SK Square Privacy Policy

SK Square (hereinafter referred to as the “Company”) processes and manages personal information lawfully and securely in compliance with the Personal Information Protection Act and related laws and regulations to safeguard the freedoms and rights of information subjects. Pursuant to Article 30 of the Personal Information Protection Act, we have formulated and disclosed the following privacy policy to inform information subjects about the procedures and standards for processing personal information. This policy also ensures the prompt and efficient resolution of any grievances related to personal information handling.

1. 1.Collection, Purpose, and Retention Period of Personal Information

   1. ①The Company collects and processes personal information for the following purposes. Personal information will not be used for any other purpose unless the data subject’s consent is obtained as per Article 18 of the Personal Information Protection Act. Additionally, the Company processes and retains personal information within the period agreed upon when collecting personal information or within the period required by law. Services are provided to children under 14 only with the consent of their legal guardians.

      • Personal Information Items Collected with Consent

      Purpose of Processing
      Providing online general meeting services ∙ Verifying eligibility for general meeting viewing rights, confirming shareholder status, sending authentication codes for accessing the online general meeting, responding to customer inquiries
      Items Collected
      Name, date of birth, gender, email address
      Retention Period
      2 years from the date of the general meeting *)

      Purpose of Processing	Items Collected	Retention Period
      Providing online general meeting services ∙ Verifying eligibility for general meeting viewing rights, confirming shareholder status, sending authentication codes for accessing the online general meeting, responding to customer inquiries	Name, date of birth, gender, email address	2 years from the date of the general meeting *)

      ^*) However, if it is required to retain personal information under the provisions of relevant laws, the personal information may be retained in accordance with the stipulations of those laws.

   2. ②No personal information is collected on the Company's main website(www.sksquare.com).

2. 2.Provision of Personal Information to Third Parties

   1. ①The Company processes personal information within the scope specified in the purpose of handling personal information and provides personal information to third parties only in cases that comply with Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or specific legal provisions.

   2. ②In accordance with the emergency guidelines for personal information processing and protection jointly announced by government ministries, the Company may provide personal information to relevant agencies without the data subject's consent in the event of emergencies such as disasters, infectious diseases, incidents, or accidents causing urgent threats to life or safety, or urgent property loss.

3. 3.Matters Concerning the Entrustment of the Processing of Personal Information

   1. ①The Company outsources personal information processing to ensure smooth operations. Details of the outsourced processing are as follows:

      Outsourced Entity
      Teletogether Co., Ltd.
      Details of Outsourced Work
      Providing online general meeting services ∙ Verifying eligibility for viewing rights, confirming shareholder status, sending authentication codes for accessing the online general meeting, responding to customer inquiries

      Outsourced Entity	Details of Outsourced Work
      Teletogether Co., Ltd.	Providing online general meeting services ∙ Verifying eligibility for viewing rights, confirming shareholder status, sending authentication codes for accessing the online general meeting, responding to customer inquiries

   2. ②The Company ensures compliance with the Personal Information Protection Act by stipulating in contracts that the outsourced entity must not process personal information beyond the scope of the outsourced work, must take technical and administrative protection measures, must limit re-outsourcing, must ensure the safety of personal information, and must be supervised and monitored by the Company.

   3. ③If there are changes in the outsourced work or the outsourced entity, this privacy policy will be updated promptly.

4. 4.Personal Information Deletion Procedures and Methods

   1. ①The Company deletes personal information without delay when the retention period expires, or the purpose of processing is achieved.

   2. ②If the retention period of personal information, for which consent was obtained from the information subject, has expired or the processing purpose has been achieved, but the personal information must be retained according to other laws, the Company will move the relevant personal information to a separate database (DB) or store it in a different location.

   3. ③The procedures and methods of deleting personal information are as follows:

      1. A. Deletion Procedure

         The Company selects personal information for deletion when there is a reason for deletion and deletes the personal information upon approval from the Personal Information Protection Officer.

      2. B. Deletion Method

         The Company deletes personal information recorded and stored in electronic file format in a manner that ensures the information cannot be reproduced, and personal information recorded and stored on paper is shredded using a shredder.

5. 5.Rights and Obligations of Information Subjects and Their Legal Representatives and Exercise of the Rights

   1. ①The information subject may exercise the rights of access, correction, deletion, suspension of processing, refusal of automated decision-making, and request for explanation against the Company at any time.

