POSCO E&C

Annual Performance
of the Recent Three Years

Management Performance

Main Indicators (as of the end of each year)

POSCO E&C Affiliates

Personal Data Processing Policy Legal Disclaimer

General provisionsPOSCO E&C Ltd. discloses the following privacy policy to protect the personal information of data subjects and handle related complaints quickly and efficiently according to Article 30 of the 『Personal Information Protection Act』. This policy stipulates how the personal information you provide is used, what it is used for, and what measures are taken to protect it.* This policy has been revised on 2023.01.31.  - revised content : Enactment of Privacy PolicyConsent to collection of personal informationPOSCO E&C prepared a procedure for clicking the 「Agree」 button with regard to the terms and conditions of the POSCO E&C Official Website (https:// www.poscoenc.com/). If you click the 「Agree」button, you will be deemed to have consented to collection of personal information.- This service (site) does not collect the personal information of children under 14, or post or provide information harmful to children on the website. Purposes of collecting and using personal informationThe POSCO E&C Official Website collects only the minimum personal information necessary for using the service.Personal information will not be used for purposes other than the following, and if the purposes of using personal information are changed, necessary measures, e.g. obtaining a separate consent, will be taken according to Article 18 of the Personal Information Protection Act.To use the services of the POSCO E&C Official Website, you must enter following information when submitting inquiry. - Employment Inquiry : Name, E-mail. - Business Inquiry : Name, E-mail. The specific purposes of collecting and using each personal information item are as follows:- Name, E-mail : Communication Purposes(Q&A) Period of retaining and utilizing personal informationThe retention period of the personal information collected in the the POSCO E&C Official Website will be retained for 3 year and will be destroyed after answering.The POSCO E&C Official Website destroys your personal information beyond recovery (if personal information was provided to a third party, the third party will also be instructed to destroy it). In any of the following events, however, personal information will be retained for the specified period.·     ① If it is necessary to retain personal information according to laws, such as the Commercial Act, the transaction details and the minimum basic information will be retained for the retention period set forth in the laws·     ② The retention period will be notified to reporter in advance, and if the retention period has not expired, and the consent of individual members was obtained, personal information will be retained for the promised retention period. Out-of-purpose use and provision to a third partyIn principle, the POSCO E&C Official Website will process the personal information of data subjects within the scope specified as the collection and use purposes, and except for the following events, personal information will not be processed or provided to a third party beyond the original purposes without the prior consent of data subjects.·     ① if separate consent is obtained from data subjects·     ② if there are special provisions in laws Consignment of personal information·     ① The POSCO E&C Official Website is outsourcing personal information management for efficient personal information management as follows:<figure class="table"><table><thead><tr><th>Outsourcee</th><th>Description of  outsourced jobs</th><th>Period of retaing and  utilizing personal information</th></tr></thead><tbody><tr><td>POSCO ICT</td><td>Service operations</td><td>Personal Information is destroyed without exception when Purposes of collecting personal information are achieved.</td></tr></tbody></table></figure>·     ② When the outsourcing contract is concluded, the POSCO E&C Official Website stipulates matters concerning responsibility, e.g. prohibition of processing personal information for purposes other than performing the outsourced jobs, technical and administrative protection measures, limitation of re-outsourcing, management and supervision of outsourcees, compensation for damages, etc. in documents like contracts, and supervises whether the outsourcee is safely processing personal information according to Article 25 of the Personal Information Protection Act.·     ③ If outsourced jobs or outsourcees are changed, we will immediately disclose the information through this privacy policy. Technical measures to protect personal informationWhen handling personal information, the POSCO E&C Official Website has the following technical measures to ensure safety in processing your personal information so that it is not lost, stolen, leaked, altered or damaged·     ① Your personal information will be protected by a password, and important data will be protected by using separate security functions, such as encrypting files and transmission data or using the lock function.