1. Purpose of Processing, Items Processed, and Retention and Use Period

1. ①

   The Company processes the personal information of information subjects as follows.

   Legal Basis	Service	Purpose of Collection	Type	Collected Items	Retention and Use Period
   Personal Information Protection Act Art. 15(1)2 (Special provisions in laws), Tourism Promotion Act Art. 29 (Verification of foreigners), Act on Reporting and Using Specified Financial Transaction Information Art. 5-2 (Customer due diligence)	Casino use	Verification of casino entry qualification and management of entry history	Mandatory	Copy of passport (name, gender, date of birth, passport photo, nationality, date of issue, date of expiry, passport stamp, visa), mobile phone number, address. [If applicable] Industry, source of funds, purpose of transaction, real name verification number. [If applicable] Identification documents (permanent resident card, resident register extract, alien registration card, report card of domestic residence of foreign nationality Korean, certificate of alien registration, certified copy of register of overseas Korean, notification of overseas emigration, confirmation of acquisition of permanent residence, certificate of entry/exit, diplomat ID card, seafarer's book, other documents designated by the Minister of Culture, Sports and Tourism)	5 years from the final transaction date
   Personal Information Protection Act Art. 24(1)2 (Unique identifier), Art. 24-2(1)1 (Resident Registration Number), Tourism Promotion Act Art. 29, Act on Reporting and Using Specified Financial Transaction Information Art. 5-2				Resident Registration Number, Passport Number, Alien Registration Number
   Personal Information Protection Act Art. 15(1)1 (Consent of Data Subject)	Membership Service	Verification of casino entry qualification, member registration/management for providing membership services, provision of membership service and information, improvement of customer satisfaction and service quality management	Mandatory	Customer number, name, gender, date of birth, mobile phone number, address, nationality, membership tier, game records	Until membership withdrawal (However, if a retention period is specified in relevant laws, such period shall apply)
   Personal Information Protection Act Art. 24(1)1 (Unique identifier)		Verification of qualification for membership, identification for service provision		Passport Number
   Personal Information Protection Act Art. 15(1)1 (Consent of Data Subject)	Marketing Service	Information on products and services, customer appreciation/promotional events, satisfaction surveys, market research, transmission of marketing and advertising information such as events/promotions, new service development, provision of personalized customized services, statistics based on service usage, provision of services based on demographic characteristics	Optional	Customer number, name, gender, date of birth, mobile phone number, address, nationality, membership tier, game records	Until withdrawal of consent or membership withdrawal
   Personal Information Protection Act Art. 15(1)1 (Consent of Data Subject)	Voice of Customer (VOC)	Identification, customer counseling/inquiry guidance	Mandatory	Name, e-mail, password	3 years from the date of processing completion

2. ②

   The Company retains personal information in accordance with the relevant laws and regulations as follows.

   Applicable statutes	Information retained	Period of holding the information
   Act on Consumer Protection in Electronic Commercial Transactions etc.	Record on contracts, withdrawal of subscription, etc.	5 years
   	Record of payment, supply of goods, etc.	5 years
   	Record of consumer complaints, or dispute resolution	3 years
   	Record on indication and statements	6 months
   Basic Act on National Tax	Books and supporting documents for all transactions as prescribed under the tax law	5 years
   Act on Communication Confidentiality Protection	Internet log	3 months
   Commercial Act	Commercial ledgers and important documents related to business	10 years
   	Sales slips, or similar documents	5 years
   Credit Information Act	Record of collection, processing and use of personal credit information	3 years
   Specific Financial Information Act	Information to verify the identity of a guest	5 years from the last transaction date

2. Processing of Personal Information of Children under 14 Years of Age

1. ① In principle, we do not process personal information of children under 14 years of age.
2. ② In exceptional cases, when it is necessary to process the personal information of children under the age of 14, the consent of a legal representative is validly obtained.

3. Provision of Personal Information to a Third Party

1. ①

   We process the personal information of an information subject, only within the scope specified in the purpose of processing the personal information. We provide personal information to a third party only as specified in Articles 17 and 18 of the Personal Information Protection Act, including by obtaining the consent of the information subject and complying with the special provisions of the law and otherwise do not personal information of an information subject to a third party.

   ②

   For smooth service provision, the Company provides personal information only to the minimum necessary extent with the consent of the Data Subject under Article 17(1)1 of the Personal Information Protection Act as follows.

