Privacy Policy

• 1. The Company processes the following personal information items for the purposes set forth below. The personal information being processed will not be used for any purposes other than those stated below, and if the purposes of use are changed, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

  Purpose of Processing, Categories of Personal Information Processed, and Retention and Use Period

  Category		Items Processed	Purpose of Processing	Retention and Use Period	Legal Basis
  Ethics Reporting/Complaint Handling	Named	Name, mobile phone number, e-mail address, password	Processing of ethics reports/complaints and providing results	Until the investigation and all follow-up actions are completed after receipt of the report	Article 15(1)(1) of the Personal Information Protection Act
  	Anonymous	E-mail address

• 2. Methods of collecting personal information
  • - Information directly entered by users through the website
• 3. Processing and retention period of personal information in accordance with relevant laws
  • 1) The Company processes and retains personal information within the period of retention and use agreed upon by the data subject at the time of collection, or within the period prescribed by law.
  • 2) The personal information processing and retention periods are as follows.
  
  

  Notwithstanding the foregoing, if the Company is required to retain personal information for a certain period in accordance with relevant laws and regulations for reasons such as confirming transactional rights and obligations, the information will be retained for such period as follows.

  Processing and Retention Periods of Personal Information Under Applicable Laws and Regulations

  Relevant Law	Items Processed	Retention Period
  Article 15-2 of the Protection of Communications Secrets Act	Computer communications and internet log records, trace data on access points	3 months

• 1. The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has expired or the purpose of processing has been achieved.

• 2. Even if the retention period of personal information agreed to by the data subject has expired or the purpose of processing has been achieved, where the personal information must continue to be preserved pursuant to other laws and regulations, such personal information will be stored by transferring it to a separate database (DB) or by changing the storage location.

• 3. The procedures and methods for destruction of personal information are as follows:

  • 1) Destruction procedure
    The Company selects personal information for which a reason for destruction has occurred and destroys such personal information with the approval of the Company’s Personal Information Protection Officer.
  • 2) Destruction method
    Personal information recorded and stored in electronic file format is destroyed so that the records cannot be restored, and personal information recorded and stored on paper documents is shredded by a shredder or incinerated.

• 1. The Company processes reporters’ personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information, Items Processed, and Retention and Use Period) and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the reporter’s consent or where there are special provisions under the law.

• 2. The Company provides personal information to third parties as follows.

  Provision of Personal Information to Third Parties

  Recipient	Purpose of Provision	Items Provided	Retention Period	Legal Basis
  Kyungdong Group companies (Kyungdong One, Kyungdong Everon, Kyungdong Polyum, Kyungdong T&S, and Kyungdong C&S)	To forward the report and resolve the complaint	For a named report Name, mobile phone number, e-mail address	From receipt of the report until the investigation and all follow-up actions are completed	Article 17(1)(1) of the Personal Information Protection Act
  		For an anonymous report E-mail address

• 1. The Company does not entrust the processing of customers’ personal information to any external company for the purpose of personal information protection, and all personal information is managed internally.

• 2. When the Company concludes an outsourcing contract, it specifies in the contract and other documents, in accordance with Article 26 of the Personal Information Protection Act, matters such as prohibition of processing personal information for purposes other than the performance of the outsourced services, technical and managerial safeguards, restrictions on re-outsourcing, management and supervision of the subcontractor, and allocation of liability including compensation for damages, and supervises the subcontractor to ensure that personal information is handled safely.

• 3. If the details of the outsourced work or the subcontractor change, the Company will promptly disclose such changes through this Privacy Policy.

The Company takes the following measures to ensure the security of personal information.

• 1. Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.

  • 1) Establishment and implementation of internal management plans

    • - The Company has established and implements internal management plans to ensure the secure processing of personal information.
    • - The Company regularly checks the implementation status and compliance with personal information protection measures and takes immediate corrective actions upon discovering any issues.

  • 2) Minimization of personnel handling personal information and training

    • - The Company designates employees who handle personal information, limits the number of employees in charge to the minimum necessary, and implements measures to manage personal information securely.
• 2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identifiers, installation of security programs

  • 1) Installation and operation of access control devices

    • - The Company uses firewalls and other intrusion prevention systems to prevent unauthorized external access and endeavors to maintain security by implementing all technically feasible protective measures.

  • 2) Encryption of personal information

    • - User passwords are stored and managed in encrypted form, and transmission of personal information data is protected using encryption or other security functions.

