HYUNDAI STEEL Cyber Audit

Purpose of processing personal information

Hyundai Steel processes personal information for the following purposes. The processed personal information will not be used for purposes other than those stated below, and in the event that the purpose of use is changed, necessary measures will be taken, including obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

Processing and retention period of personal information

Hyundai Steel processes and retains personal information within the period for which consent was obtained from the
information subject, or according to the retention and usage periods of personal information as stipulated by law.

• Hyundai Steel does not, in principle, collect personal information from users under the age of 14.
  If it is necessary to collect personal information from users under 14 for service use, prior consent will be obtained from their legal guardian. The collected information will be
  promptly discarded upon completion of the relevant task, and during the process, strict measures will be taken to ensure the protection of personal information.

Personal Information Processing Item

Hyundai Steel processes the following personal information items.

Entrusting the processing of personal information

Hyundai Steel entrusts the processing of personal information as follows to ensure smooth management of personal information tasks.

Destruction procedures and methods for personal information

1. Hyundai Steel will promptly destroy the personal information once the purpose of processing has been achieved. However, this does not apply in cases where retention is required by other laws. The procedures, timelines, and methods for destruction are as follows.

• A. Destruction Procedure: Personal information that has exceeded the retention period will be destroyed without delay from the expiration date.
• B. Destruction method:
  • 1) The electronic form of information uses a technical method that cannot reproduce the record.
  • 2) Personal information printed on paper is destroyed by shredding or incineration.

Rights and obligations of the information subject and legal representatives, and how to exercise them

• 1. The information subject (referring to legal representatives in the case of those under 14 years of age) may exercise rights such as requesting access, correction, deletion, or suspension of processing of their personal information held by Hyundai Steel at any time.
• 2. Rights under Paragraph 1 can be exercised by contacting the personal information manager via the email provided below with a request for “access, correction, deletion, or suspension of processing of personal information,” and action will be taken without delay.
• 3. Exercise of rights under Paragraph 11 can be carried out through a representative, such as a legal representative of the information subject or an authorized person.
• 4. Requests for access to personal information and suspension of processing may be limited under Article 35, Paragraph 44 and Article 37, Paragraph 22 of the Personal Information Protection Act.
• 5. Requests for correction and deletion of personal information cannot be made if the information is explicitly stated as being subject to collection under other laws.
• 6. When requests for access, correction, deletion, or suspension of processing are made, we will verify whether the person making the request is the information subject or a legitimate representative.

Measures for ensuring the security of personal information

Hyundai Steel implements the necessary technical, managerial, and physical measures to ensure security in accordance with Article 29 of the "Personal Information Protection Act" as follows.

• 1. Establishment and implementation of internal management plans: The establishment and implementation of Hyundai Steel’s internal management plans are carried out in accordance with Hyundai Steel’s internal management guidelines.
• 2. Minimization and training of personal information handlers: Individuals responsible for handling personal information are designated and minimized, and measures are implemented to manage personal information accordingly.
• 3. Access restrictions to personal information: Necessary measures are taken to control access to personal information by granting, modifying, or revoking access rights to the database systems that process personal information, and unauthorized access from external sources is restricted using intrusion prevention systems.
• 4. Storage of access records and prevention of tampering: Records of access to the personal information processing system (such as web logs and summary information) are retained and managed for at least one year, and security features are implemented to prevent tampering, theft, or loss of access records.
• 5. Encryption of personal information: Users’ personal information is encrypted and stored securely. In addition, important data is subjected to encryption during storage and transmission, and other security features are utilized.
• 6. Technical measures against hacking: Hyundai Steel installs security programs and performs regular updates and inspections to prevent personal information leakage and damage caused by hacking or computer viruses. Systems are installed in areas where access is restricted from external sources, and technical and physical monitoring and blocking measures are in place. In addition, monitoring of network traffic is conducted, as well as detection of attempts to illegally alter information.
• 7. Access control for unauthorized persons: A separate physical storage location for the personal information systems is established, and access control procedures are implemented and managed accordingly.

Installation, operation, and refusal of devices for automatic collection of personal information

• 1. Hyundai Steel uses cookies to store user information and retrieve it periodically.
• 2. Cookies are small amounts of information sent from the server (http) operating the website to the user’s computer browser, which may be stored on the hard disk of the user’s PC.
  • A. Purpose of using cookies: Cookies are used to determine the frequency of user access and visit times, thereby providing users with more convenient services.
  • B. Installation, operation, and refusal of cookies: You can configure cookie acceptance or blocking settings through your browser’s options.
    • 1) Internet Explorer: Tools menu in the upper right corner of the web browser > Internet Options > Privacy > Settings > Advanced
    • 2) Edge: Settings menu in the upper right corner of the web browser > Cookies and site permissions > Manage and delete cookies and site data
    • 3) Chrome: Settings menu in the upper right corner of the web browser > Privacy and security > Cookies and other site data
  • C. If you refuse or block the storage of cookies, you may encounter difficulties in using the services.

Information on the Personal Information Protection Officer

To protect personal information and address complaints related to personal information, we have designated the following Personal Information Protection Officer and staff members.

Department responsible for receiving and processing requests for access to personal information

1. Information subjects may request access to personal information in accordance with Article 35 of the Personal Information Protection Act through the department listed below.

Remedies for infringement of the rights of information subjects

1. Information subjects may inquire about remedies and consultations regarding personal information infringement with the following organizations.

2. In addition, if an information subject’s requests for access, correction, deletion, or suspension of
processing of personal information lead to infringement of their rights or interests due to actions or omissions of the head of a public institution,
they may file an administrative appeal in accordance with the provisions of the Administrative Appeal Act.

Matters relating to changes in the privacy policy

• 1. This policy will take effect from January 1, 2024.
• 2. The previous privacy policy can be reviewed at the top of the Cyber Audit Office website under “View revision history.”