·     ② The POSCO E&C Official Website is using vaccine programs to prevent damages due to computer viruses. Vaccine program is periodically updated, and if a virus appears suddenly, we will provide a vaccine as soon as it becomes available to prevent infringement of personal information.·     ③ The POSCO E&C Official Website has a security device (SSL or SET) that can use the encryption algorithm to safely transmit personal information on the network.·     ④ To prevent your personal information from being leaked due to hacking, etc., we are using a device that prevents intrusion from the outside, and installed the intrusion detection system in each server for 24-hour monitoring of intrusion. Using cookies to collect personal informationThe POSCO E&C Official Website operates 'cookies' that save and find your personal information frequently. Your personal information, which the POSCO E&C Partner Portal website collects through cookies, will be limited to (ID, page views, etc.), and no other information will be collected. This information will be used for the following purposes:We analyze the access frequency, view page and visit duration of POSCO E&C Official Website visitors, and use them as a yardstick for improving website services.You have options with regard to cookies. You can allow all cookies by selecting [Tool] > [Internet options] > [Security] > [User-defined level] in the web browser, or confirm every time a cookie is saved, or refuse to save any cookie. Chief Privacy Officer, listening to opinions/handling complaintsTo protect your personal information and handle related complaints, the POSCO E&C Official Website is administered by personal information manager, and provides a channel for leaving your opinions and complaints about privacy policy. If you have any question or complaint with regard to your personal information, please contact the personal information manager below. We will take necessary measures, and notify the result to you immediately.<figure class="table"><table><thead><tr><th>                 Description</th><th>                 Chief Privacy Officer</th><th>                 Personal information manager</th></tr></thead><tbody><tr><td>Name</td><td>Kyeung-Won, Kim</td><td>Jae-wook, Jung</td></tr><tr><td>Department</td><td>Promotion Group</td><td>Promotion Group</td></tr><tr><td>Tel. /  E-Mail   </td><td>032)748-2182 /  iloveincheon@poscoenc.com</td><td>032)748-2631/  jaewook.jung@poscoenc.com</td></tr></tbody></table></figure>You may contact the following agencies to seek relief actions to infringement of personal information and ask questions.* The following agencies are independent from the Company. Please contact them if you are not satisfied with the company's handling of your complaints or the result of relief actions, or need help or more detailed information. National Police Agency Cyber Bureauwebsite: cyberbureau.police.go.krphone: (without exchange number) 182 High-Tech Crime Investigation Division, Supreme Prosecutors' Officewebsite: www.spo.go.krphone: 02-3480-3573 Privacy Complaint Center (operated by Korea Internet and Security Agency)functions: receiving reports or requests for counseling on infringement of personal informationwebsite: privacy.kisa.or.krphone: (without exchange number) 118address: (58324) Privacy Complaint Center, 3F, Jinheung-gil 9, Naju, Jeollanam-do(Bitgaram-dong 301-2) Personal Information Dispute Mediation Committeefunctions: receiving requests for mediation of disputes related to personal information or collective disputes (civil settlement)website: www.kopico.go.krphone: (without exchange number) 1833-6972address: (03171) 4F, Government Complex-Seoul, 209, Sejong-daero, Jongno-gu, Seoul Matters concerning destruction of personal informationIf personal information is no more necessary due to its retention period expiration, or the accomplishment of purposes of processing personal information, the company will immediately destroy the personal information.The procedure and method of destroying personal information are as follows:·     1. Destruction procedure: Unnecessary personal information and personal information files are handled as follows according to the internal guideline. Destruction of personal information: We destroy personal information immediately when the retention period expires.·     2. Destruction method: We destroy information in the form of electronic files beyond recovery, and shred or incinerate personal information printed on paper. Obligation to notify policy changesThis privacy policy was established on Jan. 31, 2023, and if it has any addition/erasure or modification due to changes in laws/policies or security technology, we will post notices about the reason for change and details on our website at least 10 days prior to enforcement of the revised privacy policy.·     - Privacy policy version number: v1.00·     - Privacy policy enforcement date: 2023-01-31·     - Last revision date of the privacy policy: 2023-01-31

