1. General Provisions

Lee Convention Co., Ltd. (hereinafter referred to as "the Company") actively protects the privacy of subscribers and complies with personal information protection laws such as the "Personal Information Protection Act" and the "Act on Promotion of Information and Communications Network Utilization and Information Protection, etc." in relation to the website services provided by the Company (hereinafter referred to as "the Services"). The Company has established and adheres to this Privacy Policy to comply with these regulations. The Company's Privacy Policy may be revised according to changes in relevant laws, guidelines, or the Company's internal management plans, and such changes will be notified in accordance with the methods stipulated by the relevant laws.

This Privacy Policy contains the following:

• General Provisions
• Purpose of Processing Personal Information
• Processing, Items, and Retention Period of Personal Information
• Matters Regarding the Destruction of Personal Information
• Matters Regarding the Provision of Personal Information to Third Parties
• Matters Regarding the Outsourcing of Personal Information Processing
• Rights and Obligations of Subscribers and How They Can Be Exercised
• Measures to Ensure the Security of Personal Information
• Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
• Complaint Services Related to Personal Information
• Supplementary Provisions

2. Purpose of Processing Personal Information

The Company collects personal information for the following purposes. All information provided by the data subject will not be used for purposes other than those necessary for the following purposes, and prior consent will be sought if the purpose of use changes.

• Sending newsletters related to Lee Convention events
• Managing posts and delivering notifications
• Handling complaints, suggestions, compliments, and other customer service matters

3. Processing, Items, and Retention Period of Personal Information

1. The Company collects the minimum necessary personal information required to provide services as follows, with the consent of the subscriber under Article 15, Paragraph 1 of the "Personal Information Protection Act," or if it is inevitable to comply with legal obligations or in cases specified by law.

• Required items: Name, Resident Registration Number, Virtual Resident Number (I-PIN), Telephone Number, Mobile Phone Number, Email, Address
• Optional items: Fax Number, Occupation, Member Classification, etc.
• Service application and use via the website: Applicant Information, Service Usage Records, Access Logs, etc.

2. The Company does not collect sensitive personal information such as beliefs, membership or withdrawal from labor unions or political parties, political opinions, health, sexual life, or other information that may significantly infringe on the privacy of the data subject, except with the separate consent of the data subject or as required or permitted by law.
3. When the Company collects personal information with the consent of the data subject, the following matters are notified to the data subject, and consent is obtained in a manner that allows the data subject to clearly recognize the distinction between items requiring consent.

• Purpose of collecting and using personal information
• Items of personal information to be collected
• Retention and usage period of personal information
• The fact that the data subject has the right to refuse consent and, if there is any disadvantage due to refusal, the details of such disadvantage

4. In accordance with Article 22 of the "Framework Act on Electronic Transactions," personal information related to the digital certificate of the data subject will be retained for 10 years from the date the certificate expires.

4. Matters Regarding the Destruction of Personal Information

1. The Company will promptly destroy the personal information it holds once the purpose of its collection or the purpose for which it was provided has been achieved.
2. Notwithstanding the above, if it is necessary to retain personal information for a certain period according to relevant laws, the Company may retain it for up to five years in accordance with such laws.

• Retention items: Service usage records, access logs, access IP information: 3 months (Protection of Communications Secrets Act)
• Records related to display/advertising: 6 months (Act on Consumer Protection in Electronic Commerce)
• Records related to contracts or withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records related to payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records related to consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)

5. Matters Regarding the Provision of Personal Information to Third Parties

1. The Company may provide (including sharing; hereinafter the same) the personal information of subscribers to third parties if the data subject consents in accordance with Article 17, Paragraphs 1 and 2 of the "Personal Information Protection Act," or if it is inevitable to comply with legal obligations or in cases specified by law.
2. When the Company provides personal information to third parties with the consent of the data subject, the following matters are notified to the data subject, and consent is obtained.

