Article 1 Privacy Notice
This Privacy Notice (this “Notice”) is issued by HYBE Co., Ltd. (“HYBE,” “the company,” “we,” “us,” or
“our”) and is addressed to our general customers, visitors to the “HYBE AUDITION” Site, users of our Apps
and other users of our services (together, “you”). In this Notice, the term “App” means any application made
available by us (including where we make such applications available via third-party stores or marketplaces
or by any other means), and the term “Site” means any website operated or maintained, by us or on our
behalf. As this Notice may be amended or updated from time to time, we encourage you to check this Notice
regularly to review any changes to the terms.
Article 2 Purposes of Processing Personal Information
We process your personal information for the following purposes pursuant to applicable law
-
To provide our Sites, Apps, products and services:
Providing our Sites, Apps, products or services; creating an account; providing customer support on the
use of services; identifying and preventing wrongful uses; providing audition application functions;
performing statistical analyses; providing promotional materials (upon request); communicating with you in
relation to our Sites, Apps or services; conducting service satisfaction surveys; provision and operation
of event services (confirming participants for events, providing and delivering prizes to winners,
handling other complaints).
-
To operate our business:
Operating and managing our Sites, Apps, and services; providing you with content; displaying advertising
and other information to you; authenticating users for the sales/delivery of products and the
identification and prevention of duplicate purchases/uses or other wrongful uses; communicating and
interacting with you via our Sites, Apps or services; and notifying you of changes to any of our Sites,
Apps or services.
-
To manage IT systems:
Managing and operating our communications, IT, and security systems; and auditing (including security
audits) and monitoring such systems.
-
To improve our Sites, Apps, and services:
Identifying issues related to our Sites, Apps, or services; planning improvements to our Sites, Apps, or
services; and developing new Sites, Apps, or services.
Article 3 Processed Personal Information
The personal information that we process about you is as follows
-
What is "required items"?: Information required to provide the service's fundamental functions
-
What is "optional items"?: Information collected additionally to provide specialized services (Your
use of the service will not be restricted even if you do not enter optional items.)
(1) Regular Audition Application
(1) Regular Audition Application
| BIGHIT MUSIC |
Upon Regular Audition Application |
Mandatory |
Name, Email Address, Date of Birth, Country and Region, Contact Information, SNS ID, Messenger ID,
Profile Picture
|
3 years after audition application or the period according to relevant laws and regulations
|
| PLEDIS ENTERTAINMENT |
Upon Regular Audition Application |
Mandatory |
Name, Email Address, Date of Birth, Country and Region, Contact Information, Messenger ID, Profile
Picture, Gender, Place of Residence, Height, Weight, Self-Introduction Video
|
| Optional |
SNS ID, Photos/Audio/Video Materials |
| KOZ ENTERTAINMENT |
Upon Regular Audition Application |
Mandatory |
Name, Email Address, Date of Birth, Country and Region, Contact Information, SNS ID, Gender, Place
of Residence, Height, Weight, School/Occupation, Emergency Contact, Special Skills, Career/Awards
Experience, Audition Experience, Multiple Citizenship, Trainee Experience
|
| Optional |
Profile Picture, Photos/Audio/Video Materials |
| ADOR |
Upon Regular Audition Application |
Mandatory |
Name, Email Address, Date of Birth, Country and Region, Contact Information, SNS ID, Messenger ID,
Profile Picture, Gender, Self-Introduction Video, Photos/Audio/Video Materials
|
| HYBE INDIA |
Upon Regular Audition Application |
Mandatory |
Name, Email Address, Date of Birth, Country and Region, Contact Information, SNS ID, Messenger ID,
Profile Picture
|
(2) Legal Guardian Identity Verification
(2) Legal Guardian Identity Verification
| Legal Guardian Identity Verification outside the US region |
Upon Legal Guardian Identity Verification |
Mandatory |
Name, Contact Information, Email Address, Relationship with Applicant |
3 years after audition application or the period according to relevant laws and regulations
|
| Optional |
Contact Information, Email Address, Address (State, Province, City, Area), SSN Number, Date of
Birth
|
| Legal Guardian Identity Verification in the US region |
Upon Legal Guardian Identity Verification |
Mandatory |
Name, Street Address, Zip Code |
| Written Legal Guardian Identity Verification |
Upon Legal Guardian Identity Verification |
Mandatory |
Guardian's Name, Relationship with the Child, Email Address, Residential Address
|
(3) Consultation Reception and Service Use
(3) Consultation Reception and Service Use
| Upon Consultation Reception |
Mandatory |
Email Address (Note: Additional information may be processed depending on the consultation
content.)
|
Retained for 3 years after inquiry registration according to relevant laws and regulations
|
| Upon Service Access and Use |
Mandatory |
Cookies collected during internet service use, Service use records (visit date/time, IP address,
record of improper use, etc.), Device information (unique device identifier, OS version), Country
of Access
|
1 year after collection or the period according to relevant laws and regulations
|
The Company processes personal data items for the event-based (one-time) auditions listed below, in addition
to the regular auditions.