  • 3) Technical measures against hacking and the like

    • - To prevent leakage or damage of personal information caused by hacking or computer viruses, the Company installs security programs, updates and checks them on a regular basis, installs systems in areas where access from outside is controlled, and monitors and blocks access both technically and physically.
• 3. Physical measures: Access control to computer rooms, data storage rooms, etc.

  • - The Company designates computer rooms and data storage rooms as specially protected areas and controls access to them.

• 4. In addition to the measures required by law, the Company has obtained international information security and personal information protection certifications (ISO 27001 / 27701) to further ensure the security of personal information.

• 1. Data subjects may, at any time, exercise the following personal information protection-related rights against the Company:

  • 1) Request for access to personal information
  • 2) Request for correction in case of errors, etc.
  • 3) Request for deletion
  • 4) Request for suspension of processing

• 2. The rights under Paragraph 1 may be exercised against the Company via written request, telephone, e-mail, facsimile (FAX), etc., and the Company will take measures without delay.

• 3. Where a data subject requests correction or deletion of personal information due to errors, etc., the Company will not use or provide the personal information in question until the correction or deletion is completed.

• 4. The rights under Paragraph 1 shall be exercised by submitting a request to the personal information controller using the form prescribed in the Rules on the Method of Processing Personal Information or using a format notified by the Company. The rights may also be exercised through a legal representative or an authorized agent of the data subject, in which case a letter of proxy must be submitted.

The Company does not currently operate devices that automatically collect personal information such as cookies generated during the use of services. However, if such automated collection devices are installed and operated in the future to provide services, data subjects will be able to choose whether to allow the installation of cookies or to refuse the storage of all cookies.

• 1. What is a cookie?

  • - A cookie is a small text file sent by the server used to operate the Kyungdong Navien website to the user’s browser and stored on the user’s computer hard disk. When the user later visits the website, the website server reads the contents of the cookie stored on the user’s hard disk to maintain the user’s environment settings and provide customized services. Cookies do not automatically or actively collect information that can identify an individual, and data subjects may refuse or delete the storage of cookies at any time.

• 2. Installation, operation, and refusal of cookies

  • - Users have the option to allow the installation of cookies. Accordingly, users may allow all cookies, confirm each time a cookie is stored, or refuse the storage of all cookies through browser settings. However, if the storage of cookies is refused, some services may be difficult to use.

  • - The method for specifying whether to allow the installation of cookies is as follows.

    • · Allowing/blocking cookies in web browsers
      01. Chrome: Browser settings > Privacy and security > Clear browsing data
      02. Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data
    • · Allowing/blocking cookies in mobile browsers
      01. Chrome (mobile): Mobile browser settings > Privacy and security > Clear browsing data
      02. Safari: Mobile device Settings > Safari > Advanced > Block All Cookies
      03. Samsung Internet: Mobile browser Settings > Personal browsing data > Delete browsing data

• 1. The Company has designated the following department and Personal Information Protection Officer to protect users’ personal information and handle complaints related to personal information:

  Personal Information Protection Officer and Responsible Department

  Personal Information Protection Officer	Head of Management Division
  Department in Charge of Personal Information Protection	Information Security Team
  E-mail	privacy@kdiwin.com

• 2. Users may report any complaints related to personal information that arise while using the Company’s services (or business) to the Personal Information Protection Officer or the department in charge. The Company will respond to users’ inquiries in a prompt and sincere manner.

• The Company values users’ opinions, and users have the right to receive sincere responses from the Company. To ensure smooth communication with users, the Company operates a customer service center as follows.

  • - Department: Kyungdong Navien Customer Service Center

  • - E-mail: webmaster@kdiwin.com (When sending your opinion, we would appreciate it if you could include your mobile phone number (or phone number) so that we can contact you.)

  • - Phone: 1588-1144 (main customer service)

• If you need to report or consult on matters related to personal information infringement, please contact the institutions below.

  Organizations for Reporting and Consultation on Personal Information Infringement

  Personal Information Dispute Mediation Committee	www.kopico.go.kr / 1833-6972
  Personal Information Infringement Report Center	privacy.kisa.or.kr / 118 (without area code)
  Supreme Prosecutors’ Office	www.spo.go.kr / 1301 (without area code)
  Cyber Bureau of the National Police Agency	ecrm.police.go.kr / 182 (without area code)

• The above institutions are independent of the Company. If you are not satisfied with the results of the Company’s handling of personal information complaints or damage relief, or if you need more detailed assistance, you may contact them.

• 1. This Privacy Policy will take effect on October 30, 2026.

• 2. Previous versions of this Privacy Policy can be found at the top right of this Privacy Policy page.