Double Eagle Inc. ("Company") publishes this Privacy Policy in accordance with Article 30 of Korea's Personal Information Protection Act (PIPA).

The Company processes personal information for the following purposes and will not use it beyond these purposes.

1. Member registration and management: Identity verification, authentication, membership maintenance, and prevention of fraudulent use
2. Service provision: Tee time notifications, golfer matching ("Join"), live scorecards, golf course information, golf course auto-login, community, chat, and personalized services
3. Payment processing: Processing payments for paid services, refunds, and settlements
4. Marketing and advertising: Providing event and promotional information (only to users who have given separate opt-in consent), service usage statistics and analysis, and developing new services
5. Complaint handling: Receiving and processing complaints, and retaining records for dispute resolution

The Company does not collect personal information from children under 14 years of age. Registration is restricted for individuals under 14. If the Company becomes aware that personal information of a child under 14 has been collected, it shall be destroyed without delay.

The Company retains personal information within the period prescribed by law or as agreed at collection.

The Company does not provide personal information to third parties without the data subject's consent, except in the following cases:

1. When prior consent has been obtained from the data subject
2. When required by law or to comply with legal obligations
3. When prior consent cannot be obtained and it is urgently necessary for the life, body, or property of the data subject or a third party

The Company entrusts personal information processing to the following parties and manages them in accordance with Article 26 of the PIPA.

The Company transfers personal information overseas as follows for service provision.

Appropriate protective measures are taken for cross-border transfers in accordance with Article 28-8 of the PIPA.

The Company destroys personal information without delay when it is no longer needed due to the expiration of the retention period or the achievement of the processing purpose.

1. Destruction procedure: Unnecessary personal information is selected and destroyed with the approval of the Chief Privacy Officer.
2. Destruction method: Electronic files are deleted using technical methods that prevent record recovery.

Information required to be preserved by law is stored separately.

1. Data subjects may exercise the following rights regarding their personal information at any time:
   • Request access to personal information
   • Request correction of errors
   • Request deletion
   • Request suspension of processing
2. Rights may be exercised in writing, by email (contact@dbegl.com), or through an authorized representative.
3. When correction or deletion is requested, the information will not be used or provided until completed.
4. Post-withdrawal requests for deletion of personal information in posts will be processed per applicable law.

The Company takes the following measures to ensure the security of personal information:

1. Access control: Access to personal information processing systems is controlled through the granting, modification, and revocation of access rights.
2. Intrusion prevention: Firewall systems are used to control unauthorized external access.
3. Encryption: Sensitive data such as payment information and golf course account credentials is encrypted using secure algorithms such as AES-256 for storage and management.
4. Access log retention: Records of access to personal information processing systems are retained for at least one year.

In the event of a personal information breach, the Company shall notify affected data subjects without delay (within 72 hours of becoming aware) in accordance with Article 34 of the PIPA, including the following information:

1. Categories of personal information that were breached
2. Time and circumstances of the breach
3. Measures that data subjects can take to minimize potential harm
4. The Company's response measures and remediation procedures
5. Contact information for the department handling reports of harm

The Company processes location information for nearby golf course search and distance display.

1. Location information is collected from the device, stored on our servers, and retained for one year from collection.
2. Users may disable location collection through device settings, which may limit location-based features.
3. Location information is not provided to third parties except within the scope of Articles 6 and 7.

The Company uses cookies on its website to provide personalized services. Users may refuse cookie storage through browser settings, but some services may be limited as a result.

The Company collects app usage statistics through Firebase Analytics for service improvement. Collected information includes device identifiers and app usage patterns, but does not include information that directly identifies individuals.

The Company may send event, promotional, and advertising information via push notifications or other methods.

1. Processing of personal information for marketing purposes requires separate opt-in consent from the user, independent of consent for service use. Users may withdraw consent at any time.
2. Consent may be withdrawn through the Platform's settings or by email (contact@dbegl.com).
3. Users who do not consent to marketing communications may still use the Services without limitation.

The Company designates the following Chief Privacy Officer and Location Information Manager.

For privacy inquiries, contact the officer above.

Data subjects may seek dispute resolution or consultation from the following organizations for relief from personal information infringement:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cyber Crime Division: 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)

This Privacy Policy is drafted in Korean. The English translation is provided for reference only. In the event of any conflict between the Korean and English versions, the Korean version shall prevail.

This Privacy Policy is effective as of March 10, 2026.

Previous versions of the Privacy Policy can be found below:

• August 25, 2023 – March 9, 2026