Privacy Policy

W Company (the “Company”) complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This Privacy Policy explains how the Company collects, uses, stores and deletes the personal information of members who use the THE WET website and mobile app (the “Service”).

Article 1 (Purposes of Processing)

The Company processes personal information for the purposes below. Personal information is not used for any other purpose; if a purpose changes, the Company obtains separate consent or takes other measures required under Article 18 of the Personal Information Protection Act.

1. Membership and account management: confirming the intent to sign up, identifying and authenticating members, maintaining accounts, reviewing creator applications, preventing misuse, sending notices, handling complaints
2. Providing goods and services: orders, payment, delivery and refunds of art goods, artworks and programs; program participation notices; creator settlements
3. Communication between members: messages between creators and members, artwork inquiries, follows, program group chats
4. Customer inquiries: receiving inquiries, verifying facts, notifying results
5. Service improvement and safety: analyzing access logs, responding to failures, preventing account takeover and fraudulent payments
6. Marketing (optional): newsletters and announcements of new programs and goods, sent only to members who opted in

Article 2 (Personal Information Collected and How)

The Company processes the following items.

1. Sign-up (required): email address, password (stored with one-way encryption), username. (Optional): marketing opt-in, creator invitation code
2. Profile (optional): profile photo, bio, phone number, country, interest tags, Instagram URL (creators)
3. Creator application: legal name, artist name (Korean and English), city, artist statement, studio address, profile photo, representative work image, portfolio link or file, how you learned about the Service
4. Orders and delivery: recipient name, phone number, shipping address, delivery note, order history, payment history (payment method type and approval details). Card numbers, bank account numbers and other payment credentials are processed directly by the payment gateway (KG Inicis) and are not stored by the Company.
5. Creator settlements: settlement requests and payout records
6. Inquiries: email address, phone number (optional), subject and message. For artwork inquiries: name, email address, phone number (optional), message
7. Messages: message content, sent time, participants
8. Registered content: information and images for artworks, goods, programs and art tours, and posts
9. Automatically generated during use: IP address, device and browser information (User-Agent), sign-in time and session details, usage records, cookies, and the sign-in token and language setting kept in the app’s local storage

Personal information is collected when members enter it on Service screens (sign-up, profile, creator application, orders and payment, inquiries, messages) or when it is generated automatically while using the Service.

Article 3 (Retention and Use Period)

1. The Company retains and uses personal information from sign-up until the member deletes the account. When a member deletes the account, the Company promptly destroys the personal information or anonymizes it so that the individual can no longer be identified.
2. The following records are kept for the periods required by law:
   • Records on contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
   • Records on payment and supply of goods: 5 years (same Act)
   • Records on consumer complaints or dispute resolution: 3 years (same Act)
   • Records on labeling and advertising: 6 months (same Act)
   • Service access logs: 3 months (Protection of Communications Secrets Act)
3. Messages between members remain, with the deleted member’s name anonymized, to protect the other participant’s conversation history.
4. Product names, images and similar details of artworks, goods and programs that appear in order history are kept as part of the transaction records for the periods above.

Article 4 (Provision to Third Parties)

The Company processes personal information only within the purposes in Article 1 and does not provide it to third parties except with the member’s consent or where specifically required by law. To provide the Service, it is shared as follows.

1. Creators fulfilling orders: when a member orders a creator’s goods or artwork, the recipient name, phone number, shipping address and delivery note are provided to that creator for delivery. The creator keeps them until delivery is complete; retention as transaction records follows Article 3.
2. Visibility to other members: username, profile photo and bio are visible to other members within the Service. A creator’s artist name, city, statement, Instagram URL and registered works are public through the creator’s room. Message content is visible only to the participants of that conversation.

Article 5 (Outsourcing of Processing)

The Company outsources the following processing to provide the Service, and supervises each processor under Article 26 of the Personal Information Protection Act so that personal information is handled safely.

• KG Inicis: payment processing, cancellations and refunds
• NHN Cloud: email delivery (sign-up notices, password reset, order and program notifications)
• Naver Cloud Platform: storage of images and attachments
• Clevon: development, operation and maintenance of the Service systems

Address search during shipping-address entry uses the Korean Ministry of the Interior and Safety road-name address API; only the search term entered by the member is sent. The Company does not transfer personal information abroad.

