MBC ARCHIVE

Regarding the privacy policy, Munhwa Broadcasting Corporation and iMBC Co., Ltd. (hereinafter referred to as the "Company") place great importance on the protection of personal information on the Internet, and make every effort to ensure that the personal information provided to the Company by members using the services of the MBC Archive website (hereinafter referred to as "MBC Archive", www.mbcarchive.com) is protected.

Accordingly, the Company has established and complies with this Privacy Policy based on applicable laws and regulations that information and communications service providers must observe, including the Protection of Communications Secrets Act, the Telecommunications Business Act, the Act on Promotion of Information and Communications Network Utilization, and the Personal Information Protection Act. This Privacy Policy may be amended from time to time due to changes in government laws and guidelines or changes in the Company’s internal policies. In the event of any changes, the Company will immediately reflect the relevant details in the Privacy Policy posted on the initial screen of the website.

Through this Privacy Policy, members will be able to understand for what purposes and by what methods the collected personal information is used, and how it is safely protected.

1. Purpose of Collection and Use of Personal Information

Members’ personal information is collected and used for the purposes of establishing the service use agreement (including identification of the user and confirmation of the user’s intent), performing the service (including payment settlement and product delivery), and providing information on other new services, new products, or events.
In addition, in order to provide members with convenient and diverse services, the Company may use personal information collected from members to conduct advertising or marketing activities for various services provided by the Company by email, TM (telemarketing), DM (postal mail), SMS (mobile text message), and other methods. In such cases, members may refuse unwanted services at any time by email or other means.

2. Items of Personal Information Collected

The Company collects only the minimum personal information necessary to provide the service; however, if additional information is required, the Company may request such additional information. On the membership registration screen, the Company receives the following corporate and personal information items from members as required input items.

The required input items listed below are divided into company information and contact person information.
- Company Information
Company name Business registration number Business address
- Contact Person Information
Department name Name ID Password Password recovery question and answer Mobile phone number Email address
The Company does not collect sensitive personal information that may significantly infringe upon members’ basic human rights, such as race and ethnicity, ideology and beliefs, place of origin and registered domicile, political inclination and criminal record, health condition, or sexual life.

3. Methods of Collecting Personal Information

The Company collects personal information through the following methods.
Website, written forms, fax, telephone, email, event applications, and provision by partner companies.

4. Consent to Collection of Personal Information

When registering as a member, if you select and click the "Agree" button for the Company’s Terms of Service, you will also be deemed to have agreed to this Privacy Policy. Accordingly, the Company collects personal information based on the information entered in the registration form.
Users who do not agree to the collection of personal information or who do not wish to register as members for such reason may select and click the "Do Not Agree" button for the Company’s Terms of Service in the membership registration menu. The Company does not provide membership registration services to individuals other than sole proprietors or corporate business operators. Individual customers are asked to contact us separately by email at mbcarchive@imbc.co.kr.

5. Outsourcing of Personal Information Processing

For service improvement, the Company outsources personal information processing as follows, and stipulates necessary matters in outsourcing agreements so that personal information can be managed safely in accordance with relevant laws and regulations.
The Company’s personal information processing trustees and entrusted tasks are as follows.

Outsourcing of Personal Information Processing

Trustee	Entrusted Task	Retention and Use Period of Personal Information
Payment agency (PG) for paid services Payletter Inc	Provision of payment method information (credit card, account transfer, etc.) necessary for purchase of paid passes and materials, payment cancellation, refund processing, etc.	Until membership withdrawal or termination of the outsourcing agreement
Munhwa Broadcasting Corporation	Review of suitability for material sales	Until membership withdrawal

6. Access, Correction, Update, and Withdrawal of Consent (Membership Withdrawal)

Members may access, correct, update, and withdraw consent (membership withdrawal) for their registered personal information at any time.
That is, after logging in with the member ID and password through the LOG-IN menu and going to the member information modification menu, members may access, correct, and update all input information except the member ID, and may also withdraw consent to the provision of personal information through membership withdrawal.

7. Retention Period and Use Period of Personal Information

As follows, after the purpose of collection or the purpose for which personal information was provided has been achieved, the Company destroys personal information without delay by using a technical method that makes restoration impossible.
- For membership registration information: when the member withdraws from membership or is expelled from membership - For payment information: on the date of full payment or the expiration date of the statute of limitations for the claim - For product delivery information: when goods or services have been delivered or provided - If separate consent has been obtained from the user regarding the personal information retention period: upon expiration of that period - For information necessary for legal response due to the possibility of litigation or disputes: when the relevant reason ceases to exist However, if laws and regulations prescribe an obligation to retain such information, the information is retained for the period prescribed by the laws below, and during such period, the personal information will never be used for any other purpose. If continued retention is necessary thereafter, the Company will notify the member of this fact and obtain the member’s consent.

