Hyundai E&C Privacy Policy (Version 9) Effective Date: August 12, 2024 Last Updated: August 5, 2024 Hyundai Engineering & Construction Co., Ltd. (hereinafter referred to as “the Company”) is committed to safeguarding the privacy and personal data of its users. This Privacy Policy outlines the procedures and standards for processing and protecting personal data, ensuring compliance with the Personal Information Protection Act and related regulations. In accordance with Article 30 of the Act, this policy ensures transparency in how personal data is managed and provides mechanisms for addressing grievances related to personal data. --- Key Principles of Data Protection The Company ensures that its privacy policy is easily understandable and accessible to empower users to exercise their right to data self-determination. Relevant information is provided in a clear and concise manner. --- Personal Data Processing Overview 1. Purpose of Processing Personal Data The Company processes personal data for specific purposes outlined below. Personal data will not be used for purposes beyond these unless prior consent is obtained from the data subject. 1. Customer Inquiries Personal identification and authentication. Prevention of fraudulent activity. Dispute resolution and complaint handling. Record-keeping for notifications and post-deletion verification. 2. Newsletter Management Subscription management and cancellations. Sending newsletters to subscribers. --- Detailed Privacy Policy Article 1: Purpose of Processing Personal Data The Company processes personal data for legitimate business operations, including: 1. Handling customer inquiries and grievances. 2. Managing newsletter subscriptions and communications. Article 2: Processing and Retention Period of Personal Data Personal data is retained for the agreed-upon duration or as required by law. Specific retention periods include: 1. Customer Inquiries: Data is retained for three years after the inquiry date. 2. Newsletter Management: Data is deleted within five days of a cancellation request. Additional retention periods may apply as required by relevant laws: Records of transactions, contracts, and payments: 5 years. Consumer complaints or dispute resolution: 3 years. Data under tax or accounting regulations: 5–10 years. --- Article 3: Provision of Personal Data to Third Parties The Company processes personal data within the defined scope and provides it to third parties only: 1. With the explicit consent of the data subject. 2. Under legal requirements outlined in Articles 17 and 18 of the Personal Information Protection Act. --- Article 4: Outsourcing of Personal Data Processing To ensure smooth operations, the Company outsources personal data processing to third parties. The Company ensures that all outsourced activities are compliant with strict contractual safeguards. If outsourcing arrangements change, updates will be provided in this policy. --- Article 5: Rights of Data Subjects Data subjects have the following rights: 1. Access, correction, deletion, or suspension of processing of their personal data. 2. Exercise of rights through written, email, or fax communication. 3. Delegation of requests via a legal representative with an authorized power of attorney. Requests may be limited under specific conditions, such as ongoing legal investigations or compliance with other laws. --- Article 6: Items of Personal Data Processed The Company processes the following types of data: 1. Customer Inquiries: Name, contact information, email, inquiry details, and attachments. 2. Newsletter Management: Name, email address, and subscription preferences. --- Article 7: Methods of Data Collection Personal data is collected via: Online platforms (websites, mobile apps). Emails and customer contact points. --- Article 8: Destruction of Personal Data Personal data is destroyed when it is no longer needed or upon expiration of the retention period. 1. Procedure: Data is identified for destruction, approved by the Chief Privacy Officer, and securely erased. 2. Methods: Digital data: Erased using Low-Level Format methods. Physical documents: Shredded or incinerated. --- Article 9: Security Measures The Company employs robust measures to safeguard personal data, including: 1. Development of internal management plans. 2. Limiting and monitoring access to personal data. 3. Encrypting sensitive data and communications. 4. Technical measures to prevent hacking or data leaks. --- Article 10: Automatic Collection Devices The Company does not use cookies or automated devices for collecting personal data. --- Article 11: Image Data Processing For safety and security purposes, the Company operates image data processing devices in specific locations (e.g., entrances, parking lots). 1. Image data is stored for 30 days and processed securely. 2. Data subjects may request access to their image data, subject to conditions ensuring privacy and security. --- Article 12: Chief Privacy Officer The Chief Privacy Officer oversees data protection and compliance: Name: Lee-Neul Title: Vice President Contact: 523-4644| privacy investorrelationslee@gmail.com Article 13: Access Requests The Public Relations Group handles requests for access, modification, or deletion of personal data. * Contact: 835-6699 | kimjimpublicrelation@gmail.com Working Hours: Weekdays, 09:00–17:00 (excluding holidays). Article 14: Remedies for Rights Infringement Data subjects may seek resolution for privacy-related grievances through the following organizations: 1. Personal Information Infringement Report Center Contact: Support@hec-inc.com whatsapp: https://wa.me/message/TV7IORUAJX7TG1 Telegram: T.me/hecincom 2. Personal Information Dispute Mediation Committee whatsapp: https://wa.me/message/TV7IORUAJX7TG1 --- Article 15: Policy Updates Any changes to this Privacy Policy will be announced at least seven days in advance via the Company’s website. Announcement Date: August 5, 2024 Effective Date: August 12, 2024 For inquiries about this policy, please contact our Chief Privacy Officer or Privacy Manager. --- This updated Privacy Policy reflects Hyundai E&C's commitment to transparency and compliance with legal standards for protecting personal data.