Article 6 (How to Delete Your Account and Personal Information)

1. Members can delete their account at any time from within the Service. The steps are the same in the app and on the website.
   • Sign in and open My Room.
   • In the Account panel, tap Delete account.
   • Read the notice about what is deleted and what is kept, enter your password, then tap Delete my account. Deletion takes effect immediately.
2. If you cannot access the app, email info@thewet.xyz from the address you signed up with. After verifying your identity the Company will process the request without delay, and within 10 days at the latest.
3. Upon deletion, your sign-in credentials (password and sessions), email address, username, phone number, profile photo, bio, shipping addresses, cart, interests, follows, notifications, and creator application with its attachments are deleted or anonymized immediately. A creator’s artworks, goods and art tours become private and the creator’s room closes.
4. Records that must be kept by law under Article 3(2) (orders, payments, delivery, settlements, inquiries and disputes) are kept in anonymized form for the required period and then destroyed.
5. If an order is still being shipped or refunded, or a settlement is still being processed, the account can be deleted after that process completes, to protect the other party to the transaction.
6. Signing up again with the same email address creates a new account that is not linked to the previous one.

Article 7 (Rights of Data Subjects and Legal Representatives)

1. Members may at any time request access to, correction or deletion of, or suspension of processing of their personal information.
2. Email address, username, profile, phone number, shipping addresses, interests and marketing preferences can be viewed and changed directly in My Room. Other requests can be made to info@thewet.xyz or through the Service’s inquiry form; the Company acts on them within 10 days of receipt.
3. Rights may also be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form prescribed by the Enforcement Rules of the Personal Information Protection Act must be submitted.
4. Requests for access or suspension of processing may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act, and deletion cannot be requested for information that other laws require to be collected.

Article 8 (Destruction of Personal Information)

1. The Company destroys personal information without delay once it is no longer needed, such as when the retention period ends or the purpose has been achieved.
2. Information that must be kept by law is moved to a separate database or storage area, or anonymized, and is not used for any purpose other than that required by law.
3. Electronic files are deleted using technical methods that prevent recovery; paper documents are shredded or incinerated.

Article 9 (Security Measures)

The Company takes the following measures to keep personal information secure.

• Administrative: an internal management plan, a minimal number of trained staff with access to personal information
• Technical: one-way encryption of passwords, encryption in transit (TLS), access control for processing systems, retention of access logs, security updates
• Physical: access control for data centers and servers

Article 10 (Cookies and Local Storage)

1. The website uses cookies and the app uses the device’s local storage to keep you signed in and to remember your language setting. No advertising or tracking cookies are used.
2. You can refuse cookies in your browser settings, in which case you may not stay signed in. In the app, signing out or deleting the app removes the information in local storage.

Article 11 (Children Under 14)

The Company does not accept sign-ups from, and does not collect personal information of, children under the age of 14. If the Company learns that such information has been collected, it deletes it without delay.

Article 12 (Privacy Officer)

The Company has designated the following privacy officer, who is responsible for overall personal information processing and handles inquiries, complaints and remedies from data subjects.

• Privacy officer: Sanghyun Lee (CEO)
• Contact: info@thewet.xyz, +82-2-2135-1361
• Address: W Company, B1, 55 Yanghwa-ro 10-gil, Mapo-gu, Seoul, Republic of Korea

Members may contact the privacy officer about any privacy-related inquiry, complaint or remedy arising from use of the Service, and the Company will respond without delay.

Article 13 (Remedies for Infringement)

Members may contact the following organizations for remedies or consultation regarding personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation: 1301, www.spo.go.kr
• National Police Agency Cyber Bureau: 182, ecrm.cyber.go.kr

Article 14 (Changes to This Policy)

1. This Privacy Policy takes effect on September 12, 2026.
2. The Company may revise this Policy when laws or the Service change. Revisions are announced within the Service or by email at least 7 days before the effective date, and at least 30 days before for changes that materially affect members’ rights.

Supplementary Provision

Announced: September 12, 2026

Effective: September 12, 2026