Privacy Policy

Article 1 (Purposes of Processing, Items, and Retention Periods of Personal Information)

1. The Company processes personal information for the following purposes. The personal information processed will not be used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

   Where consent of the data subject is obtained

   Service Name	Category	Purpose of Collection and Use	Items	Retention Period	Basis for Collection
   www.tym.world	Main Website (Customer Center)	Product/parts inquiries, Maintenance/service inquiries, Recruitment inquiries, Press/media inquiries, Feedback/complaint receipt, Dealership-opening inquiries, Newsletter subscription, Other inquiries, Cyber grievance channel	(Required) Name, email, phone number, nationality, region (province), city/county/district, address, detailed address, postal code, inquiry details	Until withdrawal of consent or achievement of the purpose of use	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)
   www.tym.world	Marketing and advertising	Guidance on new services (including products) and event information, DM/SMS/MMS/postal mail, prize delivery and event guidance, use of customer-specific statistical analysis, market research	(Optional) Name, date of birth, product number, product used before purchase, purchase date, point of sale, model name, mobile phone number	Until withdrawal of consent or achievement of the purpose of use	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)
   MYTYM-SAM	Telematics App	Securing the stability of agricultural machinery, R&D, quality management, product-competitiveness improvement, customer-type analysis, and new-service development	(Required) ID, name, mobile phone number, encrypted identification information (CI, DI), gender, date of birth, usage records, access logs, cookies, access IP information, purchased-vehicle information, emergency-relief information, payment information, used-vehicle information, vehicle operation information, vehicle status information, usage history information, diagnostic information, consumables-management information, maintenance history information, vehicle driving information, consumer complaint receipt and customer center consultation details, visit date and time, abnormal usage records, service usage records, device OS information, device unique number, device model name, location information (Optional) Email	Until expiry of the warranty period and the parts-retention period	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)
   TYM Customer Care Center	CCC	Verification of the consulting customer's identity, customer consultation, and grievance handling	(Required) Name, date of birth, address, contact number, email, model name	2 years from the date of collection	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)
   Agricultural Machinery Sales	PDI (End-user education confirmation)	Product-use education, after-sales service, warranty, tracking of end users' product service life, use of customer-specific statistical analysis, market research	(Required) Name, date of birth, address, point of sale, contact number, purchase date, model name, engine number, optional specifications, details of product used before purchase	Until expiry of the warranty period and the parts-retention period	Personal Information Protection Act, Article 15(1)1 (consent of the data subject), Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Guidance on financial support programs (loans, leases)	(Loan/lease) calculation, credit assessment	(Required) Personal information (name, date of birth, contact number, address); personal credit information (credit transaction information, default information, public information, credit rating)	Until the purpose of use is achieved	Personal Information Protection Act, Article 15(1)1 (consent of the data subject), Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Test-drive application	Provision of agricultural machinery test-drive service, consumer opinion surveys, customer management, test-drive machine operation management, grievance handling	(Required) Name, date of birth, address, contact number, test-drive information (test-drive period, test-drive machine information)	Until the purpose of use is achieved	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)