      ※ Requests for access to personal information, etc., concerning children under the age of 14 must be made by their legal representative. Information subjects who are minors over the age of 14 may exercise their rights concerning their personal information either by themselves or through their legal representative.

   2. ②The information subject may exercise the rights by contacting the department described in Article 9(1) of this policy, and the Company will take immediate action.

   3. ③The rights may be exercised through an agent, such as the legal representative of the information subject or a person authorized by him/her. In this case, the information subject should use the power of attorney form provided in Appendix 11 of the Notification on the Personal Information Processing Methods.

   4. ④The rights of the information subject to request access to and suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.

   5. ⑤The right of the information subject to request the deletion of personal information may be restricted under Article 36(1) of the Personal Information Protection Act.

   6. ⑥If the information subject has consented to automated decision-making, has been informed in advance through a contract, or if there are clear legal regulations, the right to refuse automated decision-making is not recognized. However, requests for explanation and review are allowed.

   7. ⑦Requests for refusal of automated decision-making or explanations may be rejected if there are legitimate reasons such as the risk of unjustly infringing on the life, body, property, or other rights of others.

   8. ⑧The Company verifies whether the person exercising the rights is the information subject himself/herself or a legitimate representative.

   9. ⑨The Company endeavors to ensure that the information subject's rights are processed quickly and efficiently by the information protection department.

6. 6.Measures to Ensure the Security of Personal Information

   The Company takes the following measures to ensure the security of personal information:

   • Administrative measures: Establishment and implementation of internal management plans, operation of a dedicated organization, and regular employee training
   • Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, and installation of security programs
   • Physical measures: Access control to computer rooms and data storage rooms

   Additionally, the Company implements the following activities to ensure the security of personal information beyond the requirements stipulated by law:

   • Obtaining Information Protection Certification (ISO/IEC 27001)

7. 7.Installation and Operation of Automated Tools for the Collection of Personal Information and Refusal to Accept Them.

   The Company does not use tools that automatically collect personal information, such as "cookies" that store and retrieve information about users.

8. 8.Matters Concerning the Refusal of Collection, Use, and Provision of Behavioral Information

   The Company does not collect, use, or provide behavioral information for online customized advertising.

9. 9.Personal Information Protection Officer and Department Responsible for Receiving and Processing Access Requests

   1. ①The Company endeavors to ensure that the information subject's rights are processed quickly and efficiently by the information protection department.

      	Privacy Officer	Privacy Manager
      Depart- ment	Information Protection	Information Protection
      Name	Kim Byeongyoon	Cho Hyewoo PL
      E-mail	-	pi@partner. sk.com
      Contact	-	02-6100- 3114

   2. ②Information subjects can contact the Personal Information Protection Officer and the designated department for inquiries, complaint handling, and remedies related to personal information protection arising while using the Company’s services. The Company will respond and address the inquiries of information subjects without delay.

   3. ③Information subjects may also request access to their personal information under Article 35 of the Personal Information Protection Act through the information protection department. The Company will make efforts to ensure that requests for access to personal information by information subjects are processed promptly.

10. 10.Remedies for Infringement of Rights

    1. ①Information subjects can seek remedies for personal information infringement by applying for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency Personal Information Infringement Report Center, and other relevant agencies. For further reports or consultations on personal information infringement, please contact the following organizations.

       1. A. Personal Information Dispute Mediation Committee : (No area code) 1833-6972 (www.kopico.go.kr)
       2. B. Personal Information Infringement Report Center : (No area code) 118 (privacy.kisa.or.kr)
       3. C. Supreme Prosecutors' Office : (No area code) 1301 (www.spo.go.kr)
       4. D. National Police Agency : (No area code) 182 (ecrm.cyber.go.kr)

    2. ②The Company strives to guarantee the information subject's right to self-determination regarding personal information and endeavors to provide consultation and remedies for personal information infringement. If you need to report or consult on such matters, please contact the following department.

       Consultation and Reporting on Personal Information Protection
       Department	Information Protection
       Name	Cho Hyewoo PL
       E-mail	pi@partner.sk.com
       Contact	02-6100-3114

       	Consultation and Reporting on Personal Information Protection
       Department	Information Protection
       Name	Cho Hyewoo PL
       E-mail	pi@partner.sk.com
       Contact	02-6100- 3114

11. 11.Disclosure and Changes to the Privacy Policy

    This privacy policy is effective from August 7, 2024.