Privacy Policy

<HL Mando Corp> (http://www.hlmando.com/, hereinafter referred to as the “HL Mando Website”) established the following privacy policy to protect the personal information, rights and interests of the users and to process any grievances of the users related to the personal information pursuant to the Personal Information Protection Act. HL Mando Website will provide notice of any changes to the privacy policy through the notices section (or individual notice) on the website.
Effective Date of the Privacy Policy: Oct. 1, 2022

1. Purposes of Processing Personal Information

HL Mando Website processes personal information for the following purposes. The personal information processed shall not be used for other purposes, and a prior consent will be obtained pursuant to Article 18 of the Personal Information Protection Act when the purpose of the use is changed.

A. Processing Complaints

- Personal information is processed for the purpose of verifying the identity of the person making the complaint, verifying the complaint, contact/notice for fact-finding and notice of the processing result, etc.

2. Period of Processing and Retaining Personal Information

A. HL Mando Website processes and retains the personal information for the duration provided for by the relevant statutes for the retention and use of personal information or the period to which each data subject consents when the personal information is collected.

B. The period during which personal information is processed and retained is as follows:

- Processing Complaints: 30 days (prior consent of the user)

3. Matters Pertaining to the Provision of Personal Information to Third Parties

A. HL Mando Website processes the personal information of the users only within the purposes stipulated in Article 1, as a rule, and does not process beyond the original scope nor provide to a third party. Provided, the personal information may be provided to a third party for the following

– When the user consents to providing and/or disclosing to a third party in advance;
– When required by law;
– 서비For personal information needed to fulfill the contract related to the provision of the service and is difficult to obtain consent for economic or technical reasons or
– When used by processing in a format that cannot be individually identifiable.

4. Outsourcing of Personal Information Processing

A. HL Mando Website outsources the processing of personal information as follows:

<Maintenance of the HL Mando Website>

- Company (Outsourcer): Biznetpia
- Outsourced Function: System management, etc.
- Outsourcing Period: Until the termination of the outsourcing contract

<Cloud Server of the HL Mando Website>

- Company (Outsourcer): Magnumvint
- Outsourced Function: Cloud Server management, etc.
- Outsourcing Period: Until the termination of the outsourcing contract

B. HL Mando Website stipulates the terms, including prohibition on processing personal information outside the purpose of the outsourced work, technical and managerial protective measures, restriction on re-outsourcing, management and supervision on the outsourcer, indemnification, etc., on the contract pursuant to Article 25 of the Personal Information Protection Act when executing the outsourcing contract, and supervises the outsourcer to securely process the personal information.

C. Any changes in the above commissioned tasks or the contractor will be publicly announced through the privacy policy without any delay.

5. Rights and Obligations of Data Subjects and the Exercise of the Rights and Obligations

The user may exercise the following rights as the data subject.

A. The data subject may exercise each of the following personal information protection-related rights against HL Mando Website at any time:

① Request for accessing personal information;
② Request for correcting errors, if any;
③ Request for deleting personal information; and
④ Request for suspending processing.

B. The rights provided in Paragraph A may be exercised by completing the form specified Personal Information Protection Act and submitting it by post, e-mail or fax. In such cases, HL Mando Website will take the necessary measures promptly.

C. Where a data subject requests the correction or deletion of any error, etc., to his/her personal information, the relevant information will not be used or provided until such information is corrected or deleted.

D. A data subject may exercise the rights provided in Paragraph A through an agent, including a legal representative and a power of attorney. In such a case, the data subject is required to submit a letter of delegation as specified Rule of the Personal Information Protection Act.

6. Personal Information to be Processed

A. HL Mando Website processes the following personal information:
<Processing of Complaints>

– Required Items: Name, e-mail, telephone, details of the complaint

B. The following personal information may be automatically created and collected in the process of using the internet service:

– IP Address, cookies, MAC address, service use record, visiting log, etc.

7. Destruction of Personal Information

HL Mando Website disposes of records containing personal information immediately after achieving the purpose of processing the personal information, as a rule. The procedures, deadlines and methods for destroying personal information are as follows

A. Procedure for Destruction

– The information entered by the user is moved to a separate DB after achieving the purpose (a separate document, in case of a paper document) and destroyed after being retained for a fixed period pursuant to the internal policy and other relevant laws, or immediately. At such a time, the personal information moved to a separated DB is not used for other purposes, unless required by law.