-
Time of processing:
When applying for an audition
-
Personal information processed:
Name, email address, nationality and region, place of birth, gender, date of birth, phone number,
place of residence, height, weight, school, occupation, special talents, activity history, awards,
audition experience, related experience, application category, social media ID, messenger ID,
photographs/videos/other creative content uploaded by the applicant, application channel, emergency
contact number, recommender’s name, recommender’s email address, recommender’s phone number
* The information collected in the application form varies for each audition
-
Period for retention and use:
3 years after the submission of the audition application or period stated in relevant laws
-
Time of processing:
When verifying the identity of the legal representative
-
Personal information processed:
(Outside the U.S.) Name, phone number, email address, relationship to applicant
(Within the U.S.) Phone number, email address, name (first and last), address, postal code, Social
Security number, date of birth
-
Period for retention and use:
3 years after the submission of the audition application or period stated in relevant laws
-
Time of processing:
When verifying the identity of the legal representative in writing
-
Personal information processed:
Guardian information (name, relationship to child, email address, residential address)
-
Period for retention and use:
3 years after the submission of the audition application or period stated in relevant laws
-
Time of processing:
When receiving customer service
-
Personal information processed:
Email address
(however, additional information may be processed depending on the details of the inquiry)
-
Period for retention and use:
3 years after making the inquiry, in accordance with relevant laws
-
Time of processing:
When accessing and using the service
-
Personal information processed:
Cookies collected during the use of internet services, service usage history (date and time of visit,
IP address, records of improper use, etc.), device information (unique device identification value, OS
version), country of access
-
Period for retention and use:
3 years after the submission of the audition application or period stated in relevant laws
-
Time of processing:
When applying for an audition
-
Personal information processed:
Name, email address, nationality and region, place of birth, gender, date of birth, phone number,
place of residence, height, weight, school, occupation, special talents, activity history, awards,
audition experience, related experience, application category, social media ID, messenger ID,
photographs/videos/other creative content uploaded by the applicant, application channel, emergency
contact number, recommender’s name, recommender’s email address, recommender’s phone number
* The information collected in the application form varies for each audition
-
Period for retention and use:
The period agreed upon when applying for the audition, in accordance with relevant laws
Article 4 Provision of Personal Information to Third Parties
We do not provide third parties with your personal information unless you consent thereto or the disclosure
is otherwise expressly prescribed in applicable law.
In addition, in accordance with relevant laws and regulations, we may share personal information without
your consent to the extent that such sharing is reasonably related to the purpose of the collection of such
personal information. In the foregoing case, we will comprehensively consider factors such as whether the
sharing is related to the original purpose of collection, whether the sharing is predictable in light of the
circumstances under which the personal information was collected or under usual processing practices,
whether the sharing unreasonably infringes upon your interests and whether security measures such as
pseudonymization or encryption have been implemented.
Article 5 Entrustment of Personal Information
When necessary for the purposes of service use, performing contractual obligations, and improving member
convenience, we entrust the processing of personal information to specialized service providers or utilize
specialized platforms within the scope disclosed in this Privacy Notice.
When signing the consignment contract to entrust the personal information processing, we include clauses
stating the consignee's responsibilities such as the prohibition of processing personal information for
purposes other than entrusted tasks, technical/administrative measures, prohibition of reconsigning,
managerial and supervision of consignee, and compensations for damages, and we supervise the consignees to
handle the information safely.
We will immediately disclose when there is any change in the entrusted tasks or consignees via the Notice.
Article 6 International Transfer of Personal Information
The company saves all personal information in the region of South Korea. For the purposes of providing our
services and enhancing users’ convenience, we may transfer and/or manage your personal information overseas
as follows.
You have the right to refuse the international transfer of personal information, and in such cases, your use
of services requiring the mandatory international transfer of personal information may be restricted. If you
do not wish for your information to be transferred outside of South Korea, you can request the suspension of
the processing of your personal information through the company's Data Protection Officer and the department
responsible for handling customer complaints.
Article 7 Retention of Personal Information
If we collect any personal information from you, we comply with our internal policy to use and retain such
personal information for the period during which you use our services.
We immediately destroy your personal information when it becomes unnecessary, such as when the retention
period has elapsed or when the purpose of processing personal information has been achieved.
In addition, we separately store and manage your personal information until the retention period specified
in the provisions of applicable law has elapsed. If we need to preserve personal information in accordance
with our internal policies, we will retain relevant personal information for a specified period.
Article 8 Procedures and Methods of Destroying Personal Information
Once the purposes of collection and use of your personal information are achieved, we destroy your personal
information in accordance with our internal policies and other applicable laws. However, personal
information collected with your consent or stored in the form of electronic files will be deleted using
technical means that make the records unreproducible, and personal information printed on paper, such as
filings or printed materials, will be shredded or incinerated.
Article 9 Your Legal Rights
Subject to applicable law, you may have the following rights relating to your personal information managed
by us. You may exercise your rights at any time by contacting us via the contact information provided in
Article 13.
-
The right not to provide your personal information to us (however, please note that we will be unable to
provide you with the full benefit of our Sites, Apps, or services if you do not provide us with your
personal information – e.g., we might not be able to process your requests without the necessary
details);
-
The right to request information regarding the nature, processing, and disclosure of your personal
information managed by us and request access to or copies of such personal information;
-
The right to request rectification of any inaccuracies in your personal information managed by us;
-
The right to request, on legitimate grounds:
-
Deletion of your personal information managed by us; or
-
Suspension of processing of your personal information managed by us;
-
The right to have certain personal information transferred to another entity in a structured, commonly
used, and machine-readable format to the extent applicable;
-
Where we process your personal information managed by us on the basis of your prior consent, the right
to withdraw that consent (noting that such withdrawal does not affect the lawfulness of any processing
performed prior to the date on which we receive notice of such withdrawal, and does not prevent the
processing of your personal information in reliance upon any other available legal bases, as
applicable); and
-
The right to submit complaints to an authority in charge of the protection of data regarding the
processing of your personal information managed by us.
