GTALAB Privacy Policy

In principle, these Services may be provided to users who are subject to the privacy laws of Korea, the European Union, and California, USA.

Effective as of: [7. 19. 2026]

We value your privacy. Please read the following carefully to understand our Privacy Policy ("Policy") regarding use of the website https://gtalab.gg, including all subdomains and localized language versions thereof, and any related applications (collectively, the "Sites") and the services provided through our Sites ("Services").

This Policy describes the personal information we collect from users of the Sites and Services and how we use and share such information. If you use our Sites and Services, you agree to the use of your personal information under this Policy. If you do not agree to this Policy, please do not use our Sites or Services. The Sites and Services are operated by [dododream] ("we", "us" or "our").

Effective Date and Changes to this Policy

This Policy is current as of the Effective Date set forth above. This Policy is subject to change, and changes to this Policy will be posted on the Sites. In the case of changes that may adversely affect you or in the case of significant changes, a notice period of at least 30 days will be provided before the changes take effect. Therefore, it is important that you review this Policy periodically. If we make any changes to this Policy that materially affect our practices, we will provide you with notice of such change (and will endeavor to do so in advance of its effectiveness) by highlighting the change on our Sites or, if you have an account with us, by providing notice to the email address associated with your account. For this reason, you should make sure to update your account information promptly if it changes.

Information Collected

Information We Collect Directly From You. We respect your concerns regarding privacy. Our Sites and Services do not collect personally identifiable information about you unless you expressly provide such information. We may collect personal information in the following instances:

- If you register as a user of our Services, we will ask for your email address only. Your email address must be verified through the email verification process we provide. We do not require any other personal information as a condition of registration. We use this information to identify you as a user, to authenticate your account, and to communicate with you regarding the Services.

- You may voluntarily set a nickname or other profile information for use within the Services. Such information is optional and is displayed to other users in connection with your activity on the Sites.

- Our Sites and Services may allow users to post or upload content. Please note that any information you post will be accessible to the public and to other users.

- If you contact us, we will collect your email address and the information you provide in order to respond to your inquiry.

Information We Collect Automatically. We may automatically collect the following information about your use of our Sites or Services through cookies and other technologies: your domain name; your browser type and operating system; web pages you view; links you click; your IP address; your service usage and history; records of restrictions imposed for violations of our policies; the length of time you visit our Sites or Services; and the referring URL, or the webpage that led you to our Sites (hereinafter, "Automatically Collected Information"). We may combine this information with other information that we have collected about you, including, where applicable, your email address. Please see the section "Cookies and Other Tracking Mechanisms" below for more information.

Purpose of Use of Personal Information

We use your information, including your personal information, for the following purposes:

1. To provide our Sites and Services to you, to communicate with you about your use of our Sites and Services, to authenticate users, to prevent fraudulent or abusive use of the Services, to provide notices, to respond to your inquiries, to preserve records for dispute resolution, and for other customer service purposes: your email address, the information you provide.

2. To process and display the content that you elect to share through the Sites and Services: all content (posts, comments, etc.) you post.

3. To tailor the content and information that we may display to you, to offer language and location customization, and to otherwise personalize your experience while using our Sites or Services: Automatically Collected Information, and geolocation data such as country of residence (derived from your IP address).

4. To better understand how users access and use our Sites and Services, both on an aggregated and individualized basis, in order to improve our Sites and Services and respond to user preferences, and for other research and analytical purposes: Automatically Collected Information.

5. We and our third-party service providers may combine Automatically Collected Information with other personal information we collect from you (and our third-party service providers may do so on our behalf): Automatically Collected Information.

We do not send marketing or promotional emails without your separate consent. If the personal information we collect is to be used outside of the above purposes, or if there is additional personal information to collect other than the above, we will notify you and obtain your consent separately at the time of collection.

Sharing of Your Information

We may share your information, including personal information, as follows:

- Other Users. Any content that you post on our Services and any nickname you use will be made available to other users of the Services.

