Privacy Policy

Dokori (the "Company") handles users' personal information and other user data in connection with Dokori (the "Service") as described below.

Article 1. Information We Collect

The Company may collect the following information in providing the Service:

1. Account Registration Information Name or display name, email address, password, profile image, biography, and other information necessary for account management
2. Transaction Information Purchase history, download history, order date and time, order number, purchased products, refund history, inquiry history, and other information necessary for transaction management
3. Creator Information Pen name or trade name, contact information, bank account details for transfers, qualified invoice issuer registration number, tax-related information, identity verification documents, and other information necessary for Creator registration and payment processing
4. Product-Related Information Product name, description, price, thumbnail, map data, supplementary materials, license terms, tags, publication settings, and other information necessary for listing and selling products
5. Payment-Related Information Payment method, payment status, refund status, payment identifiers shared by the payment service provider with the Company, and other information necessary for payment management. Note: Sensitive payment information such as credit card numbers is not directly held by the Company; it is managed by the payment service provider.
6. Device and Usage Information IP address, cookies, log information, browser information, device identifiers, access date and time, referrer, operation history, and other information related to usage of the Service
7. Event Application Information Application class, participation date, affiliated club or organization and other identification information relating to competition eligibility and affiliation, identification numbers of electronic timing cards (such as SI or E cards), safety management information (emergency contacts (name, relationship, and contact details), membership information for membership programs such as mountain rescue and search services, etc.), self-reported health status, matters stated in the participation consent form, consent or refusal regarding the use of photographs and video, and other information that the Organizer requires for event operation
8. Information Relating to the Individual and the Applicant Name (in kanji, kana, and Roman letters), date of birth, gender, nationality, address, telephone number, emergency contact, and other information necessary for identity verification and the application procedure

Article 2. Purpose of Use

The Company uses collected information for the following purposes:

1. Providing, maintaining, and improving the Service
2. Account creation, identity verification, login authentication, and fraud prevention
3. Product sales, payment processing, download delivery, and refund handling
4. License fee calculation, payment processing, and tax/accounting processing for Creators and Organizers
5. Product review, rights verification, report handling, removal actions, and other rights protection measures
6. Responding to inquiries, sending important notices, and providing support
7. Investigating Terms violations, dispute resolution, and legal compliance
8. Analyzing Service usage, improving quality, and developing new features
9. Embedding purchaser identification information in Digital Products for the purpose of preventing and investigating unauthorized use
10. Campaigns, update notifications, and information about our services
11. Purposes incidental to the above
12. Processing event applications and managing Participants
13. Providing the information necessary for participation to the Organizer of the event for which the application is made
14. Contacting in emergencies (notifying the emergency contact)
15. Verifying competition eligibility and reporting competition results to the governing organization in connection with sanctioning programs
16. Publishing the list of event Participants (name or display name, affiliation, application class, application status, etc.) on the Service (the individual may request to be excluded from publication)
17. Cooperating in safety management at the event venue (reporting to venue managers, local governments, the police, medical institutions, etc. as necessary)
18. Taking photographs and video for event records and publicity and using them in the media of the Service or the Organizer (except where the individual has refused; the purpose of the photography and the method of refusal will be displayed on each event page)
19. Saving the information entered by a logged-in User to their account, and auto-filling it in subsequent applications

Article 3. Provision to Third Parties

1. The Company does not provide personal data to third parties except in the following cases:

   1. With the consent of the individual
   2. As required by law
   3. When necessary to protect the life, body, or property of a person
   4. When particularly necessary for improving public health or promoting the sound development of children
   5. When cooperation with a national institution or local government is required
   6. When provided to the service providers set forth in Article 5, to the extent necessary for the performance of their services

2. When a User makes an event application, the Company provides the following information to the Organizer of the event, based on the consent of the individual. Such consent is obtained through agreement to the Terms of Service and this Privacy Policy as well as the participation consent form for each event.

   1. The applicant's name (in kanji, kana, and Roman letters)
   2. Contact information (email address, telephone number)
   3. Affiliation (such as club)
   4. Competition-Related Information (identification information relating to competition eligibility and affiliation, identification numbers of electronic timing cards, age class categories, etc.)
   5. Emergency contact
   6. Matters stated in the participation consent form
   7. Other information that the Organizer requires for event operation (which will be specified on each event detail page)

   The Organizer shall appropriately handle the information provided to it within the scope necessary for the operation of the event, and may carry out processing necessary for operation, such as provision to relevant organizations in connection with sanctioning programs. The details of the Organizer's handling shall be as separately determined between the Company and the Organizer.

