Privacy Policy

JCG (hereinafter referred to as the "Company") establishes this Privacy Policy (hereinafter referred to as the "Policy") to protect the personal information of individuals (hereinafter referred to as the "User") using the services provided by the Company. This Policy complies with the Personal Information Protection Act (PIPA) of the Republic of Korea and other relevant domestic laws, ensuring that any grievances related to privacy are handled promptly and smoothly.

The Company may collect the User's personal information in accordance with relevant privacy laws and this Policy. The collected information may be provided to a third party only with the explicit consent of the User. However, if lawfully mandated by legal regulations, the Company may provide the collected information to a third party without prior consent.

1. The Company discloses this Policy on the initial screen of the Company's website or a linked screen so that Users can easily access it at any time.
2. When disclosing this Policy, the Company utilizes appropriate font sizes and colors to ensure it is easily recognizable by Users.

1. This Policy may be amended due to changes in privacy-related laws, guidelines, government notices, or modifications in the Company's service policies.

2. In the event of an amendment, the Company will notify Users through one or more of the following methods:

   1. Posting on the notice board or a separate pop-up window on the initial screen of the Company's website.
   2. Notifying Users individually via written notice, fax, email, or similar methods.
3. Notices of amendments will be provided at least 7 days prior to the effective date. However, significant changes affecting User rights will be announced at least 30 days in advance.

The Company collects the following information for User membership registration:

1. Required Information: Email address, Password, Name, and Mobile phone number.
2. Optional Information: Name as written on passport, Date of birth, and Address.

The Company collects the following information for verifying the User's identity:

1. Required Information: Email address.

The Company collects the following information for statistical analysis of service usage and to identify/prevent fraudulent activities. (Fraudulent activities refer to illegal or unauthorized actions, such as repeatedly canceling purchases after making them, illegitimately acquiring economic benefits like discount coupons, violating the Terms of Use, or identity theft.)

1. Required Information: Service usage records, Cookies, Connection IP/Location data, and Device information.

The Company collects personal information through the following methods:

1. When the User inputs personal information on the Company's website.
2. When the User inputs personal information through applications or other services provided by the Company.
3. When the User inputs personal information in response to an email sent by the Company.
4. When the User provides personal information via phone calls, SMS, or messaging services initiated by the Company.

The Company utilizes personal information for the following purposes:

1. Necessary operations of the Company, such as delivering announcements.
2. Improving User services, such as responding to inquiries and handling complaints.
3. Providing the Company's core services.
4. Taking restrictive measures against Users violating laws or Company policies, and preventing/sanctioning actions that disrupt smooth service operations.
5. Marketing and advertising, including event and promotional notifications.

1. Despite the general prohibition of providing personal information to third parties, the Company may do so if the User makes it public in advance or explicitly consents to the following. Even in such cases, the Company limits the provision to the minimum extent required under relevant laws.

   1. Providing Passport, Driver's License, International Driving Permit, and Address to the French automotive manufacturers (Citroën, DS, Peugeot) for the purpose of executing the tax-free lease vehicle contract.
2. If there are changes or terminations regarding the third-party provision, the Company will notify the User and obtain consent through the same procedure.

1. The Company retains and uses the User's personal information only for the duration necessary to achieve the purposes of collection and use.
2. Notwithstanding the above, to prevent fraudulent registrations and unauthorized use, records of fraudulent service usage will be retained for up to 1 year from the time of membership withdrawal in accordance with internal policies.

The Company retains and uses personal information as required by relevant South Korean laws, including but not limited to:

1. Act on the Consumer Protection in Electronic Commerce, etc.

   1. Records on contracts or withdrawal of subscription: 5 years
   2. Records on payment and supply of goods: 5 years
   3. Records on consumer complaints or dispute resolution: 3 years
   4. Records on labeling and advertising: 6 months

2. Protection of Communications Secrets Act

   1. Website log records: 3 months

3. Electronic Financial Transactions Act

   1. Records on electronic financial transactions: 5 years

As a general rule, the Company promptly destroys personal information once the purpose of processing is fulfilled or the retention/use period expires, rendering the information no longer necessary.

1. Information entered by the User for membership registration is transferred to a separate database (or a separate filing cabinet for paper records) once the purpose is achieved. It is then stored for a specific period based on internal policies and other relevant legal protection grounds (refer to the Retention and Use Period) before being destroyed.
2. Personal information subject to destruction is destroyed following the approval of the Data Protection Officer (DPO).

Personal information stored in electronic file formats is securely deleted using technical methods that prevent record recovery. Personal information printed on paper is destroyed by shredding or incineration.

1. When transmitting advertising information for commercial purposes via electronic media, the Company obtains explicit prior consent from the User. However, prior consent is not required in the following cases:

   1. If the Company collected contact information directly from the recipient through a transaction of goods, and intends to send advertising information about similar goods within 6 months from the transaction's end date.
   2. If a telemarketer under the Act on Door-to-Door Sales, etc., verbally informs the recipient of the source of the personal information and makes a solicitation.
2. Despite the above, the Company will not send commercial advertising if the recipient expresses a refusal to receive or withdraws prior consent, and will notify the recipient of the processing result.
3. To send commercial advertising between 9:00 PM and 8:00 AM via electronic media, the Company will obtain separate prior consent from the recipient.

4. When sending commercial advertising via electronic media, the Company will specifically state the following in the advertisement:

   1. The Company's name and contact information.
   2. Instructions and methods for expressing the intention to refuse receipt or withdraw consent.

