Privacy Policy

1. General Provisions

RunnersLikeMe (hereinafter the “Company”) complies with the Personal Information Protection Act of Korea (PIPA), the Act on the Protection and Use of Location Information of Korea, and other applicable laws, and through this Privacy Policy informs users of the purposes for which and the manner in which their personal information is processed, and how it is protected.

This Privacy Policy applies to the services provided by the Company. For details on the processing of location information, please also refer to the Location-Based Services Terms of Use.

2. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information being processed is not used for any purpose other than those stated below, and if the purpose of use changes, the Company takes necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act of Korea (PIPA).

3. Personal Information Collected and Methods of Collection

A. Items Collected

B. Methods of Collection

• Entered directly by users during registration and onboarding
• Automatically generated and collected during service use (running records, access records, etc.)
• Received from external services with the user's consent when using social login (Google, etc.) or integrating external services (Strava, etc.)
• Collected during phone number verification (SMS)
• Collected through customer service inquiries and report submissions

4. Retention and Use Period of Personal Information

The Company destroys personal information without delay once the purpose of its collection and use has been achieved. However, the following information is retained for the periods specified below in accordance with applicable laws.

A. Retention Under Applicable Laws

B. Retention Under Internal Policy

5. Provision of Personal Information to Third Parties

The Company processes users' personal information within the scope of the purposes specified in Section 2 and does not provide it to third parties without the user's prior consent. However, the following cases are exceptions.

A. Provision Between Members for Service Delivery (within the scope of the user's consent when using the service)

B. Provision Required by Law

• Where required by law
• Where requested by investigative authorities for investigative purposes in accordance with the procedures and methods prescribed by law
• Where ordered by a court

6. Outsourcing of Personal Information Processing

The Company outsources personal information processing tasks as follows to provide the service. When entering into outsourcing contracts, the Company stipulates the outsourcee's personal information protection obligations and supervises the outsourcee in accordance with Article 26 of the Personal Information Protection Act of Korea (PIPA).

7. Cross-Border Transfer of Personal Information

Some of the cloud infrastructure used by the Company is located outside the Republic of Korea. The Company transfers personal information abroad as follows, based on Article 28-8(1)3 of the Personal Information Protection Act of Korea (PIPA) (outsourcing or storage of personal information processing necessary for the conclusion and performance of a contract with the data subject, where the details are disclosed in this Privacy Policy).

If a user does not wish their personal information to be transferred abroad, the user may refuse the transfer through the contact listed in Section 14. However, because the cross-border transfer concerns infrastructure essential to providing the service, refusing the transfer may make it impossible or restricted to use the service. When transferring personal information abroad, the Company implements protective measures under Article 28-8(4) of the Personal Information Protection Act of Korea (PIPA) (encrypted transmission, contractual safeguards with outsourcees, etc.).

8. Destruction of Personal Information

1. The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or achievement of the purpose of processing.
2. Electronic files are deleted using technical methods that make recovery impossible, and printed materials are shredded or incinerated.
3. Upon membership withdrawal, personal information is destroyed within 30 days. This grace period exists to handle restoration requests in cases of accidental withdrawal and to prevent fraudulent re-registration aimed at evading sanctions; during the grace period, the relevant information is stored separately and is not used for any purpose other than destruction or restoration. Information subject to retention under Section 4 (“Retention and Use Period of Personal Information”) above, including retention under applicable laws and retention under internal policy, is stored and managed separately from other personal information during the retention period and then destroyed.
4. The destruction of personal location information is governed with priority by Article 7 of the Location-Based Services Terms of Use, under which it is destroyed without delay upon withdrawal.

9. Rights of Data Subjects and Legal Representatives

1. Users may exercise the following rights against the Company at any time.
   • Right to request access — access to their personal information being processed
   • Right to request correction and deletion — correction of errors and deletion
   • Right to request suspension of processing — suspension of the processing of personal information
   • Right to withdraw consent — withdrawal of consent to collection, use, and provision
   • Right to request transmission — transmission of personal information as prescribed by law
2. Rights may be exercised through the following methods, and the Company notifies the user of the outcome within 10 days of receiving the request.
   • Directly edit or delete in Settings > Account Management
   • Withdraw consent in Settings > Marketing Preferences
   • Email: runnerslikeme@gmail.com
3. Rights may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney under the Notification on the Methods of Personal Information Processing of Korea must be submitted.
4. Requests for access and other rights may be restricted on grounds such as specific provisions in the law; in such cases, the Company notifies the user of the reason.