Article 10 Technical/Administrative Measures for Protecting Personal Data
When handling personal information, we take appropriate measures to keep the information safe and prevent
from loss, theft, leakage, falsification, or damage, and we take technical measures as follows:
-
Your personal information is protected by password and encrypted information. However, your information
can be exposed to others in many ways, including when you use the public internet, so you need to be
responsible for protecting your own information. We are not responsible for any damages that arise from
your negligence or the fundamental nature and risks of the internet.
-
Your personal information is protected with a password and encrypted information by default, and
important data are protected with separate security functions by encrypting files and transmitted data.
-
We use vaccine programs to prevent possible damage by computer viruses, and vaccine programs are updated
periodically.
-
We prevent leakage and damage of personal information caused by hacking and viruses by monitoring the
system 24 hours a day using a system that detects and blocks external intrusion.
We fully acknowledge the importance of your personal information, and accordingly, we have a reasonably
limited number of employees handling personal information. The personnel in charge of protecting personal
information conducts periodical education for the employees, putting the utmost effort into protecting
personal information. Also, we periodically check the compliance status of commitments stated in the policy
and relevant employees, and when we detect any violation, we immediately correct and improve the issue and
take necessary measures.
Article 11 Installation and Operation of Automatic Collection Tools for Personal Information and Refusal
Thereof
We use cookies to store and discover information about members. Cookies are strings of small amounts of text
transmitted by the website server to users’ computer browsers (e.g., Internet Explorer, Safari, Chrome,
Firefox). Cookies identify each member’s computer but do not identify individual members.
We use Google Analytics(
Terms of Service
) and API provided by Google (
Privacy Policy
)for providing services and statistical analyses. For further details, please see our
Cookie Policy
(1) Operation of Cookies
① Provide differentiated information depending on each individual’s interests
② Identify the traces of browsing records of contents in which members were interested in providing
personalized services on the next visit
③ Analyze customers’ habits and use the results as criteria for service reorganization, etc.
(2) Cookie options
By adjusting the settings on their web browser, members may accept all cookies, receive notifications
whenever cookies are installed, or refuse all cookies. However, if you refuse cookies, you may not be able
to use certain functions of the service that require login.
You can set whether to permit cookies (on Internet Explorer) as follows:
① Go to [Tools] and [Internet Options].
② Click [Privacy].
③ Under the tab [Settings], choose the level you want from “Accept All Cookies – Low – Medium – Medium High
– High – Block All Cookies.”
(3) Cookies expire when you close or log off from the browser.
Article 12 Decision-Making Standards for Additional Use and Provision of Personal Information
In accordance with Article 15(3) and Article 17(4) of the Personal Information Act of South Korea, we may
additionally use or provide your personal information without your consent, in consideration of Article 14-2
of the Enforcement Decree of the Personal Information Protection Act of South Korea.
Article 12 Decision-Making Standards for Additional Use and Provision of Personal Information
|
Automatically generated information (internal identification key, device information, etc.),
service usage history (date and time of visit, IP address, records of improper use, etc.), device
information (unique device identifiers, OS version), country of access
|
Statistics and sales analysis regarding service use |
The period agreed upon when applying for the audition, in accordance with relevant laws
|
| Email address |
Audition operations management and major announcement delivery |
3 years after the completion of the audition |
| (Event winners) Email address, phone number |
Audition applicant event prize notification and winner confirmation |
1 year after the completion of the event |
-
Personal information to be provided:
Automatically generated information (internal identification key, device information, etc.), service
usage history (date and time of visit, IP address, records of improper use, etc.), device information
(unique device identifiers, OS version), country of access
-
Purpose of provision:
Statistics and sales analysis regarding service use
-
Period for retention and use:
The period agreed upon when applying for the audition, in accordance with relevant laws
-
Personal information to be provided:
Email address
-
Purpose of provision:
Audition operations management and major announcement delivery
-
Period for retention and use:
3 years after the completion of the audition
-
Personal information to be provided:
(Event winners) Email address, phone number
-
Purpose of provision:
Audition applicant event prize notification and winner confirmation
-
Period for retention and use:
1 year after the completion of the event
Accordingly, we have considered the below items for additional use and provision of information without the
user's consent.
1. Whether the purpose of additionally using and providing the personal information is relevant to the
initial purpose of collecting the information.
2. Whether there is predictability about additional use and provision of personal information based on the
circumstances of collecting information or its processing practices.
3. Whether the additional use and provision of personal information violates your rights.
4. Whether security measures have been taken, such as pseudonymization or encryption.
Article 13 Data Protection Officer
In order to protect users’ personal information and handle complaints related to personal information, we
have designated our Data Protection Officer as follows. Users may report all complaints related to personal
information protection arising in the course of using our services to the Data Protection Officer, and we
will provide prompt and sufficient responses to such reports.
-
Data Protection Officer: Sung-Koo Ryeo
-
Department responsible for processing complaints: Planning Part
-
Department responsible for information inspection request: Planning Part
-
Email address: audition_cs@hybeaudition.com
Article 14 Handling of Comments and Complaints
We operate a customer services center for smooth communication and resolution of any comments and/or
complaints presented by our users in connection with personal information protection. If you are a user in
Korea, in the event of a dispute arising between you and us in connection with personal information
protection for which you require help regarding potential infringement upon your information, you can
contact the Personal Information Infringement Report Center of the Korea Internet & Security Agency, the
Cyber Bureau of the National Police Agency, or other relevant agencies.
