HL Group (hereinafter 'the Company') places a high priority on user privacy and abides by the personal information protection regulations stipulated in the Act on the Promotion of Information and Communications Network Utilization and Information Protection and the Personal Information Protection Guidelines established by the Ministry of Information and Communication. Our Personal Information Management Policy delineates how we utilize the personal information provided by users and what measures we adopt to safeguard this information. The Company may modify this policy in line with government regulations, its terms and conditions, and internal policies, and will promptly post any revisions on its website.

1. Personal Information Processing Items, Purpose of Processing, and Retention Period

HL Group fulfills its social responsibilities and aims to be a company beloved by the public.

• 1) The "HL Group Integrated Reporting Center" processes personal information for the purposes listed below. The processed personal information will not be used for any purposes other than these, and in the event of a change in the purpose of use, the necessary measures such as obtaining separate consent from the user will be taken as per Article 18 of the Personal Information Protection Act.

• Optional items (when reporting under a real name)	name, email address, contact number
  Processing purpose	Additional verification of reported contents when required, notification of receipt or processing results, addressing complaints, and delivering notifications

  ※ The Company refrains from gathering sensitive information that may severely infringe upon the user's privacy (such as beliefs, labor union/political party membership, political perspectives, health, and sexual life).
• 2) Processing and Retention Period of the Above Personal Information
• The "HL Group Integrated Reporting Center" handles and stores personal information for the period agreed upon at the time of data collection, from the moment the report is lodged until its conclusion. Exceptions may be made for certain cases that require separate preservation, such as disciplinary matters.

2. Third-Party Provision of Personal Information

• 1) The "HL Group Integrated Reporting Center" handles personal data only within the boundaries outlined in Article 1 (Personal Information Processing Items, Purpose of Processing, and Retention Period), and shares personal data with third parties only under circumstances permissible by Articles 17 and 18 of the Personal Information Protection Act.
• 2) The "HL Group Integrated Reporting Center" shares personal data with third parties as follows:

• Recipients	- The respective company, if needed for a whistleblowing investigation - The investigative authority, if needed for a criminal prosecution(If the individual does not agree, the personal information is not provided to the investigative authority.)
  Recipient's Purpose of Use	- Verification of facts and investigation, subsequent actions such as rewards or disciplinary measures - Details for the criminal complaint or indictment (If the individual does not agree, the personal information is not provided to the investigative authority.)
  Data Provided	- Name, telephone number, email, mobile phone number
  Data Retention and Usage Period	- Upon the fulfillment of the purpose (until the conclusion of the received report), the data is immediately discarded.

3. Consignment of Personal Information Processing

• 1) The "HL Group Integrated Reporting Center" outsources personal data processing tasks to ensure efficient personal data handling as follows.

• Consignment Recipient (Trustee)	HL Holdings
  Content of Consignment	Website Management

• 2) When the "HL Group Integrated Reporting Center" contracts out the processing, it stipulates in contracts and other documents matters related to the prohibition of processing personal data for purposes other than executing the contracted tasks, technical and administrative protection measures, re-consignment restrictions, trustee management and supervision, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises the trustee's safe handling of the personal data.
• 3) If there are changes to the consigned tasks or the trustee, such changes are promptly disclosed through this Personal Information Processing Policy.

4. User Rights, Obligations, and Methods of Exercise

• 1) Users and their legal guardians may request, at any time, access, correction, or deletion of, cessation of processing, or withdrawal of consent for the personal data of the registered user or a child under 14.
• 2) The user's right to request access can be exercised through written requests, email, or fax to the "HL Group Integrated Reporting Center" in compliance with the form attached to the Enforcement Rules of the Personal Information Processing Act, and the "HL Group Integrated Reporting Center" shall promptly respond to such requests.
• 3) If a user requests a correction or deletion due to inaccuracies in his/her personal data, the "HL Group Integrated Reporting Center" shall refrain from using or providing such personal data until the correction or deletion is completed.
• 4) The user's right to request access can be exercised via a representative who has been authorized by the data subject. In such cases, a power of attorney according to the form of Appendix No. 11 to the Enforcement Rules of the Personal Information Protection Act must be submitted.
• 5) Users must not violate the privacy of others or their personal data that is processed by the "HL Group Integrated Reporting Center" in breach of the Personal Information Protection Act or other relevant laws.

5. Disposal of Personal Information

When the need for personal information has passed, such as when the retention period expires or the processing purpose is achieved, the "HL Group Integrated Reporting Center" promptly disposes of such personal information.

• 1) Procedure for Disposal
• - Upon fulfillment of the intended purpose for the user's personal information, it is relocated to a distinct database (or a separate file box for paper documents) and then preserved for a predetermined period according to our internal policies and various legal stipulations pertinent to information protection (please refer to the guidelines for data retention and usage). It is important to note that the personal information, once moved to this separate database, will not be utilized for any additional purposes unless mandated by law.
• 2) Method for Disposal
• - The process of disposal for electronically stored personal information involves employing technical procedures that eliminate the possibility of record recovery. Any personal information printed on paper is disposed of through either shredding or incineration.

6. Guaranteeing Personal Information Security

• 1) The "HL Group Integrated Reporting Center" has implemented the following measures to secure personal information and guard against loss, theft, leakage, alteration, or damage during handling.
• ① Managerial Measures: Creation and execution of internal management plans, regular staff training, enforcement of personal information protection pledges, etc.
• ② Technical Measures: Regulation of access rights to personal information processing systems, installation of access control systems, and deployment of security software.
• ③ Physical Measures: Control of access to computer facilities, data storage areas, etc.
• 2) The "HL Group Integrated Reporting Center" notifies users promptly and adopts necessary actions to minimize harm in the event of personal information breaches such as leakage or damage.

7. Officer for Personal Information Protection

To protect user personal information and manage related grievances, the company has assigned the following department and personal information management officer.

• ▶ Customer Service Department
• - Department : HL Group Audit office
• – Phone : 031-280-4638
• – Contact : ethics.hl@hlcompany.com
• ▶ Officer for Personal Information Management
• - Department : HL Group Jeong-Do Management Office
• - Personal Information Management Officer : Team Leader Shin Su-jin
• – Phone : 031-280-4636
• – Email : ethics.hl@hlcompany.com

8. Installation, Management, and Refusal of Automatic Personal Information Collection Devices

The company may offer links to websites or resources from other companies. In such instances, the company has no control over these third-party sites, resources, products, or services and cannot assume responsibility for or offer guarantees of their usefulness. When navigating from our site to another site by clicking a link, the personal information protection policy of the new site is independent of ours, so it is recommended that users review the new site's policy.

9. Remedies for Rights Violations

Users can lodge all personal information protection-related complaints that arise while using the company's services with the personal information management officer or the designated department. The company will promptly provide comprehensive responses to user complaints. For reports or consultations regarding other personal information violations, please contact the following institutions.

• – Personal Information Infringement Report Center (www.118.or.kr / 118)
• – Internet Crime Investigation Center, Supreme Prosecutors' Office (www.spo.go.kr / 02-3480-2000)
• – Cyber Terror Response Center, National Police Agency (www.netan.go.kr/ 1566-0112)