OSCO E&C Ltd. (hereinafter referred to as the "Company") values your personal information and complies with regulations in relation to the protection of personal information as stipulated in the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., the Personal Information Protection Act, and the Guidelines for the Protection of Personal Information enacted by the Ministry of Interior and Safety. The Company informs through the Privacy Policy of the method and purpose of collecting and using the personal information you have provided and the measures we take for data protection.* This Privacy Policy has been revised on February 28, 2020. - Revision details: Change of Privacy Officer and the consignment agent1. Personal Information Items Collected and Method of Collection The Company website collects the personal information within the minimum scope required for the use of services. For use of the Customer Center within the Company website, you are required to provide your personal information (name, residence phone number, mobile phone number, and email address). Please be reminded that there are no restriction on the use of the Company's services even if you do not provide information on the optional items. There is also a section where you are asked to agree or disagree on the Terms of Service, collection and use of personal information, provision of personal information to a third party, and consignment of processing personal information. Once you click the “I agree” button, you are deemed to have agreed to the relevant provisions.2. Purpose of Collection and Use of Personal Information The specific purpose of the collection and use of each personal information item is as follows: - Your name, residence phone number, mobile phone number, and email address will be collected and used to secure communication channels for handling complaints. 3. Provision of Personal Information to a Third Party The Company website uses your personal information only within the scope specified in the Purpose of Collection and Use of Personal Information and shall not provide the information to another person, company, or organization.However, to provide better services, your personal information may be provided to or shared with the affiliates of the Company. In such an event, the Company will personally inform you in advance via email or mail on the affiliate information, personal information items to be provided or shared, why such information needs to be provided or shared, and until when and how the information will be protected and managed and acquire your consent. In the event you do not consent to such actions, your personal information will not be provided to or shared with the Company's affiliates: Provided, That this shall not apply in any of the following circumstances:(a) Where it is required by related organizations for investigation purposes according to applicable laws and regulations; (b) Where it is required by the Korea Internet Safety Commission; or (c) Where it is required by procedures stipulated by other applicable laws and regulations 4. Consignment of Processing Collected Personal InformationThe processing of your personal information may be consigned to an external agent for improved provision of services. The Company will inform you in advance in the event of consigning the processing of your personal information. In such an event, the Company will clearly regulate strict compliance with orders regarding the protection of personal information, confidentiality of personal information, prohibition of providing information to a third party, and liabilities in the event of accidents through a consignment contract and keep a hard or soft copy of the contract. The personal information consignment agent and duties for consignment differ per the privacy policy of each division.<figure class="table"><table><thead><tr><th>Consignment Agent</th><th>Consigned Duty</th><th>Period of Retention and Use of Personal Information</th></tr></thead><tbody><tr><td>NEXMEDIA Co., Ltd.</td><td>Service operation</td><td rowspan="2">Personal information shall be destroyed without exception after the purpose of the collection and use of personal information has been achieved.</td></tr><tr><td>POSCO ICT</td><td>Server operation</td></tr></tbody></table></figure> 5. Period of Retention and Use of Personal InformationAfter the purpose of collection and use of personal information is achieved, the said information shall be immediately destroyed in a form that cannot be restored. In the event the information had been provided to a third party, the third party shall be ordered to destroy the said information in the same manner. However, personal information may be retained for a certain period of time in any of the following circumstances. The retained information shall be used for the purpose of storing only.(a) When the information requires to be preserved in accordance with laws, including the Commercial Act, the transaction records and the minimum scope of basic information shall be retained for a period as prescribed by laws. (b) The information can be retained for the agreed retention period when the retention period has been notified to you and the retention period has not exceeded or when the Company has obtained your consent.6. Procedures for Destroying Personal InformationIn principle, the Company shall destroy personal information without delay once the purpose of collection and use of personal information has been achieved. The destroying procedure and method are as follows:Destroying ProcedureOnce your personal information has achieved the purpose of collection and use, it is transferred to a separate database (separate cabinet in case of paper documents) and stored for a certain period of time according to grounds for information protection as prescribed by internal policies and other applicable laws (refer to Period of Retention and Use) before it is destroyed. Personal information transferred to a separate database shall not be used for other purposes than storage, unless