Privacy Policy

Maptlantis (hereinafter the "Company") establishes and discloses the following Privacy Policy under Article 30 of the Personal Information Protection Act, to protect data subjects' personal information and to handle related grievances promptly and smoothly.

Article 1 (Purposes of processing personal information)

The Company processes personal information for the following purposes. Personal information processed is not used for any purpose beyond these, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Membership registration and management: confirming intent to join, identifying and authenticating members for membership services, maintaining and managing membership status, preventing fraudulent use of the Service, various notices and communications, and grievance handling
2. Intermediating product inquiries and bookings: delivering inquiries, receiving booking requests, notifying Host confirmation/decline, viewing booking history, and providing a messaging channel between members and Hosts
3. Payment and settlement: deposit payment, confirming payment authorization, processing cancellations/refunds, settling with Hosts, and retaining transaction records under applicable law
4. Provision of travel products: confirming bookers for travel products the Company plans and sells directly, delivering information necessary for transport, accommodation and on-site operation, and safety management
5. Operating the used-gear marketplace: registering and posting listings, connecting conversations between members, saving wish lists, receiving and reviewing reports, and managing blocking relationships
6. Operating the community: posting content and comments, recommending/saving/subscribing, receiving and reviewing reports, acting on rights-infringement reports, and managing blocking relationships
7. Responding to customer inquiries: verifying the identity of an inquirer, confirming the content of an inquiry, contacting/notifying for fact-finding, and notifying the outcome
8. Service improvement: analyzing access frequency, compiling usage statistics, and producing statistics on Service use. Information in a form that cannot identify an individual is used for this purpose.
9. Providing marketing information: sending information on new products, event information, and personalized recommendations, only to members who have separately consented

Article 2 (Items of personal information processed)

① The Company collects and processes the following items.

1. Membership registration (required)

• Email address, password (stored one-way encrypted)
• If joining via social login (Google, Apple): the account identifier, email address, and name or nickname provided by the relevant provider

2. Bookings and inquiries (required)

• Name, mobile phone number and email address of the booker/inquirer
• Number of participants, date and session of use, requested items
• Diving certification level, diving experience, and responses to health-status confirmation items
• The contact channel and account the member chooses (KakaoTalk ID, Instagram account, etc.)
• Payment authorization number, payment method type, payment amount, and date/time of payment and refund

3. Use of the used-gear marketplace (only for members who use the Marketplace)

• Listing photos, title, description, price, condition of use, brand/model and other posted content the member enters directly
• Trading method and preferred area for direct trade (province/city and the district the member enters directly)
• Content of conversations between members and photos attached to those conversations
• Wish list, list of blocked members, Marketplace notification settings
• Where a report is filed, the reason for and content of the report

4. Use of the community (only for members who post to the community)

• Display name, content of posts and comments, attached photos
• Regions/operators/products/marine life/observation records linked to a post
• Recommendation, save, subscription and block lists, and notification settings
• Where a report is filed, the reason for and content of the report

4-2. Smart Logbook and Dive Conquest (only for members who post records)

• Dive date, time and time of day, country/region/place name, type of activity, depth/dive time/water temperature/visibility, gear and gas used, marine life encountered, title and notes, attached photos
• Dive shop used, accompanying instructor (a registered instructor or a name the member entered directly), buddies' nicknames, personal log number
• Scope of disclosure: under Article 13-2 of the Terms of Service, a posted record is fully disclosed on Dive Conquest, the rankings and the community. An instructor name entered directly, buddies' nicknames, and the personal log number are visible only to the member.

4-3. Consent records (all members)

• The items consented to (age verification, Terms of Service, collection/use of personal information, identity-verification processing, disclosure of logbook records, receipt of advertising), the version of the terms, the date/time of consent or withdrawal, and the channel of consent (sign-up, re-consent, settings). The raw access IP and device information are not stored in the consent record.

