Keytalk AI Inc. Ltd. (hereinafter referred to as the “company", “we”, “us”, “our”) will comply with all laws regarding digital privacy and information protection laws such as Communications Directive 2002/58/EC, as applicable, and the General Data Protection Regulations of the EU (GDPR), as applicable, from the creation to the termination of the service. In the case of a revised Privacy Policy, users will be notified via website and mobile app.

1. 1. General purpose

We use the information collected about you for the following purposes. Your information will not be used for any other purpose other than the following, and prior consent will be sought in accordance with any changes to the following.

• For registration and management of your account

• For identification for our membership service

• For verification of personal information

• For the prevention of dishonest use or abuse of service

• For general communication, including informative notifications about us

• For the purpose of using at marketing and advertising

• For user opportunities for participation

• For identifying frequency of access or statistics on members' use of the services.

1. 2. Privacy Policy

Personal Data being collected: Name (English), gender, date of birth, log-in ID, password, email address, phone number, account information, service history, connection log, cookies, device information, IP address Collection method: Automatic collection via webpage or mobile app visits

Cookies and similar tracking technology

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you, including to serve interest-based advertising. For further information about the types of Cookies we and our vendors use, why, and how you can control Cookies, please see our Cookie Policy. We may combine the information you give us with information related to your transactions and information we receive about you from third parties who carry out services on our behalf. The information received via Cookies and similar technologies may allow us to cross track devices and users' clickstream data associated with the Cookies.

In general, we will use the personal information we collect from you only for the purposes described in this Privacy Policy or for purposes that we explain to you at the time we collect your personal information.

In order to optimize our services and marketing activities, and to make sure we give you a consistent user experience, we use something known as “cross-device tracking.” This can be done with or without the use of cookies. For more general info about cookies and other similar technologies, see our Cookie Policy.

With cross-device tracking, Staypia is able to track user behavior across multiple devices. As part of cross-device tracking, we may combine data collected from a particular browser or mobile device with data from another computer or device that’s linked to it.

1. 3. Cookie Policy

At Staypia, we want to ensure that your visit to our site is smooth, reliable and as useful to you as possible. To help us do this, we use cookies.

• What are cookies?

• What types of cookies do we use?

• How can you manage your cookies?

• Where can I get further information?

What are cookies?

Cookies are small bits of information that are placed on your computer or mobile device when you visit almost any website. Cookies do not recognize you personally and are not harmful to your computer or mobile device. They are used by websites you visit in order to improve your experience on the website.

For instance, we use cookies on our site to allow you to login without having to type your login name each time. Other cookies help us to understand what did and didn’t interest you about our website so we can provide you with features that are more relevant and useful to you next time you visit. We and some of our partners also use cookies on our site to measure the effectiveness of advertising on our site and how visitors use our site.

As well as setting some cookies ourselves - "first party cookies", we also work with some partners to help give you access to even more great features on our site. These partners set "third party cookies" which enable their features to be provided on or through our website (such as advertising or videos). Third party cookies do not recognize you personally but can recognize your computer when it visits Staypia.com and other websites. This helps to ensure you get the best experience possible when visiting these sites.

Some cookies, called "session cookies", stay on your computer only while your website browser is open and are deleted automatically once you close your browser. Other cookies, called "persistent cookies", remain on your computer or mobile device after your browser is closed. This enables websites to recognize your computer when you later re-open your browser to give you as smooth a browsing experience as possible.

What types of cookies do we use?

• Essential cookies

These cookies help you to move around our site and use all its essential features. Without these cookies, our website would not work properly, and you would not be able to use features such as the shopping basket or the secure customer account pages.

• Performance and analytics cookies

At Staypia, we want to make your experience on our website as smooth and as enjoyable as possible. Performance and analytics cookies help us understand how our website is being used and how we can improve your experience on it. These cookies cannot identify you personally; rather they provide us with anonymous information to help us understand which parts of our website interest our visitors and if they experience any errors. We use these cookies to test different designs and features for our website and we also use them to help us monitor how our visitors reach our sites and how effective our advertising is. The data we gather through these cookies can include which web pages you’ve viewed, which referral/exit pages you’ve entered and left from, which platform type you’ve used, which emails you’ve opened and acted upon, and date and timestamp info. It also means we can use details about how you’ve interacted with the site or app, such as the number of clicks you make on a given screen, your mouse and scrolling activity, the search words you use, and the text you enter into various fields.