otherwise regulated by laws.Destroying MethodPersonal information printed on paper shall be destroyed through shredding or incineration, while electronic data shall be deleted in a technical manner which the records cannot be restored.7. Rights of the User's Legal Representative and How to Exercise Their RightsYou may access or modify your registered personal information any time.To do so, log into the Company website, click “Edit,” and personally view or modify your information. You can also contact the Privacy Officer via mail, telephone, or email to get immediate actions. Should you request for correction on your personal information, the Company shall not use the corresponding information until the correction is completed. If the incorrect information had already been provided to a third party, it shall be notified with the correction without delay.In addition, you may withdraw your consent to the collection and use of personal information, provision of personal information to a third party, and consignment of processing collected personal information at any time. For withdrawal of consent, click “Withdraw Consent (Delete Account)” on the website's main page or contact the Privacy Officer via mail, telephone, or email and your personal information will be deleted and other necessary measures will be taken. Personal information deleted by the request of a user or his or her legal representative shall be processed as stated in 5. Period of Retention and Use of Personal Information, and cannot be accessed or used for other purposes.8. Installation, Operation, and Refusal of Automatic Data Collection ToolsThe Company website uses cookies that constantly save and bring back your information. Your information collected through cookies include your username and the pages you view. Other information are not subject for collection. Information collected through cookies are used for the following purposes:- To analyze the access frequency and visiting hours of members and non-members to the Company website and understand user interests for targeted marketing and renewal of services- To understand your participation and visiting frequency to promotional events held by the Company website and provide distinctive participating opportunities and differentiated information according to personal interestsYou have the right to choose the use of cookies.From your web browser, go to [Tools] > [Internet options] > [Security] > [Custom level] and choose whether to allow the use of all cookies, confirm each time a cookie is to be saved, or refuse all cookies.9. Protection Measures to Ensure the Stability of Personal Information (Technical Measures for the Protection of Personal Information)To prevent loss, theft, divulgence, forgery, alteration, or damage of your personal information, the Company website formulates technical measures as follows:<ol><li>(1) Your personal information is protected with a password, and the files and transferred data are encrypted or locked using a separate security feature.</li><li>(2) The Company website uses an antivirus software that is updated regularly to prevent damages from computer viruses. In the event novel virus appears, a relevant software is distributed as soon as it is developed to prevent infringement of personal information.</li><li>(3) The Company website strictly selects security devices (SSL or SET) to safely transmit personal information in networks by using encryption algorithms.</li><li>(4) To prevent personal information leakage through hacking or other methods, the Company uses a device that blocks access from external channels and has installed an intrusion detection system in each server to monitor intrusions 24 hours a day.</li></ol>10. Privacy Officer or Division in Charge of Personal InformationTo protect your personal information and manage complaints in relation to personal information, the Company has designated a Privacy Officer to manage your personal information on the website and is currently building a channel where you can submit your opinions and complaints in relation to personal information protection.Should you have any questions and/or complaints regarding personal information or concerns on the infringement on the rights and interests of information subjects, such as the possibility of leakage of personal information, please contact the Privacy Officer and we will take immediate action on the case.<figure class="table"><table><thead><tr><th>Privacy Officer</th><th>Privacy Staff</th></tr></thead><tbody><tr><td>Name: Lee Sang-ho</td><td>Name: Park Kyeong-min</td></tr><tr><td>Department / Position: Promotion Group / Head</td><td>Department / Position: Promotion Group / Assistant Manager</td></tr><tr><td>Tel. / Email: +82-32-748-2902 /shlee1669@poscoenc.com</td><td>Tel. / Email: +82-32-748-2826 /balsi.civil@poscoenc.com</td></tr></tbody></table></figure>For consultation on or to report other infringement on personal information, you may contact the following organizations:- Korean National Police Agency Cyber Bureau (<a href="http://cyberbureau.police.go.kr/">cyberbureau.police.go.kr</a> / 182 without area code) - Cybercrime Investigation Division, Supreme Prosecutors’ Office of the Republic of Korea (<a href="http://www.spo.go.kr/">spo.go.kr</a> / 1301 without area code) - Personal Information Infringement Report Center (<a href="http://privacy.kisa.or.kr/">privacy.kisa.or.kr</a> / 118 without area code) - Personal Information Dispute Mediation Committee (<a href="http://kopico.go.kr/">kopico.go.kr</a> / 1833-6972)11. Duty of NotificationThis Privacy Policy was enacted on September 30, 2011. Should there be any addition, deletion, or modification of the contents in accordance with the change of laws, policies, or security technology, the reasons for such change and the contents shall be notified through the Company website at least ten (10) days prior to the implementation of the revised Privacy Policy.- Privacy Policy version no.: v1.7 - Enacted on: September 30, 2011 - Final modification made on: February 28, 2020

