In accordance with Article 30 of the Personal Information Protection Act, the Company establishes and discloses the following privacy policy to protect the personal information of data subjects and to ensure prompt and smooth handling of related grievances.

Article 1(Purpose of Processing Personal Information)
The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those specified below. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
Membership Registration and Management
To confirm the intent to register as a member, provide membership-based services, verify and authenticate identity, maintain and manage membership status, implement a limited identity verification system, prevent fraudulent service use, verify legal representatives’ consent when processing personal information of children under 14, issue various notices and notifications, and handle complaints.
Provision of Goods or Services
To deliver goods, provide services, send contracts and invoices, supply content, offer personalized services, verify identity and age, process payment and settlement, and conduct debt collection.
Handling of Complaints
To verify the identity of complainants, confirm the nature of complaints, contact and notify for fact-finding, and communicate processing results.

Article 2(Processing and Retention Period of Personal Information)
The Company processes and retains personal information within the retention and use period prescribed by law or agreed upon by the data subject at the time of collection.
The personal information processing and retention periods for each purpose are as follows:

1. Membership Registration and Management
Retained until withdrawal from the business/entity website.
However, in cases where the following conditions apply, the retention period extends until the condition is resolved:
If an investigation or inquiry is ongoing due to a violation of related laws, the retention period extends until the completion of the investigation or inquiry.
If there are outstanding debts or claims arising from website usage, the retention period extends until settlement of those claims.

2. Provision of Goods or Services
Retained until the completion of goods/service provision and payment/settlement.
However, in cases where the following conditions apply, the retention period is as follows:
Records related to transactions under the Act on the Consumer Protection in Electronic Commerce, etc.:
Records on display/advertisement: 6 months
Records on contracts, withdrawal of offers, payment, and supply of goods: 5 years
Records on consumer complaints and dispute resolution: 3 years
Retention of telecommunications records under the Protection of Communications Secrets Act:
Subscriber telecommunications information (e.g., communication time, start/end time, counterparty’s phone number, base station location): 1 year
Computer communication, internet log records, access tracking data: 3 months

Article 3(Provision of Personal Information to Third Parties)
The Company processes personal information only within the scope outlined in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only when consent is given by the data subject, when required by special provisions in the law, or under Article 17 of the Personal Information Protection Act.
The Company provides personal information to third parties as follows:

Recipient:
Purpose of Use by Recipient:
Personal Information Provided:
Retention and Use Period by Recipient:

Article 4(Rights of Users and Legal Representatives and How to Exercise Them)
Data subjects may exercise the following personal information protection rights at any time:
- Request access to personal information
- Request correction of errors
- Request deletion of personal information
- Request suspension of processing
- Requests under Paragraph 1 can be submitted via written documents, phone, email, or fax, and the Company will promptly take action.

If a data subject requests correction or deletion due to errors in their personal information, the Company will not use or provide the information until the correction or deletion is complete.
A data subject’s rights may also be exercised through a legal representative or an authorized agent, in which case, a power of attorney must be submitted in accordance with Form No. 11 of the Enforcement Rules of the Personal Information Protection Act.
The data subject must not violate relevant laws and infringe upon the personal information or privacy of the Company or others.

Article 5(Items of Personal Information Processed)
The Company processes the following personal information:

1. Membership Registration and Management
Required items:
Optional items:

2. Provision of Goods or Services
Required items:
Optional items:

3. Information Automatically Collected During Internet Use
IP address, cookies, MAC address, service usage records, visit records, records of improper use, etc.

Article 6(Destruction of Personal Information)
The Company promptly destroys personal information when the retention period has expired or when the purpose of processing has been achieved.
If retention is required by law despite the expiration of the agreed-upon retention period, the data will be transferred to a separate database (DB) or stored in a different location.
Destruction Procedures and Methods:
Procedure: Personal information scheduled for destruction is selected and destroyed upon approval from the Company’s Personal Information Protection Officer.

Method:
Electronic files: Irretrievably deleted using low-level format (LLF) or equivalent methods.
Paper documents: Shredded or incinerated.

Article 7(Measures for Personal Information Security)
The Company implements the following security measures:

Administrative Measures: Establishment and implementation of internal management plans, regular employee training, etc.
Technical Measures: Access control to personal information systems, installation of access control systems, encryption of unique identifiers, installation of security programs.
Physical Measures: Access control to computer rooms, data storage rooms, etc.

Article 8(Use of Cookies and Their Management)
The Company uses cookies to provide personalized services.
Users can refuse the storage of cookies by adjusting browser settings under Tools > Internet Options > Privacy.

Article 9(Personal Information Protection Officer)
The Company is responsible for overseeing the processing of personal information and has designated a Personal Information Protection Officer to handle complaints and provide relief related to personal information processing.

▶ Personal Information Protection Officer
- Name: Park Sangmok
- Position: Team Leader
- Contact: 051-260-2333 / parksm@idaehan.com
※ Connected to the Personal Information Protection Department.

▶ Personal Information Protection Department
- Department: PPE Business Team
- Contact Person: Hong Jeongbong
- Contact: 051-260-2333 / jbhong@yksteel.co.kr
Data subjects may contact the Personal Information Protection Officer or the Personal Information Protection Department for inquiries, complaints, and requests for relief related to personal information while using the Company’s services (or business). The Company will respond and process such inquiries without delay.

Article 11(Request for Access to Personal Information)
Data subjects may request access to their personal information under Article 35 of the Personal Information Protection Act by contacting the department listed below. The Company will make every effort to process such requests promptly.

▶ Personal Information Access Request Department
- Department: PPE Business Team
- Contact Person: Hong Jeongbong
- Contact: 051-260-2333 / jbhong@yksteel.co.kr

Article 12 (Remedies for Personal Information Infringement)
Data subjects may contact the following organizations for personal information infringement reports, relief, or counseling:

▶ Personal Information Infringement Report Center (Operated by KISA - Korea Internet & Security Agency)
Services Provided: Reporting personal information breaches, counseling requests
- Website: privacy.kisa.or.kr
- Phone: (No area code) 118
- Address: 3rd Floor, Personal Information Infringement Report Center, 9 Jinheung-gil, Naju-si, Jeollanam-do, 58324, South Korea

▶ Personal Information Dispute Mediation Committee
Services Provided: Mediation of personal information disputes, class action mediation (civil resolution)
- Website: www.kopico.go.kr
- Phone: (No area code) 1833-6972
- Address: 4th Floor, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul, 03171, South Korea

▶ Supreme Prosecutors’ Office Cybercrime Investigation Division
- Phone: 02-3480-3573
- Website: www.spo.go.kr

▶ National Police Agency Cyber Bureau
- Phone: 182
- Website: http://cyberbureau.police.go.kr

Article 13 (Implementation and Changes to the Privacy Policy)
This Privacy Policy has been in effect since January 10, 2023.