1. The personal information of the individuals to whom the information relates (“data subjects”) will be used by KLP solely for the purposes set forth in Article 1 above. KLP will not use personal information beyond the original scope of such purpose or transfer personal information to any third party except in the following circumstances:

• 1) if separate consent is obtained from the data subject;
• 2) if the transfer is required by law or regulation; or
• 3) if the transfer is necessary in emergency situations to protect life, safety, or property of the data subject concerned or a third party, when the data subject or his/her legal representative is not in a position to express intent or it is impossible to obtain prior consent from the data subject due to an inability to contact the data subject, etc.

2. In obtaining consent under item 1 of Paragraph (1) above from a data subject, KLP will provide the following information to the data subject. KLP will also notify the data subjects if the following list changes and will obtain their consent:

• 1) the proposed third party recipients of the personal information;
• 2) the purpose for transferring the personal information (the recipient’s purpose for using the personal information);
• 3) the types of personal information to be provided and used by the third party recipient;
• 4) the retention period of the personal information (the recipient’s retention period for the personal information); and
• 5) a reminder that the data subject may refuse consent and an explanation of any disadvantages if consent is refused.

1. For effective management of personal information, KLP has outsourced certain management of personal information as follows:

2. When entering into outsourcing agreements, KLP includes (i) provisions that prohibit the use of personal information for any purpose other than the outsourced work; (ii) technical requirements and required administrative measures to protect personal information; (iii) restrictions on subcontracting its obligations, and requirements for supervising entrusted parties; and (iv) liability provisions(indemnification), etc., pursuant to Article 26 of the Personal Information Protection Act. KLP will supervise the outsourced service provider to ensure that personal information is safely managed.

3. Should there be any changes in the outsourced work or the contractor, KLP will promptly update this Privacy Policy to reflect such changes.

1. Data subjects may request that their personal information used by KLP be available for inspection. However, KLP may restrict or refuse such inspection for the following reasons:

• 1) if inspection is prohibited or restricted by law; or
• 2) if inspection is likely to harm the life or body of another person or unreasonably infringe the property or other interests of another person.

2. Within 10 days of receiving a request for inspection under Paragraph (1) above, KLP will reply as to whether or not the data subject can inspect the requested personal information. If KLP postpones or refuses such inspection, KLP will inform the data subject of the reason for such postponement or refusal.

3. Any data subject who inspected his/her personal information under Paragraph (1) above may request that KLP delete or correct such information. However, no such request for deletion can be made if the personal information concerned is required to be collected under express provisions of applicable law or regulations.

4. Within 10 days after KLP receives a request to correct or delete personal information under Paragraph(3) above, KLP will inform the data subject concerned of the status of the correction or deletion, if any, performed by KLP, or if KLP refuses to meet such request, it will notify the data subject, explaining the reasons for its refusal and what the data subject may do to raise an objection.

5. Any data subject may request that KLP suspend the use of his/her personal information. In such case, KLP will promptly suspend all or part of its use of the personal information of the data subject concerned as requested by the data subject. However, KLP may refuse the data subject’s request for suspension in any of the following cases or for other reasonable grounds:

• 1) if there are special provisions in law or it is necessary in order to fulfill an obligation imposed by law or regulation;
• 2) if such suspension is likely to harm the life or body of another person or unreasonably infringe the property or other interests of another person; or
• 3) if the failure to use the personal information will make it difficult for KLP to provide the agreed services with the data subject or otherwise perform any agreement with the data subject, and the data subject has not clearly indicated an intent to terminate such agreement.

6. Within 10 days after receipt of a request to suspend the use of personal information under Paragraph (5) above, KLP will inform the data subject of the status of any suspension or if KLP refuses to grant such request, it will notify the data subject, explaining the reasons for such refusal and what the data subject may do to raise an objection.

7. To exercise his/ her rights under this Article, the data subject may submit a request form by personal delivery, by email or fax to KLP (at the department responsible for the protection of personal information) as set forth in Article 7(1). The request form is for the inspection, correction, deletion, or suspension of personal information management as set out in the form of Appendix 1 of the Personal Information Protection Guidelines regulated by Personal Information Protection Commission.

8. Any data subject may exercise his/her rights under this Article through his/her legal representative, any other appointee or agent, subject to the submission of a power of attorney in the form of Appendix 2 of the Personal Information Protection Guidelines regulated by Personal Information Protection Commission.

1. KLP will promptly destroy personal information that is no longer needed, including when the purpose of collecting personal information is achieved or the retention period under Article 1 has expired.2. KLP will destroy personal information in the following manner:

• 1) electronic files : permanently delete so that restoration of data is impossible; and
• 2) records, printouts, documents or other media, other than falling under item 1 above: shred or burn.

KLP employs the following technical, administrative and physical measures to protect personal information as required under Article 29 of the Personal Information Protection Act:

1. KLP’s personal information protection manager and department responsible for the protection of personal information are as follows:

2. The data subject may contact the personal information protection manager and the department responsible for the protection of personal information regarding any inquiry on personal information protection, complaints, relief, etc. that may arise in the course of the use of KLP services. KLP will promptly respond to and handle any such inquires raised by data subjects.

Data subjects may seek relief and advice on personal information infringement from the following organizations. Please contact the following organizations directly if you are not satisfied with KLP’s handling of complaints related to your personal information or relief provided by KLP or need more detailed support.

1. This Privacy Policy is effective as of July 1, 2021. Any amendment hereto (such as any addition hereto or deletion or correction of any part hereof) will be published on the KLP website(www.klpartners.com) at least 7 days prior to the effective date of such amendment.2. Please see here (Korean ver.) for previous privacy policy. (2018. 7. 1.~2021. 6. 30.)