3. With respect to requests for disclosure, correction, suspension of use, and the like concerning the User's own data held by the Organizer, the User may, in principle, request that the matter be relayed to the Organizer through the Company's inquiry desk set forth in Article 14. Where an Organizer's inquiry desk is displayed on the relevant event page, the User may also make the request directly to that desk.

Article 4. Information Sharing with Creators and Organizers

1. The Company is the seller to Purchasers and Participants.
2. A Purchaser's name, address, telephone number, and similar information are not disclosed to Creators as a matter of course. However, in the following cases, information may be shared with Creators to the minimum extent necessary:
   1. When necessary for rights processing, defect investigation, or refund decisions regarding a Product
   2. When a Purchaser requests content verification or support regarding the relevant Product and sharing is necessary
   3. When required by law or for dispute resolution
3. With respect to Organizers, as set forth in Article 3, Paragraph 2, the Company shares the information necessary for event operation based on the express consent of Participants. The method of obtaining the consent underlying information sharing and the scope of sharing differ between Creators and Organizers.

Article 5. Entrustment

1. The Company may entrust the following operations to external providers in connection with the Service. In such cases, the Company shall appropriately select its service providers and provide necessary and appropriate supervision.

Operation	Data Provided
Payment processing	Payment information (card numbers etc. are held only by the payment service provider), transaction information
Database and authentication	Account information, transaction information, service data
Hosting and CDN	IP addresses, access logs, traffic data
Search	Search queries, search target data
Analytics	Cookies, browsing behavior, device information
Email delivery	Email addresses, sent content
Error monitoring	Error logs, session information
Image processing	Image data (generally does not include personal information)
AI and machine learning	Data within the scope necessary for service improvement
Electronic ticket and pass issuance	Participant identifiers, application details, event date and time, etc.
Calendar integration	Event date and time, venue, Participant identifiers
Management dashboard provider (infrastructure provision)	Data within the scope necessary for hosting and operating the management features for Organizers

2. In addition to the above, the Company may entrust data processing to appropriately selected external providers to the extent necessary for providing and improving the Service.
3. Organizers are not service providers (entrustees) but are subject to the provision to third parties set forth in Article 3, Paragraph 2. An Organizer's access to Participant information through the management dashboard for Organizers is based on such provision to a third party.

Article 6. Provision to Third Parties in Foreign Countries

1. The service providers used by the Company include providers located in foreign countries (such as the United States). The Company entrusts the handling of personal data to these service providers after establishing systems that conform to the standards under the Act on the Protection of Personal Information (APPI) (such as by concluding data processing agreements) and taking other measures in accordance with applicable law. Information regarding the names of the destination countries, the personal information protection systems of those countries, and the protection measures taken by the service providers will be provided upon request by the individual.
2. Where, in connection with a sanctioned competition or other event, it is necessary to provide competition results or other information to relevant foreign institutions (such as the organization that governs the sanctioning program), such provision shall be carried out by the Organizer on its own responsibility, and the consent therefor is obtained through the participation consent form or the like for each event. The Company shall not, in principle, be the party making such provision.

Article 7. Cookies and External Transmission

1. The Company may use cookies and similar technologies to improve convenience, prevent fraud, and analyze usage of the Service.
2. In accordance with the amended Telecommunications Business Act, the Company discloses the following information regarding data transmitted from users' devices to external providers:
   • The content of user information being transmitted
   • The name of the receiving entity
   • The purpose of use
3. Details regarding external transmission are described on the Service's help page or in an appendix to this Policy.
4. Users may restrict cookies through browser settings, but in such cases, some features of the Service may become unavailable.

Article 8. Security Measures

The Company implements the following security measures to prevent leakage, loss, damage, or unauthorized access to personal data:

1. Organizational security measures: Designation of a person responsible for personal information protection, establishment of handling regulations
2. Personnel security measures: Communication of precautions regarding the handling of personal data
3. Physical security measures: Prevention of theft of devices and electronic media, lock management
4. Technical security measures: Access control, communication encryption, log management, vulnerability response, and additional access privilege management for sensitive information such as emergency contacts and health status

Article 9. Retention Period

1. The Company retains user information for the period necessary to achieve the purpose of use or for the period required by law, and thereafter deletes or anonymizes it by appropriate means.
2. The retention period for information related to event applications shall be as set forth in Article 11, Paragraph 2.

Article 10. Disclosure, Correction, Suspension of Use, and the Like

1. Users may, in accordance with applicable law, request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, or cessation of third-party provision of their retained personal data. Please direct such requests to the inquiry desk described in Article 14.

2. Accompanying Participants who applied through a Representative Applicant also hold the rights to make the requests set forth in this Article with respect to their own personal data.

3. With respect to requests concerning a User's personal data held by an Organizer, the Company will receive the User's request and relay it to the Organizer.