   Where consent of the data subject is not obtained

   Service Name	Category	Purpose of Collection and Use	Items	Retention Period	Basis for Collection
   Agricultural Machinery Sales	Contract and purchase (Wholesale)	Provision of goods/services related to a sales contract (grievance handling, delivery of notices, service-satisfaction surveys, customer management, guidance on agricultural machinery management, billing, identity verification for payment and collection, and record retention for dispute resolution)	(Required) Name, date of birth, business name, business registration number, address, phone number, email, purchase-machine information (Optional) Personal information of a joint guarantor	10 years from the date of contract conclusion, or, where a statutory period is prescribed by relevant statutes, that period	Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Contract and purchase (Wholesale)	Credit information inquiry, determination of whether to establish or maintain a commercial relationship, and debt collection	(Required) Personal information (name, date of birth, contact number, address); personal credit information (credit transaction information, default information, public information, credit rating)	From the date of collection until termination of the commercial relationship or completion of debt repayment	Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Contract and purchase (Retail)	Performance of obligations under a sales contract (provision of goods and services, zero-rate tax processing)	(Required) Name (agent's name), date of birth, contact number, address, email, purchase date, model name, machine serial number, agricultural business entity confirmation	10 years from the date of contract conclusion, or, where a statutory period is prescribed by relevant statutes, that period	Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Used agricultural machinery (Wholesale, retail)	Product sales agency and subsequent customer management, vehicle delivery, warranty repair, emergency dispatch, vehicle management, service-program operation, and provision of product and promotional information	(Required) Name, address, contact number, purchase date, model name, machine serial number, agricultural business entity confirmation	10 years from the date of contract conclusion, or, where a statutory period is prescribed by relevant statutes, that period	Personal Information Protection Act, Article 15(1)4 (performance of a contract)
   Agricultural Machinery Sales	Agricultural machinery maintenance	Agricultural machinery repair, inspection and maintenance, warranty service, maintenance-service reservation, and provision of customized services	(Required) Name, date of birth, address, point of sale, contact number, purchase date, model name, engine number, optional specifications, details of product used before purchase	Until expiry of the warranty period and the parts-retention period	Personal Information Protection Act, Article 15(1)4 (performance of a contract)

2. However, where there is an obligation to retain information under relevant statutes such as the Commercial Act, the Company retains the data subject's personal information. In this case, the Company uses the retained information only for the purpose of such retention, and the retention periods are as follows.
   1. Information related to the Company's commercial books and important documents and vouchers concerning its business: 10 years for important documents / 5 years for vouchers (Commercial Act)
   2. Information related to books and supporting documents concerning all transactions: 5 years from the day following the statutory filing deadline for the relevant national tax for the taxable period to which the transaction belongs (Framework Act on National Taxes, Corporate Tax Act)
   3. Records concerning contracts or withdrawal of subscription, and records concerning payment and the supply of goods, etc.: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
   4. Books and issued tax invoices or receipts: 5 years (Value-Added Tax Act)
   5. Service usage records, access logs, and access IP information under the Protection of Communications Secrets Act: 3 months
3. In accordance with Article 16(2) of the Act on the Protection, Use, etc. of Location Information, the Company automatically records and retains data confirming the collection and provision of personal location information, and retains such data for 12 months.
4. The Company may pseudonymize the personal information it has collected so that specific individuals cannot be identified, and process it for purposes such as compiling statistics, scientific research, and archiving in the public interest.
   1. “Pseudonymized information” means information that cannot identify a specific individual without the use or combination of additional information (hereinafter “additional information”) needed to restore it to its original state through pseudonymization.
   2. “Pseudonymization” means processing personal information so that it cannot identify a specific individual without additional information, by means such as deleting some of the personal information or replacing some or all of it.
   3. Acts of identifying a specific data subject through pseudonymized information are, in principle, prohibited.
   4. Pseudonymized information and additional information are stored separately, with technical and managerial protective measures applied.

      *Status of pseudonymized information processing

      Matters concerning the use of pseudonymized information

      Service Name	Purpose of processing pseudonymized information	Period of processing pseudonymized information	Items of personal information processed	Legal basis
      -	-	-	-	-

      Matters concerning the provision of pseudonymized information to third parties

      Service Name	Recipient	Recipient's purpose of use	Items provided	Recipient's retention and use period
      -	-	-	-	-

      Matters concerning the consignment of pseudonymized information processing

      Service Name	Consignee (trustee)	Consigned work
      -	-	-

5. When the Company collects the personal information of a child under the age of 14, it may request minimal information from the child, such as the legal representative's name and contact number, and confirms whether a lawful legal representative has consented by one of the following methods.
   1. A method of having the legal representative indicate whether they consent on an internet site that posts the consent details, and notifying the legal representative by mobile-phone text message that the personal information controller has confirmed such indication of consent
   2. A method of having the legal representative indicate whether they consent on an internet site that posts the consent details, and receiving the legal representative's card information such as a credit card or debit card
   3. A method of having the legal representative indicate whether they consent on an internet site that posts the consent details, and confirming their identity through mobile-phone identity verification, etc.
   4. A method of issuing a document stating the consent details directly to the legal representative, or delivering it by post or fax, and having the legal representative submit it after signing and sealing the consent details
   5. A method of sending an email stating the consent details and receiving from the legal representative a return email containing their indication of consent
   6. A method of informing the legal representative of the consent details by telephone and obtaining consent, or guiding them to a means of confirming the consent details such as an internet address and then obtaining consent through a further telephone call
   7. Any other method equivalent to the above that informs the legal representative of the consent details and confirms their indication of consent
6. The Company does not include sensitive information among the information disclosed in the course of providing goods or services. Where sensitive information is included, the Company will provide guidance on the relevant status (name of the goods or service, items of sensitive information) and the method for choosing non-disclosure.
7. The Company may be provided with and collect and use customer information from other institutions/individuals to provide services; in this case, responsibility for the customer's consent rests with the relevant institution/individual.