General provisions

POSCO E&C Ltd. discloses the following privacy policy to protect the personal information of data subjects and handle related complaints quickly and efficiently according to Article 30 of the 『Personal Information Protection Act』. This policy stipulates how the personal information you provide is used, what it is used for, and what measures are taken to protect it.

* This policy has been revised on 2023.01.31.

- revised content : Enactment of Privacy Policy

Consent to collection of personal information

POSCO E&C prepared a procedure for clicking the 「Agree」 button with regard to the terms and conditions of the POSCO E&C Official Website (https:// www.poscoenc.com/). If you click the 「Agree」button, you will be deemed to have consented to collection of personal information.

- This service (site) does not collect the personal information of children under 14, or post or provide information harmful to children on the website.

Purposes of collecting and using personal information

The POSCO E&C Official Website collects only the minimum personal information necessary for using the service.

Personal information will not be used for purposes other than the following, and if the purposes of using personal information are changed, necessary measures, e.g. obtaining a separate consent, will be taken according to Article 18 of the Personal Information Protection Act.

To use the services of the POSCO E&C Official Website, you must enter following information when submitting inquiry.

- Employment Inquiry : Name, E-mail.

- Business Inquiry : Name, E-mail.

The specific purposes of collecting and using each personal information item are as follows:

- Name, E-mail : Communication Purposes(Q&A)

Period of retaining and utilizing personal information

The retention period of the personal information collected in the the POSCO E&C Official Website will be retained for 3 year and will be destroyed after answering.

The POSCO E&C Official Website destroys your personal information beyond recovery (if personal information was provided to a third party, the third party will also be instructed to destroy it). In any of the following events, however, personal information will be retained for the specified period.

· ① If it is necessary to retain personal information according to laws, such as the Commercial Act, the transaction details and the minimum basic information will be retained for the retention period set forth in the laws

· ② The retention period will be notified to reporter in advance, and if the retention period has not expired, and the consent of individual members was obtained, personal information will be retained for the promised retention period.

Out-of-purpose use and provision to a third party

In principle, the POSCO E&C Official Website will process the personal information of data subjects within the scope specified as the collection and use purposes, and except for the following events, personal information will not be processed or provided to a third party beyond the original purposes without the prior consent of data subjects.

· ① if separate consent is obtained from data subjects

· ② if there are special provisions in laws

Consignment of personal information

· ① The POSCO E&C Official Website is outsourcing personal information management for efficient personal information management as follows:

Outsourcee	Description of outsourced jobs	Period of retaing and utilizing personal information
POSCO ICT	Service operations	Personal Information is destroyed without exception when Purposes of collecting personal information are achieved.

· ② When the outsourcing contract is concluded, the POSCO E&C Official Website stipulates matters concerning responsibility, e.g. prohibition of processing personal information for purposes other than performing the outsourced jobs, technical and administrative protection measures, limitation of re-outsourcing, management and supervision of outsourcees, compensation for damages, etc. in documents like contracts, and supervises whether the outsourcee is safely processing personal information according to Article 25 of the Personal Information Protection Act.