-
Korea Internet & Security Agency
-
https://privacy.kisa.or.kr
-
118
-
Personal Information Dispute Mediation Committee
-
https://www.kopico.go.kr
-
1833-6972
-
Cybercrime Investigation Division of Supreme Prosecutors’ Office
- https://www.spo.go.kr
-
1303
-
Cyber Bureau of National Police Agency
Article 15 Changes in Privacy Notice
This Privacy Policy will take effect from March 31, 2026 (KST). Please refer to the link below to see the
previous version of the Privacy Policy.
Privacy Policy version number: V1.2
Effective date: March 31, 2026 (KST)
Previous Privacy Policy
Jurisdiction-Specific Terms
The following are supplementary clauses applicable depending on your location or nationality. In the event
of a conflict between the following and the main text of this Privacy Notice, the following shall prevail.
EEA and UK
For the purposes of this section, the term “personal information” used in the main text of this Notice shall
be replaced with the term “personal data” – the term shall have the same meaning as set out in Article 1
Clause Article 1 of this Notice shall be supplemented with the following text as a new final paragraph:
Article 1 Privacy Notice
For the purposes of the GDPR and the UK Data Protection Act 2018, HYBE Co., Ltd. is the entity (or
“controller”) that decides how and why your personal data are processed and has primary responsibility for
complying with applicable data protection laws.
Clause Article 2 of this Notice shall be replaced with the following:
Article 2 Purposes and Legal Bases for Processing of Personal Data
The purposes of processing of your personal data and the legal bases on which we rely under applicable laws
are as follows:
Article 2 Purposes and Legal Bases for Processing of Personal Data
|
To provide our Sites, Apps, products and services:
Providing our Sites, Apps, products or services; creating an account; providing customer support
on the use of services; identifying and preventing wrongful uses; providing audition application
functions; performing statistical analyses; providing promotional materials (upon request);
communicating with you in relation to our Sites, Apps or services; conducting service satisfaction
surveys; and providing and operating event services (confirming participants for events, providing
and delivering prizes to winners, handling other complaints).
|
-
The processing is necessary in connection with any contract that you have entered into with
us, or to take steps prior to entering into a contract with us; or
-
We have a legitimate interest in carrying out the processing for the purpose of providing
you with our Sites, Apps, or services (to the extent that such legitimate interest is not
overridden by your interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (the aforementioned legal basis is
only used in relation to processing that is entirely voluntary – it is not used for
processing that is necessary or obligatory in any way).
|
|
To operate our business:
Operating and managing our Sites, Apps, and services; providing you with content; displaying
advertising and other information to you; authenticating users for the sales/delivery of products
and the identification and prevention of duplicate purchases/uses or other wrongful uses;
communicating and interacting with you via our Sites, Apps or services; and notifying you of
changes to any of our Sites, Apps or services.
|
-
The processing is necessary in connection with any contract that you have entered into with
us, or to take steps prior to entering into a contract with us; or
-
We have a legitimate interest in carrying out the processing for the purpose of providing
you with our Sites, Apps, or services (to the extent that such legitimate interest is not
overridden by your interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (the aforementioned legal basis is
only used in relation to processing that is entirely voluntary – it is not used for
processing that is necessary or obligatory in any way).
|
|
To manage IT systems:
Managing and operating our communications, IT, and security systems; and auditing (including
security audits) and monitoring such systems.
|
-
The processing is necessary for our compliance with a legal obligation; or
-
We have a legitimate interest in carrying out the processing for the purpose of managing and
maintaining our communications and IT systems (to the extent that such legitimate interest
is not overridden by your interests, fundamental rights, or freedoms).
|
|
To improve our Sites, Apps, and services:
Identifying issues related to our Sites, Apps, or services; planning improvements to our Sites,
Apps, or services; and developing new Sites, Apps, or services.
|
-
We have a legitimate interest in carrying out the processing for the purpose of improving
our Sites, Apps, or services (to the extent that such legitimate interest is not overridden
by your interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (this legal basis is only used in
relation to processing that is entirely voluntary – it is not used for processing that is
necessary or obligatory in any way).
|
-
To provide our Sites, Apps, products and services:
Providing our Sites, Apps, products or services; creating an account; providing customer support on the
use of services; identifying and preventing wrongful uses; providing audition application functions;
performing statistical analyses; providing promotional materials (upon request); communicating with you in
relation to our Sites, Apps or services; conducting service satisfaction surveys; and providing and
operating event services (confirming participants for events, providing and delivering prizes to winners,
handling other complaints).
-
Legal basis for processing:
-
The processing is necessary in connection with any contract that you have entered into with us,
or to take steps prior to entering into a contract with us; or
-
We have a legitimate interest in carrying out the processing for the purpose of providing you
with our Sites, Apps, or services (to the extent that such legitimate interest is not overridden
by your interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (the aforementioned legal basis is only
used in relation to processing that is entirely voluntary – it is not used for processing that
is necessary or obligatory in any way).
-
To operate our business:
Operating and managing our Sites, Apps, and services; providing you with content; displaying advertising
and other information to you; authenticating users for the sales/delivery of products and the
identification and prevention of duplicate purchases/uses or other wrongful uses; communicating and
interacting with you via our Sites, Apps or services; and notifying you of changes to any of our Sites,
Apps or services.
