BILLFREE LABS PRIVATE LIMITED. (the "Company") sets forth this Privacy Policy (this "Policy") with regard to the handling of user information, including but not limited to personal information, in connection with "Bill Free" and other services provided by the Company (the "Services"). The Company complies with the Act on the Protection of Personal Information, government guidelines and all other relevant laws and regulations for the purpose of protecting user information within the Services.

For the purposes of this Policy, "User Information" means personal information ("personal information" means information about a living individual which can identify the specific individual by name, date of birth or other description contained in such information, including such information which allows easy reference to other information and thereby enables the identification of the specific individual) that makes a user identifiable whether directly or indirectly, history of user activities associated with communication services, and other information created or accumulated in relation to users or users' devices, which shall be collected by the Company pursuant to this Policy.

The Services become available to users once the installation of Bill Free and its related software (the "App") is completed. Users shall provide e-mail addresses, mobile number and other registration information requested by the Company within the Services.

User Information which may be collected by the Company regarding user access and usage of the Services includes the following:

• device information;
• access log information;
• e-mail addresses;
• sensor information associated with users' communication equipment;
• information that users transmit while using each service;
• users' usage history regarding each service;
• other information entered by users into such forms as specified by the Company;
• mobile number;
• Location;

The Company will not use User Information of a user without obtaining the prior consent of the user, unless it is necessary for the accomplishment of any of the following purposes of use:

• providing, maintaining, protecting or improving the Services;
• collecting outstanding payments and delinquency charges from users;
• customizing information and advertisements regarding the Services to suit to users;
• conducting marketing activities by delivering notices to users regarding the Services;
• notifying of any outage, discontinuance or termination of the Services;
• addressing any violation of rules or policies relating to the Services;
• notifying any modification to the terms of use or this Policy;
• handling conflicts and litigations;
• providing guidance or responding to inquiries relating to the Services;
• creating statistical data relating to the Services in a form that is not personally identifiable;; and
• any other purposes incidental to the foregoing

The Company, its affiliate partners and third parties may mutually provide to each other User Information including Personal Information to the extent necessary for achieving the purposes set forth in the preceding paragraph after obtaining prior consent from users

The Company may modify the purposes of use for Personal Information in the preceding Article to the extent that the modified purpose remains duly relevant to that before the modification, upon which event the Company will notify users of or publicly make an announcement regarding such modification in a manner separately specified by the Company.

The Company shall collect User Information in a proper manner without relying on any wrongful or fictitious means.

The Company shall notify of or announce the purposes of use in advance by a method separately determined by the Company when collecting User Information in a manner other than through users' use of the Services.

The Company shall take all necessary and/or proper security measures in preventing any leakage or loss of, or damage to User Information.

Should the Company entrust an individual and/or a business operator ("Agents") with the handling and/or processing of User Information in whole or in part, it shall conclude a confidentiality agreement in advance with terms consistent with this Policy and exercise necessary and appropriate supervision over the Agents in order to ensure the security of User Information.

The Company shall comply with laws, regulations and other standards pertaining to the protection of Personal Information and make every effort to protect such Personal Information to prevent it from any loss, theft, destruction, alteration, leakage and unauthorized access from outside.

The Company restricts access to e-mail addresses only to those authorized employees in order to protect users' email addresses.

The Company delivers to all users "important notices" and other notifications that need to be communicated to users.

The website for the Services contain webpages and that utilize "cookies" and other similar technologies. The Company may use cookies and other similar technologies to provide the Services. The usages of website on handheld devices may also use cookies and other similar technologies to provide the services.

A "cookie" is an industry-standard technology which enables web servers to identify each user's computer. Cookies can identify users' computers but not the individual users. Users can choose to disable cookies, although their use of all or part of the Services on the webpages may be restricted as a result.

The Company may provide the Services in cooperation with external services ("External Services"). The Company may provide User Information to the providers of External Services if and when it provides the Services in cooperation with External Services upon request by a user.

The Company shall not disclose or share Personal Information without users' consent except in the event of disclosures permitted on the basis of the Act on the Protection of Personal Information or other relevant laws or regulations; provided, however that this shall not apply in the following cases:

• a case in which the Company provides users' information to payment system providers, and merchant companies for billing purposes;
• a case in which the Company provides Personal Information to External Services providers in accordance with the provisions of the preceding Article;
• a case in which the Company provides Personal Information as a result of a succession of business in a merger or otherwise;
• a case in which a disclosure is required by an official body such as the court or police based on relevant laws and/or regulations;
• a case in which the Company collects and/or analyzes individual pieces of Personal Information and processes such information into a form that is not personally identifiable for the purpose of providing statistical information;
• a case in which a user has violated any of the terms of use stipulated by the Company;
• a case in which the Company takes necessary measures including legal actions against a user who has caused serious injury to others or acted in violation of public order and morality or has attempted to do the same; and
• a case in which disclosure is necessary in an emergency situation involving an immediate threat to life or property.

Any external websites that are accessible via links on the websites of the Company are not under the Company's control. The Company shall assume no responsibility whatsoever for any leakage, loss and/or damage of information resulting from the users' own use of such external websites.

The Company shall, from time to time, conduct a review of how User Information is being managed and use its best efforts to continuously improve such management. The Company may amend this Policy as necessary without obtaining prior consent from users. Any amendments to this Policy shall be effective upon its release on the Company's website except as separately specified by the Company; provided, however that in the case of any amendments requiring consent from users on the basis of any applicable laws and/or regulations, such consent shall be obtained through a procedure separately established by the Company.

The Services may include links to External Services other than those managed and operated by the Company. The Company shall not be responsible for the contents of such External Services or the protection of Personal Information in connection therewith.

Effective: February 1, 2018