SAMSUNG ELECTRO-MECHANICS

Article 1 (Purpose of Processing Personal Data)

SEM processes personal data for the following business purposes. If the purpose of processing is changed, necessary measures will be implemented, as required under applicable local law, such as obtaining a separate consent under Article 18 of the Personal Information Protection Act. Note that any references to consent are only to the extent, and in the manner, required by applicable local law.

Article 2 (Personal Data Processing and Retention Period)

To the extent required under applicable local law, and unless otherwise noted in this Privacy Policy:

1. ① SEM processes and retains personal data within the personal data retention and use period under laws or the personal data retention and use period agreed when collecting personal data from data subjects.
2. ② (Ethical Management/Security Reporting/Compliance Management Reporting/Product Inquiries/Technical Inquiries/Certificates/Recruitment Inquiries/Corporate Data/IR)
   The personal data processing and retention period is one year. However, personal data for which the retention and use period has expired may be preserved without being destroyed where it is required to be preserved under other laws or where a separate consent has been obtained.
3. ③ (Newsletter)
   Personal data processing and retention period is until the application for newsletter opt-out.

Article 3 (Provision of Personal Data to Third Party)

As may be required under applicable local law, and unless otherwise noted in this Privacy Policy:

1. ① SEM processes the personal data of the data subjects only within the scope specified in the Purpose of Personal Data Processing, and provides personal data to third parties only when it falls under Articles 17 and 18 of the Personal Information Protection Act, and otherwise, does not provide the personal data of the data subjects to third parties.
2. ② In accordance with the Personal Data Handling and Protection Rules in Emergency Situations jointly announced by the relevant government ministries and agencies, SEM may provide personal data to relevant organizations without the consent of the data subject in response to emergencies such as disasters, infectious diseases, events or accidents that cause imminent danger to life or body, or imminent property loss.

Article 4 (Entrustment of Personal Data Processing)

1. ① The Company entrusts the processing of personal data as follows for the smooth processing of personal data.

   SEM entrusts the processing of personal data as shown in [Attachment 1] for the smooth processing of personal data.

   No.	Name of Entrustee	Entrusted Work	Representative Phone No.
   1	The Uber Creative Co., Ltd.	Operation and maintenance of website, send newsletters​	+82-2-517-5133
   2	Samsung SDS Co., Ltd.	Operate computer system	+82-2-6155-3114

2. ② When executing an entrustment agreement, in accordance with Article 26 of the Personal Information Protection Act, SEM specifies prohibition on personal data processing for purposes other than the purpose of carrying out the entrusted work, technical and managerial protection measures for personal data, purpose and scope of the entrusted work, restriction on re-entrustment, safety securement measures, management and supervision of the entrustee, matters relating to liability such as compensation for damages, etc. in documents, and supervises whether the entrustee safely processes personal data.
3. ③ If the content of the entrusted work or the entrustee is changed, SEM will immediately notify such change through this Privacy Policy.

Article 5 (Rights and Obligations of Data Subject, Its Statutory Agent and Method of Exercising Them)

As may be required under applicable local law, and unless otherwise noted in this Privacy Policy:

1. ① The data subject (or its statutory agent, in case the data subject is under the age of 14) may exercise the following rights relating to personal data protection against SEM at any time.

   1. 1. Request for access to personal data
   2. 2. Request for correction in case there exists any error, etc.
   3. 3. Request for deletion
   4. 4. Request for suspension of processing
2. ② The exercise of rights pursuant to Paragraph 1 may be executed in writing, or by e-mail, fax, etc. in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and SEM will take action without delay accordingly.
3. ③ The exercise of the rights under Paragraph 1 may be carried out through an agent such as the data subject’s statutory agent or delegated person. In this case, the power of attorney in the attached Form No. 11 of the Enforcement Rules of the Personal Information Protection Act shall be submitted.
4. ④ In the case of the request for access to personal data or the request for suspension of processing, the data subject’s rights may be restricted under Articles 35 (4) and 37 (2) of the Personal Information Protection Act.
5. ⑤ If the personal data is specified as data that SEM is obligated to collect in any other laws and regulations, notwithstanding the foregoing, any correction and/or deletion of personal data cannot be requested.
6. ⑥ SEM verifies whether the person who has made the request for access, the request for correction or deletion, or the request for suspension of processing based on the Data Subject’s rights is the Data Subject itself or its legitimate statutory agent.

Article 6 (Personal Data Items Processed)

1. ① SEM is handling the following personal data items.

