Privacy Policy

Manna Company Inc. (“Company,” “we,” “us,” or “our”) may collect, store, use, and share (“process”) your personal information. This Privacy Policy explains how we process and protect your personal information when you use the Kfriday service (the “Service”), and how you may exercise your rights or resolve any related grievances. Please carefully read and review this Privacy Policy which will help you understand your privacy rights and choices.

1. Your Information We Collect or Receive

Personal Information You Provide Directly

We do not process your special personal data, such as race and ethnicity, political opinions, religious or philosophical beliefs, genetic data, biometric data for ID purposes, health data, sexual orientation, sexual life data.

Automatically Collected When You Access Our Services

Usage information: IP address, cookies, access logs, service usage records, device information, device model, operating system type and version, and browser type and version, and records of improper usage.

2. Legal Bases We Rely on to Process Your Data

• Consent (withdrawable at any time)

• Performance of a Contract (including pre-contractual steps)

• Vital interests (e.g., detecting and preventing fraud or abuse)

• Public interest or official authority

• Legitimate interests pursued by us or third parties, except where overridden by the interests or rights of the data subject

3. Retention Periods

We will delete and destroy your personal information without delay once the purpose of collection and processing has been achieved, unless retention is required by law. Specifically:

• General retention: up to 12 months after collection, unless otherwise required.

• Where retention is legally required:

  • Communications data (Protection of Communications Secrets Act): 3 months

  • Transaction records (Framework Act on National Taxes): 5 years

  • Records under the Act on Consumer Protection in Electronic Commerce:

    • Advertisements: 6 months

    • Contracts, payments, and supply of goods: 5 years

    • Consumer complaints or dispute resolution: 3 years

4. Children’s Privacy

We may collect and process personal information of children under the age of 14 only with the consent of their parent or legal guardian. Without such consent, children under the age of 14 may not use the Service. The minimum age requirement may be higher if required by applicable local laws.

5. Provision of Personal information to Third Parties

6. Outsourcing

To ensure smooth operations, we outsource certain personal information processing tasks as follows:

When entering into outsourcing agreements, we include provisions to prohibit processing beyond the purpose of outsourcing, require technical and administrative safeguards, restrict re-outsourcing, and impose liability for damages. We also monitor whether processors handle personal information safely.

If the scope of outsourced tasks or the processor changes, we will promptly disclose such changes through this Privacy Policy.

7. Cross-border Transfer

We transfer personal information abroad to third-party processors. In accordance with Article 28-8(2) of the Personal Information Protection Act of Korea, we provide the following information:

8. Destruction of Personal Information

Procedure

Information that has fulfilled its purpose or exceeded retention is identified and destroyed with the approval of the Chief Privacy Officer.

Methods:

• Electronic files: permanently deleted with technical measures making recovery impossible.

• Paper documents: shredded or incinerated.

9. You and Your Legal Representatives’ Rights, Obligations, and Exercise Methods thereof

You and your legal representatives have the right to:

• Access your personal information

• Correct inaccuracies

• Request deletion

• Request suspension of processing

• Request transfer (portability)

• Object to processing

• Request explanation of automated decision-making

Requests may be made in writing, email, or fax. We will respond without undue delay. Some rights may be restricted by law (e.g., deletion cannot be granted if retention is legally required). We verify the identity of requestors to ensure lawful exercise of rights.

10. Security Measures

We implement the following safeguards:

• Administrative Measures: internal management plans, training, limited access to personnel

• Technical Measures: encryption, intrusion prevention, backup, anti-virus, access control

• Physical Measures: restricted access to server and storage facilities

If information is lost, leaked, altered, or damaged due to internal error or technical accident, we will notify affected users within 72 hours.

11. Cookies, Tracking, and Behavioral Information

We use cookies and other tracking technologies to provide personalized services. You may refuse cookies by adjusting browser settings, but refusal may affect your ability to use some features.

Examples of tracking tools:

12. Chief Privacy Officer

We have designated a Chief Privacy Officer responsible for managing personal information processing and handling your grievances and damage relief, as follows:

Chief Privacy Officer

• Name: Sinsub Jeong

• Position: CEO

• Contact: 070-8633-0767, corp@kfriday.net

You may direct all personal information protection-related inquiries, handling grievances, or damage relief arising from using our services to our Chief Privacy Officer or the following department in charge:

• Department: Customer Care

• Contact: 070-8687-0333, contact@kfriday.net

13. Updates to this Policy

We may update this Privacy Policy to comply with law or reflect changes in our Services. Changes will be notified at least 30 days in advance, or 7 days if less favorable to you. Notice will be provided on our website or by other appropriate means.

If you continue to use the Services after such notice, you will be deemed to have accepted the changes.

14. Governing Law

This Policy will be governed by the laws of the Republic of Korea, unless otherwise required by GDPR or other applicable laws.

Effective Date: October 15, 2025