Shinsegae Property Inc. Achieve 5-Star Rating in GRESB for Two Consecutive Years

Policy on the Handling of Personal Information

This "Policy on the Handling of Personal Information" concerns the protection measures taken by the Company to protect the personal information of the customers using Starfield, Starfield City, and The Shops at Centerfield operated by the subsidiaries ("Company") of Shinsegae Property including Shinsegae Property Inc. or Starfield Hanam Inc. The company values its customer's personal information most of all and always puts all-out efforts to protect it safely.

The Company complies with the relevant laws including PERSONAL INFORMATION PROTECTION ACT and the ACT ON THE PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION, ETC. and has established and released the Policy on the Handling of Personal Information on its website accessible by its customers. Since the Policy on the Handling of Personal Information may be amended due to changes in governmental law and policy or in the corporate policy, it is recommended for its customers to frequently visit the Notice on the website.

1. Collection and Consent of Personal Information
2. Collected Item, Purpose of Usage, and Storage Period of Personal Information
3. Destruction of Personal Information
4. Provision of Personal Information to a Third Party
5. Consignment of the Handling of Personal Information
6. Method of View, Correction, Withdrawal of and the Withdrawal of Consent on Personal Information
7. Operation and Use of the Automatic Personal Information Collecting Device (Cookie)
8. Rights of a Customer and Legal Representative, and the Methods of Exercising the Rights
9. The Officer and Division Responsible for Personal Information Protection
10. How to Recover Infringed Rights
11. Technical / Administrative Management for Personal Information Protection
12. Protection of Personal Information for Children under the Age of Fourteen(14)
13. Limit the Transfer of Commercial Type Information
14. Criteria on the Additional Provisions and the Use of Personal Information
15. Obligation for Notification

1. Collection and Consent of Personal Information

1.The Company collects the personal information entered and sent by the customers via its website, mobile app, written form, phone, and fax in relation to joining the membership, using the Q&A Board, applying for gift events, and making a delivery request.
2.The following information can be created and gathered by an electronic collector system in the process of using the services or handling business.
- Record of using the service, access log, cookie, access IP information, mobile devices, etc
3.Customers may hold the right to refuse the collection and use of the personal information. There is no disadvantage according to the refusal. However, if they reject to consent on the required items, they will not be eligible for all or limited services.

2. Collected Item, Purpose of Usage, and Storage Period of Personal Information

The Company collects the following personal information from the customers for the provision of services.

Personal information from the customers for the provision of services
Item		Collected Item	Purpose of Usage	Storage Period
Member(membership) management	Required	Name, date of birth, gender, email address, mobile phone number, permanent address, point card number, connected information (CI)	Identity the verification and member management pursuant to the use of the membership service and facilities, the issuance and the management of Shinsegae Point, the earning and use of card points, the calculation of all points from its affiliated franchises	Until the withdrawal of membership or the duration of the legally required storage period
		Name, mobile phone number, permanent address, email address	Secure a seamless communication channel for the notification and consultation on the use of its service, the handling of customer complaints, etc.
		Record of using the service, IP address, access log, cookie, mobile devices, payment	Verify the details in using the service and follow the information management obligation pursuant to the relevant laws.
	Optional	Name, date of birth, gender, mobile phone number, email address, permanent address	Inform products and services provided by the Company and its affiliates; provide newsletters; provide information on events(text message, email, DM, TM); use marketing materials to promote collaborative events and its services; analyze information for marketing purposes; and develop services.
	Optional	Company name, company address, evidence material(business card)	Offer the "Starfield Office(SO) CLUB" service.	On the membership withdrawal or withdrawal of the consent for the storage
Non-member management	Required	Name	Receive and handle customer inquiries and inconveniences and improve its services.	For three(3) years from the inquiry date or the duration of the legally required storage period
Non-member management	Optional	Email address, phone number, password
Proposal on business & investment	Required	Name, phone number, email address	Reply to the proposal on business & investment and franchising inquiries.	For two(2) years from the collected date or the duration of the legally required storage period
Ethics report ("HOT-LINE")	Required	Name	Check and process facts upon the receipt of a report and inform the results.
Ethics report ("HOT-LINE")	Optional	Phone number, email address(if reply is necessary)
Voice of Partner ("VOP")	Required	Name	Check and process the facts upon the receipt of VOP and inform the results.
Voice of Partner ("VOP")	Optional	Phone number, email address(if reply is necessary)
Starfield app	Optional	Notification	Push notification service for the provision of information	On the deletion of the app or membership withdrawal
		Camera, gallery	Upload an evidence material when joining SO CLUB; verify its user by using a QR code.
		Vehicle registration plate	Use the service of "Locate My Car."