   *Information provided by other institutions/individuals for service provision

   Service Name	Provider	Items provided	Purpose of collection and use	Retention Period	Basis for Collection
   Warranty	TYM Co., Ltd. dealership (Find a Dealer)	Customer personal information (name, date of birth, address) Machine information (machine serial number, engine number)	Warranty, customer management	Until withdrawal of consent	Personal Information Protection Act, Article 15(1)1 (consent of the data subject)

Article 2 (Procedures and Methods for Destroying Personal Information)

1. When personal information becomes unnecessary—such as upon expiry of the retention period or achievement of the processing purpose—the Company destroys the relevant personal information without delay.
2. Where, despite the expiry of the retention period consented to by the data subject or achievement of the processing purpose, personal information must continue to be retained under other statutes, the Company moves the relevant personal information to a separate database (DB) or stores it in a different location. Personal information moved to a separate DB is not used for any purpose other than that for which it is retained, except as required by law.
3. The procedures and methods for destroying personal information are as follows.
   1. Destruction procedure

      The Company selects the personal information for which grounds for destruction have arisen and destroys it with the approval of the Company's Personal Information Protection Officer.

   2. Destruction method
      1. Information in the form of electronic files is destroyed using technical methods that make the records unrecoverable.
      2. Personal information printed on paper is destroyed by shredding or incineration.
      3. In accordance with the amendment to the Personal Information Protection Act (Sept. 2023), from April 1, 2024, the Company no longer converts users who have not used the service for one year into dormant accounts or stores their personal information separately. However, for accounts converted to dormant status before April 1, 2024, users may, after logging in and with their consent, restore the dormant account and use the service normally.

Article 3 (Consignment of Personal Information Processing)

1. For the smooth handling of personal information operations, the Company consigns personal information processing tasks as follows.
   1. Domestic companies

      Status of personal information processing consignment to domestic companies

      Service Name	Category	Consignee	Details of consigned work	Sub-consignee	Sub-consigned work
      TPIS	Dealership management	Arcdo Co., Ltd.	TPIS system operation, electronic processing and storage of personal information	-	-
      www.tym.world	Main Website	Magnum Vint Co., Ltd.	Website operation and maintenance	-	-
      CRM	Customer management	Daeyu Aion Co., Ltd.	Customer-management system operation, electronic processing and storage of personal information	Salesforce, Inc	Customer-management system operation, electronic processing and storage of personal information
      MYTYM-SAM	Telematics App	TYM ICT Co., Ltd.	MYTYM (telematics-based IoT platform operation business), location-based service business	-	-
      TYM Customer Care Center	CCC	LG Uplus Corp. (LG U+ Message Hub Easy)	Sending of marketing and advertising text messages	-	-
      SNS	SNS content management	Proda Corporation	Content production agency and management	-	-
      DMS	Dealer management	J2J Korea Co., Ltd.	DMS system operation and maintenance, personal information processing	-	-

   2. Overseas companies

      Status of personal information processing consignment to overseas companies

      Service Name	Category	Consignee	Details of consigned work	Country to which transferred	Sub-consignee	Sub-consigned work
      CRM	Customer management	Salesforce, Inc	Customer-management system operation, electronic processing and storage of personal information	United States	-	-

2. When entering into a consignment contract, in accordance with Article 26 of the Personal Information Protection Act, the Company specifies in the contract and other documents matters such as the prohibition of processing personal information beyond the purpose of performing the consigned work, technical and managerial protective measures, restrictions on re-consignment, management and supervision of the trustee, and liability such as damages, and supervises whether the trustee processes personal information safely.
3. If the content of the consigned work or the trustee changes, the Company will disclose such changes without delay through this privacy policy.