· ③ If outsourced jobs or outsourcees are changed, we will immediately disclose the information through this privacy policy.

Technical measures to protect personal information

When handling personal information, the POSCO E&C Official Website has the following technical measures to ensure safety in processing your personal information so that it is not lost, stolen, leaked, altered or damaged

· ① Your personal information will be protected by a password, and important data will be protected by using separate security functions, such as encrypting files and transmission data or using the lock function.

· ② The POSCO E&C Official Website is using vaccine programs to prevent damages due to computer viruses. Vaccine program is periodically updated, and if a virus appears suddenly, we will provide a vaccine as soon as it becomes available to prevent infringement of personal information.

· ③ The POSCO E&C Official Website has a security device (SSL or SET) that can use the encryption algorithm to safely transmit personal information on the network.

· ④ To prevent your personal information from being leaked due to hacking, etc., we are using a device that prevents intrusion from the outside, and installed the intrusion detection system in each server for 24-hour monitoring of intrusion.

Using cookies to collect personal information

The POSCO E&C Official Website operates 'cookies' that save and find your personal information frequently. Your personal information, which the POSCO E&C Partner Portal website collects through cookies, will be limited to (ID, page views, etc.), and no other information will be collected. This information will be used for the following purposes:

We analyze the access frequency, view page and visit duration of POSCO E&C Official Website visitors, and use them as a yardstick for improving website services.

You have options with regard to cookies. You can allow all cookies by selecting [Tool] > [Internet options] > [Security] > [User-defined level] in the web browser, or confirm every time a cookie is saved, or refuse to save any cookie.

Chief Privacy Officer, listening to opinions/handling complaints

To protect your personal information and handle related complaints, the POSCO E&C Official Website is administered by personal information manager, and provides a channel for leaving your opinions and complaints about privacy policy. If you have any question or complaint with regard to your personal information, please contact the personal information manager below. We will take necessary measures, and notify the result to you immediately.

Description	Chief Privacy Officer	Personal information manager
Name	Kyeung-Won, Kim	Jae-wook, Jung
Department	Promotion Group	Promotion Group
Tel. / E-Mail	032)748-2182 / iloveincheon@poscoenc.com	032)748-2631/ jaewook.jung@poscoenc.com

You may contact the following agencies to seek relief actions to infringement of personal information and ask questions.

* The following agencies are independent from the Company. Please contact them if you are not satisfied with the company's handling of your complaints or the result of relief actions, or need help or more detailed information.

National Police Agency Cyber Bureau

website: cyberbureau.police.go.kr

phone: (without exchange number) 182

High-Tech Crime Investigation Division, Supreme Prosecutors' Office

website: www.spo.go.kr

phone: 02-3480-3573

Privacy Complaint Center (operated by Korea Internet and Security Agency)

functions: receiving reports or requests for counseling on infringement of personal information

website: privacy.kisa.or.kr

phone: (without exchange number) 118

address: (58324) Privacy Complaint Center, 3F, Jinheung-gil 9, Naju, Jeollanam-do(Bitgaram-dong 301-2)

Personal Information Dispute Mediation Committee

functions: receiving requests for mediation of disputes related to personal information or collective disputes (civil settlement)

website: www.kopico.go.kr

phone: (without exchange number) 1833-6972

address: (03171) 4F, Government Complex-Seoul, 209, Sejong-daero, Jongno-gu, Seoul

Matters concerning destruction of personal information

If personal information is no more necessary due to its retention period expiration, or the accomplishment of purposes of processing personal information, the company will immediately destroy the personal information.

The procedure and method of destroying personal information are as follows:

· 1. Destruction procedure: Unnecessary personal information and personal information files are handled as follows according to the internal guideline. Destruction of personal information: We destroy personal information immediately when the retention period expires.

· 2. Destruction method: We destroy information in the form of electronic files beyond recovery, and shred or incinerate personal information printed on paper.

Obligation to notify policy changes

This privacy policy was established on Jan. 31, 2023, and if it has any addition/erasure or modification due to changes in laws/policies or security technology, we will post notices about the reason for change and details on our website at least 10 days prior to enforcement of the revised privacy policy.