• Recipient of personal information
• Purpose of use of personal information by the recipient
• Items of personal information to be provided
• Retention and usage period of personal information by the recipient
• The fact that the data subject has the right to refuse consent and, if there is any disadvantage due to refusal, the details of such disadvantage

3. The Company does not use personal information beyond the scope set forth in this Policy’s Article 3 or provide it to third parties beyond the scope set forth in this Policy’s Article 5.
4. The Company may use personal information for purposes other than those stated or provide it to third parties without the consent of the data subject in the following cases, except where such use or provision could unfairly infringe upon the interests of the data subject or a third party. However, the Company will request the recipient of the personal information to restrict its use, usage method, and other necessary matters, or take measures to ensure the security of the personal information.

• If separate consent is obtained from the data subject
• If there is a special provision in another law
• If it is difficult to obtain prior consent due to the data subject or their legal representative being unable to express their intention, or due to unknown address, etc., but it is deemed necessary for the immediate protection of the life, body, or property of the data subject or a third party
• If it is necessary for the purpose of compiling statistics, conducting academic research, etc., and the personal information is provided in a form that does not allow identification of a specific individual

5. When obtaining the above consent, the Company will notify the data subject of the following:

• Recipient of personal information
• Purpose of use of personal information (or the recipient's purpose of use when provided)
• Items of personal information to be used or provided
• Retention and usage period of personal information (or the recipient's retention and usage period when provided)
• The fact that the data subject has the right to refuse consent and, if there is any disadvantage due to refusal, the details of such disadvantage

6. Matters Regarding the Outsourcing of Personal Information Processing

1. The Company outsources personal information processing tasks to external professional firms for smooth business operations, as follows, and enters into an outsourcing contract that clearly stipulates the purpose of the outsourced task, restrictions on re-outsourcing, prohibition of personal information processing, liability for damages, and technical and managerial protection measures for personal information to ensure the safety of personal information. If the outsourcing firms change, the Company will notify the data subjects of the new firm names through announcements or the Privacy Policy.

• Outsourced tasks: Identity verification, I-PIN
• Outsourced firm (Recipient): NICE Credit Information Co., Ltd.

7. Rights and Obligations of Data Subjects and How They Can Be Exercised

1. Data subjects may request to view, correct, delete, or suspend the processing of their personal information processed by the Company.
2. Upon receiving a request for access, the Company will allow the data subject to view the relevant personal information. However, if there is a legitimate reason that prevents access within the specified period, the Company will notify the data subject of the reason and may postpone access, ensuring that access is granted without delay once the reason no longer exists.
3. The Company may restrict or refuse access to personal information if it falls under any of the categories stipulated in Article 35, Paragraph 4 of the "Personal Information Protection Act," which prohibits access by law.
4. A data subject who has viewed their personal information may request the Company to correct or delete it. However, if the personal information is specified as a collection target under another law, the data subject may not request its deletion.
5. Unless a special procedure is prescribed by another law, the Company will promptly investigate and take necessary measures such as correcting or deleting the personal information to prevent its restoration in response to the data subject's request.
6. A data subject may request the suspension of the processing of their personal information, and the Company must suspend all or part of the processing without delay. However, if the request falls under any of the categories stipulated in Article 37, Paragraph 2 of the "Personal Information Protection Act," the Company may refuse the request after notifying the data subject.
7. The data subject may exercise their rights under Articles 2, 4, and 6 of this Policy (hereinafter referred to as "Request for Access, etc.") through a representative in accordance with Articles 45 and 46 of the "Enforcement Decree of the Personal Information Protection Act," and the legal representative of a child under the age of 14 may request access, etc., to the child's personal information.
8. The Company may charge fees and postage (only if a copy is requested) for those who make a "Request for Access, etc." in accordance with Article 47 of the "Enforcement Decree of the Personal Information Protection Act."

• Access Request Procedure: The requester submits a request to the personal information protection officer at Lee Convention Co., Ltd., and the personal information protection officer sends a decision notice to the requester within five days. The personal information protection officer at Lee Convention Co., Ltd. implements the access request within 10 days after receiving the request.
• Correction, Deletion, or Processing Suspension Request Procedure: The requester (data subject or their representative, or the legal representative in the case of a child under the age of 14) submits a request for correction, deletion, or processing suspension to the personal information protection officer at Lee Convention Co., Ltd. The personal information protection officer sends a decision notice to the requester within 10 days and implements the correction, deletion, or processing suspension within 10 days after receiving the request.