Article 4 (Provision of Personal Information to Third Parties)

1. The Company processes the data subject's personal information only within the scope specified in Article 1 (Purposes of Processing), and provides personal information and personal location information to third parties only where it falls under Articles 17 and 18 of the Personal Information Protection Act and Articles 19 and 21 of the Act on the Protection, Use, etc. of Location Information, such as the consent of the data subject or special provisions of law.
2. The Company provides personal information and personal location information to third parties as follows.

   Service Name	Category	Recipient	Recipient's purpose of collection and use	Items provided	Recipient's retention period
   Performance of statutory obligations	Transaction reporting	Ministry of Agriculture, Food and Rural Affairs	Agricultural machinery transaction reporting (Article 9-7(1) of the Agricultural Mechanization Promotion Act and Article 14-9 of its Enforcement Rule)	(Required) Name, address, date of birth, phone number	Until the purpose of use is achieved
   Performance of statutory obligations	Warranty	TYM Co., Ltd. dealership (Find a Dealer)	Warranty, product after-sales service, end-user education confirmation	(Required) Name, date of birth, address, point of sale, contact number, purchase date, model name, engine number, optional specifications, details of product used before purchase	Until expiry of the warranty period and the parts-retention period
   MYTYM-SAM	Location-based service business	TYM ICT Co., Ltd.	Data management, new-service development and enhancement	(Required) ID, name, mobile phone number, encrypted identification information (CI, DI), gender, date of birth, usage records, access logs, cookies, access IP information, purchased-vehicle information, emergency-relief information, payment information, used-vehicle information, vehicle operation information, vehicle status information, usage history information, diagnostic information, consumables-management information, maintenance history information, vehicle driving information, consumer complaint receipt and customer center consultation details, visit date and time, abnormal usage records, service usage records, device OS information, device unique number, device model name, location information (Optional) Email	Until the end of the service provision period and the time of service termination ○ Personalized profile: 6 months after service termination ○ Vehicle operation/status information, usage history information, diagnostic information, consumables-management information, and personal location information: until the purpose of collection and use is achieved or consent is withdrawn ○ Where payment and settlement of fees have not been completed: until payment and settlement of fees are completed ○ Where a dispute such as a customer complaint/grievance or litigation is in progress or anticipated: until such handling is completed ○ Use of collected personal information for marketing and advertising: until service termination or withdrawal of consent
   Finance	Agricultural machinery lease	NH Nonghyup Capital	Screening for agricultural machinery lease use	(Required) Name, address, phone number, mobile phone number	Until the purpose of use is achieved
   Finance	Agricultural machinery lease	De Lage Landen Co., Ltd.	Screening for agricultural machinery lease use	(Required) Name, address, phone number, mobile phone number	Until the purpose of use is achieved

3. Where the Company provides a customer's personal location information to a third party designated by the customer, it immediately notifies the customer of the recipient, the date and time of provision, and the purpose of provision, each time, via the communications terminal device from which the personal location information was collected. However, in the following cases, the Company notifies the customer via a communications terminal device or email that the customer has specified and designated in advance.
   • Where the communications device from which the personal location information was collected does not have the function to receive text, voice, or video
   • Where the personal location information subject has requested in advance to be notified via the communications terminal device from which the personal location information was collected, or via email, etc.

   ※ However, the Company may aggregate and notify the details of information provision within a range of up to 30 days, in accordance with the following.

   • Number of times: a multiple of 10, such as 10, 20, or 30 times
   • Period: 10 days, 20 days, or 30 days

Article 5 (Measures to Ensure the Security of Personal Information)

In processing the data subject's personal information, the Company applies the following technical, managerial, and physical protective measures to ensure security so that personal information is not lost, stolen, leaked, altered, or damaged.

