KOREA FITTING CO., LTD.

KOREA FITTING CO., LTD. (hereinafter the "Company") has established this Privacy Policy in accordance with applicable laws and regulations in order to protect the personal information and rights of customers who use the Internet site operated by the Company (hereinafter the "Site") and to handle related complaints smoothly. When this Privacy Policy is revised, the Company will announce the revision through a notice on the website (or an individual notice).

Article 1. Purpose of Collection and Use of Personal Information

The Company collects personal information for the following purposes. The collected personal information will not be used for any purpose other than the following, and the Company will obtain prior consent if the purpose of use changes.

Handling of Inquiries and Complaints

For confirming the identity of the inquirer, confirming the inquiry, sending notices for fact-finding, and notifying the results of handling

Provision of Services

For providing services and content, providing customized services, identity verification, age verification and other input

Marketing and Advertising

For developing new services and providing customized services, providing information on events and advertisements and opportunities to participate, providing services and placing advertisements according to demographic characteristics, verifying the effectiveness of services, identifying access frequency, and compiling statistics on members' use of services

Article 2. Items of Personal Information Collected and Collection Methods

Items of personal information collected

① Form mail inquiry

[Required] Name, email, mobile phone number

② Information automatically generated and collected during service use or business processing

[Required] Access IP information, cookies, service usage records, access logs
[Optional] Response records by item from customer satisfaction surveys

③ Others

• When additional personal information that was not collected at sign-up is collected during the use of additional or customized services or event participation, the Company will notify users of the relevant items and process the matter after obtaining separate consent.

Methods of collecting personal information

• Online collection through the website and the consultation board, offline collection through telephone and written application forms within the Company, and collection through email and event entries
• Provision by identity verification agencies or affiliates
• Collection through information generation tools

Article 3. Retention and Use Period of Personal Information

• 1.When collecting personal information from users, the Company retains and uses it within the period for which consent was obtained. However, if retention is required under relevant laws and regulations, the Company retains it in accordance with those laws.
• 2.For members, the retention and use period of personal information runs from the conclusion of the service agreement (sign-up) until its termination (including withdrawal request and withdrawal by the Company). Unless other laws set a separate period or the customer requests otherwise, the Company destroys the personal information of members who have not used the service for the period defined by law (1 year). However, at least 30 days before the expiry of the period, the Company notifies the member by email, telephone or a similar method that the personal information will be destroyed, the expiry date and the items concerned.
• 3.The retention periods of personal information under relevant laws are as follows.
  • <Retained information / Retention period>
    Records on labeling and advertising: 6 months
    Computer communication or Internet access records: 3 months
• 4.Even where there is no basis in relevant laws, the Company may retain information in accordance with company policy when necessary to prevent significant loss to the Company or for crime investigation and litigation. In such cases, only the minimum period and items necessary to achieve that purpose are retained.
  • <Retained information / Retention period>
    Information of members who have lost their qualification under the terms of use: 5 years

Article 4. Provision of Personal Information to Third Parties

• 1.As a rule, the Company does not provide users' personal information to outside parties. The exceptions are cases where special provisions of law exist or where it is unavoidable in order to comply with legal obligations, as set out below. When providing personal information to a third party for a purpose other than the original one, the Company imposes certain restrictions on the purpose and method of use, or requests the recipient to take the measures necessary to ensure safe handling.
  • ①Where users have given prior consent
  • ②Where there is a basis in other laws, such as the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Telecommunications Business Act and the Use and Protection of Credit Information Act
  • ③Where information is provided in a form that does not identify specific individuals for statistics, academic research, market research, information provision or notification mailings
  • ④Where the data subject or his/her legal representative is unable to express intent or prior consent cannot be obtained because the address is unknown, and it is necessary for the urgent protection of the life, body or property of the data subject or a third party
  • ⑤Where it is necessary for criminal investigation, prosecution and maintenance of charges, court trials and execution of sentences, and lawful procedures have been followed
• 2.If a third-party recipient arises, the matter will proceed through separate consent.
• 3.Consent to provision to third parties can be withdrawn by contacting the Company at kft@koreafitting.co.kr, and upon withdrawal the information will be destroyed immediately.

Article 5. Procedures and Methods for Destroying Personal Information

The Company destroys personal information when the purpose of collection and use has been achieved or the retention period has expired. The destruction procedures and methods are as follows. However, this does not apply where the information must be preserved under other laws.

Destruction procedure

Information entered by users is, after its purpose has been achieved, moved to a separate database (separate files in the case of paper) and stored for a certain period or destroyed immediately in accordance with internal policy and other relevant laws. Personal information moved to the database is not used for any other purpose except as required by law.

Destruction deadline

A user's personal information is destroyed within 5 business days from the end of the retention period when that period has elapsed, and within 5 business days from the day the information is deemed unnecessary when it is no longer needed because the processing purpose has been achieved, the service has been discontinued or the business has ended. If the legal representative of a child under 14 refuses, or consent cannot be confirmed, the information is destroyed within 5 business days of the date of collection.