B. Deadline for Destruction

– The personal information of the users is destroyed within 5 days after the expiration of the retention period, when the retention period has elapsed, and within 5 days from becoming unnecessary when such personal information becomes unnecessary, such as achieving the purpose of processing the personal information, abolition of the concerned service and the end of the business, etc.

C. Method of Destruction

– The information stored in electronic files will be destroyed through technical methods to prevent the recovery of the records. The personal information recorded and preserved in paper documents will be destroyed by a shredder or incinerated.

8. Deployment and Operation of Devices to Collect Personal Data; Your Right to Disagree

We use cookies or a similar means to save your data and retrieve it from time to time.

A. Option to Use Automatic Collection

- your web browser, you can either accept all cookies, demand consent from you whenever a cookie is stored or prevent cookies from being installed.

B. Disapproval of Automatic Collection

- you can either accept all cookies, demand consent from you whenever a cookie is stored or prevent cookies from being installed. (Please note that if you do not allow cookies to be installed on your computer, your access to certain services may be limited.)

9. Measures for Ensuring the Safety of Personal Information

HL Mando Website takes the following technical, administrative and physical measures necessary to ensure the safety pursuant to Personal Information Protection Act and Article 30 of the Enforcement Decree of the Act:

1. Conducting Self-Audit on a Regular Basis

- To ensure safety related to the handling of personal information, a self-audit is conducted on a regular basis (quarterly)

2. Minimizing and Educating Personnel Authorized to Handle Personal Information

- HL Mando designates and minimizes the personnel handling of the personal information to manage the personal information

3. Establish and Implement an Internal Management Plan

- Mando establishes and implements internal management plans to safely process the personal information

4. Technical Measures Against Hacking, Etc.

- HL Mando Website has installed a security program and updates and inspects the programs to protect personal information from being leaked externally or destroyed by hacking or computer viruses, and the systems have been installed in an area with restricted access to technically and physically monitor and block external access.

5. Encryption of Personal Information

- Passwords and identification numbers for the personal information of each user are encrypted for storage and management. Furthermore, additional means, such as encrypting essential data for storage and transmission, are used in securing important data that are known only by the information owner.

6. Preserving Access Logs and Preventing any Forgery and Alteration

- Log data about access to the personal information processing system are retained for at least 6 months, and the access logs are maintained properly to prevent any forgery, theft and losses.

7. Restrictions on Access to Personal Information

- Access to personal information is controlled by granting, amending or cancelling the authority to access the database system that processes personal information. Unauthorized external access is controlled by operating firewalls.

8. Use of Locking Devices to Protect Documents

- Documents and storage media with personal information are stored in a secure location with locking devices.

9. Controlling Access by Unauthorized Persons

- The area for the physical storage of the personal information is separated from other areas and a procedure for controlling access to this area is established and implemented.

10. Designation of a Privacy Officer and department that handles

A. HL Mando Website designates a privacy officer to supervise and be responsible for the personal information processing duties and for the processing of any complaints by the data subjects on the personal information processing.

Information on the department in charge of personal information
Division	Privacy Officer	Personal Information Department
Name	Park, Kwangmin	Park, Mi-Na
Department	Sustainable Value & Relations	Sustainable Value & Relations
Phone	82-2-6244-2799	82-2-6244-2345
Email	kwangmin.park@halla.com	mina.park@halla.com

B. Any inquiries related to personal information protection, complaints processing, damage relief from using the services (or business) of HL Mando Website can be directed to the privacy officer or the managing department. HL Mando Website will answer and process any inquiries regarding a data subject without delay.

11. Remedial Measures on Personal Information Infringement

▶ Personal Information Infringement Reporting Center (privacy.kisa.or.kr / 118)

▶ Prosecution Service (www.spo.go.kr / 02-3480-2000)

▶ Korea National Police Agency Cyber Terror Response Center (cyberbureau.police.go.kr / 182)

12. Changes to the Privacy Policy

This privacy policy is effective from the implementation date, and any addition, deletion or correction of the terms pursuant to the laws and/or policy will be publicly announced through the notice 7 days prior to the implement of the changes.