5. Host registration (required for Hosts only)

• Trade name, representative's name, contact person's phone number, business address
• Qualification/certification information (training agency, level, certification number), and copies of related licenses/registrations
• Profile image, introduction text
• Account holder name, financial institution, and account number for settlement

6. Optional items

• Whether the member consents to receive advertising/event notices (marketing information) and the means of receipt. Membership registration and use of the Service are not restricted if this consent is not given, and it can be withdrawn at any time from the account's consent history.
• Web push notification subscription information (a subscription identifier issued by the browser)
• Information the member enters directly, such as a profile photo, regions of interest, or certifications held

7. Items automatically generated/collected while using the Service

• Access IP address, access date/time, Service usage records, records of improper use
• Browser type and version, operating system, device type
• Login session information kept in cookies and browser storage

② The Company does not store detailed payment-method information (card numbers, expiration dates, account passwords, etc.). Such information is collected and processed directly by the payment gateway described in Article 4. ③ The Company accepts as members only adults who have completed domestic mobile identity verification, and confirms that the age requirement is met at sign-up. The Company does not accept membership registration from children under the age of 14.

Article 3 (Period of processing and retention of personal information)

① The Company processes and retains personal information within the retention/use period required by law or the retention/use period consented to by the data subject. ② The processing/retention period for each item is as follows.

Category	Retention period	Basis
Membership registration and management information	Until withdrawal of membership	Data subject's consent
Records concerning contracts or withdrawal of offer, etc.	5 years	Act on Consumer Protection in Electronic Commerce
Records concerning payment and supply of goods, etc.	5 years	Act on Consumer Protection in Electronic Commerce
Records concerning consumer complaints or dispute handling	3 years	Act on Consumer Protection in Electronic Commerce
Records concerning labeling and advertising	6 months	Act on Consumer Protection in Electronic Commerce
Records of website visits and access	3 months	Protection of Communications Secrets Act
Marketing-consent records	Until consent is withdrawn	Data subject's consent
Marketplace listings and conversation records	Until withdrawal of membership. However, for dispute resolution, the listing information as it stood and the conversation remain available to conversation participants even after the listing is deleted	Data subject's consent
Marketplace report receipt/review records	3 years from the date of receipt	Act on Consumer Protection in Electronic Commerce
Community posts/comments	Until deleted by the member. Destroyed together upon withdrawal of membership, though a deletion notice remains for the context of replies	Data subject's consent
Community report/rights-infringement action records	3 years from the date of the action	Retention of the basis for action under the Act on Promotion of Information and Communications Network Utilization

Here, "Act on Consumer Protection in Electronic Commerce" refers to the Act on the Consumer Protection in Electronic Commerce, etc.

③ Even after withdrawal of membership, information is retained until the following reasons end, if applicable.

1. Where an investigation is under way for a violation of applicable law
2. Where a claim or obligation relationship remains from use of the Service
3. Where the minimum identifying information necessary to prevent fraudulent use is retained (1 year from the date of withdrawal)

Article 4 (Entrustment of personal information processing)

① The Company entrusts personal information processing as follows for smooth provision of the Service.

Trustee	Content of entrusted work
Supabase, Inc.	Member authentication, database operation, file storage
Vercel Inc.	Web service hosting, access log processing
Cloudflare, Inc.	Storage and delivery of image/media files
Korea PortOne Co., Ltd.	Providing the payment window, payment integration, and confirming payment results
The payment gateway connected through PortOne (currently Toss Payments Corp.)	Credit/debit card authorization, processing cancellations/refunds
Resend, Inc.	Sending booking notices and verification emails

② When entering into an entrustment agreement, the Company specifies in the contract, under Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information beyond the purpose of the entrusted work, technical and administrative protection measures, restrictions on re-entrustment, oversight of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely. ③ If the content of entrusted work or the trustee changes, the Company will disclose this through this Privacy Policy without delay. ④ If the Company introduces sending of text messages or KakaoTalk notification messages, it will add the sending agency and the details of entrustment to this Article and disclose them before use.

Article 5 (Overseas transfer of personal information)

① The Company processes personal information overseas through the following entities among the trustees in Article 4.