   Recipient	Purpose of Provision	Provided Items	Retention and Use Period
   Paradise Segasammy Co., Ltd.	Membership affiliate service, point accumulation/usage and cross-usage management by affiliate, prevention of unauthorized member (blacklist) usage, identification of unauthorized actions, provision of accommodation service	Name, gender, date of birth, mobile phone number, membership tier	Until membership withdrawal
   SK Networks Co., Ltd.	Membership affiliate service, provision of accommodation service	Customer number, name, region of residence, date of entry/exit	Until membership withdrawal
   Paradise Hotel Busan Co., Ltd., GLAD Hotels & Resorts, Bolton Hotel	Membership affiliate service, provision of accommodation service	Name, gender, date of birth, mobile phone number	Until membership withdrawal

2. ③

   The Company may provide personal information to relevant authorities without the Data Subject's consent as follows.

   Legal Basis	Recipient	Purpose of Provision	Provided Items	Retention and Use Period
   Foreign Exchange Transactions Act Art. 20	Korea Customs Service	Regular business report of currency exchange operators	Name, nationality, real name verification number	5 years
   Foreign Exchange Transactions Regulations Art. 3-2	National Tax Service, Korea Customs Service	Submission of foreign exchange transaction history	Name, nationality, real name verification number	5 years
   Income Tax Act Art. 127, 164	National Tax Service	Compliance with statutory obligations such as withholding tax, submission of payment statements, etc.	Name, address, nationality, Resident Registration Number, Passport Number, Alien Registration Number	5 years
   Foreign Exchange Transactions Act Art. 18	Bank of Korea	Submission of CHIPS credit status	Name, customer number	5 years
   Act on Reporting and Using Specified Financial Transaction Information Art. 5-2	Korea Financial Intelligence Unit (KoFIU)	Collection and analysis of information related to anti-money laundering	Name, customer number, date of birth, gender, real name verification number, nationality, address, contact, occupation, actual owner	5 years

4. Delegation of Personal Information Processing

1. ①

   The Company outsources personal information processing tasks for the smooth handling of personal information as follows.

   Outsourcee (Trustee)	Outsourced Task
   SK Inc. AX (Sub-trustee: Data Sketchers)	Integrated ITO operation (Sub-outsourced tasks: POS/KIOSK, casino system maintenance)
   SK Shieldus Co., Ltd.	Security ITO operation
   Eluo CNC	Casino homepage development and maintenance
   Paradise Tour	Airline service reservation agency business

2. ② When concluding an outsourcing contract, the Company strictly clarifies responsibilities such as the prohibition of processing personal information outside the purpose of performing outsourced tasks, technical and managerial protection measures, restrictions on sub-outsourcing, management and supervision of the trustee, and compensation for damages in written documents such as contracts, in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the trustee processes personal information safely.
3. ③ If the trustee sub-contracts the Company's personal information processing tasks according to Article 26(6) of the Personal Information Protection Act, it obtains the Company's consent, and the Company discloses the sub-trustee and the details of the sub-contracted tasks through this Privacy Policy.
4. ④ If the details of the outsourced tasks or the trustee changes, we will disclose it without delay through this Privacy Policy.

5. Destruction of Personal Information

1. ① If it is no longer necessary to hold personal information (the period of holding personal information has passed, the purpose of information processing has been achieved, etc.), the Company promptly destroys the relevant personal information.
2. ② If personal information must continue to be preserved pursuant to other laws and regulations although the purpose of processing has been achieved, or despite the expiration of the period of the personal information retention consented to by the information subject, the personal information shall be transferred to a separate database, or preserved at a different storage location.
3. ③ The Company will destroy personal information recorded and stored in the form of electronic files so that it cannot be recovered, or reproduced. The Company destroys other records, printed materials, documents, etc. by shredding, or incineration.

6. Rights and Obligations of Information Subjects and Their Legal Guardians, and Method of Exercising the Rights

1. ① Information subjects can exercise rights to view, correct, delete, or suspend processing of their personal information, request withdrawal of consent, and otherwise exercise their rights at any time.
   
   * For children under the age of 14, their legal guardians shall directly exercise the rights regarding the personal information rights. Information subjects who are minors over the age of 14 may directly exercise their rights regarding the personal information, or through a legal guardian.
2. ② To exercise your rights, please contact the department in charge of personal information in writing or via email, and we will promptly take measures. The Company may restrict the rights of an information subject if there is a justifiable reason to do so, and the Company will promptly inform the information subject of the reason for such restriction.

7. Measures to Ensure the Security of Personal Information

1. ①

   The Company is taking the following measures to ensure the security of personal information.

