SHINSEGAE PROPERTY

This “Policy on the Handling of Personal Information” concerns the protection measures taken by the Company to protect the personal information of the customers using Starfield, Starfield City, and The Shops at Centerfield operated by the subsidiaries (“Company”) of Shinsegae Property including Shinsegae Property Inc. or Starfield Hanam Inc. The company values its customer’s personal information most of all and always puts all-out efforts to protect it safely.

The Company complies with the relevant laws including PERSONAL INFORMATION PROTECTION ACT and the ACT ON THE PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, ETC. and has established and released the Policy on the Handling of Personal Information on its website accessible by its customers. Since the Policy on the Handling of Personal Information may be amended due to changes in governmental law and policy or in the corporate policy, it is recommended for its customers to frequently visit the Notice on the website.

1. Collection and Consent of Personal Information

1. 1.The Company collects the personal information entered and sent by the customers via its website, mobile app, written form, phone, and fax in relation to joining the membership, using the Q&A Board, applying for gift events, and making a delivery request.
2. 2.The following information can be created and gathered by an electronic collector system in the process of using the services or handling business.
   • Record of using the service, access log, cookie, access IP information, mobile devices, etc
3. 3.Customers may hold the right to refuse the collection and use of the personal information. There is no disadvantage according to the refusal. However, if they reject to consent on the required items, they will not be eligible for all or limited services.

2. Collected Item, Purpose of Usage, and Storage Period of Personal Information

The Company collects the following personal information from the customers for the provision of services.

The Company does not collect sensitive information (race and ethnicity, ideology and doctrine, political orientation, health status, etc.) that may infringe on the basic human rights of the customers.

3. Destruction of Personal Information

1. 1. The Company destroys personal information immediately when it attains the collection and usage purpose of personal information including the withdrawal or termination of membership or when its customer requests the withdrawal of consent to the collection and usage of personal information. However, if necessary, personal information can be stored for a designated period of time pursuant to the relevant laws. In this case, the Company uses the stored information only for the storage purpose. The storage period is stated as follows:
   1. A.Records on the contract or withdrawal of subscription, etc.
      • Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
      • Storage period: Five(5) years
   2. B.Records on payment settlements and the supply of goods, etc.
      • Reason for storage: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
      • Storage period: five(5) years
   3. C.Records on customer complaints or dispute settlements
      • Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
      • Storage period: Three(3) years
   4. D.Records on website visit history
      • Storage reason: PROTECTION OF THE COMMUNICATIONS SECRETS ACT
      • Storage period: Three(3) months
   5. E.Records on mark · commercials
      • Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
      • Storage period: Six(6) months
2. 2.The methods of destructing personal information are as follows:
   1. A.Personal information printed in paper documents: Shredded with a shredder or incinerated
   2. B.Records of personal information stored in an electric file format: Deleted via a technical method that cannot reproduce the record.
3. 3.Deactivate the accounts of the customers who haven't used the service for a long time.
   1. A.For a customer who hasn’t logged in or used the service for one(1) year, the Company classifies his or her account as a dormant account and separately stores or destroys his or her personal information to protect the personal information of the customer.
   2. B.The Company notifies the customer through email, etc. on the details one(1) month prior to the conversion to a dormant account.

4. Provision of Personal Information to a Third Party

The Company only uses the customer’s personal information strictly within its originally intended scope prescribed by the Policy on the Handling of Personal Information and does not provide it to any third party (person or company) without consent except in the following cases:

1. 1.When obtaining prior consent from the customers;
2. 2.. When the Company fulfills its obligations pursuant to the relevant laws or in case the investigation agency lawfully asks for such according to the procedures and methods stipulated under the laws for the purpose of an investigation and others.

The Company may provide the following subsidiaries or affiliates with the personal information under the consent of the customers for the provision of a better service. The customers may withdraw such consent at any time.

5. Consignment of the Handling of Personal Information

The Company consigns the handling of personal information to the following outside agencies to provide its services.

6. Method of View, Correction, Withdrawal of and the Withdrawal of Consent on Personal Information

Customers may view, delete, and withdraw their membership anytime with the following methods.