Destruction method

Information in electronic file form is deleted using technical methods that make the records impossible to reproduce. Personal information printed on paper is destroyed by shredding or incineration.

Article 6. Rights of Users and Legal Representatives and How to Exercise Them

• 1.Users may withdraw their consent to the collection, use and provision of personal information at any time. Upon withdrawal, the Company takes necessary measures without delay, such as destroying the collected personal information.
• 2.Users may request access to, provision of, and correction of the following items concerning themselves.
  • ①The users' personal information held by the Company
  • ②The status of use and third-party provision of the users' personal information
  • ③The status of consent given to the Company for the collection, use and provision of personal information
• 3.If a user requests correction or deletion of an error in personal information, the Company will not use or provide that personal information until the correction or deletion is completed.
• 4.Users may submit requests for access to personal information to the department below. We will do our best to process such requests promptly.
• <Inquiries on access to personal information>

  Inquiries on access to personal information

  Department	Customer Support Office, KOREA FITTING CO., LTD.
  Main Phone	KOREA FITTING CO., LTD. ( +82-51-312-9941~2)
  Email	kft@koreafitting.co.kr

Article 7. Installation and Operation of Automatic Personal Information Collection Devices and Refusal

• 1.To identify users, keep members logged in and provide personalized services, the Company uses cookies, which store and frequently retrieve user information. A cookie is a small amount of information that a website server sends to the user's web browser and is stored on the hard disk of the user's computer.
• 2.Users have the option to accept or refuse cookies. Through web browser settings, users can allow or block all cookies, or require confirmation each time a cookie is stored. However, if cookies are refused, some services provided by the Company, such as personalized services, may be difficult to use.
  • How to refuse cookies (Internet Explorer):
    In the web browser, select the [Tools] menu > [Internet Options] > the [Privacy] tab > choose the desired option under [Advanced]

Article 8. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act and Article 28 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Company takes the following technical, managerial and physical measures necessary to ensure security.

Handling of personal information

Minimizing and training staff: we designate the employees who handle personal information, limit them to the persons in charge, and manage personal information accordingly.

Regular self-audits

To ensure the security of personal information handling, we conduct regular self-audits (once a quarter).

Establishment and implementation of an internal management plan

We have established and implemented an internal management plan for the safe handling of personal information.

Encryption of personal information

Users' passwords are stored and managed in encrypted form so that only the user knows them, and important data is protected with additional security features such as encryption of files and transmitted data or file locking.

Technical measures against hacking

To prevent leakage and damage of personal information by hacking or computer viruses, we install security programs and update and inspect them periodically, place systems in areas with controlled external access, and monitor and block technically and physically.

Restriction of access to personal information

We take the measures necessary to control access to personal information by granting, changing and revoking access rights to the database systems that process personal information, and we use an intrusion prevention system to control unauthorized external access.

Retention of access records and prevention of forgery

We keep and manage records of access to personal information processing systems for at least 6 months, and use security features to prevent the access records from being forged, altered, stolen or lost.

Use of locking devices for document security

Documents and auxiliary storage media containing personal information are kept in a safe place with a locking device.

Access control for unauthorized persons

We maintain a separate physical storage location for personal information and have established and operate access control procedures for it.

Personal information validity period system

In accordance with the Act on Promotion of Information and Communications Network Utilization and Information Protection and other relevant laws, to protect the personal information of users who have not used the service for a long period (1 year), the Company has destroyed such personal information since August 18, 2015, and notifies the relevant users by email or similar means 30 days before processing a withdrawal.

Article 9. Chief Privacy Officer

Users may direct all inquiries, complaints and requests for remedies concerning personal information that arise while using the Company's services to the Chief Privacy Officer or the department in charge. The Company will respond to and handle users' inquiries.

[Chief Privacy Officer]

Name : Yun-Kun Kim

Department : Customer Support Office, KOREA FITTING CO., LTD.

Position : CEO

Contact : +82-51-312-9941~2, kft@koreafitting.co.kr

Article 10. Remedies for Infringement of Rights

Users may contact the following organizations for remedies and consultation regarding infringement of personal information. (Please use them if you are not satisfied with the results of the Company's own complaint handling and remedies, or if you need more detailed help.)

Personal Information Protection Portal (operated by the Ministry of the Interior and Safety)

• Website : http://www.privacy.go.kr
• Phone : +82-2-403-0073

Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency)

• Website : http://privacy.kisa.or.kr
• Phone : 118 (within Korea, no area code)

Personal Information Dispute Mediation Committee

• Website : http://www.kopico.go.kr
• Phone : +82-1833-6972

Cyber Bureau, Korean National Police Agency

• Website : http://cyberbureau.police.go.kr
• Phone : 182 (within Korea, no area code)

Article 11. Notice of Changes to the Privacy Policy

This Privacy Policy may be changed due to government policy, laws and regulations, or the Company's needs. If content is added, deleted or corrected, the Company will give prior notice by posting on the website, email or similar means 7 days before the change takes effect, and as soon as possible if prior notice is difficult. However, if important matters such as the purpose of collection and use of personal information or the recipients of third-party provision are added, deleted or corrected, notice will be given 30 days in advance.