<Act on Consumer Protection in Electronic Commerce, Etc.>
- Records on contracts or withdrawal of offers: retained for 5 years - Records on payment and supply of goods, etc.: retained for 5 years - Records on consumer complaints or dispute resolution: retained for 3 years
<Protection of Communications Secrets Act>
- Login records: retained for 3 months Personal information entered after the Company clearly states that it is being provided for temporary purposes (events, surveys, etc.) will, after the purpose has been achieved, be processed as information necessary for membership registration according to the member’s intent, or be completely deleted from the disk by a method that makes restoration impossible, so that it cannot be accessed or used later.
If a member has ceased using the service as a member for a long period of time, the Company may set a membership cleanup period, provide notice for a certain period through the site screen or by email, and, if the relevant member raises no objection, terminate that member’s membership and delete the related personal information accordingly.

8. Personal Information Destruction Procedures and Methods

In principle, members’ personal information is destroyed without delay once the purpose of collecting and using the personal information has been achieved.
The Company’s personal information destruction procedures and methods are as follows.

A. Destruction Procedures
- Information entered by members for membership registration, etc. is transferred to a separate database after the purpose has been achieved (or to a separate document box in the case of paper documents), stored for a certain period in accordance with internal policies and other relevant laws and regulations for information protection reasons (please refer to “7. Retention Period and Use Period of Personal Information”), and then destroyed. - Such personal information is not used for any purpose other than retention, except as required by law.
B. Destruction Methods
- Personal information printed on paper is destroyed by shredding or incineration. - Personal information stored in electronic file format is deleted using a technical method that makes the records impossible to restore.

9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company uses cookies, which store and retrieve members’ information from time to time, in order to provide customized services tailored to members. Cookies are small pieces of information that a website sends to the member’s computer web browser and may be stored on the PC hard disk. When a member accesses the website, the Company’s server reads the contents of the cookies in the member’s web browser and finds additional information about the member on the member’s computer, thereby providing services without requiring additional input such as the member’s name upon access.

A. Purpose of Using Cookies
- Cookies identify a member’s computer, but do not individually identify each member. The Company uses these cookies to understand the visit and usage patterns and usage scale for each service visited by members, and to create more convenient services. Members may choose whether to use cookies by adjusting the options in their web browser. In other words, members may accept all cookies, have a notification sent when cookies are installed, or refuse all cookies. However, members must allow cookies in order to log in after accessing MBC Archive and use the services. For reference, the Company is not responsible for the privacy protection obligations of websites linked to MBC Archive that collect personal information.

B. Installation, Operation, and Refusal of Cookies
- Members have the right to choose whether to install cookies. Accordingly, members may set options in their web browser to allow all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies. - As a method of refusing cookie settings, members may select the options of the web browser they use to allow all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies. - Example of setting method (for Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy - However, if cookies are refused, there may be difficulties in using some services of MBC Archive that require login.

10. Technical and Managerial Measures for Personal Information Protection

The Company takes the following technical and managerial measures to protect personal information.
- Security devices using passwords, etc. - Devices to prevent damage from computer viruses using antivirus programs - Security devices to safely transmit personal information using encryption - Devices to block external intrusions such as hacking - Designation of the minimum number of personal information handlers - Regular in-house awareness training on personal information protection Maintaining the security of member IDs and passwords is very important for the protection of personal information, and the responsibility for maintaining the security of the member ID and password lies with the relevant member. Since the Company will not directly ask members for their passwords under any circumstances, members must take special care to ensure that their passwords are not disclosed to others.

11. Use for Purposes Other Than Intended and Provision (or Sharing) to Third Parties

The Company does not disclose personal information provided by members to the outside or share it with third parties without the member’s consent. However, exceptions are made in any of the following cases:

