Collection Items and Purpose of Use of Personal Information

Article 1 (Collection Items and Purpose of Use of Personal Information)

The Company collects users' personal information for the purposes defined below. The collected personal information will not be used for any purpose other than the stated purpose.

• (1)Customer consultation and processing
• (2)Preservation of records for dispute mediation, handling of complaints and other grievances, and delivery of notices
• (3)Provision of event and advertising information, delivery of prizes, market research, etc.
• (4)Identification of individuals and prevention of fraudulent use related to service usage

Article 2 (Method of Collection)

The Company collects personal information that the data subject directly inputs on the website.

Period of Retention and Use of Personal Information

Article 3 (Period of Retention and Use of Personal Information)

The Company retains and uses the user's personal information from the time the user's personal information is collected until the purpose of collecting and using the personal information is achieved, and when the purpose of collecting and using personal information is achieved, the information will be destroyed without delay. However, if it is necessary to preserve it in accordance with the provisions of the relevant laws, the Company will retain the user's personal information until the relevant period. In this case, the Company uses the information only for the purpose of retention, and the retention period is as follows.

• (1)Records of consumer complaints or dispute settlement
  • Relevant Law : Act on Consumer Protection in Electronic Commerce, etc.
  • Retention period : 3 years
• (2)Applicant personal information
  • Personal information of applicants who join the company: Retained while working
  • Personal information of applicants who have not joined the company: 3 years from the date of application
  • Upon expiration of the retention period: Immediately destroyed

If it is necessary to retain the information beyond the retention period mentioned above, the Company will obtain separate consent from the user. However, in the case of a job application, the retention period may vary depending on the details disclosed and consented to at the time of application.

Article 4 (Consent to Collection/Use of Personal Information)

The Company has established a procedure for users to consent to the collection and use of personal information. If users agree, they are considered to have consented to the personal information they input being stored in the Company’s database and being used for the purposes specified in the consent form. Users may choose not to consent to the collection and use of personal information, but if they do not agree, access to certain services may be limited.

Outsourcing of Personal Information Processing

Article 5 (Outsourcing of Personal Information Processing)

Article 5 (Outsourcing of Personal Information Processing)

Purpose and Details of Outsourcing	Outsourced Companies:	Period
Website management and maintenance	Hyundai AutoEver Co., Ltd., XEOGEN	Until the purpose of use of personal information is achieved

• (1)The Company outsources personal information processing tasks to external professional companies to ensure smooth business operations, including handling user inquiries. If there is a change in the outsourced company, the Company will notify users of the new company name through the notice or privacy policy.
• (2)When entering into outsourcing agreements, the Company specifies in the contract or other documents that the outsourced company is prohibited from processing personal information beyond the scope of the task, and requires technical and managerial protective measures, restrictions on subcontracting, management and supervision of the outsourced company, and liability for damages. The Company also monitors whether the outsourced company is processing personal information securely.

Article 6 (Provision of Personal Information to Third Parties)

The Company uses the user's personal information within the scope notified in the purpose of collection and use of personal information, and does not use it beyond the notified scope or provide it to a third party (including sharing) except for the following reasons.

• (1)When there is a request from a related agency for the purpose of investigation in accordance with relevant laws.
• (2)When it is necessary for the purpose of statistical preparation or academic research, etc., and when personal information is provided in a form that cannot identify a specific individual.
• (3)When the user's consent is obtained.
• (4)In the event of a request in accordance with the procedures prescribed by other relevant laws.

Procedure and Method of Destruction of Personal Information

Unless it is required to preserve personal information in accordance with relevant laws and regulations, the Company shall, in principle, destroy the information without delay after the purpose of collecting and using personal information is achieved.

Article 7 (Procedure for Destruction)

• (1)After the purpose of collection and use is achieved, the personal information provided by the user to the Company is transferred to a separate DB (separate filing cabinet in the case of paper) and destroyed after being stored for a certain period of time according to the internal policy and reasons for information protection according to the other relevant laws (refer to the period of retention and use).
• (2)Personal information transferred to a separate DB will not be used for any purpose other than the purpose for which it is retained, unless it is required by relevant laws and regulations.

Article 8 (Method of Destruction)

• (1)Personal information stored in the form of an electronic file will be deleted using a technical method that makes it impossible to restore it.
• (2)Personal information printed on paper is shredded with a shredder or destroyed by incineration.

Rights of Users and Legal Representatives and Methods of Exercising Them

Article 9 (Withdrawal of Consent to Collection, Use, and Provision of Personal Information)

Users may withdraw their consent to the collection, use, and provision of personal information to the Company at any time.

Article 10 (Correction of Information)

Users may request the Company to access their personal information and correct errors.

Article 11 (Method of Correction)

Users may exercise their rights under Articles 9 and 10 by contacting the Company's personal information officer in writing, by phone, or by e-mail, after going through the identity verification process.

Article 12 (Confirmation of Correction)

If a user requests the correction of an error in personal information, the Company will not use/provide the personal information until the error correction is completed, and if the personal information has already been provided to a third party, the Company will notify the third party without delay so that the error can be corrected.