1. Establishment and implementation of an internal management plan
   To manage personal information safely, the Company has established and operates an internal personal information management system.
2. Minimizing and training staff who handle personal information
   The Company receives information-protection pledges from personal information handlers who process data subjects' personal information and conducts personal information protection training once a year to manage information safely. In addition, through access-rights management for personal information handlers, it minimizes unnecessary access to and exposure of data subjects' personal information.
3. Encryption of personal information
   Where personal information requiring encryption by statute, such as unique identifying information and card numbers, is stored, it is encrypted and stored/managed within the DB, and for sections where personal information is entered and transmitted, such as membership registration and login through the website, measures are taken to ensure safe transmission via encrypted communication such as SSL.
4. Installation of security solutions
   To provide services and manage data subjects' information safely, the Company installs and operates antivirus programs for its personal information processing system. In addition, to prepare against external intrusions such as hacking, it installs an intrusion-prevention/detection system and continuously monitors for hacking and external intrusions through an integrated security control center.
5. Access control for unauthorized persons
   The Company maintains a separate physical storage location for the personal information system that stores personal information, and establishes and operates access-control procedures for it.
6. Regular self-audits
   To ensure security in relation to personal information processing, the Company conducts regular self-audits. It makes efforts to improve and correct matters such as the operation of the personal information management system and personal information protection issues.

Article 6 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

1. The Company uses “cookies” that store and frequently retrieve usage information to provide customers with individually customized services and convenience.

   ※ For details, refer to the website Cookie Policy.

2. A cookie is a small piece of information that the server (https) operating the website sends to the customer's computer browser, and it is stored on the customer's PC or mobile device.
3. Customers may set cookie preferences such as allowing or blocking cookies through their web browser options. However, if you refuse the storage of cookies, you may experience difficulty using customized services.
   • Allowing/blocking cookies in a web browser
     Chrome: Settings at the top of the web browser → Privacy and security → Cookies and site
     Edge: Settings at the top of the web browser → Cookies and site
   • Allowing/blocking cookies in a mobile browser
     Chrome: Select the option at the top right of the mobile browser → New Incognito tab
     Safari: Mobile device Settings → Safari → Advanced → Block All Cookies
     Samsung Internet: Select the tab icon at the bottom of the mobile browser → Turn on Secret mode → Block

Article 7 (Rights and Obligations of Customers and Legal Representatives and How to Exercise Them)