- Affiliates. We may disclose the information we collect from you to our affiliates or subsidiaries solely for the purpose of providing the Sites and Services to you; however, if we do so, their use and disclosure of your personally identifiable information will be maintained in accordance with this Policy. We currently do not provide any information we collect from you to any affiliates or subsidiaries, and if we do so in the future, we will identify that affiliate or subsidiary in this Policy.

- Service Providers (Processing Consignment and Cross-Border Transfer). We entrust the processing of personal information to third-party service providers who perform functions on our behalf (such as hosting and data storage). The service providers listed below are located outside of Korea (in the United States), and personal information is transferred to and stored outside of Korea for the provision of the Services. As of the Effective Date, the following service providers perform functions on our behalf:

1. Recipient: Vercel Inc. (USA) — Function: website hosting and content delivery — Items transferred: Automatically Collected Information (IP address, access logs, etc.)

2. Recipient: Railway Corp. (USA) — Function: application server operation — Items transferred: email address, service usage records, Automatically Collected Information

3. Recipient: Atlas MongoDB, Inc. (USA, MongoDB Atlas) — Function: database storage and management — Items transferred: email address, nickname (if set), posts, service usage records

- Country of transfer: United States (other countries may be included depending on the cloud infrastructure regions used by the recipients)

- Time and method of transfer: transmitted from time to time via information and communications networks at the time of service use

- Recipients' retention and use period: until the member withdraws or the consignment contract ends

- You may refuse the cross-border transfer of your personal information. However, as such transfer is essential to the provision of the Services, refusal will make it impossible to use the Services. Requests to refuse cross-border transfer may be made via ddd_admin@dododream.co.

- Business Transfers. If we are acquired by or merged with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding, we may transfer the information we have collected from you to the other company.

- In Response to Legal Process. We may disclose the information we collect from you in order to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a subpoena.

- To Protect Us and Others. We may disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Use or this Policy, or as evidence in litigation in which we are involved.

- Aggregate and De-Identified Information. We may share aggregate or de-identified information about users with third parties and publicly for advertising, research, or similar purposes.

We do not sell your personal information to third parties.

Retention of Your Information

We retain personal information only as long as it is necessary and relevant for our operations.

- Membership registration and management (email address): retained until 30 days after the date of withdrawal, in order to prevent another person from immediately re-registering using the withdrawn member's email address. However, if an investigation or legal proceeding relating to a violation of applicable laws is in progress with respect to the member, the information is retained until such investigation or proceeding is conclusively closed.

- Handling of inquiries and complaints (email address): retained until the relevant matter is resolved. However, if litigation commences in connection with the matter, the information is retained until such litigation is conclusively closed.

- Statutory retention: we may retain certain information for the periods required by applicable laws, including, under Korean law: records on display and advertising (6 months); records on contracts or withdrawal of offers (5 years); records on payment and supply of goods (5 years); records on consumer complaints or dispute resolution (3 years) under the Act on Consumer Protection in Electronic Commerce; and communication confirmation data (log records) (3 months) under the Protection of Communications Secrets Act.

- Dormant accounts: in accordance with the Personal Information Protection Act of Korea, personal information of members who have not used the Services for one year may be destroyed or separately stored and managed.

Information retained beyond the periods above will be handled in accordance with this Policy and applicable law. You may access, update, alter, or delete your account information by logging into your account and updating your settings.

Destruction procedure and method. When the purpose of processing has been achieved or the retention period has expired, we destroy the relevant personal information without undue delay (in principle, within 5 days from the expiration date). Personal information recorded and stored in electronic file format is destroyed in a manner that renders the records unrecoverable, and personal information recorded on physical media is destroyed by shredding or incineration.

Cookies and Other Tracking Mechanisms

We and our third-party service providers use cookies and other tracking mechanisms to track information about your use of our Sites and Services. We may combine this information with other personal information we collect from you (and our third-party service providers may do so on our behalf). You may disable certain tracking as discussed in this section (e.g., by disabling cookies), but such disabling may impair your use of the Sites and Services.

Cookies. Cookies are alphanumeric identifiers that we transfer to your device's storage through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Sites and Services, while others are used to enable a faster log-in process or to allow us to track your activities on our Sites and Services.

