1. Personal Information Collected

Category	Items
Account	Name, email (ID), contact number
Payment	Payer's name and contact number, payment method and approval information (processed by the PG company), student information
Consultation	Name, contact number, age, position and tier, inquiry details
Automatically collected	Access logs, cookies (to keep you logged in), etc.

2. Purposes of Collection and Use

• Providing the Service: account management, class booking and delivery, feedback and attendance management
• Payment and pass management, and refund processing
• Receiving and responding to consultations
• Improving the Service and preventing misuse

3. Retention and Use Period

In principle, personal information is destroyed without delay once the purpose of its collection and use has been achieved. However, where retention is required under applicable laws, it is kept for the relevant period. (E.g., records of contracts, payments, and refunds for 5 years and records of consumer complaints and dispute handling for 3 years under the Act on Electronic Commerce.)

4. Provision to Third Parties

As a rule, the Company does not provide users' personal information to outside parties. Exceptions are limited to cases where there is a legal basis or the user has consented.

5. Outsourcing of Processing

To provide the Service smoothly, the Company outsources personal-information processing tasks as set out below, and in the outsourcing contracts stipulates the matters required by applicable laws so that personal information is managed securely.

Processor	Outsourced task
Toss Payments Co., Ltd.	Processing of electronic payments such as credit cards and simple payments, and prevention of payment fraud
Discord Inc. (USA)	Sending internal operational notifications (class bookings and changes, consultation-receipt alerts — private operations channel). Consultation-inquiry notifications do not include contact numbers, and names are sent masked.

※ Discord Inc. is an overseas (U.S.) operator, and within the scope of the notification purpose above, personal information (minimal information such as a name) may be transferred abroad. Users may request the personal information protection officer to refuse the overseas transfer.
※ If a provider for sending notification messages (such as KakaoTalk alerts) is introduced, this Policy will be updated and notice given in advance.

6. Destruction Procedures and Methods

For personal information whose retention period has elapsed or whose purpose has been achieved, electronic files are deleted by an unrecoverable method and printed materials are shredded or incinerated.

7. Rights of Data Subjects

A user (or their legal representative) may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information, and the Company will take action without delay.

8. Measures to Ensure Security

• Passwords are stored encrypted using a non-decryptable method (BCrypt)
• Personal information and payment secrets are not exposed to the client (browser)
• Minimization of access privileges and encryption of transmission (HTTPS)

9. Personal Information of Children Under 14

The Company does not collect the personal information of children under the age of 14 without the consent of a legal representative (parent). The personal information of minor students is collected and used with the consent of a legal representative, who may at any time request access to, correction of, deletion of, or suspension of the processing of the child's personal information.

10. Personal Information Protection Officer and Exercise of Rights

The Company designates a personal information protection officer with overall responsibility for tasks relating to the processing of personal information, as set out below.

Category	Details
Personal information protection officer	Kang Tae-wook (Representative)
Affiliation / business name	YesICan (YIC Academy)
Inquiries / exercise of rights	Received through the consultation-request channel on the website (including requests for access, correction, deletion, or suspension of processing of personal information)

If a user needs consultation regarding an infringement of personal information, they may contact the Personal Information Dispute Mediation Committee (1833-6972), the Personal Information Infringement Report Center (118), the Supreme Prosecutors' Office (1301), the National Police Agency (182), and similar bodies.

This Policy takes effect on July 11, 2026. Any additions, deletions, or changes will be announced on the website beginning 7 days before they take effect. · YesICan · Representative Kang Tae-wook · Business registration no. 652-31-01503 · Phone 010-6726-3200