Privacy Policy

1Article 1 (Purpose of Processing and Items Collected)

The Company processes the minimum personal information necessary within the following purposes.

1. Membership and Account Management

① Items collected upon standard sign-up

[Required] Email (login ID), password, mobile phone number (incl. SMS verification), nickname

[Optional] Name (family/given), gender, date of birth

* Profile image and bio are collected only if the member registers them in profile settings after sign-up.

② Items collected via social login

Google login

Email (required), Google account identifier (required), name (optional)

Kakao login

Email (required), Kakao account identifier (required), mobile phone number (required), name (optional), gender (optional), date of birth (optional)

Apple login

Email (required), Apple account identifier (required)

* Information collected via social login is used only for member identification and service provision. Mobile phone verification is also performed for social sign-ups.

③ Items collected upon DUPR account linking (optional)

DUPR ID, name registered with DUPR, singles/doubles ratings and reliability, match count, linking tokens

* DUPR linking data is deleted without delay upon unlinking or membership withdrawal.

④ Purpose of processing

Member identification and verification, account management and service provision, fraud prevention, customer support, in-service notifications

⑤ Retention period

Until membership withdrawal. After withdrawal, data is retained for 30 days to prevent fraudulent re-registration and to handle refunds or disputes, then destroyed.

However, where retention is required by applicable laws, data is kept for the legally required period and then destroyed.

2. Marketing Use (optional)

Only when a member consents at sign-up or in settings, the Company uses the nickname, email, and mobile phone number to deliver promotional information (events, promotions, benefits) and personalized updates.

* Consent can be withdrawn anytime in Settings > Preferences > Notifications; refusing does not restrict service use. Night-time (21:00–08:00) promotional messages require separate consent.

2Article 2 (Personal Information of Children Under 14)

The Company does not allow children under 14 to register directly online. However, where a legal guardian consents through the procedure below, the Company may create an account on the child's behalf.

■ Guardian consent procedure

The legal guardian verifies their own mobile phone number on the guardian consent screen in the Company's service, reads the consent text displayed there and indicates consent. The Company then notifies the verified mobile number by text message that the indication was confirmed (Article 17-2(1)(1) of the Enforcement Decree of the Personal Information Protection Act). Once consent is confirmed, the Company creates the child's account and notifies the same number. The time of consent, the time the confirmation message was sent, the version of the consent text and connection information are kept as evidence of consent.

■ Items collected

[Child] Name, date of birth, email, mobile phone number (if any)

[Guardian] Name, relationship to the child, mobile phone number

[Evidence] Connection information at the time of consent (IP address, browser information)

* Guardian information is used only to confirm consent and to give legally required notices under Article 22-2 of the Personal Information Protection Act, and for no other purpose. If consent is not confirmed, or a request is rejected or cancelled, it is destroyed without delay; requests awaiting account creation are cancelled and destroyed automatically 30 days after receipt. Where consent is confirmed it is retained as evidence of consent until the child withdraws membership.

If a child under 14 is found to have registered without guardian consent, the Company deletes the account and its personal information without delay. A legal guardian may exercise access, correction, and deletion rights on behalf of the child.

3Article 3 (Event Application and Participation)

1. Default information (reuse of already collected data)

Nickname, profile image, email

2. Conditional information (only when requested by the organizer)

Name, gender, date of birth, mobile phone number, DUPR information (ID, ratings, reliability), application form entries (answers and attachments), and team name/member information for team entries

3. Method and retention

The above information as of the time of application is stored separately in the participant roster (snapshot). For events with eligibility conditions, the items needed to verify them (gender restriction → gender, age restriction → date of birth, DUPR condition → DUPR information) are included.

4Article 4 (Payment and Refund Processing)

The Company brokers payments through a payment gateway (Toss Payments) and may process the following information.

■ Items processed

* The Company does not store sensitive financial information such as full card numbers, CVC, or passwords.

5Article 5 (Provision to Third Parties)

The Company provides personal information to third parties only with the user's consent, as follows.

1. Event organizers

This consent covers the provision of personal information to the organizer upon event application. Users may refuse; refusal may restrict event applications. Organizers may use the provided information only for the purposes above and may not reuse or re-provide it.

2. DUPR, LLC

For members who link a DUPR account, match results are transmitted to DUPR for rating calculation. See Article 7 (Overseas Transfer) for details.

6Article 6 (Outsourcing of Processing)

The Company outsources the following processing tasks for smooth service provision.

The Company specifies safety measures in outsourcing contracts and supervises processors as required by law. If a new processor (e.g., a web analytics tool) is introduced, this Policy will be revised and notified beforehand.