The Company does not collect sensitive information (race and ethnicity, ideology and doctrine, political orientation, health status, etc.) that may infringe on the basic human rights of the customers.

3. Destruction of Personal Information

1. The Company destroys personal information immediately when it attains the collection and usage purpose of personal information including the withdrawal or termination of membership or when its customer requests the withdrawal of consent to the collection and usage of personal information. However, if necessary, personal information can be stored for a designated period of time pursuant to the relevant laws. In this case, the Company uses the stored information only for the storage purpose. The storage period is stated as follows:
1. A.Records on the contract or withdrawal of subscription, etc.
  - Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
  - Storage period: Five(5) years
2. B.Records on payment settlements and the supply of goods, etc.
  - Reason for storage: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
  - Storage period: five(5) years
3. C.Records on customer complaints or dispute settlements
  - Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
  - Storage period: Three(3) years
4. D.Records on website visit history
  - Storage reason: PROTECTION OF THE COMMUNICATIONS SECRETS ACT
  - Storage period: Three(3) months
5. E.Records on mark · commercials
  - Storage reason: ACT ON THE CONSUMER PROTECTION IN ELECTRONIC COMMERCE, ETC.
  - Storage period: Six(6) months
2.The methods of destructing personal information are as follows:
1. A.Personal information printed in paper documents: Shredded with a shredder or incinerated
2. B.Records of personal information stored in an electric file format: Deleted via a technical method that cannot reproduce the record.
3.Deactivate the accounts of the customers who haven't used the service for a long time.
1. A.For a customer who hasn't logged in or used the service for one(1) year, the Company classifies his or her account as a dormant account and separately stores or destroys his or her personal information to protect the personal information of the customer.
2. B.The Company notifies the customer through email, etc. on the details one(1) month prior to the conversion to a dormant account.

4. Provision of Personal Information to a Third Party

The Company only uses the customer's personal information strictly within its originally intended scope prescribed by the Policy on the Handling of Personal Information and does not provide it to any third party (person or company) without consent except in the following cases:

1.When obtaining prior consent from the customers;
2.. When the Company fulfills its obligations pursuant to the relevant laws or in case the investigation agency lawfully asks for such according to the procedures and methods stipulated under the laws for the purpose of an investigation and others.

The Company may provide the following subsidiaries or affiliates with the personal information under the consent of the customers for the provision of a better service. The customers may withdraw such consent at any time.

Entity to receive information, Purpose of usage of the entity, Personal information items to be provided, Storage and usage period of the entity
Entity to receive information	Purpose of usage of the entity	Personal information items to be provided	Storage and usage period of the entity
Shinsegae Inc., Gwangju Shinsegae Inc., Shinsegae Inc.	Provide members with various convenient services; inform products and services provided by each affiliate; offer information on events(text message, email, DM, TM); use marketing materials to promote collaborative events and its services; analyze information for marketing purpose; and develop services; add up all performances to provide the VIP service of Shinsegae Department Store(limited to a certain brand and customer consent to the provision of personal information to a third party).	Result value of verifying the identity of the person concerned(householder, family member), the membership card number, purchase information(date of purchase, amount purchased)	Until the withdrawal of membership or the duration of the legally required storage period

5. Consignment of the Handling of Personal Information

The Company consigns the handling of personal information to the following outside agencies to provide its services.

Entrusted contents, An entrusted company
Entrusted contents	An entrusted company
Operate the membership service.	Shinsegae Property Inc., Starfield Hanam Inc., Starfield Goyang Inc., Starfield Anseong Inc.
Operate & manage membership information; operate the website service.	PULIP COMMUNICATIONS Co., Ltd.
Operate a digital marketing channel.	THE SMC GROUP Co., Ltd.
Operate and maintain the information system; send DM; manage the registration, order, and the delivery of online products.	Shinsegae I&C, Inc.
Provide an identity verification service.	Korea Credit Bureau Co., Ltd.
Operate the customer and PP center for each store.	Hyosung ITX Co., Ltd., Unies Co., Ltd., Gng Line
Deliver and manage the products ordered online.	Sales partner: (See partner)
Deliver the products.	CJ Logistics Corp.
Operate the security system of each store.	THE GUARDIANS, Nasa Industrial Safety, Misung S&P, Samkoo Inc Co., Ltd.