<HL Mando Corp> (http://www.hlmando.com, hereinafter referred to as the “HL Mando Website") established the following privacy policy to protect the personal information, rights and interests of the users and to process any grievances of the users related to the personal information pursuant to the Personal Information Protection Act.
HL Mando Website will provide notice of any changes to the privacy policy through the notices section (or individual notice) on the website.
Effective Date of the Privacy Policy : Aug. 28, 2018

1. Purposes of Processing Personal Information

A. Processing Complaints
Personal information is processed for the purpose of verifying the identity of the person making the complaint, verifying the complaint, contact/notice for fact-finding and notice of the processing results, etc.

2. Period of Processing and Retaining Personal Information

B. The period during which personal information is processed and retained is as follows:

- Processing Complaints: 30 days (prior consent of the user)

3. Matters Pertaining to the Provision of Personal Information to Third Parties

- When the user consents to providing and/or disclosing to a third party in advance;
- When required by law;
- For personal information needed to fulfill the contract related to the provision of the service and is difficult to obtain consent for economic or technical reasons; or
- When used by processing in a format that cannot be individually identifiable.

4. Outsourcing of Personal Information Processing

A. HL Mando Website outsources the processing of personal information as follows:

<Maintenance of the HL Mando Website>

- Company (Outsourcer): Biznetpia
- Outsourced Function: System management, etc.
- Outsourcing Period: Until the termination of the outsourcing contract

C. Any changes in the above commissioned tasks or the contractor will be publicly announced through the privacy policy without any delay.

5. Rights and Obligations of Data Subjects and the Exercise of the Rights and Obligations

The user may exercise the following rights as the data subject.

A. The data subject may exercise each of the following personal information protection-related rights against HL Mando Website at any time:

① Request for accessing personal information;
② Request for correcting errors, if any;
③ Request for deleting personal information; and
④ Request for suspending processing.

B. The rights provided in Paragraph A may be exercised by completing the form specified in the attached Form 8 of the Enforcement Rule of the Personal Information Protection Act and submitting it by post, e-mail or fax. In such cases, HL Mando Website will take the necessary measures promptly.

6. Personal Information to be Processed

A. HL Mando Website processes the following personal information:
<Processing of Complaints>

- Required Items: Name, e-mail, telephone, details of the complaint

B. The following personal information may be automatically created and collected in the process of using the internet service:

- IP Address, cookies, MAC address, service use record, visiting log, etc.

7. Destruction of Personal Information

A. Procedure for Destruction
The information entered by the user is moved to a separate DB after achieving the purpose (a separate document, in case of a paper document) and destroyed after being retained for a fixed period pursuant to the internal policy and other relevant laws, or immediately. At such a time, the personal information moved to a separated DB is not used for other purposes, unless required by law.

B. Deadline for Destruction
The personal information of the users is destroyed within 5 days after the expiration of the retention period, when the retention period has elapsed, and within 5 days from becoming unnecessary when such personal information becomes unnecessary, such as achieving the purpose of processing the personal information, abolition of the concerned service and the end of the business, etc.

C. Method of Destruction
The information stored in electronic files will be destroyed through technical methods to prevent the recovery of the records. The personal information recorded and preserved in paper documents will be destroyed by a shredder or incinerated.

8. Measures for Ensuring the Safety of Personal Information

HL Mando Website takes the following technical, administrative and physical measures necessary to ensure the safety pursuant to Articles 24 (2) and 29 of the Personal Information Protection Act and Article 30 of the Enforcement Decree of the Act:

A. Conducting Self-Audit on a Regular Basis
To ensure safety related to the handling of personal information, a self-audit is conducted on a regular basis (quarterly)

B. Minimizing and Educating Personnel Authorized to Handle Personal Information
HL Mando designates and minimizes the personnel handling of the personal information to manage the personal information

C. Establish and Implement an Internal Management Plan
HL Mando establishes and implements internal management plans to safely process the personal information

D. Technical Measures Against Hacking, Etc.
HL Mando Website has installed a security program and updates and inspects the programs to protect personal information from being leaked externally or destroyed by hacking or computer viruses, and the systems have been installed in an area with restricted access to technically and physically monitor and block external access.

E. Encryption of Personal Information
Passwords and identification numbers for the personal information of each user are encrypted for storage and management. Furthermore, additional means, such as encrypting essential data for storage and transmission, are used in securing important data that are known only by the information owner.

F. Preserving Access Logs and Preventing any Forgery and Alteration
Log data about access to the personal information processing system are retained for at least 6 months, and the access logs are maintained properly to prevent any forgery, theft and losses.