   • Minimizing the scope of the authority given to persons processing the personal information: For the protection of personal information, the authority given to persons in charge of personal information is minimized.
   • Regular trainings for officers in charge of personal information: We provide regular trainings to alert officers to the importance of personal information protection.
   • Regularly conducting internal inspections: The Company conducts regular self-inspections to ensure the security of personal information processing.
   • Establishment and implementation of an internal management plan: The Company has formulated and administers an internal management plan to securely process and manage personal information.
   • Encryption of personal information: The personal information and password of an information subject are stored and managed after encryption. Even during the transmission, the information is safely managed with use of a separate security function.
   • Technical measures against hacking, etc.: To prevent unauthorized disclosure or loss of personal information due to hacking, computer virus, etc., the Company installs a security program, periodically updates and inspects it, installs the system in an area where access from the outside is controlled, and monitors and blocks system breach technically and physically.
   • Restriction of access to personal information: Necessary measures are taken to control the access authority and the access to the personal information processing system, and unauthorized access from outside is controlled using an intrusion prevention system.
   • Storage of access record and prevention of forgery and falsification: The Company stores and manages the record of access to the personal information processing system and uses security functions to prevent access record from forgery, falsification, theft, or loss.
   • Use of locking devices for document security: Documents, auxiliary storage media, etc. containing personal information are stored in a safe place with a locking device.
   • Access control for unauthorized persons: The Company has a separate physical storage location where personal information is stored and has formulated and administers the access control procedure.

8. Installation, operation and refusal of device of automatic collection of personal information

1. ① The Company uses cookies to store the information used by guests and retrieves it from time to time to provide individualized services to users.
2. ②

   Cookies are a small amount of information which the server which is used to administer the website sends to the user’s computer browser and are sometimes stored on the hard disk of a user’s computer.

   • Purpose of use of cookies: Cookies are used to provide optimized information to users by identifying the types of visits and usage of each service and website visited by the user, whether or not the connection is secure, etc.
   • Installation, operation and refusal of cookies: A guest can refuse the storage of cookies in the settings menu of the guest’s web browser. If a guest refuses to store cookies, the guest may have not be able to use customized services.

9. Officers and Departments in Charge of Personal Information Protection

The Company is responsible for overall work related to the personal information processing. In order to promptly process matters related to the personal information protection, such as resolution of a complaint by an information subject and providing relief related to the personal information processing, officers and departments in charge of personal information protection are designated as follows.

[Paradise Corporation]

- Officer in charge of personal information protection

• * Name : Park Joong-hee Managing Director

[Casino Walkerhill]

- Officer in charge of personal information protection

• * Name: Kang Jong-myung Team Leader (Planning Team)
• * Phone: 02-2204-3367
• * Email: jmkang@paradian.com

- Department in charge of personal information protection

• * Department: Planning Team
• * Phone: 02-2204-3367
• * Email: plan@paradian.com

[Casino Busan]

- Officer in charge of personal information protection

• * Name: Kim Dae-shik Managing Director
• * Phone: 051-749-3307
• * Email: bs33@paradian.com

- Department in charge of personal information protection

• * Department: Management Team
• * Phone: 051-749-3307
• * Email: bs33@paradian.com

[Casino Jeju]

- Officer in charge of personal information protection

• * Name: Ko Kwon-ho, Part Leader (IT Part)
• * Phone: 064-745-7812
• * Email: blue1er@paradian.com

- Department in charge of personal information protection

• * Department: IT Part
• * Phone: 064-745-7814
• * Email: sjkang1227@paradian.com

10. Remedy for Infringement of Rights and Interests of Information Subjects

1. ①

   To receive a remedy from personal information infringement, an information subject may request the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of Korea Internet and Security Agency, etc. for dispute resolution, consultation, etc. For other types of report and consultation regarding personal information infringements, please contact the following organizations:

   • Personal Information Dispute Mediation Committee: (no extension) 1833-6972 (www.kopico.go.kr)
   • Personal Information Infringement Report Center: (no extension) 118 (privacy.kisa.or.kr)
   • Supreme Public Prosecutors’ Office: (no extension) 1301 (www.spo.go.kr)
   • National Police Agency: (no extension) 182 (ecrm.police.go.kr)

11. Scope of Application of This Privacy Policy

This Privacy Policy applies when using Paradise Co., Ltd.'s casinos (Casino Seoul / Busan / Jeju), and separate privacy policies may apply to services provided under other brands of Paradise.

12. Amendment of Personal Information Processing Policy

This Privacy Policy is effective from September 17, 2026.