· - Privacy policy version number: v1.00

· - Privacy policy enforcement date: 2023-01-31

· - Last revision date of the privacy policy: 2023-01-31

CCTV Operation policy

CCTV Policy for the Protection of Personal Information

CHAPTER I GENERAL PROVISIONS

Article 1 (Purpose)

The purpose of this Policy is to fulfill appropriate duties and comply with applicable laws by setting matters POSCO E&C Ltd. (the “Company”) must comply with in relation to the installation and operation of closed-circuit televisions and protection of footages.

Article 2 (Definitions)

The terms used in this Policy shall be defined as follows:

1. The term closed-circuit television (“CCTV”) is a type of communication network, in which the footages recorded from the CCTVs located in specific sites are collected and transmitted to exclusive receivers through wired/wireless closed-circuit channels.
2. The term “footage” refers to CCTV recordings of which the recorded subject can be identified.
3. The term “data subject” refers to an individual who can be identified from the footage; that is, the subject of footage.
4. The term “processing” refers to the act of handling data collected through CCTVs, such as inputting, saving, editing, deleting, playing, and other similar acts, excluding the collection of such data.

Article 3 (Scope of Application)

(1) In relation to the installation and operation of CCTVs needed for crime prevention, facility security, and fire safety, as well as the protection of footages that are collected and processed by the aforementioned reasons, the provisions of this Policy shall be observed, unless special provisions are stipulated in other laws.
(2) Use of auxiliary cameras for CCTVs installed and operated by the Company shall also comply with this Policy, regardless of the fact whether their recordings are treated as actual footages or not.

Article 4 (Protection of Footages)

(1) The Company shall collect minimum scope of footages that meets the purpose of CCTV installation.
(2) The Company must have the data subject clearly aware of the installation purpose as mentioned in paragraph (1) of this Article. The footages shall not be used for other purposes than the said purpose.
(3) The Company shall secure accurate and the latest footages and manage them in a safe manner.
(4) The Company shall disclose general matters in relation to the handling of footages and protect the rights of data subjects.

CHAPTER II REQUIREMENTS FOR CCTV INSTALLATION

Article 5 (Notification of Installation Plans, etc.)

In the event of installing a CCTV, the Company shall prepare a CCTV installation and operation plan (“Plan”) that includes the following items:

1. Purpose of CCTV installation;
2. Division in charge of CCTV control: Handling officer and contact details;
3. Number of cameras, locations, performance, and scope of recording of the CCTV to be installed and operated;
4. Standard of the caution sign to be installed and the installation location in accordance with Article 7(1);
5. Contents, procedures, and methods regarding the data subject's exercise of rights and means of objection;
6. CCTV recording time, retention period of footages, methods of storage, management, and deletion of footages, and storage location of footages;
7. Actual location where footages transmitted from CCTVs are accessed and played, and access control to the said location;
8. Grounds, procedures, and methods of providing or granting access to footages to a third party; and
9. Other matters recognized to be necessary for the protection of footages

Article 6 (Designation of CCTV Managers)

(1) The head of the division in charge of the installation and operation of CCTVs shall be designated as the CCTV General Manager, while his or her staff shall be designated as CCTV Operation Manager(s) (“CCTV Manager(s)”).
(2) The CCTV Manager shall take charge of duties in relation to the installation and operation of CCTVs, reception and handling of complaints, and collection and processing of footages.
(3) The CCTV Manager shall designate and manage a separate Personal Information Handler and inform the CCTV General Manager of relevant information in the event of CCTV installation and/or other changes.

Article 7 (Installation of Caution Signs)

(1) In the event of installing a CCTV, the Company shall put up caution signs regarding CCTV operation and the collection of footages for the recognition of data subjects.
(2) The signs in relation to paragraph (1) of this Article shall mention the following items:
- 1. Purpose of CCTV installation;
- 2. Recording scope and time; and
- 3. Information on the CCTV handling division, CCTV Manager, and contact details
(3) The signs in relation to Paragraph (1) of this Article shall be installed within the recording scope where they are easily visible and understood by data subjects.
(4) Notwithstanding Paragraph (2), in the event of installing several CCTVs in the Company’s building, the sign that complies with Paragraph (1) may mention that the whole building is within the recording scope and can be attached only on the building exits.

