Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the purposes set out below. Personal information processed by the Company is not used for any purpose other than those stated below. Where the purpose of use is changed, the Company will take necessary measures, including obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act.

Article 2 (Categories of Personal Information Processed)

The Company processes the following categories of personal information.

1. Information collected through website inquiry forms

The following items are entered directly by the data subject through the inquiry screens on the Company's website (product inquiries, employee grievance reports, reports of ethical management violations, and website correction requests).

• Required: name, email address, subject, content of the inquiry
• Optional: contact number, company name, job title
• Additional items for website correction requests: department name, target page path, position within the screen, current displayed content, requested revision, desired completion date, reference links, and translation-related requests

Information voluntarily entered by the data subject in the inquiry field may itself constitute personal information. Please refrain from entering sensitive information that is not necessary for the purpose of processing.

2. Information generated and collected automatically during use of the service

The following information is recorded automatically when an inquiry is submitted.

• IP address, browser access information (User-Agent), and date and time of submission

3. Processing in connection with the operation of social media channels

The Company uses the LinkedIn API to operate its official LinkedIn channel. The information processed in this context is as follows.

• Categories processed: account identifiers used to verify authority to administer the Company channel (member URN and organization URN), access tokens, and identifiers of published posts
• Purpose of processing: publication of posts to the Company's official channel and prevention of duplicate publication
• Method of processing: access tokens and account identifiers are stored in the operating-system secure storage of the Company administrator's business device. Apart from post content and publication history, the Company does not collect or store LinkedIn members' profile information, connection or follower information, messages, or activity history.
• Processing upon disconnection: if the Company disconnects the LinkedIn integration, or a data subject revokes the permissions granted to the Company's application, the access tokens and account identifiers held by the Company are destroyed without delay. Posts already published remain on the Company's official channel in accordance with LinkedIn's policies; a request for their deletion may be made using the contact details in Article 9.

The Company does not use data obtained through the LinkedIn API for advertising targeting, does not sell or transfer it to third parties, and does not use it to train artificial intelligence models.

Article 3 (Processing and Retention Periods)

The Company processes and retains personal information within the retention and use period prescribed by applicable law, or within the retention and use period consented to by the data subject at the time of collection.

Personal information for which the retention period has expired is destroyed without delay in accordance with Article 7.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only where the data subject has consented or where Articles 17 and 18 of the Personal Information Protection Act otherwise permit, such as under specific provisions of law.

The Company does not currently provide personal information of data subjects to any third party.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing tasks as set out below in order to carry out its operations efficiently.

When entering into an entrustment agreement, the Company specifies in the contract or other written form, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing personal information for purposes other than performing the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability including compensation for damages. The Company supervises whether the trustee processes personal information safely.

If the content of the entrusted work or the identity of the trustee changes, the Company will disclose the change through this Privacy Policy without delay.

Article 6 (Transfer of Personal Information Overseas)

The Company transfers personal information overseas as set out below for the operation of its official social media channels.

A data subject may refuse the overseas transfer of personal information. Where the transfer is refused, use of the relevant service may be restricted.

Article 7 (Procedure and Method of Destruction)

The Company destroys personal information without delay once it is no longer necessary, such as upon expiry of the retention period or achievement of the purpose of processing.

Where personal information must continue to be retained under other statutes notwithstanding the expiry of the consented retention period or the achievement of the purpose of processing, the Company transfers such personal information to a separate database or stores it in a different location.

Destruction procedure: the Company identifies the personal information for which grounds for destruction have arisen and destroys it with the approval of the Chief Privacy Officer.

• Information in electronic file format: permanently deleted by a method that renders recovery and reproduction impossible
• Personal information printed on paper: shredded or incinerated

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

A data subject may exercise the following personal information protection rights against the Company at any time.

1. Request access to personal information
2. Request correction of any errors
3. Request deletion
4. Request suspension of processing

These rights may be exercised in writing, by email or by other means, and the Company will act on such requests without delay.

Where a data subject requests correction or deletion of erroneous personal information, the Company will not use or provide the personal information concerned until the correction or deletion is completed.

These rights may be exercised through a legal representative or an authorised agent. In such a case, a power of attorney in the form prescribed in Annex Form No. 11 of the Public Notice on Methods of Processing Personal Information must be submitted.

Requests for access to personal information and for suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

Article 9 (Chief Privacy Officer)

The Company has designated the following Chief Privacy Officer, who has overall responsibility for personal information processing and for handling data subjects' complaints and providing remedies in relation to personal information processing.

Data subjects may direct any inquiries, complaints or requests for remedy relating to personal information protection arising from their use of the Company's services to the Chief Privacy Officer or the responsible department. The Company will respond to and handle such inquiries without delay.

Article 10 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: establishment and implementation of an internal management plan, and regular training for personnel who handle personal information
2. Technical measures: management of access rights to the personal information processing system, operation of administrator authentication procedures, encrypted storage of authentication credentials such as access tokens, and installation and updating of security programs
3. Physical measures: access control for systems and storage areas containing personal information

Article 11 (Installation and Operation of Automatic Collection Devices, and Refusal Thereof)

The Company uses cookies, which store and retrieve information about data subjects from time to time.

• Purpose of use: maintaining administrator login sessions and storing display preferences such as language and theme
• How to refuse: cookies may be refused through the settings of your web browser.

If you refuse the storage of cookies, you may experience difficulties in using some services. Cookie settings can be configured through the privacy or security settings menu of your web browser.

Article 12 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or counselling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency Personal Information Infringement Report Centre, and other bodies in order to obtain relief from infringement of personal information rights. For other reports of, or counselling on, personal information infringement, please contact the organisations below.

A person whose rights or interests have been infringed by a disposition or omission by the head of a public institution in response to a request under Article 35 (access to personal information), Article 36 (correction or deletion of personal information) or Article 37 (suspension of processing of personal information) of the Personal Information Protection Act may request an administrative appeal as prescribed by the Administrative Appeals Act.

Article 13 (Changes to This Privacy Policy)

This Privacy Policy applies from its effective date. Where there are additions, deletions or corrections arising from changes in applicable law or Company policy, the Company will give notice through the announcements section of its website at least seven days before the changes take effect.