G. Restrictions on Access to Personal Information
Access to personal information is controlled by granting, amending or cancelling the authority to access the database system that processes personal information. Unauthorized external access is controlled by operating firewalls.

H. Use of Locking Devices to Protect Documents
Documents and storage media with personal information are stored in a secure location with locking devices.

I. Controlling Access by Unauthorized Persons
The area for the physical storage of the personal information is separated from other areas and a procedure for controlling access to this area is established and implemented.

9. Designation of Privacy Officer

▶ HL Mando Website Privacy Officer

- Name: Park, Kwangmin
- Position: Team Leader
- Contact : +82-2-6244-2799, kwangmin.park@hlcompany.com
※ Will be connected to the department in charge of personal information protection

▶ HL Mando Website Personal Information Department

- Team : Sustainable Value & Relations
- Manager : Park, Mina, Senior Associate
- Contact : +82-2-6244-2345, mina.park@hlcompany.com

10. Remedial Measures on Personal Information Infringements

A data subject may request assistance from the following agencies to seek remedies for the breach of personal information

▶ Personal Information Infringement Reporting Center (Korea Internet and Security Agency)

- Responsible Duties : reporting personal information infringement, request consultation
- Website : privacy.kisa.or.kr
- Telephone : 118 (without dialing an area code)
- Address : (58324) Personal Information Infringement Reporting Center, 3rd Fl. 9, Jinheung-gil, Naju-si, Jeollanamdo (301-2 Bitgaram-dong)

▶ Personal Information Dispute Mediation Committee

- Responsible Duties : application for mediation on personal information dispute, mediation on group dispute (civil resolution)
- Website : www.kopico.go.kr
- Telephone : 1833-6972 (without dialing an area code)
- Address : (03171) Seoul Government Complex 4F, 209, Sejong-daero, Jongno-gu, Seoul

▶ The Cyber Crime Investigation Team of the Supreme Prosecutors’ Office : 02-3480-3573 (www.spo.go.kr)

▶ Korean National Police Agency Cyber Bureau : 182 (cyberbureau.police.go.kr)

11. Changes to the Privacy Policy

A. This privacy policy is effective from the implementation date, and any addition, deletion or correction of the terms pursuant to the laws and/or policy will be publicly announced through the notice 7 days prior to the implement of the changes.

<HL Mando Corp> ('http://www.hlmando.com', hereinafter referred to as the “HL Mando Website”) established the following privacy policy to protect the personal information, rights and interests of the users and to process any grievances of the users related to the personal information pursuant to the Personal Information Protection Act.
HL Mando Website will provide notice of any changes to the privacy policy through the notices section (or individual notice) on the website.
Effective Date of the Privacy Policy : Sept. 26, 2016

1. Purposes of Processing Personal Information

2. Status of Personal Information Files

1. Personal Information Files: Customer Voice

- Personal Information Items : E-Mail, mobile telephone number, home telephone number, name, service use record, access log, cookie, access IP information
- Collection Method : Website
- Grounds for Retention : User consent
- Retention Period: 3 years

3. Matters Pertaining to the Provision of Personal Information to Third Parties

- When the user consents to providing and/or disclosing to a third party in advance;
- When required by law;
- For personal information needed to fulfill the contract related to the provision of the service and is difficult to obtain consent for economic or technical reasons; or
- When used by processing in a format that cannot be individually identifiable.

4. Outsourcing of Personal Information Processing

A. HL Mando Website outsources the processing of personal information as follows:

<Maintenance of the HL Mando Website>

- Company (Outsourcer): Biznetpia
- Outsourced Function: System management, etc.
- Outsourcing Period: Until the termination of the outsourcing contract

C. Any changes in the above commissioned tasks or the contractor will be publicly announced through the privacy policy without any delay.

5. Rights and Obligations of Data Subjects and the Exercise of the Rights and Obligations

The user may exercise the following rights as the data subject.

① The data subject may exercise each of the following personal information protection-related rights against HL Mando Website at any time.

1. Request for accessing personal information
2. Request for correcting any errors, if any
3. Request for deleting personal information
4. Request for suspending processing

② The rights provided in Paragraph 1 may be exercised by completing the form specified in the attached Form 8 of the Enforcement Rule of the Personal Information Protection Act and submitting it by post, e-mail or fax. In such cases, HL Mando Website will take the necessary measures promptly.

