8B Creators Privacy Notice

[8BillionPark's exact Philippine entity name] (the “Company”) takes the personal data and privacy of 8B Creators users seriously.

The Company complies with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its implementing rules and regulations, and the related regulations and guidelines of the National Privacy Commission (NPC), and, where mandatory laws such as Korea's Personal Information Protection Act apply to users in the Republic of Korea, the Company also takes those into account when processing personal data.

This Privacy Notice explains what personal data the Company collects through 8B Creators, why it is used, with whom it may be shared, how long it is retained, and what rights users have over their personal data.

The entity processing personal data is as follows.

• Service name: 8B Creators
• Personal Information Controller: [Exact Philippine entity name]
• Business/corporate registration number: [To be confirmed]
• Address: [Exact registered address in Makati City]
• Main contact: [To be confirmed]
• Privacy inquiry email: [e.g. privacy@8billionpark.com]
• Data Protection Officer / privacy contact: [To be confirmed]

The Company bears responsibility under the Philippine DPA for the personal data it controls and, where necessary, designates a person responsible for privacy compliance, as the Philippine DPA requires personal information controllers to designate an individual accountable for compliance.

This Privacy Notice applies to the following 8B Creators services.

• Sign-up and login
• Social login via Google/Kakao, etc.
• Creator profiles
• Creator application and management
• Projects and auditions
• Project applications
• Content submission and management
• SNS account registration
• Creator Academy
• Contracts and electronic signatures
• Earnings and rewards
• Settlement
• Customer support and FAQ
• Notifications
• Service usage records
• Other related services provided by 8B Creators

Where a specific Project, campaign, or contract requires additional personal data processing, the Company may provide a separate privacy notice or obtain consent within the necessary scope.

The Company may collect the following personal data to the extent necessary to provide the Service.

1. Account and member information — name or activity name, email address, profile photo, user ID, account identifiers, preferred language, sign-up date, account status, login provider information. Where signing up with a password, necessary authentication information is processed by the authentication system. As a matter of policy, the Company does not view or store users' plaintext passwords separately.
2. Social login information — where using an external authentication service such as Google or Kakao, the Company may receive, within the scope the user has authorized, the external service's user identifier, email, name or nickname, profile image, and login provider. The Company does not obtain information that the external service does not provide or that the user has not authorized.
3. Creator profile — activity name, profile photo, bio, content category, areas of interest, activity region, language used, portfolio, career and activity information, creator tier or in-service activity status, Project participation history. Additional information may be requested with separate notice and a lawful basis where required by the nature of a Project.
4. SNS and content channel information — where a Member directly connects or provides them: YouTube channel, Facebook account or page, Instagram account, TikTok account, other SNS accounts, username/handle, public profile URL, follower or subscriber count, public content, and performance data such as views and engagement. Where additional data is retrieved via an external platform's API, it is processed within that platform's policy and the scope disclosed to the user.
5. Project and audition information — Projects applied to, application date/time, application status, audition information, selection status, Project progress status, submission history, Project evaluation or operational records, Project-related communications.
6. Content information — video, photos, audio, text, thumbnails, content files, content links, content descriptions, and submission/revision history that a Member submits through the Service or provides in the course of performing a Project. Content may include a user's face, voice, or other identifiable information.
7. Contract and electronic signature information — where using contract or electronic signature features: information about the contracting parties, contract documents, contract version, date/time of consent or signature, e-signature information, contract status, contract history, and technical records necessary for legal evidence. Additional information may be separately disclosed where a specific electronic contract requires it.
8. Earnings, rewards, and settlement information — earnings and reward history, payment amounts, settlement status, payment history, information necessary for the payment method, and information necessary for tax or legal reporting. Where higher-sensitivity settlement information such as bank account, e-wallet, or tax identification information is actually collected, the necessary items and processing purpose will be separately and clearly disclosed at that time.
9. Customer support information — inquiry content, email, inquiry and response records, report content, dispute and customer support records.
10. Service usage and security information — access date/time, service usage records, error logs, IP address, browser or device information, security and authentication records, cookies or similar technology information. The Company does not additionally collect items it does not actually collect merely because they are listed here, and processes such information within the minimum necessary scope.

The Company may process personal data for the following purposes.

1. Sign-up and account management — member identification, login and authentication, account creation and maintenance, account security, fraud-sign-up prevention.
2. Providing creator services — creator profile creation, Project recommendation and discovery, Project application, auditions, content submission, Project operation, creator activity management.
3. Project matching — the Company may use a Member's profile, content category, activity region, language, SNS information, and Project history to recommend suitable Projects or opportunities.
4. Contract and Project performance — Project contracts, content production, delivery and review, contract performance verification, dispute handling, and retention of electronic contracts and contract records.
5. Earnings and settlement — calculating Project compensation, calculating sales or performance fees, reward payment, withdrawal processing, accounting and tax processing, fraud prevention.
6. Service operation and improvement — providing service functions, error analysis, service quality improvement, usability analysis, new feature development, maintaining security.
7. Fraud and security response — preventing account takeover, detecting fraudulent conduct such as false views/sales/clicks, responding to security incidents, investigating violations of the Terms, protecting the Service and users.
8. Customer support — the Company may process personal data to respond to inquiries, complaints, reports, disputes, and service requests.
9. Legal obligations — the Company may process personal data necessary to respond to requests from applicable law, government agencies, courts, or lawfully authorized bodies, and to fulfill the Company's legal rights and obligations.
10. Marketing — where a user has separately opted in, the Company may use personal data for purposes such as notifying new Projects, events and promotions, creator programs, brand campaigns, and other service-related marketing messages.