Article 13 (Requests for Deletion)

In the event that the user or his/her legal representative withdraws his/her consent, the Company will, in principle, destroy the personal information without delay, but if it is required to be retained by relevant laws and regulations, it will be handled in accordance with the 'Period of Retention and Use of Personal Information' in the Privacy Policy.

Matters concerning the Installation/Operation of an Automatic Personal Information Collection Device and its Refusal

Article 14 (Installation/Operation of Automatic Collection Devices)

The Company may, when necessary, operate "cookies" or other devices that store and retrieve users' information periodically. A cookie is a small text file sent by the server running the Company's website to the user's browser and stored on the user's computer's hard disk. The Company uses cookies for purposes such as analyzing website access frequency and visit times, identifying and analyzing users' areas of interest, tracking participation in various events and visit counts, and providing target marketing and personalized services.

Article 15 (Choice of Automatic Collection)

Users have the right to choose whether or not to install cookies. Therefore, users can allow all cookies by setting options in the web browser, check each time a cookie is saved, or refuse to save all cookies.

Article 16 (Refusal of Automatic Collection)

As a method of rejecting the setting of cookies, users can allow all cookies by selecting the option of the web browser used, check each time a cookie is saved, or refuse to save all cookies. (However, if refusing to store cookies, it may be difficult to use some services that require login.)

How to set up

Microsoft Edge : Settings at the top of your web browser→ Cookie and site permissions → Choose how to set them
Google Chrome : Settings at the top of your web browser→ Privacy & Security→ Cookies and other site data→ Choose how to set it up

Measures to Ensure the Safety of Personal Information

Article 17 (Measures to Ensure Safety)

The Company takes technical, administrative, and physical measures necessary to ensure safety, such as establishing an internal management plan and storing access records, so that personal information is not lost, stolen, leaked, altered, or damaged.

Article 18 (Encryption of Personal Information)

• (1)Users' personal information and passwords are stored and managed in an encrypted way, so only the user can know them, and important data is encrypted and then transmitted, and separate security features such as using a file lock function are used.
• (2)The Company shall not be liable for any personal information leakage caused by the user's negligence or problems on the Internet, and the user shall thoroughly manage and take responsibility for his/her ID and password to protect the user's personal information.

Article 19 (Technical Measures)

In order to prevent leakage or damage of personal information caused by hacking or computer viruses, the Company installs security programs, periodically updates and inspects them, installs the system in areas where access from the outside is restricted, and monitors and blocks it technically and physically.

Article 20 (Restriction of Access to the Personal Information Processing System)

The Company takes necessary measures to control access to personal information by granting, changing, and canceling access rights to the database system that processes personal information, and controls unauthorized access from the outside by using an intrusion prevention system.

Article 21 (Minimization and Training of Personal Information Handling Staff)

The Company designates and limits the number of employees who handle personal information to minimize the number of employees in charge to manage personal information.

Matters Concerning the Chief Privacy Officer and the Handling of Complaints Related to Personal Information

In order to protect users' personal information and handle complaints related to personal information, the Company designates the department in charge and the chief privacy officer and staff in charge of personal information management as follows.

HYUNDAI TRANSYS Website Management

HYUNDAI TRANSYS Website Management

Category	Chief Privacy Officer
Name	Kim Young-ki, Director
Affiliation	Management Support Division
Phone	031-645-9070
Mail	security@hyundai-transys.com

HYUNDAI TRANSYS Website Management

HYUNDAI TRANSYS Website Management

Category	Personal Information Management Staff (website management)
Name	Jung Ji-won, Senior Manager
Affiliation	Communications Team
Phone	031-5177-9227
Mail	Jiwon312@hyundai-transys.com

HYUNDAI TRANSYS Website Management

HYUNDAI TRANSYS Website Management

Category	Personal Information Management Staff (computerized personal information management)
Name	Jeong Heung-soo, Senior Manager
Affiliation	Information Protection Center
Phone	031-645-9098
Mail	hsjung@hyundai-transys.com

Remedies for Infringement of Customers’ Rights and Interests

Customers can contact the following organizations for damage relief and consultation regarding personal information infringement.

The following organizations are separate from the Company, and if you are not satisfied with the results of the Company's own handling of personal information complaints and damage relief, or if you need more help, please contact the Company's chief privacy officer of staff in charge of personal information protection.

• Personal Information Infringement Report Center (Korea Internet & Security Agency)
  • Responsibilities : Report personal information infringement, request for consultation
  • Website : privacy.kisa.or.kr
  • Phone : 118 (without area code)
• Personal Information Dispute Mediation Committee
  • Responsibilities : Personal information dispute mediation application, collective dispute mediation (civil resolution)
  • Website : www.kopico.go.kr
  • Phone : (without area code) 1833-6972
• Supreme Prosecutors' Office : (without area code) 1301 (www.spo.go.kr)
• National Police Agency : (without area code)182 182 (www.police.go.kr)

Effective Date

The Company will notify in advance of any changes to this Privacy Policy by providing the reasons for the changes and the details of the modifications through methods such as posting on the homepage's main screen notice section or through a separate window. When the Privacy Policy is changed, the previous version can be viewed from the top menu bar of the Privacy Policy page.

Effective date: July 1, 2024 (Monday)