- Session Cookies. Session cookies exist only during an online session. They disappear from your device when you close your browser. We use session cookies to allow our systems to uniquely identify you during a session or while you are logged into the Sites.

- Persistent Cookies. Persistent cookies remain on your device after you have closed your browser. We use persistent cookies to track aggregate and statistical information about user activity and to remember your preferences (such as language settings).

You can refuse cookies through your browser settings (e.g., in Chrome: [ ⋮ ] → Settings → Privacy and security → Site settings → Cookies and site data). However, refusing cookies may limit your use of some features of the Services.

Do Not Track

We do not respond to Do Not Track (DNT) signals. However, some third-party websites track your browsing activity. You can enable or disable DNT by visiting your web browser's Preferences or Settings page.

Third-Party Analytics

We use Google Analytics, a web analytics service provided by Google LLC ("Google"), on our Sites and Services. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the Sites, compile reports on the Sites' activity, and provide other services related to Sites activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring URL. The Sites and Services do not use Google Analytics to gather information that personally identifies you. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google's privacy policies. To opt out of tracking by Google Analytics, you may install the browser add-on available at https://tools.google.com/dlpage/gaoptout.

Third-Party Advertising and Affiliate Programs

We may partner with third-party advertising companies (including Google AdSense) to serve advertisements on the Sites. These third-party advertisers may use cookies, web beacons, or other tracking technologies to collect information about you when you use the Sites, such as your IP address, browser type, and whether you responded to a particular advertisement. They may collect information about your online activities over time and across different websites and use this information to provide you with interest-based advertising. You can learn more about personalized advertising by Google and opt out at https://adssettings.google.com. You can learn more about online advertising generally at www.aboutads.info/consumers.

The Sites also participate in affiliate marketing programs (including, without limitation, Amazon Associates and Coupang Partners). When you click an affiliate link, the relevant affiliate program operator may place cookies on your device to attribute purchases made through such links, and we may receive a commission from qualifying purchases. Such tracking is governed by the privacy policies of the respective program operators.

We do not control these third parties' tracking technologies, how they may be used, or the information they may collect, and we are not responsible for the privacy policies or practices of those third parties. These online advertising and affiliate partners do not receive your name, email address, or other personally identifiable information from us without your consent.

No Use by Children

The Sites are not intended for use by children (the applicable age depends on the country where you reside; in the Republic of Korea, under 14 years of age). We will never knowingly collect information directly from children without verifiable parental consent. If you are a child under the applicable age, you may not use the Sites or Services, and please do not provide us with information of any kind whatsoever. If we become aware that a user is a child under the applicable age and has submitted information to the Sites without verifiable parental consent, we will remove his or her information from our files and deactivate his or her account. If you have reason to believe that we may have received personal information from a child, please contact us immediately at ddd_admin@dododream.co.

Location of Our Operations

The Sites and Services are operated from South Korea. If you choose to use the Sites or provide your information to us, your information will be transferred, processed, and stored in South Korea. Your agreement to the terms of this Policy, followed by your submission of information on the Sites and Services, represents your agreement to this practice and the transfer of your personal information to South Korea. In addition, our employees, contractors, and affiliated organizations that process information for us as described above may be located in South Korea or in other countries outside of your home country; by using the Sites and Services, you consent to the international transfer of such information by us to such parties.

Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed, including:

- Administrative measures: establishment and implementation of an internal management plan for the safe processing of personal information, and regular training of personnel who handle personal information.

- Technical measures: restriction, control, and management of access rights to personal information processing systems; application of encryption technologies for the safe storage and transmission of personal information; retention of access records and measures to prevent their forgery or alteration; and installation and updating of security programs.

- Physical measures: access control to storage facilities where personal information is kept.

We limit access to your personal information to those employees, agents, and contractors who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Please note that no data transmission over the internet is 100% secure, and complete security of any information we collect and use therefore cannot be guaranteed.