-
Legal basis for processing:
-
The processing is necessary in connection with any contract that you have entered into with us,
or to take steps prior to entering into a contract with us; or
-
We have a legitimate interest in carrying out the processing for the purpose of providing you
with our Sites, Apps, or services (to the extent that such legitimate interest is not overridden
by your interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (the aforementioned legal basis is only
used in relation to processing that is entirely voluntary – it is not used for processing that
is necessary or obligatory in any way).
-
To manage IT systems:
Managing and operating our communications, IT, and security systems; and auditing (including security
audits) and monitoring such systems.
-
Legal basis for processing:
-
The processing is necessary for our compliance with a legal obligation; or
-
We have a legitimate interest in carrying out the processing for the purpose of managing and
maintaining our communications and IT systems (to the extent that such legitimate interest is
not overridden by your interests, fundamental rights, or freedoms).
-
To improve our Sites, Apps, and services:
Identifying issues related to our Sites, Apps, or services; planning improvements to our Sites, Apps, or
services; and developing new Sites, Apps, or services.
-
Legal basis for processing:
-
We have a legitimate interest in carrying out the processing for the purpose of improving our
Sites, Apps, or services (to the extent that such legitimate interest is not overridden by your
interests, fundamental rights, or freedoms); or
-
We have obtained your prior consent to the processing (this legal basis is only used in relation
to processing that is entirely voluntary – it is not used for processing that is necessary or
obligatory in any way).
The final paragraph of Clause Article 4 of this Notice shall be replaced with the following:
Article 4 Disclosure of Personal Data to Third Parties
We disclose personal data to other entities for legitimate business purposes and the operation of our Sites,
Apps, or services to you, in accordance with applicable law. In addition, we disclose personal data to:
-
you and, where appropriate, your appointed representatives;
-
legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected
breach of applicable law or regulation;
-
accountants, auditors, consultants, lawyers, and other outside professional advisors to HYBE, subject to
binding contractual obligations of confidentiality;
-
third-party processors, located anywhere in the world, subject to the requirements noted below in this
Section Article 4;
-
any relevant party, regulatory body, governmental authority, law enforcement agency, or court, to the
extent necessary for the establishment, exercise, or defense of legal claims;
-
any relevant party, regulatory body, governmental authority, law enforcement agency, or court, for the
purposes of prevention, investigation, detection, or prosecution of criminal offenses or the execution
of criminal penalties;
-
any relevant third-party acquirer(s) or successor(s) in the title, in the event that we sell or transfer
all or any relevant portion of our business or assets (including in the event of a reorganization,
dissolution, or liquidation); and
-
any relevant third-party provider, where our Sites and our Apps use third-party advertising, plugins, or
content. If you choose to interact with any such advertising, plugins, or content, your personal data
may be shared with the relevant third-party provider. We recommend that you review that third party’s
privacy policy before interacting with its advertising, plugins, or content.
If we engage a third-party processor to process your personal data, the processor will be subject to binding
contractual obligations to:
(i) only process the personal data in accordance with our prior written instructions; and
(ii) use measures to protect the confidentiality and security of the personal data; together with any
additional requirements under applicable law.
For more information on the third-party processors engaged by the company, please see Article 5 and
Provision of Personal Information to Third Parties
Clause Article 6 of this Notice shall be replaced with the following:
Article 6 International Transfer of Personal Data
Because of the international nature of our business, we transfer personal data within the HYBE group and to
third parties, as discussed further in Article 6, in connection with the purposes set out in this Notice.
For this reason, we transfer personal data to other countries that may have different laws and data
protection compliance requirements to those that apply in the country in which you are located, including
Korea, Japan, and the United States.
If an exemption or derogation applies (e.g., where a transfer is necessary to establish, exercise, or defend
a legal claim), we may rely on that exemption or derogation, as appropriate. Where no exemption or
derogation applies, and we transfer your personal data from the EEA or UK to recipients located outside the
EEA or UK who are not in jurisdictions formally designated by the European Commission or UK Government as
providing an adequate level of protection for personal data, we do so on the basis of template transfer
clauses adopted by the European Commission or adopted by a Data Protection Authority and approved by the
European Commission, or adopted by the UK Government (as appropriate). You are entitled to request a copy of
these clauses using the contact details provided in Section Article 13 below.
Please note that when you transfer any personal data directly to any HYBE entity established outside the EEA
or UK, we are not responsible for that transfer of your personal data. We will nevertheless process your
personal data from the point at which we receive those data in accordance with the provisions of this
Notice.
Clause Article 8 of this Notice shall be replaced with the following:
Article 8 Procedures and Methods of Destroying Personal Data
We destroy your personal information in accordance with our internal policies and other applicable laws.
The following shall be added at the bottom of Clause Article 9:
Article 9 Your Legal Rights
In addition to the above rights, you remain entitled to all other statutory rights.
You may also have the following additional rights regarding the processing of your personal information:
-
the right to object, on grounds relating to your particular situation, to the processing of your
personal information by us or on our behalf, where such processing is based on Articles 6(1)(e) (public
interest) or 6(1)(f) (legitimate interests) of the GDPR; and
-
the right to object to the processing of your relevant personal data by us or on our behalf for direct
marketing purposes.
Clause Article 11 of this Notice shall be replaced with the following:
Article 11 Cookies and Similar Technologies
When you visit a Site or use an App, we will typically place cookies onto your device or read cookies
already on your device, subject always to obtaining your prior consent, where required, in accordance with
applicable law. For further details, please see our
Cookie Policy
Clause Article 13 of this Notice shall be replaced with the following:
Article 13 Contact Information
You may contact our DPO
[audition_cs@hybeaudition.com]
if you wish to exercise your rights in connection with this Notice or your personal data. You may also
contact a
Representative.
