KT&G Co., Ltd. ("Company") has the following personal information processing policies to protect the personal information and rights of a person who provides the personal information to the Company (hereinafter referred to as "Subject of Information") and to smoothly handle the related complaints according to the Personal Information Protection Act.
- This policy will take effect on September 13, 2021, and you can check the previous processing policy in the reference of previous processing policy.
- Where this policy is revised, it will be posted on the Company's website.

Article 1 (Purpose of processing personal information)

The Company processes the personal information collected from the Subject of Information according to the purpose of each of the following items and does not change the purpose of use or use it in a different way other than that without prior consent of the Subject of Information.

• A. Customer inquiries and the reporting and answering of unethical activities.

  Personal information is processed for the purpose of identifying oneself, checking civil complaints, contacting and notifying for fact-finding, and notifying the results of processing.

• B. Factory/facility tour/space rental application

  Where the application for a factory/facility tour/space rental is made, it is used for the purpose of contacting the applicant.

• C. Request for commercial use of imagination style.

  KT&G's approval is required when using KT&G's imagination style for commercial purposes.

Article 2 (Period of processing and retention of personal information)

• ① The Company processes and holds personal information within the period of possession and use of personal information under laws or within the period of possession and use of personal information agreed upon by the Subject of Information.
• ② Each personal information processing and retention period is as follows:
  • A. Processing of customer inquiries and unethical activities reporting: one month from the date of inquiry/reporting.
  • B. Factory/facility tour/space rental application: 6 months from the date of application.
  • C. Request for commercial use of imaginary style: 1 month from the date of request.
• ③ Notwithstanding the holding period of the above paragraph, where the Subject of Information directly requests the deletion according to due procedures and methods, it will be destroyed without delay.

Article 3 (Matters concerning the provision of personal information to a third party)

• ① In principle, the Company processes the user's personal information within the scope specified in Article 1 (Purpose of processing personal information) and does not process it beyond the original scope or provide it to a third party without the user's consent.
• ② However, except where there is a risk of unfairly infringing on the interests of the Subject of Information or a third party, the personal information may be provided to a third party in the following cases.
  • A. Where a separate consent is obtained from the Subject of Information,
  • B. Where there are special provisions in other laws,
  • C. Where it is necessary for the purpose of statistics preparation and academic research and the information of a specific individual is provided in an unrecognizable form.
  • D. Where it is necessary to investigate a crime, file a prosecution, and perform the court's judicial affairs.

Article 4 (Consignment of personal information processing)

• ① The Company entrusts its affairs as follows for smooth business processing.

  Trustee company	Trusted affairs and purpose	Items of personal information	Retention and use period
  Easy media, Co. Ltd.	Webpage development/maintenance/analysis	Name, contact (home/cell phone), e-mail, IP address, name of company, business type, handling goods, person in charge	No separate retention
  LG CNS, Co. Ltd.	Infra (DB) operation	Name, contact (home/cell phone), e-mail, IP address, name of company, business type, handling goods, person in charge	No separate retention

• ② In accordance with Article 26 of the Personal Information Protection Act, the Company specifies the matters related to responsibility, such as the prohibition of personal information processing, the technical and administrative protection measures, the re-consignment restrictions, the management and supervision of the trustee and compensation for damages in the documents such as a contract, and supervises whether the trustee handles personal information safely.
• ③ Where the contents of the consignment work or the trustee changes, we will disclose it through this personal information processing policy without delay

Article 5 (Rights and obligations of the Subject of Information, and the method of exercising them)

• ① The Subject of Information may exercise the following personal information protection rights against the Company at any time.
  • A. Request to access personal information.
  • B. Where there is an error, etc., request of correction.
  • C. Request of deletion.
  • D. Request for suspension of processing.
• ② If you contact the reception and processing department or request in writing for the exercise of rights such as requesting access, the Company will take action without delay.
  • A. Phone or e-mail inquiry.
  • B. A written request through e-mail or FAX.

  Reception and procession department
  Person in charge/department	Eum Moon-kyung/ promotion dept.
  Contact	02-3404-4202
  e-mail	20060108@ktng.com

• ③ You can exercise your rights, such as requesting access, through an agent delegated by the Subject of Information. In this case, you must submit the following power of attorney
• ④ Where the Subject of Information requests the correction or deletion of personal information errors, etc., the Company will not use or provide the personal information until the correction or deletion is completed.
• ⑤ The Company processes the personal information terminated or deleted at the request of the Subject of Information as specified in Article 2 (Period of processing and retention of personal information) and ensures that it cannot be accessed or used by other purposes.
• ⑥ The Subject of Information shall not infringe on the personal information and privacy of the Subject of Information itself or others in violation of the relevant laws such as the Personal Information Protection Act.

Article 6 (Items of personal information to be processed)

• ① The Company handles the following personal information items.
  • A. Answer to customer inquiries.