8. Measures to Ensure the Security of Personal Information

1. The Company takes the following technical and managerial measures to ensure that personal information is not lost, stolen, leaked, altered, or damaged when handling subscribers' personal information. However, the Company is not responsible for any loss, theft, leakage, alteration, or damage of personal information caused by irresistible forces such as hacker intrusions or new virus outbreaks that could not be prevented or addressed with the technology available at the time of the incident.
2. The personal information of data subjects is protected by a password, and important data is protected through encryption and other security features.
3. The Company uses antivirus programs to prevent damage caused by computer viruses. These antivirus programs are regularly updated, and immediate updates are provided to prevent any potential breaches of personal information caused by the sudden emergence of new viruses.
4. The Company has adopted security devices (such as SSL) that enable the safe transmission of personal information over networks by utilizing encryption algorithms.
5. To prevent the leakage of subscribers' personal information due to hacking, the Company uses intrusion prevention systems and continuously monitors for intrusions 24/7.
6. The Company minimizes the risk of personal information leakage by assigning dedicated personnel for handling personal information, managing access rights with separate passwords, and conducting regular training on new security technologies and personal information protection obligations.
7. The IDs, passwords, and other personal information used by data subjects are intended for their use only. The Company is not responsible for problems arising from personal negligence, such as the leakage of ID, password, or resident registration number, nor for general internet-related risks. It is recommended that data subjects frequently change their passwords and be particularly careful to prevent the leakage of personal information when logging in from a shared PC.

9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

The Company operates cookies and other devices that store and retrieve information to keep track of basic settings for data subjects who use the website. A cookie is a small text file that a website server sends to a user's browser, which may be stored on the user's computer hard drive.

* Data subjects have the option to set cookies. Therefore, they can allow all cookies, be prompted each time a cookie is stored, or refuse all cookies by configuring their web browser settings.

• Method to Refuse Cookie Settings
  * Example: To refuse the installation of cookies, data subjects can configure their web browser options to allow all cookies, confirm each time a cookie is stored, or refuse all cookies.

10. Complaint Services Related to Personal Information

The Company designates the following personal information protection officers to protect the personal information of data subjects and handle complaints related to personal information.

Data subjects can report any complaints related to personal information protection arising from the use of the Company's services to the personal information protection officer. The Company will promptly and thoroughly respond to all reports.

• Personal Information Protection Officer
  Name: Hyunmi Gong
  Phone: 051)711-0057
  Email: strong@leeconvention.com
• Personal Information Protection Manager
  Name: Hoejin Han
  Phone: 051)711-0058
  Email: julia@leeconvention.com

• Procedure for Reporting Infringements
  The reporter submits a personal information infringement report to the personal information protection officer at Lee Convention Co., Ltd., and the officer responds to the reporter within seven days. If further investigation is required, the officer sends the investigation results within 30 days.

For additional inquiries or reports related to personal information infringement, please contact the following agencies:

• Personal Information Infringement Report Center: 118 (without area code), http://privacy.kisa.or.kr
• Personal Information Protection Certification Committee: 02-580-0533~4, http://www.eprivacy.or.kr
• Supreme Prosecutors' Office Cyber Crime Investigation Team: 02-3480-3600, http://www.spo.go.kr
• Cyber Terror Response Center, Korean National Police Agency: 02-392-0330, http://www.ctrc.go.kr

Supplementary Provisions

This Privacy Policy is effective from January 31, 2018. Any additions, deletions, or modifications due to changes in laws, policies, or security technologies will be announced through the Company's website 15 days before the effective date.

• Privacy Policy Version Number: 2.0
• Privacy Policy Effective Date: March 31, 2018
• Date of Public Notice of Changes to Privacy Policy: March 31, 2018