1. A customer or legal representative (in the case of a child under the age of 14) may exercise rights against the Company at any time, such as the right to request access to, correction of, deletion of, or suspension of the processing of personal information.
2. The exercise of rights under Paragraph 1 may be made to the Company in writing, by email, or by facsimile (fax) in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
3. The exercise of rights under Paragraph 1 may be made through an agent, such as the data subject's legal representative or a duly authorized person. In this case, a power of attorney in the form of Annex No. 11 of the “Notice on the Methods of Processing Personal Information” (No. 2023-12) must be submitted to [email protected].
4. Requests for access to and suspension of the processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
5. A request for correction or deletion of personal information cannot be made where the personal information is specified as a subject of collection under other statutes.
6. Where the data subject has consented to the fact that an automated decision is made, has been informed in advance through a contract, etc., or where it is expressly prescribed by law, refusal of an automated decision is not permitted, and only requests for explanation and review are possible. In addition, a request to refuse or explain an automated decision may be rejected where there is a justifiable reason, such as a risk of unfairly infringing the life, body, property, or other interests of another person.
7. When a customer exercises the right to request access, correction, deletion, suspension of processing, or refusal/explanation of an automated decision, the Company verifies whether the person making the request is the individual concerned or a legitimate agent.
8. Where a customer requests correction of an error in personal information, the Company does not use or provide the relevant personal information until the correction is completed, and where the relevant personal information has already been provided to a third party, it notifies the third party without delay so that the correction is made.
9. Where a customer or legal representative withdraws consent (cancels membership), the Company, in principle, destroys the information without delay; however, where relevant statutes mandate retention, it processes the information in accordance with [2. Retention and Use Period of Personal Information] of the privacy policy and takes measures so that access or use is possible only when strictly necessary.
10. (Personal location information) Rights and obligations of guardians for the protection of children aged 8 or under, etc., and how to exercise them, when collecting personal location information
    1. Where the guardian of a person falling under any of the following (hereinafter “children aged 8 or under, etc.”) consents to the collection, use, and provision of the personal location information of a child aged 8 or under, etc., for the protection of that person's life or body, such consent is deemed to be the consent of the individual concerned.
       • A child aged 8 or under
       • A person under adult guardianship
       • A person with a mental disability under Article 2(2)2 of the Act on Welfare of Persons with Disabilities who is a person with a severe disability under Article 2(2) of the Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities (limited to persons registered as persons with disabilities under Article 32 of the Act on Welfare of Persons with Disabilities)
    2. A guardian of a child aged 8 or under, etc., means a person who actually protects the child aged 8 or under, etc., and falls under any of the following.
       • The legal representative of a child aged 8 or under, or a guardian under Article 3 of the Act on Guardianship over Minors in Protection Facilities
       • The legal representative of a person under adult guardianship
       • The legal representative of a person under Paragraph 1, Subparagraph 3, or the head of a residential facility for persons with disabilities under Article 58(1)1 of the Act on Welfare of Persons with Disabilities (limited to facilities established and operated by the State or a local government), the head of a mental care facility under Article 22 of the Act on the Improvement of Mental Health and the Support for Welfare Services for Mental Patients, and the head of a mental rehabilitation facility under Article 26 of the same Act (limited to facilities established and operated by the State or a local government)
    3. A guardian who wishes to consent to the collection, use, or provision of personal location information for the protection of the life or body of a child aged 8 or under, etc., must, to prove that they are the guardian of the child aged 8 or under, etc., state the following in a written consent form, and submit it to the Company after the guardian has signed and sealed or signed it.
       • The name, address, and date of birth of the child aged 8 or under, etc.
       • The guardian's name, address, and contact number
       • The fact that the purpose of collecting, using, or providing personal location information is limited to the protection of the life or body of the child aged 8 or under, etc.
       • The date of consent
    4. Where a guardian has consented to the collection, use, and provision of the personal location information of a child aged 8 or under, etc., the “customer (personal location information subject)” is deemed to be the guardian, who may exercise the rights under Article 24 of the Act on the Protection, Use, etc. of Location Information against the Company at any time. In addition, the rights and obligations as a customer and how to exercise them are governed by this provision.

Article 8 (Remedies for Infringement of Customers' Rights and Interests)

1. Customers may inquire with the following institutions about remedies for personal information infringement, consultation, etc.
2. The following institutions are separate from the Company; if you are not satisfied with the Company's own personal information complaint handling or remedy results, or need more detailed help, please contact the Company's Personal Information Protection Officer or staff in charge ('9. Personal Information Protection Officer, Staff in Charge, and Handling Department').
   • Privacy Infringement Report Center (operated by the Korea Internet & Security Agency)
     • Responsibilities : reporting personal information infringement, consultation requests
     • Website : privacy.kisa.or.kr
     • Phone : (no area code) 118
   • Personal Information Dispute Mediation Committee
     • Responsibilities : applications for personal information dispute mediation, collective dispute mediation (civil resolution)
     • Website : www.kopico.go.kr
     • Phone : (no area code) 1833-6972
   • Supreme Prosecutors' Office : (no area code)1301 (www.spo.go.kr)
   • National Police Agency : (no area code)182 (ecrm.police.go.kr)

Article 9 (Personal Information Protection Officer, Staff in Charge, and Handling Department)

1. The Company takes overall responsibility for tasks related to personal information processing and, as set out below, designates a Personal Information Protection Officer and staff in charge to handle customers' complaints and provide remedies in relation to personal information processing.

   Personal (location) information protection policy and oversight

   Personal (location) information protection policy and oversight
   - Personal Information Protection Officer: Baek Jae-ik, Executive Director - Department: CIO	- Personal information protection staff: Seo Gyeong-hwan, Manager - Phone: +82-2-3014-2816 - Email: [email protected]

2. Customers may raise any matter concerning personal information protection inquiries, complaint handling, remedies, requests for access to personal information, etc., that arise while using the Company's services (or business), and may contact the Personal Information Protection Team above as the responsible department for these matters.