• Functionality cookies

We use functionality cookies to save your settings on our website such as your selected currency, language preference and booking information you’ve previously used when booking a hotel with us. We also use functionality cookies to remember things such as the last hotel you searched for so you can easily find it the next time you visit. Some functionality cookies are essential if you want to view videos and maps on our site. We use it to remember your registration info so you don’t have to retype your log-in credentials each time you visit our website or app. (Don’t worry, passwords are always encrypted.) We also use "Flash cookies" for some of our animated content and to remember some of your preferences such as your volume settings.

• Advertising cookies

Advertising cookies help ensure that the advertisements you see on our website are as relevant to you as possible. For example, some advertising cookies help select advertisements that are based on your interests. Others help prevent the same advertisement from continuously reappearing for you. Some of our partners may also use cookies or web beacons (a single-pixel image file) so that you see more relevant advertisements when visiting other websites. The information collected by these cookies and web beacons does not enable us or these third parties to identify your name, contact details or other personally identifying details unless you choose to provide these details.

• Social networking cookies

We also want to make it as easy as possible for you to share content from Staypia with your friends through your favorite social networks. Social networking cookies, which are usually set by the social networking provider, enable such sharing to be smooth and seamless.

• Non-cookie techniques – email pixels

We may also use techniques like pixels, which we don’t mark as cookies because they don’t store any info on your device.

We sometimes place pixels in emails like newsletters. A “pixel” is an electronic file the size of a single pixel that’s placed in the email and loaded when you open it. By using email pixels, we can see if the message was delivered, if and when you read it, and what you click.

We also receive this info about the push notifications we send you. These statistics provide us with feedback about your reading behavior, which we use to optimize our messages, and make our communications more relevant to you.

Along with cookies, we also use tracking technologies that are very similar. Our website, emails, and mobile apps may contain small transparent image files or lines of code that record how you interact with them. These include “web beacons,” “scripts,” “tracking URLs,” or “software development kits” (known as SDKs):

• Web beaconshave a lot of different names. They might also be known as web bugs, tracking bugs, tags, web tags, page tags, tracking pixels, pixel tags, 1x1 GIFs, or clear GIFs.

In short, these beacons are a tiny graphic image of just one pixel that can be delivered to your device as part of a web page request, in an app, an advertisement, or an HTML email message.

They can be used to retrieve info from your device, such as your device type, operating system, IP address, and the time of your visit. They are also used to serve and read cookies in your browser or to trigger the placement of a cookie.

• Scriptsare small computer programs embedded within our web pages that give those pages a wide variety of extra functionality. Scripts make it possible for the website to function properly. For example, scripts power certain security features and enable basic interactive features on our website.

Scripts can also be used for analytical or advertising purposes. For example, a script can collect info about how you use our website, such as which pages you visit or what you search for.

• Tracking URLsare links with a unique identifier in them. These are used to track which website brought you to the Staypia website or app you’re using. An example would be if you clicked from a social media page, search engine, or one of our affiliate partners’ websites.

• Software Development Kits (SDKs)are part of our apps’ source code. Unlike browser cookies, SDK data is stored in the app storage.

They’re used to analyze how the apps are being used or to send personalized push notifications. To do this, they record unique identifiers associated with your device, like your device ID, IP address, in-app activity, and network location.

All these tracking technologies are referred to as “cookies” here in this Cookie Statement.

How can you manage your cookies?

You can set or amend your web browser controls to delete or disable cookies. If you choose to disable cookies on your computer or mobile device however, your access to some functionality and areas of our website may be degraded or restricted.

http://www.allaboutcookies.org/ provides good simple instructions on how to manage cookies on the different types of web browsers.

http://www.adobe.com/eeurope/special/products/flashplayer/articles/lso/ also has a good summary of how to manage Flash cookies.

Most advertising networks offer you a way to opt out of advertising cookies.

http://www.aboutads.info/choices/ and http://www.youronlinechoices.com/ have useful information on how to do this.

Under the settings for browsers like Internet Explorer, Safari, Firefox, or Chrome, you can choose which cookies to accept and reject. Where you find these settings depends on the browser you use:

• Cookie settings in Chrome

• Cookie settings in Firefox

• Cookie settings in Internet Explorer

• Cookie settings in Safari

If you choose to block certain functional cookies, you may not be able to use some features of our services.

In addition to specific settings that we may offer on the Staypia and apps, you can also opt out of certain cookies:

• Analytics

To prevent Google Analytics from collecting analytical data on certain browser types visit the following link: Google Analytics Opt-out Browser Add-on (only available on desktop).

• Advertising

We always aim to work with advertising and marketing companies that are members of the Network Advertising Initiative (NAI) and/or the Interactive Advertising Bureau (IAB).

Members of the NAI and IAB adhere to industry standards and codes of conduct, and allow you to opt out of behavioral advertising.