Your Rights and Choices

Subject to limitations in applicable law, you (including your legal representative) are entitled to object to or request the restriction of processing of your personal information, and you have the right to request access to, rectification, erasure, and portability of your own personal information, including under Articles 12 through 22 of the GDPR where applicable.

- You have the right to information as to whether or not, and to which extent, we process your personal information.

- You have the right to rectification of any inaccurate personal information about you and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

- You have the right to the erasure of your personal information without undue delay, unless we have a legitimate interest or legal obligation to keep the information.

- You have the right to restrict the processing of your personal information, unless we have a legitimate interest to continue processing the information for the purpose in respect of which you requested the restriction.

- You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used, and machine-readable format (data portability). This right does not apply where it would adversely affect the rights and freedoms of others.

- You have the right to object to the processing of your data on grounds relating to your particular situation at any time.

- You have the right to withdraw your previously given consent at any time.

You may exercise these rights through the account management functions within the Services, or by contacting us via the email address specified in the "Contact Us" section. Rights may also be exercised through an authorized representative, in which case we may require a power of attorney in the form prescribed by applicable regulations. For your protection, we will verify your identity before making your personal data available to you or acting on your request, and we will respond within the period required by applicable law (in Korea, in principle within 10 days). Your rights may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act of Korea, and where personal information is specified as subject to collection under other statutes, you may not be able to request its deletion. We may have to keep certain information as required by law and/or for our own legitimate business purposes.

We will process your personal data for as long as necessary to provide the Services to you, to perform obligations under a contract with you, or to comply with law. If and to the extent you have given consent to us to process your personal data, we will process the data in accordance with that consent, and we will delete the relevant information upon your withdrawal of consent, unless retention is required by law.

Complaints Regarding Our Processing of Your Data

If you think that we have not followed this Policy in some way, we will do our best to help you resolve your concern. You may also file a complaint with the relevant data protection authority in your jurisdiction of residence, according to applicable privacy law. In the Republic of Korea, you may contact:

- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)

- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

- Korean National Police Agency: 182 (ecrm.police.go.kr)

Links to Other Sites

Occasionally we provide links to other websites, including affiliate links, for your convenience and information. These websites operate independently from our Sites and are not under our control. These sites may have their own privacy notices or terms of use, which we strongly suggest you review if you visit any linked sites. We are not responsible for the content of these sites, any products or services that may be offered through these sites, or any other use of the linked sites.

Notice of Privacy Rights to California Residents

If you are a California resident, please review this Notice for more information concerning your privacy rights.

A. We establish and enforce this Notice for California residents.

B. For California residents, if this Notice conflicts with the other parts of this Policy, this Notice takes precedence.

C. The information we collect and the purpose of the collection.

(1) We collect the following categories of information that may directly or indirectly identify or describe you or your device, or that may be reasonably capable of being associated with or reasonably linked to you or your device ("personal information"). We have collected these same categories of personal information over the past 12 months.

(2) The information we collect about you and the purposes of its collection are as follows:

- Service operation and provision: email address, nickname (if set) (hereinafter "Identifiers").

- Automatically Collected Information: information about your use of our Sites or Services collected through cookies and other technologies, including your domain name, browser type and operating system, web pages you view, links you click, IP address, service usage and history, length of visit, and referring URL.

- Providing customized services: Identifiers, Automatically Collected Information, geographic location data (country of residence).

- Advertising: Automatically Collected Information.

- Site and Service improvement, response to user requests, other research and analysis purposes: Automatically Collected Information.

- Combining Automatically Collected Information with other personal information collected from you: Automatically Collected Information.

D. Personal information provided to third parties.

(1) We may provide specific personal information to third-party service providers for service provision and improvement, as described in the "Sharing of Your Information" section above.

(2) We do not sell your personal information, and have not sold personal information in the past 12 months.

E. California Privacy Rights.

(1) You may exercise the following rights at any time in connection with your personal information. To exercise such rights, please email us at ddd_admin@dododream.co. Please note that at least your email address will be required to submit a request, and you must specify the right(s) you wish to exercise.