Marketing consent is optional, and as a matter of policy, declining it does not disadvantage a user's use of the core Service.

The Company applies an appropriate legal basis depending on the personal data processing activity.

The Philippine DPA permits personal data processing not only on the basis of consent but also under certain conditions such as the conclusion or performance of a contract, compliance with a legal obligation, protection of vital interests, and legitimate interests. It is therefore important that not all personal data processing relies solely on “consent.”

• User consent
• Processing necessary for the conclusion or performance of a contract with the user
• Processing necessary to comply with a legal obligation
• Processing necessary for the legitimate interests of the Company or a third party
• Processing necessary to protect the vital interests of the user or another person
• Other processing permitted under applicable law

Where sensitive personal data is processed, the separate requirements under applicable law, including Section 13 of the Philippine DPA, apply.

Selling personal data is not part of the Company's business model.

The Company may disclose or share personal data as follows where necessary to provide the Service.

1. Project partners — the Company may provide information to brands, advertisers, sellers, production companies, campaign operators, and other Project partners to the extent necessary for Project participation or contract performance. For example, during Project selection, a creator's activity name, profile, portfolio, SNS information, and related activity information may be provided to a Project partner. The Company does not indiscriminately provide personal data that is unnecessary for performing the Project.

2. Service providers — the Company may use cloud, database, authentication, email, analytics, content storage, payment, and other technical service providers to operate the Service. In such cases, those providers may act as Personal Information Processors handling personal data under the Company's instructions. Under the Philippine DPA, a personal information controller remains responsible for ensuring appropriate safeguards even when outsourcing processing.

3. Legal requests — the Company may disclose personal data where required or permitted by applicable law, a court order, a government agency, or a lawfully authorized body.

8B Creators may use the following external services in the course of operating the Service.

• Supabase — authentication, database, and related backend functions
• Google — Google login, etc.
• Kakao — Kakao login, etc.

If actual API integration or personal data transfer with YouTube, Facebook, Instagram, TikTok, or similar services begins, the Company will confirm the purpose and scope of that processing and update this Notice accordingly. Important: before actual deployment, the development team must reconfirm what personal data is transmitted to each service and where it is actually processed/stored. Countries that have not been confirmed must not be arbitrarily listed in this Notice.

Where servers of the cloud, authentication, database, or other service providers the Company uses are located outside the Philippines or the user's country of residence, personal data may be processed or transferred abroad.

Where overseas processing or transfer occurs, the Company complies with applicable personal data protection laws and endeavors to apply an appropriate level of protection to personal data through contractual or other reasonable safeguards.

The Philippine DPA applies an accountability principle to personal information controllers even after personal data has been transferred to third parties domestically or abroad, and requires reasonable contractual or other safeguards.

Where personal data of a user residing in the Republic of Korea is transferred abroad, the Company will determine whether separate notice, consent, or another lawful basis is required under Korea's Personal Information Protection Act and apply the necessary procedures.

To confirm before public release: the actual countries of overseas transfer, recipients, transferred items, purposes, methods, timing, and retention period must be finalized based on the development environment and vendor contracts.

As a matter of policy, the Company retains personal data only for as long as necessary to achieve the purpose of collection. However, it may be retained for the necessary period in the following cases.

• For the duration of the member account
• For the duration of an ongoing Project or contract performance
• For the period needed to process unpaid settlements
• For any period required by law for retention
• For any period required for tax and accounting purposes
• For the period necessary to resolve disputes or legal claims
• For the period reasonably necessary to investigate fraud or misconduct

Once the retention purpose has ended and there is no separate legal basis for retention, personal data is securely deleted or anonymized. The NPC also requires that retention periods be disclosed in a Privacy Notice. It is recommended that an actual, data-specific retention schedule be finalized internally before public launch.

A user may request account withdrawal using the method provided by the Service or by requesting it from the Company.

After withdrawal, personal data is, as a rule, deleted or anonymized. However, the following information may not be deleted immediately.

• Information that must be retained by law
• Records related to an ongoing contract
• Information related to unpaid settlements
• Information related to disputes or legal claims
• Records necessary for electronic contracts and legal evidence
• Information reasonably necessary to prevent fraud

Once the need for retention has ended, the related information is securely deleted or anonymized.

The Company applies technical, managerial, and organizational safeguards appropriate to the level of risk to prevent the loss, misuse, unauthorized access, alteration, disclosure, or destruction of personal data. For example, the following measures may be applied.

