Enacted Nov. 5, 2024
Sandy Floor (hereinafter referred to as the ‘Company’) receives and processes personal information from you in the course of providing all services (hereinafter referred to as the ‘Services’) such as websites and applications. When processing personal information, the Company complies with the personal information protection regulations of relevant laws and regulations that personal information processors must comply with, such as the Personal Information Protection Act, and establishes and discloses the following privacy policy to protect users' personal information and promptly and smoothly handle grievances related thereto.
Article 1 (What Personal Information SandyFloor collects and where we collect it)
1) Game service operations
The Company collects and uses the minimum amount of personal information for the following purposes in order to provide and operate stable services in accordance with Article 15, Paragraph 1, Item 1 (Consent of the Information Subject) and Item 4 (Performance of Contract) of the Personal Information Protection Act.
Personal information items: nickname, platform ID, platform nickname, purchase history (if applicable) (purchase date, item name, order number, amount), survey response contents (including gender, age, region, language, country), mobile phone number
•
Platform ID: A Platform ID is a user identification code generated when you sign up for a platform, such as Steam by Valve Corporation, Epic Games by Epic Games, Inc. or Xbox by Microsoft Corporation, and the respective platforms are responsible for the privacy of this information. When you use the gaming services through the Platform, we will receive this value and use it to distinguish you from other users. However, we do not have access to, and do not retain, any information you provide to the Platforms (such as your name, contact details, payment information, etc.).
•
We may offer various types of goods within the Services, and you may be able to make payments for the purchase of goods through the Platform. In this case, the Company will receive your purchase details (purchase date, item name, order number, and amount) from the Platform and use them to operate the Service. However, the Company does not have access to and does not retain your payment information (card number, account number, payment method, etc.).
•
In the course of operating the Sandy Floor Game Service, the Company may generate and collect your consent history (user identifier, date and time of consent, IP address), service usage history (user identifier, date and time of visit (access history), IP address, unauthorised use history (sanction information), purchase history (purchase date, item name, order number, amount, game goods usage history), device information (OS information, make and model name, language used), chat history (message sent and received history and device information), and cookies.
2) Customer Support Services
The Company may use the information collected and generated for the purpose of ‘Game Service Operation’ in accordance with the contents of your inquiry in accordance with Article 15 (1) (Consent of the Information Subject) and (4) (Performance of Contract) of the Personal Information Protection Act.
Personal information items: nickname, email address, inquiry content, platform ID (if applicable), and primary language, depending on the inquiry channel.
•
Device information (including OS information, make and model, country code, and language used) and in-game information (including build information and language used) may be generated and collected in the course of providing customer support services.
3) Events and promotions
The Company collects and uses personal information for the purpose of ‘Providing Events and Promotions’ in this policy in accordance with Article 15 (1) (1) (Consent of the Information Subject) and Article 22 (1) (7) (Promotion of Goods or Services) of the Personal Information Protection Act.
Personal information items: email address, nickname, (if applicable) necessary for prize distribution
•
When providing promotions such as reward events, we may additionally use the information collected and generated for the purpose of ‘Game Service Operation’ in accordance with Article 15(3) of the Personal Information Protection Act without consent in order to select and contact winners and verify winner information.
•
We may request additional personal information in accordance with Article 15, Paragraph 1, Item 2 (Compliance with Laws) to process taxes and fees under the prize (if applicable).
•
In order to make additional use without your consent, we have considered that (1) the information is used to provide promotions such as events at your option, and (2) it does not unduly infringe on the interests of the data subject.
•
The Company does not process personal information of children under the age of 14 (hereinafter referred to as ‘children’) in the course of providing this Service and related customer support services. If a legal representative believes that the personal information of a child is being processed through this Service, please contact the person in charge of personal information protection by email(sandyfloor@sandyfloor.com). The Company will promptly inform you of the procedure for cancellation of membership or deletion of personal information.
Article 2 (What Personal Information SandyFloor collects and where we collect it)
The Company processes personal information for the following purposes The personal information processed will not be used for any purpose other than the following purposes, and if the purpose of use is changed, the Company will take necessary measures such as obtaining separate consent in accordance with relevant laws such as the Personal Information Protection Act. Non-personal information including game data (number of game plays, game play time, etc.) generated in the process of using the service may be used for the purpose of analysing the service usage environment, improving the service, and enhancing the game usage experience.