① Where the member’s consent has been obtained ② In order to allow members to use the services of the Company and its affiliates with a single member ID assigned by the Company without a separate membership registration procedure, the Company may provide the personal information it holds about a member who wishes to use the service of a specific affiliate to the relevant affiliate. (This also applies if affiliates are added after the member’s initial service application.) In such cases, the member may at any time refuse the provision of personal information to the relevant affiliate by email or other means and discontinue use of the related service. ③ Where the member has violated the Company’s Terms of Service, the terms and conditions for paid services and passes, or other service use conditions prescribed by the Company ④ Where there are sufficient grounds to determine that personal information must be disclosed in order to take legal measures because the member has caused mental or material damage to another person by using the service ⑤ Where the Company determines in good faith that disclosure is otherwise required by law ⑥ Where necessary for fee settlement and product delivery in connection with service provision ⑦ Where personal information is provided in a form that does not identify individuals for statistical compilation, academic research, or market research In addition, in any of the following cases, the Company may allow affiliates to use a limited scope of personal information collected from members, such as name, mobile phone number, and email address, in order to provide members with convenient and diverse services. In such cases, members may refuse unwanted services at any time by email or other means. ⑧ Where affiliated internet shopping service providers, communication service providers, manufacturers, wholesalers and retailers, telecommunications providers, business service providers, education service providers, entertainment, cultural and sports-related service providers, other professional content providers, or business operators wish to conduct advertising and marketing activities using email, TM (telemarketing), DM (postal mail), SMS (mobile text message), etc. Such information is sent after obtaining the member’s prior consent. However, this does not apply to transaction-related information or responses to customer inquiries ⑨ Where affiliated financial or insurance service providers, such as credit card, installment finance, insurance, insurance agency, and brokerage businesses, or related service providers wish to conduct advertising and marketing activities using email, TM (telemarketing), DM (postal mail), SMS (mobile text message), etc., the Company sends such information after obtaining the member’s prior consent regarding the provision of personal information to affiliates. However, this does not apply to transaction-related information or responses to customer inquiries.

12. Personal Information Management Officer and Staff

The Company appoints a personal information management officer and staff to protect members’ personal information.

- Personal Information Processing Officer: Name: Kim Young-sun; Department/Position: Archive Business Team / Team Leader; Email: kmax9932@imbc.co.kr - Personal Information Processing Staff: Name: Kim Seo-yoon; Department/Position: Archive Business Team / Staff; Email: seoyoon@imbc.co.kr - Email inquiries: mbcarchive@imbc.co.kr; Telephone: 02-2105-1159

13. Handling of Complaints and Disputes Related to Personal Information

Members who wish to receive remedies for damages due to personal information infringement should contact the MBC Archive personal information management officer or staff. Alternatively, members may apply for mediation and adjustment to the Personal Information Dispute Mediation Committee established within the Personal Information Infringement Report Center of the Korea Information Security Center operated by the government (Tel. 02-1336 or Internet: http://www.cyberprivacy.or.kr).

* Revision History of the Privacy Policy
- Current version - December 1, 2025

International Privacy Policy

Applicable to: United States · Japan · Hong Kong · Singapore

1. Overview

Munhwa Broadcasting Corporation and iMBC Co., Ltd. (collectively, "the Company") provide broadcast content archive services through MBC Archive (www.mbcarchive.com, hereinafter "the Service") to overseas members. This Privacy Policy has been established to meet the requirements of applicable data protection laws in the United States, Japan, Hong Kong, and Singapore.

Personal Information Processing Trustees and Entrusted Tasks

Item	Details
Service Name	MBC Archive (www.mbcarchive.com)
Operator	Munhwa Broadcasting Corporation & iMBC Co., Ltd.
Data Protection Officer (DPO)	Kim Young-sun (kmax9932@imbc.co.kr)
General Inquiries	mbcarchive@imbc.co.kr
Phone	+82-2-2105-1159
Effective Date	2026.06.22.

2. Personal Data Collected

The Company collects only the minimum personal data necessary to provide the Service. The categories of data collected are as follows.

Personal Data Collected

Category	Items	Required / Optional
Business Information	Company name, business registration number (or local equivalent), business address	Required
Contact Person Information	Name, department, user ID, password, mobile phone number, email address	Required
Payment Information	Credit card details, bank account information (processed by payment gateway)	Upon service use
Automatically Collected	IP address, cookies, access logs, service usage records	Auto-collected

The Company does not collect sensitive personal data such as race/ethnicity, political opinions, religious beliefs, health data, or sexual orientation.

3. Purpose of Processing Personal Data

- Member registration and identity verification - Service provision, including content sales and payment processing - Customer support and dispute resolution - Notification of new services and events (subject to prior consent) - Legal compliance and audit purposes

4. Retention Period and Deletion of Personal Data

Retention Period and Deletion of Personal Data

Category	Retention Period	Legal Basis
Member information	Until membership withdrawal	Service agreement
Payment and contract records	5 years	Act on Consumer Protection in Electronic Commerce, Article 6
Consumer complaint and dispute records	3 years	Act on Consumer Protection in Electronic Commerce, Article 6
Access logs	3 months	Protection of Communications Secrets Act, Article 15-2
Information for potential legal disputes	Until the relevant cause is resolved	Civil statute of limitations

Upon expiry of the retention period, electronic files are immediately deleted using technically irreversible methods, and paper documents are shredded or incinerated.