    - Required : Name, E-mail, Inquiry type, Inquiries, Over 14 years old

    - Optional : Attach file

  • B. Answer to report unethical activities.

    - Required : Name, Contact information(home/cell phone), E-mail, Inquiries type, Inquiries, Check my text/password, Over 14 years old

    - Optional : Country, Attach file

• ② In addition to paragraphs 1 and 2, the following personal information items may be automatically generated and collected during the service use process.
  - User Agent (browser information), IP address: Statistical analysis of service use and prevention of illegal/unfair use.
• ③ We do not process sensitive information such as thoughts and beliefs, joining and withdrawal of labor unions and political parties, political views, and sexual life.

Article 7 (Destruction of personal information)

• ① Where the personal information becomes unnecessary, such as the lapse of the period of personal information retention or the achievement of the purpose of processing, the Company will destroy the personal information without delay.
• ② Where the personal information must be preserved according to other laws and regulations even after the period of personal information retention agreed upon by the Subject of Information has elapsed or the purpose of processing has been achieved, the personal information will be moved to a separate database or preserved differently.
• ③ The procedure and method of destroying personal information are as follows:
  • A. Destruction procedure

    The Company selects personal information that has caused the reason for destruction and destroys the personal information with the approval of the Company's personal information protection officer.

  • B. Method of destruction

    The Company permanently deletes personal information recorded and stored in the form of electronic files in a way that cannot be restored, and shreds or incinerates records, prints, documents and other recording media other than electronic files.

Article 8 (Methods related to the installation and operation of personal information automatic collection device and its rejection)

The Company operates Cookie, which automatically stores and finds member information to provide the specialized services to users.

• - What is Cookie: A very small text file sent to the user's browser by the server used to run the website. It is stored on the user's computer.
• - Denial of Cookie installation and collection: Users have the option to install cookies and can allow all cookies by setting options in a web browser, or go through confirmation whenever cookies are saved, or refuse to save all cookies. However, where users refuse to install cookies, it may be difficult to use some services that require login.
  
  • · Method of setting in the case of Internet Explorer: Tools menu in the top of web browser > Internet Options > Personal Information > Settings
  • · Method of setting in the case of Chrome: Settings menu on the right side of the web browser > Indication of high rank settings at the bottom of the screen > Personal information contents setting button > Cookies
• - Purpose of automatic collection and items to collect.

  Collection purpose	Collection items	Retention period
  Statistical analysis and illegal/unlawful prevention use	Users' agents (browser information), IP address	Factory/facility tour/space rental application: 6 months - Customer inquiry, reporting of unethical activities, download of imagination style: 1 month
  Provision of customized service	Cookie	15 minutes

Article 9 (Measures to secure the safety of personal information)

The Company is taking the following measures in accordance with Article 29 of the Personal Information Protection Act.

• A. Management measures: Establishing and implementing an internal management plan, training of regular employee, and minimizing the designation of persons in charge of handling personal information.
• B. Technical measures: managing the access rights of data systems that process personal information, installing the access control systems, encrypting the unique identification information, and installing the security programs.
• C. Physical measures: Control of access to places where the personal information is stored such as computer centers.

Article 10 (Personal information protection officer)

• ① The Company is responsible for the handling of personal information as a whole, and designates the person in charge of personal information protection as follows to handle complaints and damages relief of the Subject of Information related to personal information processing.

  Officer in charge of personal information protection		Staff in charge of personal information protection
  Name	Park Young-Jo	Name	Jo Kyoung-Chun
  Position	The head of Information Security Office	Department	Information Security Office
  Contact1 (phone & fax)	042-939-5347
  Contact2 (e-mail)	kcjo@ktng.com

• ② The Subject of Information may contact the personal information protection manager and the department in charge for all personal information protection inquiries, complaints, and damage relief incurred while using the Company's service (or business). The Company will respond and process the Subject of Information's inquiries without delay.
• ③ In order to receive the relief from the personal information infringement, the Subject of Information may apply for the dispute resolution or consultation to the Personal Information Infringement Reporting Center, the Personal Information Dispute Mediation Committee, and the Korea Internet & Security Agency. Please contact the institutions below for the reports and counseling of personal information infringement.
  - Personal Information Infringement Report Center: (without a regional number) 118 (http://privacy.kisa.or.kr)
  - Personal Information Dispute Mediation Committee: 1833-6972 (http://kopico.go.kr)
  - Cyber investigation department of the Supreme Prosecutors' Office: 1301(without a regional number), cid@spo.go.kr (http://spo.go.kr)
  - National Police Agency Cyber Safety Bureau: 182(without a regional number) (http://cyberbureau.police.go.kr)

Article 11 (Change of personal information processing policy)

This personal information processing policy will take effect from the date of enforcement, and where there is any addition, deletion, or correction of changes in accordance with laws and policies, it will be notified through the Company's website (en.ktng.com) on the date of enforcement.