Clause Article 14 of this Notice shall not apply.
California Consumer Privacy Act (CCPA)
Clause Article 7 of this Notice shall be replaced with the following:
Article 7 Retention of Personal Information
We take every reasonable step to ensure that your personal information is only processed for the minimum
period necessary for the purposes set out in this Notice. We will retain your personal information in a form
that permits identification only for as long as:
(1) we maintain an ongoing relationship with you; or
(2) your personal information is necessary in connection with the lawful purposes set out in this Notice,
for which we have a valid legal basis.
Clause Article 9 of this Notice shall be replaced with the following:
Article 9 California Consumer Privacy Act Disclosures
Under the California Consumer Privacy Act (“CCPA”), we must disclose our practices regarding the collection,
use, and disclosure of the personal information of California residents (“Consumers”).
Use of Personal information
We have collected and will collect the following general categories of personal information about Consumers:
-
Personal identifiers, including names, postal addresses, IP addresses, and email addresses;
-
Protected classifications, including age;
-
Internet or other electronic network activity information; and
-
Inferences for use in creating a consumer profile.
We may collect the personal information of users under the age of 13 with the consent of their legal
representative, in accordance with relevant laws. For the personal information processing policy for
children, please refer to the
Children’s Online Privacy Notice
Use of Personal information
We may use the categories of personal information described above for the following business or commercial
purposes:
-
Advance our commercial or economic business interests;
-
Maintain or service customer accounts;
-
Provide customer service;
-
Process or fulfill orders and transactions;
-
Provide advertising or marketing services;
-
Provide analytic services;
-
Perform internal research for technological development;
-
Ensure the quality and safety of services or devices;
-
Improve the quality and safety of services or devices;
-
Debugging to address impairments to operational functionality;
-
Detect security incidents;
-
Comply with applicable law and law enforcement requirements;
-
Protect against malicious, deceptive, fraudulent, or illegal activity;
-
Prosecute those responsible for malicious, deceptive, fraudulent, or illegal activity; and
-
Defend against or bring legal action, claims, and other liabilities.
Categories of Sources of Personal Information
We collect or obtain the personal information of Consumers from the following sources:
-
Information provided to us by Consumers;
-
Information we obtain on our own;
-
Information provided to us through collaboration with Consumers;
-
Information provided to us in the course of our relationship with Consumers;
-
Information made public by Consumers;
-
App data;
-
Site data;
-
Information registered by Consumers;
-
Information obtained from content and advertising providers; or
-
Information provided to us by third parties.
Disclosure of Personal information
We do not sell any personal information to third parties. In particular, we do not sell the personal
information of minors under 16 years of age. In the preceding 12 months, we have disclosed the following
categories of personal information to the following categories of recipients:
Disclosure of Personal information
|
Vendors who may need access to Consumers’ personal information to help us provide our services.
|
-
Personal identifiers
-
Categories of personal information enumerated in Cal. Civ. Code § 1798.80 (e)
-
Protected classification (if provided)
-
Internet or other electronic network activity information
-
Inferences for use in creating a consumer profile
|
|
Entities who provide us with email address management and communication contact services, and
those who analyze and enhance our marketing campaigns and service.
|
-
Personal identifiers
-
Categories of personal information enumerated in Cal. Civ. Code § 1789.80 (e)
-
Protected classification (if provided)
-
Internet or other electronic network activity information
-
Inferences for use in creating a consumer profile
|
-
Categories of recipients:
Vendors who may need access to Consumers’ personal information to help us provide our services.
-
Categories of personal information:
-
Personal identifiers
-
Categories of personal information enumerated in Cal. Civ. Code § 1798.80 (e)
-
Protected classification (if provided)
-
Internet or other electronic network activity information
-
Inferences for use in creating a consumer profile
-
Categories of recipients:
Entities who provide us with email address management and communication contact services, and those who
analyze and enhance our marketing campaigns and service.
-
Categories of personal information:
-
Personal identifiers
-
Categories of personal information enumerated in Cal. Civ. Code § 1789.80 (e)
-
Protected classification (if provided)
-
Internet or other electronic network activity information
-
Inferences for use in creating a consumer profile
Clause Article 11 of this Notice shall be replaced with the following:
Article 11 California’s “Shine the Light” Law
Under California’s “Shine the Light” law, California residents are entitled to ask us for a notice
describing what categories of personal customer information we share with third parties or our affiliates in
connection with direct marketing performed by such third parties or our affiliates. The aforementioned
notice will identify the categories of information we shared with third parties and our affiliates and will
include a list of names and addresses of such data recipients. If you are a California resident and would
like a copy of this Notice, please submit a written request to the following email address:
-
audition_cs@hybeaudition.com
Clause Article 13 of this Notice shall be replaced with the following:
Article 13 Consumer Rights under the CCPA
If you are a Consumer, the CCPA grants you the following rights regarding your personal information. If you
make a certain request to us in order to exercise or cause an authorized representative you appointed to
exercise on your behalf, your rights to know and delete set forth in the CCPA, we will generally require you
to provide us with certain personal information for the purpose of identifying you in the course of handling
your request and compare such personal information against the personal information we have collected about
you to verify your identity (“verifiable consumer request”).
Verifiable consumer requests to know or delete information may be submitted to the following email address:
-
audition_cs@hybeaudition.com
Right to Know About Personal Information We Collected about You.
