Article 1 (Purpose and Scope of Personal Information Collection)

The “IR/PR Letter Subscription Service” operated by the Company uses personal information solely for providing and improving the subscription service. If the purpose of use changes, the Company will take necessary actions, such as obtaining additional consent.

Article 2 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the retention period stipulated by relevant laws or agreed upon by the data subject when collecting personal information.

② Retention periods for each type of personal information are as follows: collected information is retained and used for the stated purposes for up to two years from the date of consent.

- Retention Basis: Consent of the information provider Relevant Laws: Records on the Collection/Processing and Use of Credit Information: 2 years

③ The company shall destroy the personal information of the data subject without exception when the retention period has expired, the purpose of collecting and using personal information has been achieved, or upon the data subject’s request for destruction. However, in the following cases, the company may retain and use the personal information until the relevant reason has ceased to exist.

④ Notwithstanding the previous clause, if the company is obligated to preserve personal information under applicable laws and regulations, the relevant personal information or files shall be stored and managed separately from other personal information.

1. If an investigation or inquiry related to a violation of applicable laws is in progress

2. If there are remaining claims or obligations related to the dispatch of the IR/PR Letter

Article 3 (Rights of Data Subjects and How to Exercise Them)

① Data subjects may exercise their rights to access, correct, delete, or request the suspension of processing their personal information at any time.

1. To delete or suspend processing: Contact the personal information management department, complete identity verification, and proceed with withdrawing consent or canceling the subscription. The Company will take immediate action.

2. Exercise of rights beyond the above: You may submit your requests in writing, via email, or by fax to the Personal Information Protection Officer or the Personal Information Management Department. The Company will take immediate action in response.

② The rights described in Paragraph 1 may also be exercised through a legal representative or an authorized agent of the data subject.

③ If the Company is unavoidably required to comply with obligations under other laws, it may notify the data subject of the reason and deny the exercise of the rights described in Paragraph 1.

Article 4 (Destruction of Personal Information)

The Company, in principle, destroys personal information without delay once the purpose of processing such information has been achieved. The procedures and methods for destruction are as follows.

1. [Destruction Procedure] Information entered by the data subject for service use is transferred to a separate database (or, in the case of paper records, a separate document storage) after the purpose is achieved, and stored for a certain period in accordance with internal policies and other relevant laws, or immediately destroyed. Personal information transferred to the database is not used for any other purpose unless required by law.

2. [Destruction Methods] Information in electronic file formats is destroyed using technical methods that prevent the records from being restored. Information printed on paper is shredded with a shredder or incinerated for destruction.

Article 5 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to prevent the loss, theft, leakage, alteration, or damage of personal information during processing, and makes every effort to protect personal information.

1. Administrative Measures: Establishment and implementation of an internal management plan, Regular employee training

2. Technical Measures: Management of access rights to personal information processing systems, Installation of access control systems, Encryption of passwords and unique identifiers, encrypted communication, Preservation of access logs and measures to prevent their falsification or alteration, Installation of security programs

3. Physical Measures: Access control to computer rooms and data storage facilities

Article 6 (Entrustment of Personal Information Processing)

① The Company entrusts the processing of personal information for smooth business operations as follows

② Information subjects' personal information is used solely for sending IR/PR Letters and not for any purposes beyond the specified tasks.

③ In case of changes to the content of the entrusted tasks or the entrusted entity, the Company will promptly disclose the details through this Privacy Policy.

Article 7 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

The Company operates cookies, which are small text files that store and retrieve the information of data subjects. Cookies are sent by the server used to operate the Company’s website and are stored on the data subject’s computer hard disk.

1. Purpose of using cookies: Analyze the frequency of access and visit times of data subjects, track participation in various events, and manage and improve the services provided to data subjects

2. How to refuse cookie settings
For Chrome: Navigate to the 「Settings」 page, select the 「Privacy and Security」 menu, then click 「Cookies and Other Site Data」. Set the appropriate cookie allowance level or choose "Block All Cookies" to refuse the use of cookies.
For Edge: Navigate to the 「Settings」 page, select the 「Cookies and Site Permissions」 menu, then click 「Manage and Delete Cookies and Site Data」. Choose "Block Third-Party Cookies" to refuse the use of cookies.

Article 8 (Personal Information Protection Officer)

The Company designates the following Personal Information Protection Officer to oversee the management of personal information, address complaints, and provide remedies related to the handling of personal information.

- Personal Information Protection Officer

Article 9 (Personal Information Management Department)

Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act to the following department. The Company strives to process such requests promptly.

- Personal Information Access Request Reception and Processing Department (Management of IR/PR Letter Subscription Members / IR/PR Letter Bulletin Board Operation)

Data subjects may report all personal information protection-related complaints arising from the use of the IR/PR Letter delivery service to the Personal Information Protection Officer or the Personal Information Management Department. The Company will promptly provide sufficient responses to such complaints.

- Personal Information Infringement Center (privacy.kisa.or.kr / 118 (toll-free))

- Supreme Prosecutors’ Office Cybercrime Division (www.spo.go.kr /1301 (toll-free))

- National Police Agency Cyber Bureau (www.cyberbureau.police.go.kr /182 (toll-free))

Effective Date of Privacy Policy: August 16, 2023