5. Cross-border Transfer of Personal Data

Members' personal data is stored and managed on servers located in the Republic of Korea. In the course of providing the Service, transfers to the following third parties may occur. Members consent to such transfers upon registration.

Cross-border Transfer of Personal Data

Recipient	Country	Purpose	Retention Period
Payletter Inc. (Payment Gateway)	Republic of Korea	Payment processing	Until termination of contract
Munhwa Broadcasting Corporation	Republic of Korea	Review of content sales eligibility	Until membership withdrawal

6. Provisions for U.S. Members (United States — CCPA/CPRA)

Applicable Law: California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.) and California Privacy Rights Act (CPRA)

6-1. Rights of California Residents
- Right to Know: You may request information about the categories of personal data collected, the sources, the purposes of use, and whether data is disclosed to third parties. - Right to Delete: You may request deletion of personal data we hold, except where retention is required by law. - Right to Correct: You may request correction of inaccurate personal data. - Right to Opt-Out of Sale/Sharing: The Company does not sell your personal data to third parties. To opt out of sharing for marketing purposes, contact mbcarchive@imbc.co.kr. - Right to Non-Discrimination: You will not be discriminated against for exercising any of your rights.
6-2. Sale of Personal Data
The Company does not sell or share (for cross-context behavioral advertising) the personal data of California residents with any third party. 6-3. How to Exercise Your Rights
Email: mbcarchive@imbc.co.kr | Subject: [CCPA Request] Requests will be processed within 45 days of receipt. An extension of up to 45 additional days may apply. Identity verification may be required.

7. Provisions for Japanese Members (Japan — APPI)

Applicable Law: Act on the Protection of Personal Information (APPI), Article 171 (extra-territorial application) and 2022 amendments

7-1. Cross-border Transfer to the Republic of Korea
Personal data of Japanese members is transferred to servers located in the Republic of Korea for the purpose of providing the Service. The following information is disclosed in relation to such transfer. - Destination country: Republic of Korea - Data protection framework of Korea: Governed by the Personal Information Protection Act (PIPA), supervised by the Personal Information Protection Commission (PIPC). - Security measures implemented by the Company: Access controls, SSL/TLS encryption, network separation, and regular security audits.

7-2. Rights of Japanese Members
- Right to be notified of the purpose of use - Right to disclosure (access) - Right to correction, addition, or deletion - Right to suspension of use or suspension of third-party provision - Right to data portability (Article 28-5)

7-3. How to Exercise Your Rights
Email: mbcarchive@imbc.co.kr | Subject: [APPI Request] Requests will be processed within the statutory period (in principle, two weeks) from the date of receipt.

8. Provisions for Hong Kong Members (Hong Kong — PDPO)

Applicable Law: Personal Data (Privacy) Ordinance (Cap. 486) and Data Protection Principles (DPP)

8-1. Compliance with Data Protection Principles (DPP)

Compliance with Data Protection Principles (DPP)

Principle	Description	Company's Implementation
DPP1 - Purpose & Collection	Data collected by lawful and fair means; limited to what is necessary	Purpose of collection disclosed at registration
DPP2 - Accuracy	Personal data kept accurate and up to date	Member profile update function provided
DPP3 - Use Limitation	Data not used beyond the purpose of collection	Prior consent obtained for any additional use
DPP4 - Security	Measures taken to prevent unauthorized access, processing, or deletion	Encryption and access control implemented
DPP5 - Openness	Privacy policy publicly available	This policy published on the website
DPP6 - Access & Correction	Data subjects' rights to access and correct data guaranteed	Requests processed via email

8-2. Notification at the Time of Collection
At the time of membership registration, the Company discloses: (1) the purpose of data collection, (2) whether provision of data is obligatory or voluntary, and (3) the right to request access and correction, and how to do so.