5. When transmitting commercial advertising via electronic media, the Company avoids the following prohibited actions:

   1. Measures to evade or obstruct the recipient's refusal or withdrawal of consent.
   2. Measures automatically generating recipient contact information by combining numbers, symbols, or letters.
   3. Automatically registering phone numbers or email addresses to send commercial advertising.
   4. Measures to conceal the identity of the sender or the source of the advertisement.
   5. Deceptive measures inducing replies from the recipient for commercial advertising purposes.

1. To protect the personal information of children under the age of 14, the Company restricts membership registration to Users aged 14 and older.
2. Notwithstanding the above, if the User is a child under 14, the Company shall obtain consent from the child's legal guardian for the collection, use, and provision of the personal information.
3. In the case of Paragraph 2, the Company may additionally collect the legal guardian's name, date of birth, gender, duplication check information (DI), and mobile phone number.

1. Users and their legal guardians may view or modify their registered personal information at any time, and may request to withdraw their consent to the collection of personal information.
2. If a User or legal guardian contacts the Data Protection Officer or the designated department via writing, phone, or email to withdraw consent, the Company will take action without delay.

1. Users may request the Company to correct errors in their personal information through the methods described in the preceding article.
2. The Company will not use or provide the personal information until the requested correction is completed. If incorrect personal information has already been provided to a third party, the Company will notify the third party of the correction results without delay to ensure the correction is applied.

1. Users must keep their personal information up to date. Users are solely responsible for any issues arising from the entry of inaccurate information.
2. If a User registers for membership using another person's personal information, they may lose their membership qualifications and face penalties under relevant privacy laws.
3. Users are responsible for maintaining the security of their email addresses, passwords, and other credentials, and must not transfer or lend them to a third party.

In processing Users' personal information, the Company implements necessary technical and managerial security measures to ensure safety and prevent loss, theft, leakage, alteration, or damage to personal information.

Personal information terminated or deleted at the request of the User or legal guardian is processed as specified in the "Retention and Use Period of Personal Information" and is strictly restricted from being viewed or utilized for any other purposes.

The User's password is stored and managed using one-way encryption. Viewing or modifying personal information is restricted exclusively to the individual who knows the password.

1. The Company does its utmost to prevent the leakage or damage of Users' personal information resulting from hacking, computer viruses, or other unauthorized network intrusions.
2. The Company uses up-to-date antivirus programs to prevent the leakage or corruption of Users' personal information and data.
3. The Company deploys robust firewall systems to ensure maximum security against potential intrusions.
4. The Company utilizes encrypted communication protocols to ensure the safe transmission of sensitive personal information over the network.

The Company restricts the number of personnel handling personal information to a necessary minimum and ensures compliance with laws and internal policies through administrative measures, including regular training for data handlers.

1. The Company does not enter into international contracts that violate the Personal Information Protection Act or other relevant South Korean laws regarding Users' personal information.
2. The Company obtains the User's consent before transferring, outsourcing, or storing (hereinafter "transferring") personal information overseas. However, the consent procedure for outsourcing or storing data may be bypassed if the Company discloses the details specified in Paragraph 3 in accordance with the law or informs the User via email or other legally prescribed methods.

3. To obtain the consent mentioned in Paragraph 2, the Company will notify the User of all the following details in advance:

   1. Items of personal information to be transferred.
   2. The destination country, date, and method of transfer.
   3. The name of the recipient (or corporate name) and contact information of the Data Protection Officer of the recipient.
   4. The purpose of use and the retention/use period of the transferred information by the recipient.
4. When transferring personal information overseas with the User's consent, the Company implements protective measures in accordance with the Presidential Decree of the Personal Information Protection Act and other relevant laws.

1. To provide individualized and customized services, the Company uses automatic data collection devices (hereinafter "Cookies") that store and retrieve usage information. Cookies are small pieces of information sent by the server operating the website to the User's PC and mobile web browsers, and may be stored on the User's device.
2. Users have the option to manage Cookies. By configuring options in the web browser, Users can accept all Cookies, check each time a Cookie is saved, or refuse the storage of all Cookies.
3. However, if the User refuses the storage of Cookies, difficulties may arise in using certain Company services that require logging in.

Users can manage Cookie allowances and blocks through their web browser options:

1. Microsoft Edge: Settings menu at the top right > Cookies and site permissions > Manage and delete cookies and site data.
2. Google Chrome: Settings menu at the top right > Privacy and security > Cookies and other site data.
3. Apple Safari / Naver Whale: Respective Privacy & Security settings menus regarding Cookies and website data.

To protect User personal information and handle privacy-related inquiries and complaints, the Company has designated the following Data Protection Officer. For international Users, please prioritize contacting us via email for the fastest resolution.

• Name: Jae-hwang Ryu
• Position: Team Manager
• Phone: (0)2 555 3846
• Email: ask@car2europe.kr

1. Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, KISA Personal Information Infringement Report Center, etc., to seek relief from privacy infringements. For other privacy infringement reports and consultations, please contact the following institutions in South Korea:

   1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
   2. KISA Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
   3. Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
   4. Korean National Police Agency: 182 (ecrm.cyber.go.kr)

2. Any person whose rights or interests are infringed due to dispositions or omissions by the head of a public institution regarding demands made under Articles 35 (Access), 36 (Correction/Deletion), and 37 (Suspension of Processing) of the Personal Information Protection Act may file for an administrative appeal under the Administrative Appeals Act.

   1. Central Administrative Appeals Commission: 110 (www.simpan.go.kr)
3. The Company guarantees the right to self-determination of personal information for data subjects and provides assistance with consultations and reporting when contacting the Data Protection Officer for damage relief due to privacy infringements.