Recipient	Country of transfer	Items transferred
Supabase, Inc.	United States, Singapore	Member/booking/Host information under Article 2
Vercel Inc.	United States	Access IP, access records
Cloudflare, Inc.	United States	Images/media uploaded by members
Resend, Inc.	United States	Email address, content sent

② The timing and method of transfer are the same in every case. Information is encrypted and transmitted over the information and communications network at the time the member uses the Service; there is no separate offline transfer. ③ The retention/use period for every recipient is until the entrustment agreement with the Company ends. ④ A data subject may refuse the overseas transfer of personal information. However, refusing overseas transfer means the main functions of the Service, such as membership registration and booking, cannot be used.

Article 6 (Provision of personal information to third parties)

① The Company processes data subjects' personal information only within the scope specified in Article 1, and provides it to a third party only where it falls under Article 17 of the Personal Information Protection Act, such as the data subject's consent or a special provision of law. ② The Company provides personal information as follows for the performance of a booking.

Category	Content
Recipient	The Host (instructor, dive center, boat operator, etc.) to whom the member requested the booking. The trade name is shown on the booking screen.
Purpose of provision	Determining whether to confirm the booking, preparing and running the lesson/tour, confirming participants, safety management
Items provided	Booker's name, mobile phone number, email address, number of participants, date and session of use, requested items, diving certification level and experience, and the result of the health-status confirmation
Retention/use period	Until the period set by applicable law after the booking ends

③ The provision under paragraph ② takes place at the time the member requests the booking; at the inquiry stage, only information the member has stated directly in the messaging channel is delivered to the Host. ④ In the used-gear marketplace, the Company does not provide personal information to third parties. Contact details, account numbers, addresses and the like that a member discloses in conversation on their own are information the member disclosed directly to the other party, not information provided by the Company. Because whatever a member writes in a listing or conversation is delivered to the other party as written, members are advised not to write personal information that is not necessary. ⑤ Previous notice (applies to messages before the conversation review amendment takes effect) — When reviewing a report, the Company does not view members' private conversations, and decides based only on the identifier of the report's subject and the content the reporter submitted. ⑥ In the community as well, the Company does not provide personal information to third parties. Because posts and comments a member publishes publicly can be read even by people who are not logged in, members should not write personal information in a post that they do not wish to make public. ⑦ For travel products the Company plans and sells directly, the Company may provide the minimum information necessary for performing the trip to the businesses responsible for transport, accommodation and on-site operation; the recipients and items are separately announced on the booking screen, where consent is obtained.

Article 7 (Rights and obligations of data subjects and legal representatives, and how to exercise them)

① A data subject may exercise the following rights against the Company at any time.

1. Requesting access to their personal information
2. Requesting correction if there is an error, etc.
3. Requesting deletion
4. Requesting suspension of processing

② The rights under paragraph ① may be exercised directly on the in-Service account settings screen, or by written or electronic request to info@maptlantis.com; the Company will act without delay. ③ Where a data subject requests correction or deletion for an error in their personal information, the Company will not use or provide that personal information until the correction or deletion is complete. ④ The rights under paragraph ① may be exercised through an agent, such as the data subject's legal representative or an authorized representative. In this case, a power of attorney in the form of Annex Form No. 11 of the Notification on Methods of Processing Personal Information must be submitted. ⑤ A data subject's right to access and to request suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act. ⑥ Deletion may not be requested where the personal information is specified as subject to collection under other applicable law.

Article 8 (Destruction of personal information)

① When personal information becomes unnecessary, such as through expiry of the retention period or achievement of the processing purpose, the Company destroys that personal information without delay. ② Where the retention period consented to by the data subject has passed, or the processing purpose has been achieved, but retention is required under other applicable law, the Company preserves the personal information by moving it to a separate database or storing it in a different location. ③ The method of destruction is as follows.

1. Information in electronic file form: permanently deleted using a technical method that prevents recovery or reproduction
2. Information printed on paper: shredded or incinerated

Article 9 (Measures to secure the safety of personal information)

The Company takes the following measures to secure the safety of personal information.

1. Administrative measures: establishing and implementing an internal management plan, minimizing personnel who handle personal information, and training them
2. Technical measures: managing access rights to the personal-information processing system, applying row-level access control (Row Level Security), one-way encrypted storage of passwords, encryption of the entire communication path (HTTPS), and retention of access records
3. Physical measures: systems where personal information is stored use the facilities of an internationally certified cloud provider

Article 10 (Installation, operation and refusal of automatic personal-information collection devices)

① The Company uses cookies and browser storage to maintain login status and to provide services tailored to each user. ② A cookie is a small piece of information sent by the server that operates the website to a user's browser, and it is stored on the user's device. ③ A data subject may choose to allow or block cookies through their web browser settings. However, blocking cookies used for login will prevent use of member features and bookings.