8-3. How to Exercise Your Rights
Email: mbcarchive@imbc.co.kr | Subject: [PDPO Request] Supervisory Authority: Office of the Privacy Commissioner for Personal Data (PCPD) — pcpd.org.hk

9. Provisions for Singapore Members (Singapore — PDPA)

Applicable Law: Personal Data Protection Act 2012 (No. 26 of 2012) and 2020 amendments

9-1. Transfer Limitation Obligation
When transferring personal data of Singapore members to the Republic of Korea, the Company ensures that Korea provides a standard of protection for personal data that is comparable to the PDPA. To fulfill this obligation, the Company: - Enters into contractual arrangements (data transfer agreements) with data recipients - Requires sub-processors to implement equivalent protective measures - Conducts regular security audits of sub-processors

9-2. Consent and Purpose Limitation
The Company collects personal data based on the express consent of members and does not use it for purposes beyond those consented to. Separate consent is obtained for marketing communications, and members may withdraw consent at any time.

9-3. Data Protection Officer (DPO)
The Company has designated a DPO in accordance with the PDPA as follows.

Data Protection Officer (DPO)

Item	Details
Name	Kim Young-sun
Department / Title	iMBC Archive Business Team / Team Leader
Email	kmax9932@imbc.co.kr
General Inquiries	mbcarchive@imbc.co.kr

9-4. How to Exercise Your Rights
Email: mbcarchive@imbc.co.kr | Subject: [PDPA Request] Supervisory Authority: Personal Data Protection Commission (PDPC) — pdpc.gov.sg

10. Security Measures

The Company applies the following technical and administrative measures to protect the personal data of all overseas members.

Security Measures

Type	Details
Technical Measures	SSL/TLS encrypted transmission, personal data DB encryption, access controls and privilege management, network separation (internal/external), vulnerability scanning and intrusion prevention
Administrative Measures	Minimum number of authorized personnel, regular security training, public disclosure of privacy policy, supervision and audit of sub-processors
Physical Measures	Access control to server rooms, locks and CCTV surveillance

11. Disclosure and Entrustment of Personal Data

The Company does not disclose personal data to third parties without the member's consent, except in the following cases.
- Where the member has provided prior consent - Where required by law or by a legitimate request from an investigative authority - Where necessary for essential business operations such as payment processing

Entrusted processing:

Entrusted Processing of Personal Data

Sub-processor	Entrusted Task	Retention Period
Payletter Inc.	Payment processing for subscriptions, refund handling	Until termination of contract
Munhwa Broadcasting Corporation	Review of content sales eligibility	Until membership withdrawal

12. Cookies and Automated Data Collection

The Company uses cookies to provide personalized services. Members may refuse cookie storage through their browser settings; however, some features of the Service may be restricted as a result.
- Essential Cookies: Maintaining login sessions and providing basic service functions - Analytics Cookies: Analyzing usage statistics (aggregated, non-personally identifiable form)

13. How to Exercise Data Subject Rights

How to Exercise Data Subject Rights

Right	Description	Processing Period
Access	Request to view personal data held by the Company	Within 30 days
Correction	Request to correct inaccurate information	Within 30 days
Deletion	Request to delete personal data (excluding legally required retention)	Within 30 days
Restriction	Request to restrict use for specific purposes	Within 30 days
Portability	Request for personal data in a machine-readable format	Within 30 days
Withdrawal of Consent	Withdrawal of consent for marketing communications, etc.	Immediate

How to submit a request: Email mbcarchive@imbc.co.kr or use the 'Edit Profile' menu within the Service.

14. Complaints and Dispute Resolution

For personal data-related complaints, please first contact the Company's designated personnel below.

Complaints and Dispute Resolution Contacts

Role	Contact
Data Protection Officer	Kim Young-sun (kmax9932@imbc.co.kr)
Data Protection Manager	Kim Seo-yoon (seoyoon@imbc.co.kr)
General Inquiries	mbcarchive@imbc.co.kr / +82-2-2105-1159

If you are not satisfied with the Company's response, you may lodge a complaint with the relevant supervisory authority.

Supervisory Authorities by Country

Country	Supervisory Authority	Website
Republic of Korea	Personal Information Protection Commission / KISA Privacy Violation Report Center	privacy.go.kr / privacy.kisa.or.kr
United States (California)	California Attorney General	oag.ca.gov/privacy
Japan	Personal Information Protection Commission (PPC)	ppc.go.jp
Hong Kong	Office of the Privacy Commissioner for Personal Data (PCPD)	pcpd.org.hk
Singapore	Personal Data Protection Commission (PDPC)	pdpc.gov.sg

15. Updates to This Privacy Policy

This Policy may be revised from time to time due to changes in laws, regulatory guidelines, or the Service. Material changes will be notified at least 30 days in advance via the homepage or by email. A history of revisions is maintained below.

Revision History of the International Privacy Policy

Version	Effective Date	Key Changes
v1.0	March 9th, 2026	Initial establishment of the International Privacy Policy for overseas members.