(2) We will verify your identity and respond to your request within 45 calendar days. If necessary, we may take up to an additional 45 days to respond, for a maximum total of 90 days from the day the request is received, provided that we notify you of the reason for the delay.

a. Right to Access: You have the right to request, up to two times within a 12-month period: the categories and specific pieces of personal information we have collected from you over the past 12 months; the categories of sources from which personal information was collected; the business or commercial purposes for which personal information is collected; and the categories of personal information disclosed for a business purpose during the past 12 months and the categories of third parties to whom the information was disclosed.

b. Right to Request Deletion: You have the right to request that the personal information collected from you be deleted.

c. Right to Opt Out of Personal Information Sales: You have the right to opt out of the sale of your personal information. However, we do not sell personal information.

d. Right to Non-Discrimination: You have the right not to be discriminated against for exercising your privacy rights under the CCPA (including the CPRA).

e. Rights for California Minors: Minors under the age of 18 have the right to request the deletion of and/or obtain information they posted on the Sites, such as forums or bulletin boards.

f. Shine the Light: You have the right to request the categories of personal information that we disclosed to third parties in the last year for direct marketing purposes and information on the relevant third parties, and to request that your personal information not be disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

F. Authorized Agent. You may designate another person or entity ("authorized agent") to act on your behalf in connection with your request for rights guaranteed by the CCPA (including the CPRA).

Chief Privacy Officer

We have a Chief Privacy Officer who is responsible for overseeing the processing of personal information. Personal information protection matters and related grievances of users are handled by the following department:

- Department in charge: GTALAB Operations Team (handling of personal information protection matters and related grievances)

- Email: ddd_admin@dododream.co

Contact Us

If you have any questions about this Policy, please contact us via the following channel:

- Email: ddd_admin@dododream.co

[Appendix] Consent to Collection and Use of Personal Information

For those applying for membership of 'GTALAB' (gtalab.gg), we hereby inform you of the purposes of collection and use of personal information, the items of personal information collected, and the retention and use period of personal information as set forth below. Please read the following carefully before deciding whether to consent.

1. Items of Personal Information Collected

'GTALAB' collects the following items of personal information:

1. Membership registration and management: email address

2. Handling of inquiries and complaints: email address

3. Provision of services: email address

4. In the course of using the internet services, the following items of personal information may be automatically generated, recorded, and collected: IP address, cookies, access logs, service usage records, records of usage restrictions, etc.

※ Profile information such as a nickname is an optional item that members may set voluntarily within the Services.

2. Purposes of Collection and Use of Personal Information

'GTALAB' collects and uses personal information for the following purposes. The personal information collected will not be used for any purpose other than the following, and if the purpose of use changes, we will obtain your prior consent.

1. Membership registration and management: to confirm your intention to register, maintain and manage membership status, prevent fraudulent use of the Services, provide various notices and notifications, and preserve records for dispute resolution.

2. Handling of inquiries and complaints: to verify the identity of the inquirer, confirm the details of the inquiry, contact and notify for fact-finding, and communicate the results of processing.

3. Provision of services: to provide the Services and content.

3. Retention and Use Period of Personal Information

1. 'GTALAB' processes and retains personal information within the retention and use period prescribed by applicable laws or the retention and use period consented to at the time of collection from the data subject.

2. The retention and use periods for each category of personal information are as follows:

1. Membership registration and management: until 30 days after the date of withdrawal. However, if an investigation or inquiry into a violation of applicable laws is in progress, until such investigation or inquiry is closed.

2. Handling of inquiries and complaints: until the relevant matter is resolved. However, if litigation commences after the inquiry arises, until such litigation is conclusively closed.

3. Provision of services: until the provision of the relevant services is completed. However, where necessary for consumer protection or other purposes under applicable laws, until the expiration of the period prescribed by such laws.

4. Other Matters

1. You have the right to refuse consent to the collection and use of personal information; however, if you refuse, membership registration will not be possible.

2. The above items constitute the minimum personal information necessary for the provision of the Services, and your consent is required to use the Services.

3. Additional information may be collected through separate consent in the course of using the Services.