Privacy Policy

- Account creation, identity verification, sign-in and account management - Receiving, confirming, changing and cancelling bookings; processing payments and refunds - Passing booking details to the partner venue and supporting fulfilment of your booking - Sending booking-related notices (confirmation, cancellation, pre-visit information) - Reviewing partner applications, paying settlements and issuing tax records to partners - Responding to inquiries and handling disputes - Usage analytics, service improvement, security and fraud prevention - Compliance with legal obligations

1) When you create an account - Required: email address, password (stored encrypted) or social sign-in identifier (Google, Kakao, Apple) - Optional: nickname 2) When you book and pay (members and guests alike) - Required: name, email address, country, language, booking details (venue, course, date and time, party size, requests), payment record (method, amount, approval number) - Optional: mobile phone number - Card details are handled directly by the payment gateway NICE Payments Co., Ltd.; LUWEI does not store them. 3) When a partner registers - Business name, business registration number, representative and contact person name, email address, mobile phone number, settlement bank account (bank, account number, account holder) 4) Collected automatically - IP address, country (IP-based), browser and device information, access timestamps, cookies, service usage records

- Account information: until you delete your account (deleted immediately on deletion) - Booking and payment records: the statutory periods listed below - Partner information: 5 years after the agreement ends (tax and transaction records) - Access logs: 3 months

LUWEI shares only the minimum information needed to fulfil your booking, as set out below. Beyond this, we do not disclose personal information to third parties unless you separately consent or the law requires it. 1) The partner venue you booked - Items shared: name, contact details (email, mobile phone number), country and language, booking details (course, date and time, party size, requests), payment type (deposit or full prepayment) - Purpose: confirming the booking, providing the service and serving you on site - Retention: governed by the partner's own policy; LUWEI prohibits any use beyond fulfilling the booking

LUWEI entrusts the following companies with processing on our behalf and supervises them to ensure your information is handled securely. - Supabase Inc.: authentication, database and storage - Vercel Inc.: web hosting and deployment - Cloudflare, Inc.: network security and traffic management - NICE Payments Co., Ltd.: card payment authorisation, cancellation and refunds - Resend, Inc.: booking and settlement notification emails - Nurigo Inc. (Solapi): KakaoTalk notifications and SMS to partners - Popbill Co., Ltd.: issuing tax records (cash receipts, tax invoices) to partners - Google LLC (Google Analytics 4), NAVER Corp. (Naver Analytics): usage analytics (only with cookie consent)

To provide the service, LUWEI transfers (stores and processes) personal information outside Korea as follows, in accordance with Article 28-8 of the Personal Information Protection Act. 1) Supabase Inc. (USA) — data stored in the AWS Mumbai, India (ap-south-1) region - Items: account information, booking and payment records (excluding card details), partner information, usage records - Purpose: authentication, database and storage - When and how: transmitted over an encrypted (TLS) connection as you use the service - Retention: until account deletion or the end of our processing agreement - Contact: privacy@supabase.io 2) Vercel Inc. (USA) — global edge network - Items: IP address, browser information, requested URLs and other access logs - Purpose: web hosting and deployment - Retention: until the end of our processing agreement - Contact: privacy@vercel.com 3) Cloudflare, Inc. (USA) — global network - Items: IP address, request information - Purpose: network security and traffic management - Retention: until the end of our processing agreement - Contact: privacyquestions@cloudflare.com 4) Resend, Inc. (USA) - Items: email address, name, the minimum details needed for booking and settlement notices - Purpose: sending notification emails - Retention: until the end of our processing agreement - Contact: privacy@resend.com 5) Google LLC (USA) — Google Analytics 4 - Items: cookie-based identifiers, device and browser information, page views - Purpose: usage analytics - Retention: up to 14 months - Contact: https://support.google.com/policies Card details are processed by the Korean payment gateway NICE Payments Co., Ltd. and are not transferred abroad. You may refuse these transfers. Because they are essential to providing the service, refusing may prevent you from creating an account or making a booking. To refuse, contact business@luwei.kr.

- You may at any time request access to, correction or deletion of your personal information, request that processing be suspended, or withdraw consent. - Account information can be edited, and your account deleted, from the settings menu; partners can edit their details in the partner dashboard. - For any other request, write to business@luwei.kr. We will act within 10 days after verifying your identity. - You may also exercise these rights through a legal representative or an authorised agent. - Information that we are legally required to retain will be kept for the statutory period even if you request deletion.

- Personal information is destroyed without delay once the retention period expires or the purpose has been fulfilled. - Information that must be retained by law is stored separately and destroyed when the statutory period ends. - Electronic files are deleted irrecoverably; printed materials are shredded or incinerated.

- Encryption in transit (HTTPS/TLS) and one-way encryption of passwords - Least-privilege access and logging of administrator access - No storage of card details (handled directly by the payment gateway) - Security oversight of our processors

- Functional cookies: language preference (luwei_locale), sign-in session, cookie consent status — required for the service to work - Analytics cookies: Google Analytics 4 and Naver Analytics — active only if you accept them in the cookie banner - You can block or delete cookies in your browser settings; some features may then be limited.

Privacy Officer - Name: Youjin Kim (Owner, LUWEI) - Email: business@luwei.kr For any question, complaint or request regarding your personal information, contact the address above and we will respond without delay. Korean authorities for complaints - Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr) - Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr) - Supreme Prosecutors' Office Cyber Investigation: 1301 (www.spo.go.kr) - National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

This policy takes effect on 24 October 2026. If we add or change anything, we will announce it on the service at least 7 days in advance (30 days for changes that are unfavourable to you). Change log - 2026-10-24: Specified booking and payment data and disclosure to partners; updated processors and international transfers; removed items for discontinued services - 2026-09-08: Added processing for the booking request relay service - 2026-07-27: Added international transfer section - 2026-04-29: Added processing for partner onboarding and booking payments