Article 11. Handling upon Account Deletion

1. When a User requests account deletion, the Company shall delete personal data within 30 days, except for data subject to statutory retention obligations.
2. The following data may be retained after account deletion due to legal obligations or legitimate interests:
   • Consent logs: 5 years (corresponding to the statute of limitations for consumer contracts)
   • Transaction records (including payment information, application records, and license fee payment records): 7 years (corresponding to retention obligations under the Electronic Books Maintenance Act and tax laws)
   • Emergency contacts: 30 days after the conclusion of the relevant event (extended to the necessary period where related to accident response or insurance claims)
   • Participation consent forms and self-reported health status: 1 year after the conclusion of the relevant event (as evidence for accident response)
   • Logs necessary for fraud investigation: 1 year

Article 12. Minors

1. Where a minor uses the Service, the minor shall do so after obtaining the consent of their legal guardian.
2. Where a minor participates in an event, the Company may obtain the contact information of the legal guardian at the time of application.

Article 13. Amendments

1. The Company may amend this Policy as necessary.
2. In the case of material changes, the Company shall provide notice through the Service or by other means deemed appropriate by the Company.
3. Amendments to this Policy do not affect the handling of personal data in transactions already concluded at the time of the amendment.

Article 14. Contact

• Business name: Dokori (The legal name of the personal information handler will be disclosed upon request)
• Department: Privacy Inquiry Desk
• Email: support@dokori.net
• Address: Disclosed upon request

Article 15. Consent Structure

The Company obtains consent from Users regarding the handling of personal information at the following two levels:

1. L1 Consent to Use the Service

   • Scope: Storage of personal information on the Company's servers and the handling of personal information for the purpose of providing the Service
   • Timing of obtainment: At the time of account creation and at the time of a material amendment to this Policy
   • Method of withdrawal: Account deletion (which can be requested from My Page)

2. L2 Consent to Provide Information to the Organizer

   • Scope: Provision of Participant information to the Organizer of an event at the time of each individual event application
   • Timing of obtainment: At the time of application for each event (obtained through agreement to the Terms of Service and Privacy Policy and the participation consent form or the like)
   • Method of withdrawal: Cancellation before the application deadline, or a request to the Organizer for deletion through the Company's inquiry desk set forth in Article 14 (where an Organizer's inquiry desk is displayed on the relevant event page, a direct request to that desk is also possible)

Information entered by a logged-in User at the time of an event application is saved to that User's account and reused for the purpose of providing the Service and auto-filling subsequent applications. The saved information can be deleted at any time from the personal information settings on My Page.

Article 16. Rights of Individual Participants

1. Even an Accompanying Participant who applied through a Representative Applicant may exercise all the rights set forth in this Policy (collection, use, disclosure, correction, suspension of use, deletion, and others) with respect to their own personal data.
2. An Accompanying Participant may, by means of an access token (an individual magic link) issued by the Company, access their own application information and personal data and request correction and deletion thereof, even if they do not have an account on the Service.
3. The Company will respond to requests from Users who applied as guests after carrying out identity verification by means of the application number, the registered email address, or another method designated by the Company.

Article 17. Consent by Proxy (Multi-Person Applications)

1. The Representative Applicant shall have obtained, in advance, the consent of each Accompanying Participant regarding the provision of personal information to the Service and the provision of information to the Organizer.
2. The Company collects and uses the personal data of Accompanying Participants in reliance on the Representative Applicant's declaration that the consent referred to in the preceding paragraph has been obtained.
3. After the application, an Accompanying Participant may directly confirm or withdraw their own consent through an individual confirmation communication from the Company or an individual magic link.
4. Where the Representative Applicant has failed to obtain the prior consent of an Accompanying Participant, the Representative Applicant shall bear the resulting liability.

Article 18. Handling of Special Care-Required Personal Information

1. Among the Event Application Information set forth in Article 1, Item 7, the self-reported health status, the matters stated in the participation consent form, and the like may include Special Care-Required Personal Information (medical history, disabilities, medical information, etc.) as defined in Article 2, Paragraph 3 of the Act on the Protection of Personal Information (APPI).
2. In collecting Special Care-Required Personal Information, the Company obtains the express consent of the individual (or, in the case of a minor, the legal guardian) after clearly indicating the purpose of use.
3. In a multi-person application made through a Representative Applicant, the consent of the Accompanying Participant themselves or their legal guardian shall be obtained with respect to the Special Care-Required Personal Information of the Accompanying Participant. Consent by proxy based solely on the declaration of the Representative Applicant does not apply to Special Care-Required Personal Information.
4. Where the Company provides Special Care-Required Personal Information to the Organizer, it shall do so only to the extent necessary for the safety management of the relevant event, and shall obtain the express consent of the individual or the legal guardian before such provision.