Consumers have the right to submit a verifiable consumer request that we disclose the following personal
information we collected about you over the 12-month period preceding the verifiable consumer request, in a
readily useable format:
-
The categories of personal information we collected about you.
-
The purposes for which the categories of personal information collected about you will be used.
-
The categories of sources for the personal information we collected about you.
-
The categories of third parties with whom we share your personal information.
-
Our business or commercial purpose for collecting your personal information.
-
The specific pieces of personal information we collected about you.
-
The categories of personal information we have disclosed for a business purpose.
Right to Request Deletion of Personal Information.
Consumers have the right to request that we delete any personal information we have collected from them.
Right to Non-Discrimination.
Consumers have the right to be free from discrimination when they exercise their rights under the CCPA and,
should you exercise those rights, we cannot:
1. Deny you goods or services;
2. Charge you a different price or rate for goods or services;
3. Provide you with a different level of quality of goods or services;
4. Suggest that you may receive a different level of quality of goods or services.
Notice of Financial Incentive
We provide the right to participate in our services and events to consumers who provide personal
identifiers, including their name, home address, and email address, and commercial information, including
their purchase history. As participants in these programs, consumers will have the opportunity to win
prizes. Consumers may opt-in to our community events by signing up on our website. Consumers may cancel
their participation in these events at any time.
Authorized Agent
Under the CCPA, you may appoint an authorized agent to submit requests to exercise your rights on your
behalf. Should you choose to do so, for your and our protection, we will require your authorized agent to
provide us with a signed permission demonstrating they are authorized to submit a request on your behalf. We
note, should your authorized agent fail to submit proof that they have been authorized to act on your
behalf, we will deny their request.
Clause Article 14 of this Notice shall not apply.
Japan
According to the purpose of the Article, the “relevant laws" and “relevant Korean laws" stated in this
Notice shall be replaced with the Act on the Protection of Personal Information (Act No. 57 of 2003) and
relevant Japanese laws.
The terms used in Clause Article 2 of this Notice shall be replaced with the following:
The explanation in the main text shall be replaced with “The purpose for which we use your personal
information in each case in accordance with relevant laws is as follows.”
Clause Article 4 (Provision of Personal Information to Third Parties), Article 5 (Entrustment of Personal
Information), and Article 6 (International Transfer of Personal Information) of this Notice shall be
replaced with the following:
We do not provide third parties with your personal information unless you consent thereto or the disclosure
is otherwise expressly prescribed in applicable law.
Joint Use
The companies listed below and included in the above details about third parties provided with personal
information are part of the company’s group. The types of jointly used personal information; the bounds of
jointly using parties; the purpose of using; and the names of the companies and their representatives with
responsibilities of managing personal information are listed below.
Companies included in the group (jointly using parties):HYBE Co., Ltd., BIGHIT MUSIC Co., Ltd., PLEDIS
ENTERTAINMENT Co., Ltd., BELIFT LAB Co., Ltd., KOZ ENTERTAINMENT Co., Ltd., SOURCE MUSIC Co., Ltd., ADOR
Co., Ltd., PLEDIS MUSIC SERVICE Co., Ltd., YX Labels Co., Ltd., JCONIC Co., Ltd., HYBE AMERICA Co., Ltd.,
HYBE INDIA Co., Ltd.
-
https://hybecorp.com/jpn/related/site
-
Types of information for joint use: Same as listed in “Details About Providing Personal Information To
Third Parties" and “Types of personal information”.
-
Purpose of use: Same as listed in “Details About Providing Personal Information To Third Parties" and
“Types of personal information”.
-
Management responsibilities: The names of the company’s representatives are the same as listed on each
company’s website.
References:
Personal Information Protection Systems of Countries Receiving Information
Provision by Entrustment
The company has entrusted specialized companies and platforms with the tasks of processing personal
information within reasonable scopes, in order to achieve the purposes of providing service, fulfilling
contracts, and improving the convenience of customers.
When signing a contract with entrusted companies, important issues are addressed including prohibition of
processing personal information for purposes other than entrusted purposes; technical and managerial
measures to protect information; prohibition of re-entrustment; management and supervision of entrusted
companies; and indemnification for possible damages. The company supervises the entrusted companies to
ensure they handle the information safely.
If there are any changes in the entrusted tasks or list of entrusted companies, we will make sure to notify
you by sharing the revised Privacy Policy.
References :
Personal Information Protection Systems of Countries Receiving Information
Clause Article 12 of this Notice is not applied.
The following shall be added to Clause Article 13.
-
COMPANY: HYBE Co., Ltd.
-
ADDRESS: 42 Hangang-daero, Yongsan-gu, Seoul, Republic of Korea (Hangangro 3-ga, Yongsan Trade Center)
-
PRESIDENT: Lee Jaesang
Clause Article 14 of this Notice is not applied.
India
For the purposes of this section, all references “personal data” in this Notice shall have the meaning
ascribed to it under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Until the provisions of
the DPDP Act are fully brought into force, references to personal data shall be deemed to include “personal
information” and “sensitive personal data or information” as defined under the Information Technology
(Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI
Rules”).
Upon full enforcement of the DPDP Act and repeal of the SPDI Rules, personal data shall be interpreted only
in accordance with the DPDP Act. “Process”, “Processing” or “Processed” shall have the meaning ascribed to
it under the DPDP Act and includes wholly or partly automated operations performed on personal data,
including collection, recording, organisation, structuring, storage, use, disclosure, sharing, alignment,
restriction, erasure, or destruction.