• Access-rights management
• Separation of authentication and authorization
• Database access control
• Access controls such as Row Level Security
• Restricted administrator privileges
• Encrypted communications
• Security logging and monitoring
• Backup and recovery
• Vulnerability management
• Minimizing access to personal data
• Internal security procedures

No information system can eliminate all risk, however, and the Company continuously improves its security measures to maintain a reasonable and appropriate level of protection.

If a personal data breach, unauthorized access, or other privacy incident occurs, the Company assesses the nature and risk of the incident and takes the necessary protective and responsive measures.

Where applicable law requires notification to the National Privacy Commission or to users, the Company will take the necessary action in accordance with the procedures and standards set out in that law.

The NPC has consistently advised that unauthorized access, use, disclosure, or sharing of personal data may give rise to liability under the DPA.

Under the Philippine DPA, users may have the following rights, to the extent applicable.

• The right to be informed whether personal data is being processed
• The right to be provided with information about the processing of personal data
• The right to access one's own personal data
• The right to correct inaccurate or incomplete information
• The right to object to processing in certain cases
• The right to request erasure or blocking of processing where legal requirements are met
• The right to data portability in certain cases
• The right to claim damages where legal requirements are met
• The right to file a complaint with the National Privacy Commission

The NPC recognizes rights to information, access, correction, objection, erasure/blocking, and data portability. Users wishing to exercise these rights may contact the privacy contact in Article 18. The Company may verify the requester's identity by reasonable means to protect personal data and the rights of others.

Receiving marketing communications is optional.

Users who have consented to marketing may withdraw that consent in the future through settings provided by the Company or through the privacy contact.

Even after withdrawing marketing consent, essential service messages that are not for marketing purposes — such as those related to service operation, security, contracts, Project performance, or settlement — may continue to be sent where necessary.

Philippine privacy rules recognize a user's right to opt out of, or withdraw consent to, personal data processing such as direct marketing.

The Company may, in the future, use a Member's profile, activity field, Project history, or other lawfully processed information to recommend suitable Projects, content, or creator opportunities.

Where automated processing or profiling is used in a way that materially affects a user's rights or significant decisions, the Company provides the necessary information and applies appropriate safeguards in accordance with applicable law.

This Notice does not claim the existence of fully automated decision-making that produces legal or similarly significant effects beyond simple sorting, filtering, or recommendation, unless such a feature is actually in use.

The NPC requires that where automated processing and profiling exist, information about that processing be disclosed in the Privacy Notice.

The Company may, in the future, use AI technology for content creation support, translation, content analysis, recommendation, classification, or customer support, among other functions.

However, where a feature that transmits personal data to an external AI service provider is introduced, the Company will review the actual data flow and, where necessary, disclose the processing purpose, scope of information, and related matters through this Privacy Notice or a separate notice.

It is not recommended to include broad language granting the Company rights to use Members' non-public content or personal data to train external generative AI, unless such use is actually confirmed to occur.

Where the Company processes the personal data of a minor, it considers the user's age, the nature of the personal data, and applicable law.

Where consent from a legal guardian is required, the Company may verify that consent.

In particular, where a minor creator participates in filming, advertising, earnings activities, or Projects, applicable labor, advertising, contract, and privacy-related legal requirements — separate from general sign-up — may be verified.

Inquiries, access, correction, deletion, objection, withdrawal of consent, or other exercise of rights regarding personal data may be requested through the contact below.

• Company: [Exact Philippine entity name]
• Service: 8B Creators
• Data Protection Officer / Privacy Contact: [Name or responsible department]
• Email: [privacy email]
• Address: [Exact address in Makati City]

The Company processes requests in accordance with the procedures and timelines set out in applicable law after verifying the request. Users in the Philippines who believe their privacy rights have been violated may file a complaint with the National Privacy Commission under applicable law.

Where mandatory laws of the Republic of Korea, such as Korea's Personal Information Protection Act, apply to a user residing in Korea, the Company guarantees the rights required under such laws and applies any necessary additional measures. In particular, the following matters may apply.

• Personal data processing and retention period
• Third-party disclosure
• Outsourced processing
• Overseas transfer of personal data
• Destruction of personal data
• Exercise of data subject rights
• Safeguard measures
• Matters related to legal guardians

Whether a separate additional notice for Korean users is needed may be reviewed depending on the actual scale of service and personal data processing for users in Korea.

The Company may revise this Privacy Notice in response to changes in law, the Service, or personal data processing practices.

Where a material change occurs, the Company will notify users before it takes effect through an in-service notice, email, or other appropriate method.

Where the purpose, scope, or method of processing materially exceeds the scope of existing consent and requires separate consent, the Company may obtain the necessary consent again.

The NPC's 2023 Consent Guidelines likewise establish, as a matter of principle, that a Privacy Notice be provided for personal data processing, and state that where the purpose and scope of processing change, appropriate notice and consent management are important.

This Privacy Notice takes effect on August 23, 2026.