Privacy Policy

29Per Co., Ltd. (the "Company") has established and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act to protect personal information and to handle related complaints promptly and smoothly.

The Company processes personal information as follows:

1. Immediately destroyed upon member withdrawal or achievement of the collection/use purpose.
2. However, if preservation is required by applicable law, data is retained for the following periods:

   Item	Retention Period	Legal Basis
   Contracts, withdrawal records, etc.	5 years	E-Commerce Act, Art. 6
   Payment and goods supply records	5 years	E-Commerce Act, Art. 6
   Consumer complaint / dispute records	3 years	E-Commerce Act, Art. 6
   Display / advertising records	6 months	E-Commerce Act, Art. 6
   Login records	3 months	Communications Secrets Act, Art. 15

3. After member withdrawal, data is retained in soft-deleted state for 90 days before permanent deletion (for error recovery protection).
4. Payment records are retained for 5 years as required by accounting law, with identifying information (email, name) anonymized.

The Company processes personal information only within the scope specified in Section 1, and provides it to third parties only with the data subject's separate consent or under special legal provisions. Currently provided to third parties as follows:

The Company entrusts personal information processing as follows for smooth service provision:

※ When concluding entrustment agreements, the Company specifies and safely manages prohibition of processing personal information beyond the scope of entrusted work, technical/administrative protection measures, and re-entrustment restrictions, pursuant to Article 26 of the Personal Information Protection Act.

1. Data subjects may exercise the following rights against the Company at any time:
   • Request for personal information access
   • Request for correction in case of errors
   • Request for deletion (including member withdrawal)
   • Request for suspension of processing
2. Rights may be exercised via My Page or 1:1 inquiry (support@fatehacker.com), and the Company will take action without delay.
3. Membership withdrawal can be done directly via My Page → Member Withdrawal menu.
4. For children under 14 years of age, legal guardians may exercise these rights.

The Company takes the following technical, administrative, and physical measures to ensure security pursuant to Article 29 of the Personal Information Protection Act:

• Administrative: Establishment and implementation of internal management plan, regular employee training, etc.
• Technical:
  • Encrypted personal information storage (AES-256-GCM)
  • One-way password hashing (Firebase Auth bcrypt)
  • Encrypted communication (HTTPS/TLS 1.3)
  • Access control (role-based RBAC)
  • Security audit log collection and monitoring
  • Automatic blocking system for abnormal payments and access
• Physical: Use of ISO 27001/27017/27018 certified data centers through cloud infrastructure (Google Cloud, AWS)

1. The Company uses "cookies" that store and retrieve usage information to provide personalized services.
2. Purposes of cookie use:
   • Login maintenance and identity verification
   • Language setting storage
   • Service usage statistics (Google Analytics 4)
   • Security token (CSRF) management
3. How to refuse cookies: You can refuse or delete cookies in your web browser options. (Note: Refusing cookies may cause difficulties using some services that require login.)
4. Google Analytics 4 (GA4): The Company uses GA4 to collect anonymous statistics.
   • Measurement ID: G-72F5DD9RXX
   • Collected items: Page views, session time, device info (anonymous), referral channels
   • GA4 opt-out: Google Analytics Opt-out Browser Add-on

1. The Company does not, in principle, accept membership from children under 14 years of age.
2. However, for the "Child Fate Analysis" service, children's data is collected only after receiving explicit consent from a guardian (legal representative) before collecting the child's date of birth, birth time, and name for analysis.
3. Guardian consent procedure: Minor Data Collection Consent Page
4. Guardians may request access, correction, deletion, or suspension of processing of the child's personal information at any time.
5. Child information is permanently deleted immediately after analysis is complete, and only the analysis report is encrypted and stored in the guardian's account.

Data subjects may contact the Privacy Officer for any personal information protection inquiries, complaints, or damage relief arising from the use of the Company's services.

Data subjects may contact the following organizations for personal information infringement remedies and consultations:

1. This Privacy Policy takes effect on March 1, 2026.
2. The Company will notify members via the service notice board at least 7 days before any additions, deletions, or modifications resulting from changes in laws, policies, or security technology.