Clause Article 1 of this Notice shall be supplemented with the following text as a new final paragraph:
Article 1 Privacy Notice
For the purposes of the DPDP Act, HYBE is the entity that determines the purpose and means of processing
your personal data, and shall be construed as the "Data Fiduciary" under the DPDP Act. Third parties engaged
by HYBE shall act as Data Processors under contractual safeguards as required under applicable law.
Clause Article 6 of this Notice shall be supplemented with the following:
Article 6 International Transfer of Personal Data
Because of the international nature of our business, we transfer personal data within the HYBE group and to
third parties, as discussed further in this Article, for the purposes set out in this Notice. Accordingly,
your personal data may be transferred to countries that have different data protection requirements from
those of your country of residence, including India, Korea, Japan, and the United States.
Where we transfer personal data internationally, we do so under contractual and organizational safeguards
designed to ensure a level of protection comparable to that required under applicable law. You may refuse
specific international transfers; however, services that necessarily require such transfers may be
unavailable.
If you choose to transmit personal data directly to any HYBE entity established outside your country (for
example, by emailing an overseas HYBE affiliate), we are not responsible for that direct transfer. From the
point at which we receive your personal data, we will process it in accordance with this Notice.
Clause Article 9 of this Notice shall be supplemented with the following:
Article 9 Your Legal Rights
In addition to the above rights, you remain entitled to all other statutory rights. You may also have the
following additional rights regarding the processing of your personal information:
-
Right to grievance redressal: You have the right to readily available mechanisms to register a grievance
with us regarding the processing of your personal data. We will acknowledge and respond via the contact
details in Article 13 within applicable timelines.
-
You have the right to request access to your personal data processed by us and to seek correction of any
inaccurate personal data held by us. You may also request erasure of your personal data that is no
longer necessary for the purpose for which it was collected or processed, unless retention is required
under applicable law.
-
Right to nominate: You have the right to nominate another person to exercise your rights in case of your
death or incapacity.
You may exercise these rights by contacting the Grievance Officer at the contact details provided in Article
13 below with your registered email address to ensure efficient processing. Requests shall be addressed in
accordance with statutory timelines. You are also entitled to lodge a complaint with a competent Data
Protection Board of India (or any such authority formed and subsisting under applicable law), concerning the
compliance with the applicable data protection laws and regulation. We will provide the submission
steps/channels on request.
You may refuse to provide personal data or withdraw consent at any time. However, if you refuse consent to
the collection of required items, you will not be able to apply for the audition. Refusal of optional items
or third‑party sharing will not affect basic service use, but certain audition‑related benefits may not be
available.
Clause Article 13 shall be replaced with the following:
Article 13 Grievance Officer
For any concerns, complaints, or requests related to personal data, data subjects may contact:
-
Grievance Officer: Sung-Koo Ryeo
-
Email address: audition_cs@hybeaudition.com
-
Address: 42, Hangang-daero, Yongsan-gu, Seoul, Republic of Korea
Clause Article 14 of this Notice shall not apply to users in India.
The following clause is added to this Notice
Article 16Language of Notice
In accordance with Sections 5(3) and 6(3) of the DPDP Act, this Notice and any consent request shall be made
available to you in English or any language specified in the Eighth Schedule to the Constitution of India.
Please note that the language-related obligations under Sections 5(3) and 6(3) of the DPDP Act are scheduled
to be enforced 18 months from the date of notification (November 13, 2025) of the DPDP Act and rules.
Pending such enforcement, this Notice is provided in English. Upon enforcement, we shall make this Notice
available in additional languages as required under applicable law. If you require this Notice in a language
other than English, please contact us at audition_cs@hybeaudition.com.
Article 17 Minor's Privacy
HYBE is committed to protecting the privacy and safety of individuals below the age of 18 years ("Minor").
In accordance with the DPDP Act, before processing any personal data of a Minor, HYBE shall obtain
verifiable consent from the Minor's parent or lawful guardian. HYBE ensures that the collection, use, and
disclosure of Minor's personal data is limited to what is necessary for the intended purposes and is done in
a secure manner. In no event does HYBE engage in behavioral tracking or targeted advertising directed at
Minors. HYBE shall implement reasonable age‑verification mechanisms and shall not process a Minor's personal
data without first obtaining verifiable parental or guardian consent as required under the DPDP Act.
Article 18 Data of Persons with Disability
HYBE may collect and process personal data of persons with disability for the purposes specified in this
Notice. The guardian of such person with disability, where such guardian has been lawfully appointed, shall
provide the consent on behalf of the person with disability to process their personal data. HYBE shall take
reasonable endeavors to ensure that adequate measures are implemented for the processing of the personal
data of the person with disability in compliance with the applicable data protection laws.
Article 19 Retention of Personal Data
Personal data shall be retained only for as long as necessary to fulfil the stated purpose for which it was
collected or as required by applicable law. For security, breach investigation, and legal compliance
purposes, certain data and logs may be retained for a minimum of one year or as required by applicable law.
At the expiry of such periods, your personal data will be deleted or archived to comply with legal retention
obligations or maintained in accordance with applicable statutory limitation periods. Where you request
deletion of your personal data, HYBE shall delete such personal data within a reasonable timeframe after
providing at least 48 hours' notice, subject to retention being required for compliance with applicable law
or the fulfilment of any legal obligation.
In the event you withdraw your consent under this Notice, HYBE will cease to process your personal data,
unless continued retention is required for compliance with applicable law.