Visit www.networkadvertising.org to identify NAI members that may have placed advertising cookies on your computer. To opt out of any NAI member's behavioral advertising program, just check the box that corresponds to that company.

You may also want to visit www.youronlinechoices.com or www.youradchoices.com to learn how to opt out of customized ads.

Your mobile device may allow you to limit the sharing of info for retargeting purposes through its settings. If you choose to do so, remember that opting out of an online advertising network doesn't mean you’ll no longer see or be subject to online advertising or marketing analysis. It just means the network you opted out of won't deliver ads customized to your web preferences and browsing patterns anymore.

Some websites have “Do Not Track” features that allow you to tell a website not to track you. We’re currently unable to support “Do Not Track” browser settings.

Where can I get further information?

If you have any questions about our use of cookies or other technologies, please email us at support@staypia.com and we’ll do our best to help.

1. 4. Processing and retention period of personal information

• We processes and retain your personal information within the period of Privacy Statement, according to relevant statute or the period that has been agreed upon when collecting personal information from the subject of Privacy.

• Personal information related to <Webpage membership and management> is retained and used from the date of consent to the date of <When a user terminates membership> for the purpose of use above.

• However, if prior consent is obtained or it is necessary to preserve personal information under the provisions of the relevant statute, the information will be preserved for a period of time of which consent has been obtained or the period as prescribed by the relevant statute. In this case, we will transfer the relevant personal information to separate database (DB) or preserves it on different storage locations.

[ Retention records and retention period under the relevant statute]

1. Records of contract or subscription withdrawal, etc. Reason for retention: KOREAN ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC. Retention period: 5 years

2. Records of payment and supply of goods, etc. Reason for retention: KOREAN ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC. Retention period: 5 years

3. Records of consumer complaints or dispute handling Reason for retention: KOREAN ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.

Retention Period: 3 Years

1. Records of identification Reason for retention: KOREAN ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, ETC. Retention Period: 6 Months

2. Website access records Reason for retention: KOREAN PROTECTION OF COMMUNICATIONS SECRETS ACT

Retention Period: 3 Months

1. Records of collection, processing, use, etc. of credit information Reason for retention: KOREAN CREDIT INFORMATION USE AND PROTECTION ACT

Retention Period: 3 Years

1. Records of marking and advertising Reason for retention: KOREAN ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC

Retention Period: 6 Months

1. 5. Provision of Privacy to a third party;

• We will provide your personal information to a third party only with consent of the information subject or special provisions of the statute, under the GDPR, CCPA & other applicable laws

1. We provide personal information to a third party in cases of the following

2. We use personal information within the scope specified in "Terms of Use" or "Privacy Policy" and does not share or provide it with a third party beyond the specified scope.

• Recipient: All suppliers affiliated with Staypia. • Purpose of using recipient's personal information: Implementing hotel reservation services • Received personal information: names of bookers and guests, date of birth, gender, mobile phone number, e-mail, travel information, etc. However, the subjects above are not applied if there is prior consent from the customer, or special provision of the relevant statute.

• Exceptions are made from the following cases in accordance with the provisions and procedures of the relevant statute: In case it is necessary for the settlement of charges for service provision (e.g. overdue charges) B. In case it is necessary for statistical/academic research or market research and is provided in an anonymous format C. In case there are provisions in the relevant laws to this privacy policy.

• Major services will still available even if user doesn’t comply to provide personal information to a third party.

1. 6. Privacy Statement of Consignment ① We personal information for smooth service operation and improvement as following <Notification> Consigned person (trustee): Luna Soft inc. • Contents of consignment: Notifications or consultations via KakaoTalk app • Consigned period: Until withdrawal of membership, request for deletion, termination of consignment contract or service termination.

<Email> • Consigned person (trustee): Luna Soft inc. • Contents of consignment: E-mail • Consigned period: Until withdrawal of membership, request for deletion, termination of consignment contract or service termination.

<Cloud Service> • Consigned person (trustee): Amazon Web Services, Inc. • Contents of consignment: Cloud service operation and management • Consigned period: Until withdrawal of membership, request for deletion, termination of consignment contract or service termination.

② In accordance with GPDR, CCPA & other applicable laws we stipulate the Privacy Statement, technical and administrative protection measures, re-entrust restrictions, management and supervision of the trustee, and liability for damages in the contract on consigned, and supervises if the trustee handles privacy in security. ③ If the details of the consignment or the trustee is changed, we will disclose it without delay.