10. Notice on Automated Decisions

In accordance with Article 37-2 of the Personal Information Protection Act of Korea (PIPA), the Company provides the following notice regarding cases in which automated systems are involved in decisions that affect users.

1. Temporary suspension based on accumulated reports: Accounts that have accumulated 5 or more reports may automatically be subject to temporary suspension. This is a temporary measure for community safety, and the final decision on sanctions is always made through human review by the Company. Users may request an explanation of, and file an objection to, the temporary measure (Article 26 of the Terms of Service).
2. Matching and course recommendations: Recommendation algorithms based on profile information such as pace, language, and time zone are limited to providing reference information and do not independently make decisions that affect users' rights or obligations.
3. Users may request an explanation and review of automated decisions through the contact listed in Section 14.

11. Measures to Ensure the Safety of Personal Information

The Company implements the following measures in accordance with Article 29 of the Personal Information Protection Act of Korea (PIPA) and the Standards for Ensuring the Safety of Personal Information.

12. Cookies and Automatic Collection Devices

1. The Company uses cookies to keep users logged in, save preference settings, and analyze service usage statistics.
2. Users may refuse the storage of cookies in their browser settings. However, some features, such as staying logged in, may be restricted.
3. The Company does not use behavioral information collection tools that provide users' online activity to third-party advertising networks. If such tools are introduced in the future, the Company will disclose this in this Privacy Policy and obtain the necessary consent.

13. Notice for Overseas Users

The Company also provides its service to users outside the Republic of Korea and provides the following notice.

1. Legal bases for processing (EU/EEA residents): The personal information of users to whom the EU General Data Protection Regulation (GDPR) applies is processed on the following bases.
   • Performance of a contract (GDPR Art. 6(1)(b)) — service provision, matching, payment
   • Compliance with a legal obligation (Art. 6(1)(c)) — retention of transaction records, etc.
   • Legitimate interests (Art. 6(1)(f)) — prevention of fraudulent use, service security
   • Consent (Art. 6(1)(a)) — marketing, location information, optional items
2. Rights of EU/EEA residents: EU/EEA residents have the right of access, the right to rectification, the right to erasure (right to be forgotten), the right to restriction of processing, the right to data portability, the right to object, and rights related to automated decision-making, and may exercise them through the contact listed in Section 14. The Company responds within one month.
3. Complaints to supervisory authorities: EU/EEA residents have the right to lodge a complaint with the Data Protection Authority in their place of residence.
4. Users in other countries hold the rights granted by the mandatory laws of their respective countries, and the Company respects those rights.

14. Chief Privacy Officer

The Company designates the following Chief Privacy Officer to oversee personal information processing and to handle data subjects' complaints and provide remedies.

Users may submit any inquiries, complaints, or requests for remedies related to personal information arising from the use of the service to the contact above, and the Company will respond and process them without delay.

15. Remedies for Infringement of Rights

Users may apply to the following organizations for dispute resolution or consultation to obtain relief from personal information infringement.

16. Changes to the Privacy Policy

1. If the contents of this Privacy Policy are added to, deleted, or amended, notice will be given through in-service announcements starting 7 days before the effective date. However, for changes significant to users' rights, such as changes to the items collected, purposes of use, third-party provision, or cross-border transfer, notice will be given 30 days in advance, and separate consent will be obtained where necessary.
2. The version history of this Privacy Policy is as follows. Previous versions are kept by the Company and are available for review upon request.

   Version	Effective Date	Major Changes
   v1.0	2026-01-26	Initial enactment
   v2.0	2026-02-06	Wording revised
   v4.0	2026-09-18	Added cross-border transfer section; reflected outsourcing audit (corrected SMS and email delivery channels); added paid services and settlement items; added notice on automated decisions; added notice for overseas users (GDPR); reorganized safety measures into three categories; added provisions on children and sensitive information

Effective Date: September 18, 2026