1. 1.Visit Starfield Point Center: Access, correct, and withdraw one’s membership after the identity verification.
2. 2.Website or app: Click the My Page → Correct Information button after logging in to proceed to access or correct personal information, or withdraw one’s membership.
3. 3.If a customer contacts Personal Information Protection Manager via writing, call or email, the requested measures are taken immediately after the identity verification.
4. 4.If customers request errors in their personal information to be corrected, the applicable personal information cannot be used or provided until corrected. If incorrect personal information has already been provided to a third party, the corrected information will be immediately notified to the third party so that the required corrections can be made.
5. 5.If there are valid reasons including when there is a special regulation in the relevant laws or when the Company complies with its obligation pursuant to such laws, the Company may refuse to accept the customers' requests. When such valid reasons are found, the Company will immediately notify it to the customers.

7. Operation and Use of the Automatic Personal Information Collecting Device (Cookie)

1. 1.The Company may operate cookies to provide a customized services. (Cookies may identify a computer, but not an individual customer.)
2. 2.The Company uses cookies for the following purposes:
   1. A.Analyze the access frequency or duration of both members and non-members and grasp the areas of interest of each customer to use the results as standards for service restructuring and target marketing.
   2. B.Analyze the participation and frequency of access of its members in various events run by the Company, use the analysis result as a material to give opportunities customized to each member when they apply for such events, and provide information suitable to the customers depending on the areas of their interest.
   3. C.Track and analyze a customer journey on the items they purchased and others they browsed due to their own interest to use the analysis results in providing customized shopping service to the customers. A cookie expires when the cookie browser has expired or a customer is logged out. A cookie expires after one day has passed. Customers may delete it by clicking “Delete Cookie” in the browser.
3. 3.Customers have the right to install or uninstall cookies.
   Thus, customers may set options in their web browser either to allow all cookies, check whenever cookies are saved, or refuse to save all cookies.
   However, if the customers refuse to save cookies, they may have limited access to certain services.

Method of installing / operating or rejecting cookies

1. 1.[For Internet Explorer]
   1. A.Click [Tools] → [Internet Options].
   2. B.Click [Personal Information] tab.
   3. C.Click an option you need in [Advanced].
2. 2.[Safari의 경우]
   1. A.Click [Safari]→[Environment Settings] on the top left menu bar in macOS.
   2. B.Move to [Security] from the [Environment Settings] window to select whether to allow cookies or not.

8. Rights of a Customer and Legal Representative, and the Methods of Exercising the Rights

1. 1.Customers may always request a representative to view, correct, delete, or suspend the handling of their personal information, and withdraw their consent on their personal information stored in the Company. For the procedures and methods of exercising the rights, it is recommended to refer to the contents specified in Article 6.
2. 2.It is recommended for the customers to enter their personal information correctly and update it when there is any change to prevent incidents. The responsibility on the incident resulted by the customer’s entering incorrect information imposes on him or her. If a customer enters false information including the using of another's personal information without permission, the customer lose one's membership.
3. 3.Besides having their personal information and themselves protected, customers are also obliged not to infringe on other’s personal information and rights. Be careful in managing ID, password, certificate, and others to prevent the customer’s personal information from being disclosed. Also, pay attention not to infringe on other’s information including posts. If other’s personal information or rights are infringed upon because the customers didn’t fulfill the aforementioned responsibilities, they may be punished by the relevant laws.
4. 4.For the exercise of rights according to Paragraph 1 of Article 6, customers may exercise the rights through a representative including their legal representative or entrusted person. In this case, customers shall submit a power of attorney based on Form 11 of the Addendum of Enforcement Rules to the Personal Information Protection Act.

9. The Officer and Division Responsible for Personal Information Protection

The Company has assigned an officer and a division responsible for personal information protection as below to protect the customers’ personal information and respond to inquiries, complaints, remedy measures related to their personal information.

10. How to Recover Infringed Rights

Customers may ask for the settlement of a dispute or consultation to the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), etc. on the remedy for the infringed rights. For the report or consultation on other infringement cases, they are recommended to ask for help in the following institutions.