③ Where a data subject requests the correction or deletion of any error, etc. to his/her personal information, the relevant information will not be used or provided until such information is corrected or deleted.

④ A data subject may exercise the rights provided in Paragraph 1 through an agent, including a legal representative and a power of attorney. In such a case, the data subject is required to submit a letter of delegation as specified in the attached Form 11 of the Enforcement Rule of the Personal Information Protection Act.

6. Providing the Personal Information to a Third Party

① HL Mando Website processes the following personal information:
<Processing of Complaints>

- Required Items: Name, mobile telephone number, home telephone number, e-mail, service use record, access log, cookie, access IP information

7. Destruction of Personal Information

- Procedure for Destruction: The information entered by the user is moved to a separate DB after achieving the purpose (a separate document, in case of a paper document) and destroyed after being retained for a fixed period pursuant to the internal policy or other relevant laws, or immediately. At such a time, the personal information moved to a separate DB is not used for other purposes, unless required by law.
- Deadline for Destruction: The personal information of the users is destroyed within 5 days after the expiration of the retention period, when the retention period has elapsed, and within 5 days from becoming unnecessary when such personal information becomes unnecessary, such as achieving the purpose of processing the personal information, abolition of the concerned service and the end of the business, etc.
- Method of Destruction: The information stored in electronic files will be destroyed through technical methods to prevent the recovery of the records. The personal information recorded and preserved in paper documents will be destroyed by a shredder or incinerated.

8. Measures for Ensuring the Safety of Personal Information

HL Mando Website takes the following technical, administrative and physical measures necessary to ensure the safety pursuant to Article 29 of the Personal Information Protection Act:

A. Conducting Self-Audit on a Regular Basis
To ensure safety related to the handling of personal information, a self-audit is conducted on a regular basis (quarterly)

B. Minimizing and Educating Personnel Authorized to Handle Personal Information
HL Mando designates and minimizes the personnel handling of the personal information to manage the personal information

C. Establish and Implement an Internal Management Plan
HL Mando establishes and implements internal management plans to safely process the personal information

H. Use of Locking Devices to Protect Documents
Documents and storage media with personal information are stored in a secure location with locking devices.

9. Designation of Privacy Officer

① HL Mando Website designates a privacy officer to supervise and be responsible for the personal information processing duties and for the processing of any complaints by the data subjects on the personal information processing.

▶ Privacy Officer

Name : Park, Kwangmin
Position : Team Leader
Rank : Senior Manager
Contact : +82-2-6244-2799, kwangmin.park@hlcompany.com
※ Will be connected to the department in charge of personal information protection

▶ Department in Charge of Personal Information Protection

Team : Sustainable Value & Relations
Manager : Park, Mina, Senior Associate
Contact : +82-2-6244-2345, mina.park@hlcompany.com

② Any inquiries to personal information protection, complaints processing, damage relief from using the Service (or business) of HL Mando Website can be directed to the privacy officer or the managing department. HL Mando Website will answer and process any inquiries regarding a data subject without delay.

10. Remedial Measures on Personal Information Infringements

A data subject may request assistance from the following agencies to seek remedies for the breach of personal information.

▶ Personal Information Infringement Reporting Center (Run by the Korea Internet and Security Agency)

- Responsible Duties : Reporting personal information infringement, request for consultations
- Website : privacy.kisa.or.kr
- Telephone : 118 (without dialing an area code)
- Address : (138-90) Personal Information Infringement Reporting Center at KISA, 135, Jungdae-ro, Songpa-gu, Seoul

▶ Personal Information Dispute Mediation Committee (Run by the Korea Internet and Security Agency)

- Website : privacy.kisa.or.kr
- Telephone : 118 (without dialing an area code)
- Address : (138-90) Personal Information Infringement Reporting Center at KISA, 135, Jungdae-ro, Songpa-gu, Seoul

▶ The Cyber Crime Investigation Team of the Supreme Prosecutors’ Office : +82-2-3480-3573 (www.spo.go.kr)

▶ Korean National Police Agency Cyber Bureau : 1566-0112 (www.netan.go.kr)

11. Changes to the Privacy Policy

① This privacy policy is effective from the implementation date, and any addition, deletion or correction of the terms pursuant to the laws and/or policy will be publicly announced through the notice 7 days prior to the implementation of the changes.