7Article 7 (Overseas Transfer)

Personal information may be transferred overseas in the course of using the service, as follows. The Company discloses the matters listed in Article 28-8(2) of the Personal Information Protection Act below.

■ Protective measures

Before any overseas transfer, the Company enters into a personal information protection agreement with the recipient, transmits all data over encrypted connections, and specifies and supervises safety measures under that agreement. Recipients are bound not to use the information beyond the agreed purpose or to provide it to third parties.

■ How to refuse or withdraw

Users may refuse consent to overseas transfer. Refusal does not restrict basic use of the service; only the related features (DUPR rating integration, image upload, address autocomplete) become unavailable.

Transfer to DUPR does not occur unless the member links a DUPR account. To withdraw consent after linking, request unlinking under [Settings > Account] or contact customer support (contact@haveajam.com). Requests are processed within three business days and completed no later than ten days from receipt.

Once unlinked, the member's match results are no longer transmitted to DUPR from that point, and the DUPR linkage information held by the Company (DUPR ID, access tokens, ratings) is deleted at the same time. Match results already registered with DUPR remain with DUPR after unlinking, and their deletion must be requested by the member from DUPR, LLC directly. The time of receipt, the time of processing and the handler are retained as evidence of processing.

Even if a member withdraws from membership, match results of tournaments the member took part in before withdrawal may be registered with DUPR under the consent given when applying for those tournaments.

Members who linked a DUPR account before October 12, 2026 are deemed to have consented to the overseas transfer on the terms disclosed at the time of linking.

* The contacts above are the privacy inquiry channels published by each recipient. They may change; if you cannot reach them, contact the Company's customer support and we will assist.

8Article 8 (Automatic Collection Tools and Opt-Out)

The Company uses cookies (authentication tokens) and browser storage (display settings such as theme) to maintain login sessions and provide the service.

The web server may also keep access logs (IP address, access time, requested URL, browser information) for stable operation, security, and troubleshooting.

Users may refuse cookies via browser settings; however, refusing cookies may restrict some features such as login.

9Article 9 (Retention and Destruction)

The Company destroys personal information without delay once the retention period expires or the purpose of processing is achieved.

■ Destruction process

Membership withdrawal: service access is blocked immediately, and after a 30-day grace period, personal information in the account, profile, and participation records is automatically destroyed (de-identified). However, match results of tournaments the member took part in before withdrawal may be registered with DUPR after withdrawal, under the consent given when applying for those tournaments (Article 7).

Event participation data: personal information in participant rosters and application form answers is automatically destroyed 6 months after the event ends.

Error logs collected for troubleshooting are automatically deleted after 90 days.

■ Destruction method

Personal information in electronic files that no other record references (account details, profile, notification and device records, login tokens, and the like) is deleted in an unrecoverable manner.

For data referenced by other records, such as event participation records, the structure of the record is retained and only values that could identify an individual are deleted or replaced with non-identifiable values (anonymisation). The name shown in rosters becomes “Withdrawn user”; contact details, date of birth and application form answers are deleted; and nothing beyond an internal member number can identify an individual. This is because capacity counts, draws and match results reference these records.

Payment records are retained for five years under the Act on Consumer Protection in Electronic Commerce and are kept during that period only to the extent necessary to verify transactions. Once the retention period ends they are destroyed in the manner described above.

Paper documents: shredded or incinerated

■ Retention required by law

10Article 10 (Rights of Data Subjects)

Users may request access to, correction or deletion of, suspension of processing of, and withdrawal of consent regarding their personal information.

The Company handles such requests without delay in accordance with applicable laws, and within 10 days where special circumstances exist.

Identity is verified via mobile phone authentication or equivalent means when exercising these rights.

11Article 11 (Privacy Officer)

12Article 12 (Remedies)

■ Reporting an infringement of your rights

Anyone whose rights — including privacy or reputation — are infringed by information posted in the Company's service (nickname, profile photo, self-introduction and the like) may request that the Company delete the information or post a rebuttal (Article 44-2(1) of the Act on Promotion of Information and Communications Network Utilization and Information Protection).

■ External bodies

For reports or consultations regarding personal information infringement, users may contact the following organizations.

• •Personal Information Infringement Report Center (privacy.go.kr)
• •Personal Information Dispute Mediation Committee (kopico.go.kr)
• •Cybercrime Investigation Division, Supreme Prosecutors' Office
• •Cyber Bureau, Korean National Police Agency

13Article 13 (Changes to This Policy)

This Policy takes effect on October 14, 2026. Where the Company amends this Policy, the changes and their effective date are announced in the service at least seven days beforehand, or thirty days beforehand where the change is unfavourable to users.

■ Revision history