1) Operation of the Game Service
1.
Identification of users and confirmation of their intention to use the service
2.
Prevention of fraudulent registration and use
3.
Analysing the service usage environment and improving the service
2) Customer support services
1.
Receiving and handling inquiries or complaints and improving user services
2.
Payment and settlement of charges, including billing, and support for refunds
3.
Responding to service failures and ensuring stability
4.
Preventing fraudulent use, protecting accounts and items, and restricting violations of laws and our Terms of Use
3) Providing promotions such as events
1.
Notification of promotions such as play testing, pre-registration, updates, and participation in events for all services provided by the Company
2.
Confirmation of intent to participate in promotions, and prevention of unauthorised use such as duplicate participation and winning
3.
Selecting and contacting winners and verifying winner information
4.
Payment of prizes, processing of taxes and bills
Article 3 (Provision of personal information to third parties)
The Company uses personal information within the scope disclosed in ‘Article 2. Purpose of Processing Personal Information’, and in principle, the Company does not use personal information beyond the scope or disclose personal information to the outside without the prior consent of the user. However, the following cases are exceptions.
1) When obliged to provide personal information under relevant laws and regulations
If the Company is required to provide personal information by an administrative or investigative agency in accordance with Article 17 (1) (2) of the Personal Information Protection Act (provision of information collected to comply with statutory obligations) or related laws, the Company will provide it in accordance with due process, such as by warrant or a written document bearing the seal of the head of the agency as prescribed by law.
2) When separate consent is obtained from the user
The Company may provide/share your personal information to companies that have a special relationship with the Company in order to provide better services. However, in this case, in accordance with Article 17, Paragraph 1, Item 1 of the Personal Information Protection Act, the Company will notify you in advance of the recipients of the information, the items of personal information to be provided/shared, the reason and period for the provision/sharing, and the protection measures for the information provided/shared, and will go through a separate consent procedure, and will not provide/share the information if you do not agree.
Article 4 (Retention period of personal data)
In principle, the personal information of users is destroyed or separately stored without delay when the purpose of collecting and using personal information is achieved. Examples of achieving the purpose of collecting and using personal information are as follows.
•
When a user requests to withdraw from membership or delete personal information
•
When the Company terminates the provision of the Service
•
When the Company completes the handling of inquiries or complaints from users
•
When the necessary procedures for providing promotions such as events are completed (payment of prizes, processing of utility bills, etc.)
However, for the following reasons only, the information shall be stored and managed separately from other information for a certain period of time and shall be destroyed or segregated without delay after the period specified below.
1) Complaints and dispute resolution
In the event of a request for membership withdrawal or deletion of personal information, personal information collected for the operation of the game service for the purpose of providing support, protecting user accounts, and resolving complaints and disputes shall be stored for up to 15 days from the date of the request and then destroyed or separated.
2) Prevention of unauthorised registration and use
Records of unauthorised use of the game service shall be kept for 5 years from the date of occurrence and then destroyed or separately stored. However, if you are permanently suspended from using the service due to unauthorised use in accordance with the Terms of Service and Operating Policy, records of unauthorised use shall be kept permanently.
3) Provision of additional services such as holding events
Personal information collected for the purpose of holding events, etc. may be retained for different periods depending on the type of event, and is subject to the retention period described on each event page. In general, the Company shall retain personal information for a period of 6 months after the end of the event (end of the promotion period, completion of payment of prizes, etc. and (if applicable) completion of processing of tax bills) We will keep the data for 6 months from that point and then destroy or segregate it.
In addition, if there is an ongoing investigation or inquiry into a violation of applicable laws, we will retain your personal information until the investigation or inquiry is concluded. In addition, if it is necessary to retain your information after the purpose of collection and use has been achieved pursuant to Article 15 (1) (2) of the Personal Information Protection Act (compliance with statutory obligations) and the provisions of applicable laws, we will retain your information for a certain period of time as stipulated by applicable laws as follows. For the relevant laws and regulations, please check each of the following ‘grounds for retention (name of law)’.