1. 7. Rights and obligations of information subject and methods of exercise The user can exercise the following rights as the subject of personal information. ① You may exercise the following privacy rights in subject of information you provide us with. Requesting Privacy access B. Request correction in case of errors, etc. C. Request for deletion D. Request for processing suspension

② The exercise of rights under paragraph (1) may be carried out by the company in writing, e-mail, or facsimile (FAX) and the company will take action without delay. ③ If the subject of information requests correction or deletion of personal information errors, etc., the company does not use or provide such personal information until correction or deletion is completed. ④ The exercise of rights under paragraph (1) may be carried out through an agent, who is a legal representative of the information subject or an entrusted individual.

1. 8. Processing Privacy Statement

① The company processes the following statement

1. A. <Confirming the intention of joining and managing a website member, recognition and certification according to the provision of membership-based services, maintaining and managing membership, verifying personal information following the implementation of the limited identification system, preventing the dishonest use of the service, and various notices.>
   • Required subjects: E-mail address, ID
   B. Providing goods or services, providing contents, providing customized services, processing payment of charges, settlement of accounts>
   • Required subjects: Service records, access logs, cookies, e-mail addresses, phone numbers, account information.

2. C. <Use at marketing and advertising, developing new services (product), providing customized services, providing event and advertising information, providing opportunities for participation, providing services according to demographic characteristics, and posting advertisements, statistics on the frequency of access or statistics on member’s use of the services >
   • Required subjects: Service records, access logs, cookies, device information, access IP address

1. 9. Disposal of Personal Information We will destroy collected personal information without delay if the purpose of Privacy Statement is achieved. Procedure, deadline, and method for revocation are as follows.

• Disposal Procedure: Entered information by the user is transferred to a separate database after achieving the purpose (in case of paper, as separate documents) and saved for a period of time in accordance with internal policies and other related statute, and then destroyed immediately. The transferred information to a third database is not used for any other purposes other than legality issues.

• Disposal Deadline: Users' personal information is destroyed within five days from the end of the retention period, within five days from the end of the retention period, or within five days from the date on which the personal information is deemed unnecessary, such as achieving the purpose of processing personal information, abolishing the relevant service, or terminating the project.

• Disposal Method: Information in electronic file form uses a technical method that cannot be reproduced. Personal information printed on paper is shredded or destroyed by incineration.

1. 10. Measures to ensure the safety of personal information

In accordance with consumer protection laws, the administrative and physical measures we take for securing safety as follows.

① Regular self-audit is conducted on a quarterly basis to ensure stability of privacy. ② Implementing measures to manage privacy by minimizing the number of employees handling Privacy and designating employees who handle Privacy. If personal information becomes unnecessary within five days from the end of the retention period, such as achieving the purpose of processing personal information, abolishing the relevant service, or terminating the project, the personal information is destroyed within five days from the date it is deemed unnecessary to process personal information. ③ The internal management plan is established and implemented for the safe handling of Privacy management. ④ To prevent privacy breaches or damages caused by hacking or computer viruses, the company installs security programs, updates and checks the status regularly. While installing systems in areas with restricted access from outside, and monitors and blocks breaches technologically and physically.

⑤The personal information of the encrypted users is saved and managed by encryption and only the user can know the password. Important data is used separately for security functions such as encrypting files and transmitting data or using file lock function. ⑥ Retaining and managing records that have been accessed by the Privacy System for at least two years and use security functions to prevent forgery, theft, or loss of records. ⑦ Implementing necessary measures to control access to personal information by granting, changing, and canceling access rights to the database system, and use an intrusion prevention system to prevent unauthorized access from outside.

1. 11. Preparation of responsible agent for personal information protection The company handles privacy as a whole and appoints a Privacy Protection Administrator who is responsible for Privacy protection to handle complaints and recover damage of information subjects related to Privacy as follows:

[Privacy Protection Administrator]

Name: Sang-won Kang

Position: Representative Director Contact: 02-6245-7403, support@staypia.com ※ Connect to the department of Privacy Protection. [ Department of Privacy Protection ] Department: Staypia CS Team Contact: 02-6245-7403, support@staypia.com ※ Connect to the department of Privacy Protection. For further assistance, please contact the following consumer protection agencies of your nation.

The subject of information can contact the Privacy Protection Administrator and the department in charge of all Privacy Protection inquiries for complaints handling and damage relief related to the company's service (or business). We will respond to and process inquiries without delay.

1. 12. Changing Privacy Policy Privacy Policy descripted above is applied from the date of implementation, and if there is any addition, deletion, or correction of changes in accordance with statutes or policies, it will be notified through a notice seven days before the implementation.

[Attachment] Article 1 (Enforcement Date) This Privacy Policy will take effect on 20.10.2020