6. Method of View, Correction, Withdrawal of and the Withdrawal of Consent on Personal Information

Customers may view, delete, and withdraw their membership anytime with the following methods.

1.Visit Starfield Point Center: Access, correct, and withdraw one's membership after the identity verification.
2.Website or app: Click the My Page → Correct Information button after logging in to proceed to access or correct personal information, or withdraw one's membership.
3.If a customer contacts Personal Information Protection Manager via writing, call or email, the requested measures are taken immediately after the identity verification.
4.If customers request errors in their personal information to be corrected, the applicable personal information cannot be used or provided until corrected. If incorrect personal information has already been provided to a third party, the corrected information will be immediately notified to the third party so that the required corrections can be made.
5.If there are valid reasons including when there is a special regulation in the relevant laws or when the Company complies with its obligation pursuant to such laws, the Company may refuse to accept the customers' requests. When such valid reasons are found, the Company will immediately notify it to the customers.

7. Operation and Use of the Automatic Personal Information Collecting Device (Cookie)

1.The Company may operate cookies to provide a customized services. (Cookies may identify a computer, but not an individual customer.)
2.The Company uses cookies for the following purposes:
1. A.Analyze the access frequency or duration of both members and non-members and grasp the areas of interest of each customer to use the results as standards for service restructuring and target marketing.
2. B.Analyze the participation and frequency of access of its members in various events run by the Company, use the analysis result as a material to give opportunities customized to each member when they apply for such events, and provide information suitable to the customers depending on the areas of their interest.
3. C.Track and analyze a customer journey on the items they purchased and others they browsed due to their own interest to use the analysis results in providing customized shopping service to the customers. A cookie expires when the cookie browser has expired or a customer is logged out. A cookie expires after one day has passed. Customers may delete it by clicking "Delete Cookie" in the browser.
3.Customers have the right to install or uninstall cookies.
Thus, customers may set options in their web browser either to allow all cookies, check whenever cookies are saved, or refuse to save all cookies.
However, if the customers refuse to save cookies, they may have limited access to certain services.

Method of installing / operating or rejecting cookies

1.[For Internet Explorer]
1. A.Click [Tools] â [Internet Options].
2. B.Click [Personal Information] tab.
3. C.Click an option you need in [Advanced].
2.[Safariì ê²½ì°]
1. A.Click [Safari]â[Environment Settings] on the top left menu bar in macOS.
2. B.Move to [Security] from the [Environment Settings] window to select whether to allow cookies or not.

8. Rights of a Customer and Legal Representative, and the Methods of Exercising the Rights

1.Customers may always request a representative to view, correct, delete, or suspend the handling of their personal information, and withdraw their consent on their personal information stored in the Company. For the procedures and methods of exercising the rights, it is recommended to refer to the contents specified in Article 6.
2.It is recommended for the customers to enter their personal information correctly and update it when there is any change to prevent incidents. The responsibility on the incident resulted by the customer's entering incorrect information imposes on him or her. If a customer enters false information including the using of another's personal information without permission, the customer lose one's membership.
3.Besides having their personal information and themselves protected, customers are also obliged not to infringe on other's personal information and rights. Be careful in managing ID, password, certificate, and others to prevent the customer's personal information from being disclosed. Also, pay attention not to infringe on other's information including posts. If other's personal information or rights are infringed upon because the customers didn't fulfill the aforementioned responsibilities, they may be punished by the relevant laws.
4.For the exercise of rights according to Paragraph 1 of Article 6, customers may exercise the rights through a representative including their legal representative or entrusted person. In this case, customers shall submit a power of attorney based on Form 11 of the Addendum of Enforcement Rules to the Personal Information Protection Act.

9. The Officer and Division Responsible for Personal Information Protection

The Company has assigned an officer and a division responsible for personal information protection as below to protect the customers' personal information and respond to inquiries, complaints, remedy measures related to their personal information.

Person in charge, Name, Division/Job, Phone number E-mail
Item	Person in charge	Name	Division/Job	Phone number	E-mail
Shinsegae Property Inc.	Chief Personal Information Protection Officer	Jeon Sang-jin	General Manager of the Support Division	1833-9001	ssgproperty_privacy@shinsegae.com
Shinsegae Property Inc.	Personal Information Protection Manager	Leader of the Compliance Team
Starfield Hanam	(Store) Officer Responsible for Personal Information Protection and Management	Hanam Branch Manager
Starfield Goyang		Goyang Branch Manager
Starfield COEX Mall		COEX Mall Branch Manager
Starfield Anseong		Anseong Branch Manager
Starfield City Wirye		Wirye Branch Manager
Starfield City Bucheon		Bucheon Branch Manager
Starfield City Myeongji		Myeongji Branch Manager
Centerfield		Centerfield Branch Manager

10. How to Recover Infringed Rights

Customers may ask for the settlement of a dispute or consultation to the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), etc. on the remedy for the infringed rights. For the report or consultation on other infringement cases, they are recommended to ask for help in the following institutions.