• Personal Information Dispute Mediation Committee (http://www.kopico.go.kr/ without area code 1833-6972)
• Personal Information Infringement Report Center of KISA (http://privacy.kisa.or.kr/ without area code 118)
• Supreme Prosecutors' Office (SPO) (http://www.spo.go.kr/ without area code 1301)
• Korean National Police Agency (KNPA) (http://cyberbureau.police.go.kr/ without area code 182)

11. Technical / Administrative Management for Personal Information Protection

회사는 고객의 개인정보를 보호하기 위해 아래와 같이 기술적 대책과 관리적 대책을 마련하여 이를 적용하고 있습니다.

1. 1.Technical measures
   • To secure the safety of personal information, the Company devises technical measures to ensure personal information not to be lost, leaked, modified or damaged when handling it.
   • Your personal information is safeguarded by the password. The Company encrypts a file or transmitted data. Important data are safeguarded via a separate security function with the use of a file locking system.
   • With a vaccine program, the Company takes the measures to prevent the damage caused by a computer virus. The program is updated regularly and is run immediately after a virus emerges abruptly to prevent the personal information infringement.
   • The Company uses a security protocol (Secure Sockets Layer (SSL) or Secure Electronic Transaction (SET)) can safely transmit personal information on the network with the use of an encryption algorithm.
   • In preparation for the external intrusion attempts including hacking, the Company is fully committed to the security by using a firewall system and vulnerability assessment system for each server.
2. 2.Administrative measures
   • The Company limits the number of personnel accessing to your personal information as a minimum. The applicable personnel are described as follows:
     • Those entrusted to directly handle the personal information of the customers
     • Those managing personal information including the Officer and Manager Responsible for Personal Information Protection
     • Those inevitably handling personal information due to their other jobs
   • The Company implements regular in-house training and external outsourcing training on the acquisition of new security technologies and an obligation to protect personal information for the employees handling the customer’s personal information.
   • The Company prevents the information from being disclosed through a security pledge written by personal information-related handlers at the time of being hired. It also establishes internal procedures to inspect whether its employees implement and follow the personal information protection policy.
   • The handover of personal information-related handlers is carried out thoroughly while security is maintained, and the responsibility for personal information accidents after joining and resigning from the Company is clarified.
   • The Company stores personal information separately from any general data.
   • The Company is not be liable to personal information related issues caused when a customer makes mistake or there is no liability for company. The customers shall properly manage the IDs and passwords of the customers.

12. Protection of Personal Information for Children under the Age of Fourteen(14)

The Company does not collect the personal information of a child under the age of fourteen(14) who shall obtain the consent of his / her legal representative.

13. Limit the Transfer of Commercial Type Information

The Company does not transfer commercial type information without the customer's prior consent.

When sending commercial type information via email and others for the purpose of online marketing including the product guide information, the Company obtains prior consent from the customers on the sending of such information and takes the measures as below for each means, allowing the customers to recognize it easily.

1. 1.Email: Enter the phrase “(Ads)” in the Korean character without spaces in the beginning of the Subject line before indicating the major contents for the body text. In the body text, clearly state the name of a sender, email address, phone number, and permanent address, with a checkbox where they may choose not to receive email notifications.
2. 2.Other methods besides email including fax and text message: Take the required measures including the indication of a sender’s name.

14. Criteria on the Additional Provisions and the Use of Personal Information

Pursuant to the relevant laws, the criteria of the Company on the use or provision of the additional personal information without a customer’s consent is as follows:

1. 1.Where the purpose of using and providing personal information additionally is relevant to the original collection purpose;
2. 2.Where there is any possibility to predict the use or provision of the additional personal information in light of the circumstances where personal information is collected or due to the personal information handling practice;
3. 3.Where the use or provision of personal information unlawfully infringes on the interests of the personal information owner;
4. 4.Where the necessary measures including a pseudonym or encryption are taken to secure the safety of the personal information.

15. Obligation for Notification

Should there be information to be added, deleted and edited according to the government policies or the policies of the Company, the notification on such changes will be provided via the website at least seven(7) days before the revision.

This Policy on the Handling of Personal Information takes effect as of November 25, 2021, and the previous version will be replaced with the current version.