← LUMIN ART MUSEUM

Privacy Policy

Last updated: 2026-10-01

Article 1 (Purpose)

This Privacy Policy specifies the purposes and methods by which personal information is collected, used, disclosed, retained and destroyed in connection with the sale of digital vouchers exchangeable for Lumin Art Museum admission tickets (the “Service”) through luminartmuseum.net, an online platform operated by EZM Co., Ltd. (주식회사 이지엠, the “Company”).

The Company follows the principles of minimum data collection, purpose limitation and enhanced security, based on membership through social media sign-up, integration with domestic payment gateways (PGs) and minimum information sharing with the overseas Partner (the on-site operator).

Article 2 (Definitions)

Terms used in this Policy have the same meanings as in Article 2 of the Terms of Service and apply to personal information processing as follows.

1. “Company” means EZM Co., Ltd. (주식회사 이지엠), which operates luminartmuseum.net and provides the digital voucher sales service. 2. “Platform” means the Company's web and mobile online system that provides digital voucher sales, payment processing, information, user authentication and customer support. 3. “Service” means the sale of digital vouchers exchangeable for Lumin Art Museum admission tickets through the Platform and all related online services. 4. “Voucher” means a digital certificate sold through the Platform that is exchangeable for a Lumin Art Museum admission ticket and is used or verified on site or through partner channels designated by the Company. 5. “Partner” means PMA Thai, which operates Lumin Art Museum and handles on-site voucher verification, admission processing and operational services. 6. “User” means a member or non-member who uses the Company's services under this Policy and the Terms of Service. 7. “Member” means a person who signs up for the Platform using an external social account such as Google, Kakao or LINE and is identified for continued use of the Service. 8. “PG” means a domestic payment gateway contracted by the Company solely to provide payment services, including electronic payment processing and payment information intermediation. 9. “Voucher verification information” means the minimum information provided to the Partner to verify that a voucher was legitimately sold by the Company and prevent misuse.

Article 3 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes and does not use it for other purposes.

1. Member identification and authentication - Identifying users through social sign-up. - Preventing duplicate registration and misuse.

2. Digital voucher sales and payment processing - Voucher purchases, payment approval and payment history management. - Payment error handling and refunds.

3. Voucher use verification and Partner integration - Verifying that vouchers were sold by the Company. - Minimum identity verification upon admission.

4. Customer support and dispute handling - Handling inquiries, complaints and customer consultations. - Addressing Service-related disputes and legal matters.

5. Legal compliance and security management - Retaining records required by applicable laws. - Detecting fraudulent transactions and maintaining system security.

Article 4 (Categories of Personal Information Processed)

1. Information collected during social sign-up The Company collects only the information necessarily provided by the user's selected social account provider as its basic data collection. - Google: required — email address and unique identifier (ID); optional — profile name and profile image. - Kakao: required — unique identifier (ID); optional — email address, nickname and profile image. - LINE: required — unique identifier (ID); optional — display name, profile image and email address (if configured for provision). ※ The Company does not collect or store social account passwords.

2. Voucher purchase and payment - Required: payment amount, payment approval information and payment method identifiers. - Optional: email address for receipt delivery. ※ Sensitive payment information, including card numbers, is processed directly by the PG and is not stored by the Company.

3. Automatically collected information - IP addresses, access logs, cookies, device information and Service usage records.

Article 5 (Disclosure of Personal Information to Third Parties)

As a general rule, the Company does not disclose users' personal information externally. Only in the following cases does it provide the minimum information necessary to achieve the stated purpose.

1. Payment processing (domestic) - Recipient: domestic payment gateway (PG). - Purpose: electronic payment processing and payment approval. - Information: payment approval number, transaction identifiers and payment amount.

2. Voucher use verification (overseas) - Recipient: overseas Partner (PMA Thai). - Voucher identifiers: voucher ID and QR code identifier, to verify that the voucher was sold by the Company. - Usage status: whether and when the voucher was used, to prevent duplicate or fraudulent use. - Minimum identity information: name or part of an email address, for identity verification upon admission; masking may be applied. ※ The Partner does not receive member account information, social account information, payment information or other information beyond the above and may not use the information for purposes other than voucher verification.

Article 6 (Retention and Use Periods)

1. Member information: until membership withdrawal. 2. Payment and transaction records: five years in accordance with applicable laws. 3. Customer inquiry records: three years after the inquiry is resolved.

Article 7 (Destruction of Personal Information)

The Company destroys personal information without delay when its retention period expires or its processing purpose is fulfilled. - Electronic files: deleted in an irrecoverable manner. - Paper documents: shredded or incinerated.

Article 8 (Privacy Officer)

The Company designates the following Privacy Officer to oversee personal information processing and handle complaints and remedies relating to personal information.

▶ Privacy Officer - Name: Sangyeon Lee (이상연) - Position: Department Manager - Email: sylee@ezmc.co.kr - Telephone: +82-1899-8296

Data subjects may use the above contact details for privacy inquiries, complaints or requests for remedies. The Company will respond promptly and diligently.

Personal Data Processing Entrustment — Payment Integration The Company entrusts payment integration services to Korea PortOne Co., Ltd. to facilitate payment processing.