•
Classification: Computer communications, internet logs, access point tracking data
◦
Personal information items: date and time of access, IP address
◦
Grounds for retention (name of law): Act on the Protection of Communications Secrets (Article 15(2))
◦
Retention period: 3 months
•
Classification: Records of consumer complaints or dispute handling
◦
Personal information items: Any information collected directly or automatically for customer support services
◦
Grounds for retention (name of law): Act on Consumer Protection in Electronic Commerce, etc. (Article 6)
◦
Retention period: 3 years
•
Classification: Records of contract or subscription cancellation, etc.
◦
Personal information items: User identifier, date of consent, IP address
◦
Grounds for retention (name of law): Act on Consumer Protection in Electronic Commerce, etc. (Article 6)
◦
Retention period: 5 years
•
Classification: Records on payment and supply of goods, etc.
◦
Personal information items: (if applicable) purchase history (purchase date, item name, order number, amount), game goods usage history
◦
Grounds for retention (name of law): Act on Consumer Protection in Electronic Commerce, etc. (Article 6)
◦
Retention period: 5 years
•
Classification: Records on processing prescribed by tax laws
◦
Items of personal information: Information required for prize distribution (if necessary)
◦
Grounds for retention (name of law): National Taxes Act (Article 85(3)), Corporate Income Tax Act (Article 116), Income Tax Act (Article 160(2))
◦
Retention period: 5 years
Article 5 (Processes and methods for destroying personal data)
In principle, the Company destroys or separately stores personal information without delay when the retention period specified in ‘4. Retention Period of Personal Information’ has elapsed. However, if there are special provisions in laws and regulations, personal information will be stored for a certain period of time and then destroyed in accordance with the relevant laws and regulations. The detailed procedures and methods for the destruction of personal information are as follows.
1) Destruction Procedure
When the requirement to destroy personal information arises, the Company will destroy personal information in accordance with its internal policies.
2) Method of destruction
Personal information recorded and stored in the form of electronic files shall be destroyed so that the records cannot be reproduced, and personal information recorded and stored in paper documents shall be destroyed by shredding or incineration.
Article 6 (Outsourcing the processing of personal data)
In order to provide smooth game services and customer support services, the Company entrusts and operates the processing of personal information to external specialised companies as follows, and stipulates matters for the safe management of personal information to such entrusted companies. Some of these entrusted services may be processed by transferring the relevant personal information overseas. If there are any changes to the consignment of personal information processing, we will notify you in advance.
1) Consignment of Personal Information Processing (Overseas Transfer)
Classification (details of consignment) Cloud server operation and management
•
Legal basis: Article 28 (8) (1) (3) of the Personal Information Protection Act (entrustment and storage of personal information for the performance of a contract)
•
•
Items of Personal Information: Any of the items of personal information specified in ‘1. Items of Personal Information Collected and Methods of Collection’ of this Privacy Policy
•
Country of transfer: United States
•
Date and method of transfer: Transferred via network when using the service
•
Period of use of personal information: Upon withdrawal of membership, request for deletion of personal information, or termination of consignment contract
Classification (details of consignment) Cloud server operation and management
•
Legal basis: Article 28 (8) (1) (3) of the Personal Information Protection Act (entrustment of personal information processing for contract performance, storage)
•
•
Personal Information Items: Any of the personal information items specified in the ‘Operation of Game Services’ purpose of this Privacy Policy
•
Country of transfer: United States
•
Date and method of transfer: Transferred via network when using the Game Services
•
Period of use of personal information: Until membership withdrawal or termination of consignment contract
Classification (details of consignment): Email address verification
•
Legal basis: Article 28 (8) (1) (3) of the Personal Information Protection Act (entrustment of personal information processing for contract performance, storage)
•
•
Personal data items: Email address
•
Country of transfer: United States
•
Date and method of transfer: Transferred via network when using game services
•
Period of use of personal information: Until cancellation of membership or termination of consignment contract
You may refuse the overseas transfer of your personal information by contacting the Chief Privacy Officer and the person in charge of personal information protection by email(sandyfloor@sandyfloor.com). If you refuse the overseas transfer of personal information, the Company will exclude your personal information from the overseas transfer. However, in this case, you may be restricted from using any of the Company's services that require the transfer of personal information overseas.
