HYUNDAI-STEEL

Article 1 General Provisions

1. 1. Personal information is information about a living individual that can be used to identify that individual by details such as his or her name, including information that can be easily combined with other information to identify the individual, even if such information alone does not identify a specific individual.
2. 2. The Company places great importance on the protection of customers’ personal information and complies with the personal information protection regulations under the Personal Information Protection Act and the Personal Information Protection Guidelines established by the Ministry of the Interior and Safety. The Company informs through the Privacy Policy of the method and purpose of collecting and using the personal information the customer has provided of the measures we take for protection of personal information.
3. 3. The Company ensures that the Privacy Policy is publicly available on the main screen of the website so that customers can easily access it at any time.

Article 2 Purpose of Processing Information

Hyundai Steel processes personal information for the following purposes. The processed personal information will not be used for purposes other than those stated below, and in the event of a change in the purpose of use, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

Article 3 Processing and Retention Period of Personal Information

Hyundai Steel processes and retains personal information within the retention and use period of personal information stipulated by law or within the retention and use period of personal information to which the data subject consented when the personal information was collected.

Article 4 Items of Personal Information Being Processed

Hyundai Steel processes the following personal information with the consent of the data subject.

Article 5 Entrustment of Personal Information Handling

1. 1. The Company does not use customers’ personal information or provide customers’ personal information to others, including other companies and organizations, in any case beyond the scope stipulated in Article 3 of Personal Information Protection Act ("Principles of Information Protection") except with the customer’s consent or as prescribed by relevant laws and regulations.
2. 2. In the following cases, it is possible to provide personal information without the customer’s consent in accordance with relevant laws and regulations:
   • Performance of contracts for service provision;
   • In accordance with relevant laws and regulations, or when there is a request from investigative agencies in accordance with procedures and methods prescribed by law for investigative purposes
   • Providing personal information in a form that cannot identify specific individual for purposes of statistics, academic research, or market research.
3. 3. The Company entrusts the processing of personal information as follows to ensure the smooth handling of personal information tasks

Article 6 Entrustment of Handing Collected Personal Information

The Company does not entrust customers’ information to external companies without the customer’s consent. If such a need arises, we will notify you of the party to be entrusted and the details of the work to be performed and, if necessary, obtain your prior consent.

Article 7 Procedures and Methods for Destruction of Personal Information

The Company's policy is to destroy personal information promptly after the purpose for which it was collected and used has been achieved, unless other laws require the retention of personal information. The procedures and methods for destruction of personal information are as follows:

1. 1. The information you entered for membership registration and other purposes will be transferred to a separate database (or to a separate filing cabinet in case of paper documents) after the purpose has been achieved. It will be stored for a certain period of time in accordance with internal policies and other relevant laws for information protection reasons (see the retention and use period) before being destroyed. Personal information transferred to a separate database will not be used for other purposes than storage, unless otherwise regulated by laws.
2. 2. The information you entered for membership registration and other purposes will be transferred to a separate database (or to a separate filing cabinet in the case of paper documents) after the purpose has been achieved. It will be stored for a certain period of time in accordance with internal policies and other relevant laws for information protection reasons (refer to the retention and usage period) before being destroyed. Personal information transferred to a separate database shall not be used for other purposes than storage, unless otherwise regulated by laws.

Article 8 Rights of Users and Legal Representatives, and the Exercise Thereof

1. 1. Users (or their legal representatives in case of users under the age of 14) can exercise their rights to access, correct, delete, or request the suspension of processing their personal information held by Hyundai Steel at any time.
2. 2. The rights referred to in paragraph 1 may be exercised by sending a "request for access, correction, deletion or suspension of processing personal information" to Privacy Officer’s email address set forth below, and we will make measures without delay.
3. 3. The rights referred to in paragraph 1 may be exercised through a representative, such as the user’s legal representative or a person delegated.
4. 4. Requests for access to personal information and suspension of processing personal information may be limited in accordance with Article 35(4) and Article 37(2) of the Personal Information Protection Act.
5. 5. Requests for correction and deletion of personal information cannot be made if the personal information is explicitly specified as a subject of collection in other laws.
6. 6. Hyundai Steel may request evidence necessary to verify whether the person requesting access, correction, deletion, or suspension of processing personal information is the user himself/herself or the user’s a legitimate representative, if necessary.

