The Company processes personal information for the following purposes. The personal information being processed will not be used for any purpose other than those specified below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

In the table on personal information processing tasks, the "Personal information processing tasks" and their "Purpose of processing" are described separately.

The Company processes and retains personal information within the retention period prescribed by law or within the period of use consented to by the data subject at the time of collection of personal information. The items of personal information retained by the Company can be checked through the status of retained personal information files below or via the Personal Information Protection Commission’s Personal Information Protection Portal.

It is described in a table on the processing and retention period of personal information and the items of personal information processed, “Name of personal information file,” “Items of personal information,” and “Retention period” are described separately.

The Company, in principle, does not provide the collected personal information to any third party. However, personal information may be provided to a third party in any of the following cases, except where it is likely to unduly infringe upon the interests of the user or a third party.

1. 1. Where there are special provisions under the law
2. 2. Where separate consent is obtained from the data subject
3. 3. Where the data subject or legal representative is unable to express intent, or where prior consent cannot be obtained due to reasons such as an unknown address, and it is deemed necessary for the clear protection of the urgent life, body, or property interests of the data subject or a third party
4. 4. Where it is necessary for purposes such as compiling statistics or academic research, and the personal information is provided in a form that does not allow the identification of a specific individual
5. 5. Where the personal information is used for purposes other than its intended use or provided to a third party, and failure to do so would make it impossible to perform duties prescribed by other laws, and the case has undergone deliberation and resolution by the Personal Information Protection Commission
6. 6. Where it is necessary to provide the information to a foreign government or international organization for the implementation of treaties or other international agreements
7. 7. Where it is necessary for the investigation of crimes, and for the initiation or maintenance of public prosecution
8. 8. Where it is necessary for the performance of judicial duties by the court
9. 9. Where it is necessary for the execution of criminal punishment, custody, or protective disposition

For the smooth handling of personal information affairs, the Company outsources the following personal information processing tasks.

In the table on the outsourcing of personal information processing, the “Entrusted party (trustee)” and the “Details of the outsourced tasks” are described separately.

When entering into an outsourcing contract, the Company specifies in the document matters concerning the prohibition of processing personal information for purposes other than the performance of the entrusted tasks, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and supervises the trustee to ensure that personal information is processed safely.

The Company shall destroy the relevant personal information without delay when the retention period has expired or the purpose of processing has been achieved. However, this shall not apply when personal information must be preserved in accordance with other laws.

If the retention period of personal information has expired or the purpose of processing has been achieved, but the personal information must continue to be retained in accordance with other laws and regulations, it shall be transferred to a separate database or preserved in a different storage location. The personal information will not be used for any other purpose unless required by law.

Electronic files are permanently deleted in a manner that makes recovery impossible, and printouts are destroyed by shredding or incineration.

The Company takes the following measures to ensure the security of personal information.

Administrative measures: Establishment and implementation of an internal management plan for personal information, and regular personal information protection training

Technical measures: Installation of access control systems for personal information processing systems, management of access rights, encryption of unique identification information, and installation of security programs

Physical measures: Access control for computer rooms and data storage rooms

The data subject may exercise the rights related to personal information listed in the following items with the Company at any time.

Request to access personal information
Request for correction if there is an error, etc.
Request for deletion
Request for suspension of processing

The exercise of rights may be requested by completing the form in Annex Form No. 8 of the Enforcement Rules of the Personal Information Protection Act via written document, email, or other means, and the Company will take action without delay.

In a table on the rights, obligations, and methods of exercising of data subjects, “Personal information processing tasks,” “Responsible department,” “Person in charge,” and “Contact information” are described separately.

The exercise of rights under Paragraph 1 may be carried out through the data subject’s legal representative or an agent with delegated authority. In this case, you must submit a power of attorney in accordance with Annex Form No. 11 of the Enforcement Rule of the Personal Information Protection Act.

When a request for access, correction or deletion, or suspension of processing is received in accordance with the rights of the data subject, it shall be verified that the requester is the data subject or a legitimate representative.

Appendix Form No. 8 (Request Form) of the Enforcement Rules of the Personal Information Protection Act Appendix Form No. 11 (Power of Attorney) of the Enforcement Rules of the Personal Information Protection Act

The Company, in accordance with the Standard Personal Information Protection Guidelines, designates the Chief Privacy Officer as follows to protect personal information and to handle grievances and damage relief of information subjects related to personal information processing.

The data subject may contact the following organizations for remedies and consultation regarding personal information infringement. The following organizations are separate from the Company, and you may contact them if you are not satisfied with the results of their own personal information complaint handling or redress, or if you require more detailed assistance.

This privacy policy applies from the effective date, and in the event of any addition, deletion, or correction of its contents due to changes in laws or policies, the changes will be disclosed on the Company's website from 7 days prior to the effective date.

Date of Notice: 10/14/2022

Effective Date: 10/19/2022

Previous versions of the privacy policy can be found below.