CHAPTER III REQUIREMENTS FOR HANDLING FOOTAGES

Article 8 (Limitation on Collection)

(1) CCTVs shall not be arbitrarily manipulated or shoot other places beyond the purpose of their installation during collection of footages.
(2) Footage rotation and zooming features that have no relation to the purpose of CCTV installation may not be used during collection of footages.

Article 9 (Limitation on Processing)

Footages of a data subject may not be used for other purposes than the CCTV installation purpose or be granted access or provided to a person who has no access authority: Provided, That this shall not apply in any of the following circumstances:

1. Where consent is obtained from the data subject;
2. Where the data is given access or provided to the data subject;
3. Where special provisions exist in other laws;
4. Where the data is provided in a pseudonymized manner when it is required for the purposes of reporting by the media through newspapers or broadcasting;
5. Where there is an urgent reason for not obtaining the data subject's consent when the risk that the rights and interests of the data subject may be infringed is clear and present;
6. Where it is necessary for the investigation of a crime, indictment, and/or prosecution; or
7. Where it is necessary for the enforcement of punishment, probation, and custody.

Article 10 (Safeguards, etc.)

The Company shall designate a place where footages transmitted by CCTVs are actually accessed and played (“Control Center”) as a restricted zone and strictly limit the access of individuals apart from those who have been granted the authority.
(2) The Company shall limit the authority to access footages to CCTV Managers and the minimum number of designated personnel.
(3) The Company shall regularly inspect and check the normal operation of CCTVs and keep an accurate record regarding the matters.
(4) The Company shall seek for technical and managerial safety measures in response to illegal access, alteration, leakage, and damage of footages.
(5) The Company shall prepare a training course on the personal information protection of data subjects for those who are granted authority to access footages.

Article 11 (Request for Access, etc.)

(1) A data subject may request to confirm the existence, access, and/or delete footages to the Company.
(2) In relation to the request as mentioned in the paragraph (1) of this Article, the Company shall take immediate action in accordance with Article 5(5).
(3) Notwithstanding Paragraph (2) of this Article, the Company may refuse to take action in the event of any of the following circumstances. In this case, the grounds for refusal and objection method shall be informed (including information and communications networks) to the data subject within seven (7) days.
- 1. Where it may cause grave difficulties in performing investigation of crimes, prosecution, and conduct of trials;
- 2. Where deleting only the footages of a specific data subject is extremely difficult in technical manner;
- 3. Where taking appropriate action as prescribed in Paragraph (1) of this Article may infringe upon other's privacy rights; or
- 4. Where there are appropriate grounds to refuse the request for access, etc., that meet the public interest.

Article 12 (Retention and Deletion)

Footages collected through CCTVs shall be deleted without delay once the data retention period mentioned in the Plan expires: Provided, That when it is difficult to determine the minimum period of time required to achieve the purpose of data retention due to the nature of a division, the retention period shall be within thirty (30) days after the collection of footages.

CHAPTER IV SUPPLEMENTARY PROVISIONS

Article 13 (Consignment of Duties)

(1) In the event of consigning the duties in relation to the installation, operation, and management of CCTVs, the Company shall take necessary safety measures to prevent the abuse of footages and supervise the consignee.
(2) The consignee who is granted authority to access footages in relation to paragraph (1) of this Article shall undergo a training course as mentioned in Article 10(5).[lh1]

Article 14 (Confidentiality)

Those who handle or have handled footages shall not use the obtained data for inappropriate purposes, such as revealing, processing without authority, and/or providing for the use of another person.

Article 15 (Exclusion)

This Policy shall not be applied to CCTVs installed and operated to supervise the duties of individuals who are with the military regardless of their duties.