agent to submit a request on their behalf.

Residents of states with Applicable State Privacy Laws have certain rights related to their personal information.

Users have the right to request access to, deletion of, correction of, or a portable copy of their personal information that we have collected about them, subject to certain exceptions. Users also have the right to opt out of certain processing of their personal information, including the sale or sharing of personal information and, where applicable, targeted advertising, to limit the use and disclosure of sensitive personal information as permitted by law, and to request that we cease automated processing, including profiling, that produces legal or similarly significant effects on them. We will not discriminate against users for exercising any of these rights.

Users may exercise their privacy rights by contacting us using the methods described under [Contact Information] above. We may need to verify the user's identity before processing their request, and we will respond to a verified consumer request within 45 days, or within the time period required by applicable law. Users may also designate an authorized agent to submit a request on their behalf.

If we refuse to take action regarding your request, you may appeal our decision by emailing us at privacy@gentlemonster.com.

7. Protection of personal information under 18 ages

We do not accept any request for membership of anyone who is younger than 18 years, and we do not collect any personal information under 18 ages. If we obtain knowledge that we have collected any Personal Information from children under 18 ages, we will delete that information from existing files.

However, if we collect any Personal Information from children under 18 ages for the services for unavoidable reason, we will go through the additional procedure of the followings for protecting that Personal Information of children:

• verify, to the extent that efforts are reasonably made, whether they are children of the age at which consent from their guardian is required and the consenting person is an authorized one.
• obtain consent from the parents or guardian of children to collect Personal Information of children or directly send the information of products and services of the Company
• give the parents or guardian of children a notice of Company's policy of privacy protection for children including the items, purpose and sharing of Personal Information collected
• grant to legal representatives of children a right to access to Personal Information of that children/ correction or deletion of personal information/temporary suspension of treatment of Personal Information/ and request for withdrawal of their consent provided before
• limit the amount of personal information exceeding those necessary for participation in online activities

8. Procedure and method for destroying personal information

In principle, as soon as the purpose for the collection of personal information has been achieved, the applicable information shall be destroyed without delay. The procedures, deadlines, and methods are specified in detail below.

• Procedure for disposal
  Information inputted is transferred to the separate database (separate documents for paper) once the purpose has been achieved. According to the protection of information pursuant to the internal policies and related laws, it shall be stored for a certain period or disposed without delay.
• Deadline for disposal
  Once the possession period of user’s personal information has been elapsed and if it is no longer in need due to achievement of goal, revocation of certain service, or business closure, etc. then it shall be disposed within 5 days from the last date of possession.
• Method of disposal
  The personal information in the form of electronic files shall be deleted in a way that it cannot technically be recovered. For those printed on paper shall either be grinded or incinerated.

9. Installation, operation, and rejection of automatic collection of personal information

We use cookies, which are small text files stored on your device (browser or hard disk) when you visit our website, to remember who you are and collect information about your visits.

• Purpose of using cookies
  Cookies help us provide an optimized experience by identifying the types of visits and usage of each service, supporting popular search features, and enabling secure access.
• Installation, operation, and rejection of cookies
  You may manage or disable cookies through your browser settings. Most browsers allow you to view, delete, or block cookies through the browser's privacy or settings menu. Please note that blocking certain cookies may affect the functionality of our website or your customized experience.
• Third-Party Tracking Technologies
  We use pixels, web beacons, and similar technologies from third-party advertising platforms to track conversions and deliver targeted advertisements. These third parties may collect information about your online activities over time and across different websites. For more details, please refer to our Cookie Policy.
• Do Not Track
  We respond to browser-based privacy signals, including Do Not Track (where required by law) and Global Privacy Control (GPC) signals, in accordance with applicable laws.

10. Personal information protection officer

We designated the department and administrator in charge to be responsible for the handling of personal information processing and related complaints.

You may report any inquiry regarding personal information, complaints, and damages remedies, etc. to the administrator in charge of personal information while using the services (or business), then we shall promptly respond to it.

11. Modification of privacy policy

We have the right to amend or modify this Policy from time to time and, in such case, we will make a public notice of it through bulletin board of its website (or through individual notice such as written document, fax or e-mail). Any such modifications will be published online and shall be deemed accepted without reserve by the User upon accessing the Website. We therefore recommend that you review this Privacy Policy regularly and refer to its most recent version.

12. Safeguarding your personal information

We will take reasonable care to maintain appropriate safeguards to ensure the security, integrity and privacy of the information you have provided to us. We have put in place technology and security policies which are designed to protect the personal information we hold. We also follow the security procedures that applicable privacy laws require.

• Regular self-audit conducted
  We conduct our own audits regularly to ensure the stability of handling personal information.
• Minimization and conduct training of employees handling personal information Employees who deal with personal information are designated and limited to the person in charge.
• Establishment and enforcement of internal management plan We have established and implemented internal management plan for handling personal information in the most secure way.
• Technical measures against hacking We installed a security program to prevent leakage and damage of personal information from hacking or computer viruses, also we periodically update and check the systems that are being installed and monitored both technically and physically.
• Encryption of personal information The personal information of the user is encrypted, stored, and managed which only the user can recognize it. Separate security function is being used, for example encrypting the file and transmit data or using the file lock function for important data.
• Keep logs record and prevent forgery We maintain and manage the records of access through personal information processing system for at least six months and use the security function to prevent forgery, theft or loss of access records.
• Restrict access to personal information We take necessary measures to control access to personal information through granting, modifying, and obliterating the authority to access to the database system that processes personal information. We also control unauthorized access from external by using an intrusion prevention system.
• Use locking device for document security We keep documents with personal information and auxiliary storage media in safe place with lock.
• Access control of unauthorized persons We have set up a separate physical storage area for personal information and operate access control procedures.
• Data Breach Notification
  In the event of a data breach involving your personal information, we will notify affected individuals and the appropriate regulatory authorities as required by applicable law, including California Civil Code Section 1798.82. We will provide notification without unreasonable delay and in the most expedient time possible.