Personal Information Dispute Mediation Committee (http://www.kopico.go.kr/ without area code 1833-6972)
Personal Information Infringement Report Center of KISA (http://privacy.kisa.or.kr/ without area code 118)
Supreme Prosecutors' Office (SPO) (http://www.spo.go.kr/ without area code 1301)
Korean National Police Agency (KNPA) (http://cyberbureau.police.go.kr/ without area code 182)

11. Technical / Administrative Management for Personal Information Protection

1.Technical measures
- To secure the safety of personal information, the Company devises technical measures to ensure personal information not to be lost, leaked, modified or damaged when handling it.
- Your personal information is safeguarded by the password. The Company encrypts a file or transmitted data. Important data are safeguarded via a separate security function with the use of a file locking system.
- With a vaccine program, the Company takes the measures to prevent the damage caused by a computer virus. The program is updated regularly and is run immediately after a virus emerges abruptly to prevent the personal information infringement.
- The Company uses a security protocol (Secure Sockets Layer (SSL) or Secure Electronic Transaction (SET)) can safely transmit personal information on the network with the use of an encryption algorithm.
- In preparation for the external intrusion attempts including hacking, the Company is fully committed to the security by using a firewall system and vulnerability assessment system for each server.
2.Administrative measures
- The Company limits the number of personnel accessing to your personal information as a minimum. The applicable personnel are described as follows:
  - Those entrusted to directly handle the personal information of the customers
  - Those managing personal information including the Officer and Manager Responsible for Personal Information Protection
  - Those inevitably handling personal information due to their other jobs
- The Company implements regular in-house training and external outsourcing training on the acquisition of new security technologies and an obligation to protect personal information for the employees handling the customer's personal information.
- The Company prevents the information from being disclosed through a security pledge written by personal information-related handlers at the time of being hired. It also establishes internal procedures to inspect whether its employees implement and follow the personal information protection policy.
- The handover of personal information-related handlers is carried out thoroughly while security is maintained, and the responsibility for personal information accidents after joining and resigning from the Company is clarified.
- The Company stores personal information separately from any general data.
- The Company is not be liable to personal information related issues caused when a customer makes mistake or there is no liability for company. The customers shall properly manage the IDs and passwords of the customers.

12. Protection of Personal Information for Children under the Age of Fourteen(14)

The Company does not collect the personal information of a child under the age of fourteen(14) who shall obtain the consent of his / her legal representative.

13. Limit the Transfer of Commercial Type Information

The Company does not transfer commercial type information without the customer's prior consent.

When sending commercial type information via email and others for the purpose of online marketing including the product guide information, the Company obtains prior consent from the customers on the sending of such information and takes the measures as below for each means, allowing the customers to recognize it easily.

1.Email: Enter the phrase "(Ads)" in the Korean character without spaces in the beginning of the Subject line before indicating the major contents for the body text. In the body text, clearly state the name of a sender, email address, phone number, and permanent address, with a checkbox where they may choose not to receive email notifications.
2.Other methods besides email including fax and text message: Take the required measures including the indication of a sender's name.

14. Criteria on the Additional Provisions and the Use of Personal Information

Pursuant to the relevant laws, the criteria of the Company on the use or provision of the additional personal information without a customer's consent is as follows:

1.Where the purpose of using and providing personal information additionally is relevant to the original collection purpose;
2.Where there is any possibility to predict the use or provision of the additional personal information in light of the circumstances where personal information is collected or due to the personal information handling practice;
3.Where the use or provision of personal information unlawfully infringes on the interests of the personal information owner;
4.Where the necessary measures including a pseudonym or encryption are taken to secure the safety of the personal information.

15. Obligation for Notification

Should there be information to be added, deleted and edited according to the government policies or the policies of the Company, the notification on such changes will be provided via the website at least seven(7) days before the revision.

This Policy on the Handling of Personal Information takes effect as of November 25, 2021, and the previous version will be replaced with the current version.