Privacy Policy.

NDUS Games Co., Ltd. (the "Company") complies with the Personal Information Protection Act ("PIPA") and other relevant laws of the Republic of Korea, and establishes and discloses this Privacy Policy in order to protect users' personal information and to handle related concerns promptly and effectively. This Policy applies to the games, and the related websites (ndus.io), applications, and all other services (collectively, the "Services"), that the Company provides through open markets including the Google Play Store, ONE store, and Toss Mini App (App-in-Toss).

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes and does not use it for any purpose other than those set out below. Where the purpose of use changes, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of PIPA.

a. Membership registration and management: identity verification and authentication for member-based services, maintenance and management of membership, and prevention of service misuse.

b. Service provision: providing game services and content, managing characters and game data, providing events and prizes, and processing payment and settlement of fees.

c. Customer support: handling inquiries and complaints, delivering notices, and retaining records for dispute resolution.

d. Marketing and advertising: informing users of new services, providing event information, delivering personalized advertising, and analyzing service usage statistics to improve quality.

Article 2 (Items of Personal Information Processed and Collection Methods)

The Company processes the following personal information to provide the Services.

Collection methods: (1) user input during use of the app/web services and registration; (2) automatic generation and collection during service use (usage-data collection tools, advertising SDKs, etc.); and (3) collection during customer center inquiries.

Article 3 (Retention and Use Period of Personal Information)

The Company processes and retains personal information within the retention and use period required by law or consented to by the user, and destroys it without delay once the purpose has been achieved.

a. Member information: until withdrawal of membership. However, where necessary to prevent misuse and respond to disputes, relevant records may be retained for a certain period.

b. Retention pursuant to relevant laws:

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and provides it to third parties only where the case falls under Articles 17 and 18 of PIPA, such as with the user's consent or where specially provided by law. As a rule, the Company does not provide users' personal information externally; where provision is necessary, the Company will notify the recipient, purpose, items, and retention period in advance and obtain consent.

Article 5 (Entrustment of Personal Information Processing)

For the smooth provision of the Services, the Company entrusts personal information processing tasks as set out below, and supervises the trustees so that they process personal information safely in accordance with Article 26 of PIPA.

Article 6 (Overseas Transfer of Personal Information)

The Company transfers personal information overseas as set out below. Users may refuse the overseas transfer of their personal information; if refused, the use of some services, such as advertising, may be restricted.

Other trustees and advertising providers (ONE store, Viva Republica (Toss Ads / Toss), etc.) are domestic operators that process personal information within Korea and are not subject to overseas transfer.

Article 7 (Personal Information of Children Under the Age of 14)

Where the Company processes the personal information of a child under the age of 14, it obtains the consent of the child's legal representative, who may request access to, correction of, deletion of, or suspension of the processing of the child's personal information. The Company collects only the minimum information necessary when collecting a child's personal information.

Article 8 (Rights and Obligations of Users and Legal Representatives, and How to Exercise Them)

Users may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information, or withdraw their consent. These rights may be exercised through in-service settings, the customer center (contact@ndus.io), or by written request or email to the Privacy Officer, and the Company will act without delay. Where a user requests correction of an error in personal information, the Company will not use or provide the relevant personal information until the correction is completed.

Article 9 (Procedures and Methods for Destruction of Personal Information)

The Company destroys personal information without delay once the processing purpose has been achieved or the retention period has expired. Information in the form of electronic files is deleted using technical methods that render it unrecoverable and unreproducible, and paper documents are shredded or incinerated. Where information must be retained under other laws, it is stored separately.

Article 10 (Automatic Personal Information Collection Devices and Personalized Advertising)

The Company uses cookies and advertising identifiers (Android Advertising ID, Apple IDFA, etc.) to provide personalized services and advertising. The Company delivers personalized advertising through its advertising partners (Google AdMob, Toss Ads, etc.), and in this process advertising identifiers and device and usage information may be processed.

Users may reset their advertising identifier or restrict or block personalized advertising through their device settings.

Android: Settings > Privacy (or Google) > Ads > Reset / Delete advertising ID

iOS: Settings > Privacy & Security > Tracking > turn off "Allow Apps to Request to Track"

Article 11 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to process personal information safely: administrative measures (establishing and implementing an internal management plan, and training relevant staff), technical measures (management of access rights, access control, encryption, and installation and updating of security programs), and physical measures (access control to computer rooms and data storage rooms).

Article 12 (Privacy Officer)

The Company designates the following Privacy Officer to take overall responsibility for personal information processing and to handle users' inquiries, complaints, and remedies in relation to personal information processing.

Article 13 (Remedies for Infringement of Rights)

Users may apply to the following organizations for dispute resolution or consultation regarding infringement of personal information.

Article 14 (Changes to this Privacy Policy)

This Privacy Policy applies from its effective date. Where there are any additions, deletions, or modifications due to changes in laws, policies, or security technologies, the Company will give notice through in-service announcements or the website at least 7 days before such changes take effect (at least 30 days before for material changes affecting users' rights).

Date of notice: July 28, 2026 · Effective date: July 28, 2026

Article 15 (Governing Language)

This Privacy Policy is originally written in Korean. This English version is provided for the convenience of users. In the event of any conflict or discrepancy between the Korean and English versions, the Korean version shall prevail.