Article 9 Installation and Operation of Automatic Personal Information Collection Device, and Refusal Thereof

The Company uses cookies that save and recalls your information. A cookie is a very small text file that is sent to your browser by the server that operates the Company's website and is stored on your computer's hard drive. The Company uses cookies for the following purposes:

1. 1. Analyzing the frequency of access and visit time for members and non-members, identifying users’ preferences and areas of interest, tracking user behavior, understanding the extent of participation in various events, and visit counts to provide targeted marketing and personalized services.
2. 2. You have the right to choose whether cookies are used. Therefore, you can set your web browser options to accept all cookies, confirm each time a cookie is saved, or refuse the storage of all cookies.
3. 3. To refuse cookies, for example, you can set your web browser to accept all cookies, to confirm each time a cookie is stored, or to reject all cookies.
4. 4. Example of Setting Method (for Internet Explorer)
   • Go to Tools > Internet Options > Privacy at the top of the web browser. However, please note that if you refuse cookie installation, there may be difficulties in providing services.

Article 10 Securing Safety of Personal Information

Hyundai Steel implements the necessary technical, managerial, and physical measures to ensure security in accordance with Article 29 of the "Personal Information Protection Act" as follows.

1. 1. Establishment and Implementation of an Internal Management Plan: The establishment and implementation of Hyundai Steel’s internal management plan is carried out in accordance with Hyundai Steel's internal management guidelines.
2. 2. Minimizing the number of Privacy Officers and Training Them: We designate Privacy Officers and minimize the number of them who handle personal information and implement measures to manage personal information.
3. 3. Access Control for Personal Information: We take the necessary steps to control access to personal information by granting, changing, and revoking access rights to database systems that process personal information, and we control unauthorized access from external sources using an intrusion prevention system.
4. 4. Retention of Access Records and Prevention of Forgery and Alteration: We retain and manage access records (such as web logs, summary information, etc.) for at least one year and use safeguards to prevent the forgery and alteration, theft or loss of access records.
5. 5. Encryption of Personal Information: Users’ personal information is stored and managed in an encrypted form. We also use other security features, such as encrypting important data during storage and transmission.
6. 6. Technical Measures Against Hacking and Other Threats: Hyundai Steel installs security programs and conducts regular updates and inspections to prevent personal information leakage and damage caused by hacking or computer viruses. Systems are installed in areas where access is controlled from the outside, and they are monitored and blocked both technically and physically. We also monitor network traffic and detect attempts to illegally alter information.
7. 7. Access Control for Unauthorized Persons: We have a separate physical storage location for the personal information systems that store personal information, and we have established and operate access control procedures for this location.

Article 11 Privacy Officers and Handling Complaints Regarding Personal Information

The Company has designated the relevant departments and privacy officers as set forth below to protect customers’ personal information and to handle complaints regarding personal information.

Article 12 Remedies for Infringement of Users’ Rights and Interests

1. 1. Users can inquire about remedies, consultations, etc., regarding personal information infringement to the institutions listed below.

   기관명 소관업무 홈페이지 전화번호

   Institution Name	Relevant Duties	Website	Contact
   Privacy Violation Report Center (KISA)	Reporting Personal Information Infringement and Requesting Consultation	privacy.kisa.or.kr	118 (without area code)
   Personal Information Dispute Mediation Committee (KOPICO)	Personal Information Dispute Mediation Committee (KOPICO)	www.kopico.go.kr	+82-1833-6972
   Cyber Crime Investigation Division of the Supreme Prosecutors' Office	Cyber Crime Investigation Division of the Supreme Prosecutors' Office	www.spo.go.kr	1301 (without area code)
   Cyber Investigation Bureau of the National Police Agenc	Cyber Investigation Bureau of the National Police Agency	ecrm.cyber.go.kr	182 (without area code)

2. 2. A person whose rights or interests have been infringed due to an action or omission by the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

Central Administrative Appeal Commission: 110 (without area code) (www.simpan.go.kr)

• Privacy Policy Version Number: V 2.0
• Effective Date of Privacy Policy: September 1, 2024