• Chrome: Settings > Privacy and security > Third-party cookies
• Safari: Settings > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

④ The Company does not use third-party tracking cookies for advertising purposes.

Article 11 (Chief Privacy Officer)

① The Company designates a Chief Privacy Officer as follows, to take overall responsibility for personal-information processing and to handle data subjects' complaints and remedy harm related to personal-information processing.

Chief Privacy Officer

• Name: Kim Seohyeon
• Title: Representative
• Contact: 0505-115-1234, info@maptlantis.com

② A data subject may direct any inquiry, complaint or request for remedy related to personal-information protection arising from use of the Service to the Chief Privacy Officer, and the Company will respond and act on it without delay.

Article 12 (Requesting access to personal information)

A data subject may make a request to access personal information under Article 35 of the Personal Information Protection Act through the channel below. The Company strives to process such requests promptly.

• Receiving/processing department: Customer support
• Contact: info@maptlantis.com, 0505-115-1234

Article 13 (Remedies for infringement of rights and interests)

To obtain a remedy for harm from an infringement of personal information, a data subject may apply to the following bodies for dispute resolution or consultation.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / www.kopico.go.kr (opens in a new tab)
• Personal Information Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr (opens in a new tab)
• Supreme Prosecutors' Office: 1301 (no area code) / www.spo.go.kr (opens in a new tab)
• National Police Agency: 182 (no area code) / ecrm.cyber.go.kr (opens in a new tab)

Article 14 (Changes to this Privacy Policy)

① This Privacy Policy applies from September 10, 2026. On September 15, 2026, Article 2①4-2 (Smart Logbook and Dive Conquest) and 4-3 (Consent records) were added and the advertising-receipt item was supplemented; for existing members this applies from the date they consented to the amendment. ② Where content is added, deleted or amended due to a change in law or the Service, notice will be given through an in-Service announcement from 7 days before it takes effect. However, a change that materially affects data subjects' rights will be announced from 30 days before.

Business information

Conversation review amendment (announced October 17, 2026)

Amendment ID: admin-chat-2026-11-16 · Scheduled effective date: November 16, 2026, 00:00 Korea time

1. Purpose and scope — Specifically authorized super administrators may review original messages, participant and related transaction details, and attachments in the service's marketplace, booking, pre-booking inquiry and product inquiry conversations for dispute resolution, report handling, customer support and related investigations of misuse. Unreported conversations may also be reviewed for a recorded work purpose and reason. This feature does not collect conversations from external messengers or email.
2. Access and records — General members, Hosts and business staff do not receive access to all conversations. The administrator's login, active session, current permissions and additional authentication are checked. The review purpose, reason, target, time, administrator and associated case are recorded, including search and attachment access. Internal investigation notes are not shown to the other participant. Conversation text is not copied into ordinary application logs.
3. Earlier conversations — This amendment does not retroactively open messages written under the previous notice that private conversations would not be viewed. Messages sent before November 16, 2026, 00:00 Korea time are excluded from this feature. Operational access starts after the notice and individual notification procedure is completed. If activation is later, only messages written at or after that actual activation time are eligible. Eligibility is determined per message, including in rooms created earlier. Past consent records and existing booking or transaction terms are unchanged.
4. Retention and deletion — This feature does not extend existing retention periods or suspend account withdrawal or deletion procedures. Only retained content within the applicable scope is available. Permanently deleted or anonymized originals and missing attachments are not recovered. Case materials and audit records follow their applicable retention and deletion procedures with separate access controls. Viewing alone does not change participants' read receipts, notifications, booking, payment or transaction status.
5. Contact — For scope questions or requests to access, correct, delete or restrict personal information, use the account privacy tools, info@maptlantis.com or customer support at 0505-115-1234. Where earlier notices differ, this amendment applies only within the scope described above.