Article 10 (Guidance on the Transmission of Advertising Information)

1. The Company does not transmit advertising information for commercial purposes without the customer's prior consent.
2. Where the Company transmits advertising information for commercial purposes, such as marketing and promotion (e.g., guidance on new product launches or various exhibition events), it sends such information only to customers who have given prior consent to the transmission of advertising information.
3. Where the Company transmits advertising information using electronic media, it transmits such information after taking the following measures in accordance with Articles 50 to 50-8 of the Act on Promotion of Information and Communications Network Utilization and Information Protection.

   ※ Electronic transmission means: mobile-phone text messages, email, fax, and other electronic transmission media

   • Displaying “(Advertisement)” at the beginning of the subject line
   • The sender's name and contact information
   • Indication of a toll-free number for refusing receipt
4. The Company confirms with the customer, every two years from the date the customer consented to receive advertising information, the fact of the customer's consent to receive advertising information. If the customer does not express any intention after receiving the notice about consent, the consent to receive remains in effect.
5. The Company does not transmit advertising information using electronic transmission media between 9:00 p.m. and 8:00 a.m. the following day.
6. However, in the following cases, content sent via electronic transmission media is regarded as an exception to advertising information.
   • Information related to the performance of a contract concluded between the Company and the customer, etc.
   • Responses to information requested by the customer (e.g., quotations, product catalogs, newsletters upon request, etc.)
   • Matters that the Company must inform the customer of, such as safety- and quality-related content, in accordance with relevant statutes

※ The method of withdrawing consent to receive advertising information is as follows.

• Change to refusal of advertising information receipt on the My Page of each service, or a telephone inquiry to the relevant service's customer center

Article 11 (Overseas Transfer of Personal Information)

1. As a rule, the Company does not transfer personal information to other businesses overseas without the customer's prior consent.
2. The Company transfers personal information overseas in the following cases, and this information is delivered safely with technical protective measures applied.
3. Where separate consent to the overseas transfer of personal information has been obtained from the customer
4. Where the transfer is necessary for the purpose of consigning the processing and storage of personal information for the conclusion and performance of a contract with the customer, and matters concerning the overseas transfer have been disclosed in the privacy policy or notified to the customer by email, in writing, etc.
5. Customers may proceed to withdraw from the service, or request refusal of overseas transfer through the Company's Personal Information Protection Officer or staff in charge. However, in this case, the use of services that essentially entail the overseas transfer of personal information may be restricted.

   Status of overseas transfer of personal information

   Service Name	Relevant basis	Items of personal information transferred	Country, date/time, and method of transfer	Recipient of the personal information transfer	Recipient's purpose of use and retention period
   CRM	Personal Information Protection Act, Article 28-8(1)3 (consignment/storage of processing for the performance of a contract)	Dealership information (name, email, phone number, date of birth, gender, fax, address) and customer information (name, date of birth, gender, phone number, address, business registration number)	United States	Salesforce, Inc	Purpose of use: electronic processing and storage of personal information Retention period: until the purpose of use is achieved or the consignment contract is terminated
   AWS(Amazone Web Service)	Personal Information Protection Act, Article 28-8(1)3 (consignment/storage of processing for the performance of a contract)	(Required) ID, name, mobile phone number, encrypted identification information (CI, DI), gender, date of birth, usage records, access logs, cookies, access IP information, purchased-vehicle information, emergency-relief information, payment information, used-vehicle information, vehicle operation information, vehicle status information, usage history information, diagnostic information, consumables-management information, maintenance history information, vehicle driving information, consumer complaint receipt and customer center consultation details, visit date and time, abnormal usage records, service usage records, device OS information, device unique number, device model name, location information (Optional) Email	Amazon Global Cloud service regions (United States, Germany)	Amazon Web Services, Inc	Purpose of use: personal information storage, retention, and infrastructure management Retention period: until the purpose of use is achieved or the consignment contract is terminated

Article 12 (Scope of Application of the Privacy Policy)

This privacy policy applies to the Company's product sales, services, and all online services (including the mobile web/app); for some individual services, a separate privacy policy may apply.

Article 13 (Matters Concerning Amendment of the Privacy Policy)

1. Where the Company amends this privacy policy, it announces the reasons for and content of the amendment in advance in the website's notices before making and applying the changes.
2. When the integrated privacy policy is amended, the previous version can be found in the menu at the top of the policy.