2) Management and Regulations for Consignment of Personal Information Processing
•
Purpose and scope of consignment
•
Prohibition of processing personal information other than for the purpose of performing consignment work
•
Measures to ensure technical and administrative safety, including restrictions on access to personal information
•
Restrictions on re-consignment
•
Matters concerning the Company's supervisory obligations, including checking the management status of personal information held in connection with the outsourcing business
•
Matters concerning liability, including compensation for damages, arising from the breach of the outsourcer's obligation to comply with the above provisions, etc.
Article 7 (Rights of data subjects and their legal representatives and how to exercise them)
1.
As stipulated by applicable laws and regulations, data subjects have the right to access, correct, delete, suspend processing, withdraw consent, refuse automated decisions, or request explanation of their personal information (hereinafter referred to as ‘access’).
a.
If you have any questions about personal information-related matters, please contact the person in charge of personal information protection by email(sandyfloor@sandyfloor.com), and the person in charge will verify your identity through reasonable means. The Company will respond in good faith to the exercise of the rights of the information subject in accordance with the relevant laws and regulations on personal information protection.
b.
Each of the rights of the information subject in this Article 1-1) may be exercised through the legal representative of the information subject. In this case, the legal representative shall have all the rights of the data subject.
c.
If the legal representative of the information subject requests access to personal information, the Company shall verify the legitimate representative's right to do so by executing the ‘Notice on the Method of Processing Personal Information and may require additional necessary proof, such as submission of a power of attorney in the form of Attachment 11.
2.
The Company shall allow the information subject and legal representative (hereinafter referred to as the ‘information subject, etc.’) to inspect the personal information within 10 days in response to the request for inspection, etc. However, if there is a legitimate reason why it is not possible to inspect the personal information within the period, the Company shall notify the information subject and may postpone the deadline, and if the reason disappears, the Company shall provide the personal information without delay.
3.
The Company shall notify the information subject of the request for correction or deletion of personal information within 10 days after taking measures such as correction or deletion, unless there are procedures required by other laws and regulations. However, if it is not possible to delete the personal information, such as when the personal information is specified as the subject of collection in other laws, the information subject will be notified.
4.
The request of the information subject, etc. to suspend the viewing and processing of personal information may be restricted by Articles 35(4) and 37(2) of the Personal Information Protection Act, and the deletion of the personal information cannot be requested if the personal information is specified as the subject of collection in other laws.
5.
If we have obtained your separate consent to the fact that an automated decision is being made, or if we have informed you in advance through a contract or other means, or if the law clearly stipulates otherwise, you may not refuse an automated decision, but may only request an explanation and review. In addition, a request for refusal or explanation of an automated decision may be denied if there is a legitimate reason, such as the possibility of unduly infringing on the life, body, property, and other interests of another person.
Article 8 (Technical and administrative protection measures for personal data)
We have designed and implemented the following administrative, technical, and physical safeguards to protect your personal information from loss, theft, leakage, disclosure, alteration, or destruction. However, we cannot guarantee the complete protection of all information. By providing personal information to us, you acknowledge and agree to these limitations.
•
The Company checks the implementation of the Privacy Policy and the compliance of its personnel and endeavours to promptly correct and rectify any problems found.
•
However, the Company shall not be liable for any problems caused by the leakage of personal information such as passwords due to your own negligence or internet problems.
Article 9 (Contacting the Privacy Officer)
The Company has designated the following person in charge of personal information protection to take overall responsibility for the processing of personal information and to handle complaints and damage relief of information subjects related to the processing of personal information.
Personal Information Protection Officer
•
Name: Jongchang Lee
•
Contact : maestrolee@sandyfloor.com
Article 10 (Disclosure and revision of the Privacy Policy)
If the Company makes any changes to this Privacy Policy, the effective date and the revised contents will be posted on the website 7 days prior to the effective date. However, if there are significant changes to the rights of the information subject, we will notify you 30 days in advance.