   SEM is handling the following personal data items.

   No.	Name of Personal Data File	Personal Data Items Recorded in Personal Data File
   1	Ethical Management (Reporting by Disclosing Identity)	(Optional) Name, Phone Number, E-mail address
   2	Ethical Management (Anonymous Reporting)	(Optional) Phone Number, E-mail address
   3	Security Reporting (reporting)	(Optional) First Name, Last Name, Company, Phone Number, E-mail address
   4	Compliance Management (reporting)	(Optional) First Name, Last Name, Company, Phone Number, E-mail address
   5	Recruitment Inquiries	Country recruited, Employment area, Type of employment, First Name, Last Name, Phone Number, School/Organization, Major/Department, E-mail address
   6	Product, Technology, Certificates, Company Information, IR	Country, First Name, Last Name, Company/Organization, Department, Phone Number, E-mail address
   7	Newsletter	E-mail address
   8	Component product library	Company ID, password

2. ② The following personal data items can be automatically generated and collected in the process of using the Internet services:

   • · IP address, cookie, service usage record, visiting record, defective usage record, etc.

Article 7 (Destruction of Personal Data)

To the extent required under applicable local law, and unless otherwise noted in this Privacy Policy:

1. ① Where personal data becomes unnecessary because of expiration of the personal data retention period, achievement of the purpose of processing, etc., SEM shall immediately destroy the relevant personal data.
2. ② In the event that SEM must continue to preserve the personal data in accordance with other laws even when the personal data retention period agreed by the data subject has elapsed or the purpose of processing has been achieved, SEM may move the personal data to a separate database or store it in a different storage location.
3. ③ The procedure and method of destroying personal data are as follows.

   1. 1. Destruction procedure

      SEM selects personal data for which the cause for destruction occurs, and destroys personal data with the approval of SEM’s person in charge of personal data protection.

   2. 2. Destruction method

      SEM destroys personal data recorded and kept in the form of an electronic file so that records cannot be reproduced, and the personal data recorded and kept in paper documents is shredded by a shredder or incinerated and destroyed.

Article 8 (Measures Concerning Destruction etc. of Personal Data of Dormant Users) * Applicable only to personal data related to component product library

To the extent required under applicable local law, and unless otherwise noted in this Privacy Policy:

1. ① SEM destroys the data of those users who have not used the service for one full year. However, until the retention period stipulated by other laws and regulations has elapsed, a user's data may be stored and managed as separated from other users' personal data.
2. ② SEM notifies users of the fact that their personal data will be destroyed, the expiration date of the one-year period, and items of personal data to be destroyed 30 days before the destruction of the personal data in types of notification available to users, as by e-mail or text message.

Article 9 (Personal Data Security Securement Measures)

1. ① SEM takes the following measures to help ensure the safety of personal data:
   1. 1. Establishment and implementation of an internal management plan
      SEM establishes and implements an internal management plan for the secure processing of personal data.
   2. 2. Minimization and training of the persons who handle personal data
      SEM manages personal data by designating and minimizing the persons who handle personal data, and conducts regular training for the employees who handle personal data.
   3. 3. Restriction of access to personal data
      SEM takes necessary measures to control access to personal data through granting, changing, and cancelling access to the database system that processes personal data, and controls unauthorized access from the outside using the intrusion prevention system.
   4. 4. Recordkeeping of access logs and prevention of forgery
      Records relating to access to the personal data processing system (web log, summarized data, etc.) are kept and managed in accordance with relevant laws, and security functions are used to prevent forgery, theft, and loss of access records.
   5. 5. Encryption of personal data
   6. 6. Technical countermeasures against hacking, etc.
      In order to prevent personal data leakage and damage caused by hacking or computer virus, etc., SEM installs security programs, conducts periodical updates and inspections, installs systems in areas where access from the outside is controlled, and performs monitoring and blocking technically and physically. In addition, SEM has implemented tools to not only conduct monitoring of network traffic but also detect attempts to illegally alter data, etc.
   7. 7. Control of access against unauthorized persons
      SEM has a separate physical storage place for the personal data system where personal data is kept, and establishes and operates the access control procedure.

Article 10 (Matters Concerning Installation, Operation and Refusal of Automatic Personal Data Collection Device)

1. ① SEM uses cookies to store and find usage data time to time.
2. ② Cookies are a small amount of data that the server which is used to run the system sends to the user’s computer browser, and are stored on the hard disk on the user’s computer.
   1. 1. Purpose of using cookies : to check user errors and prevent illegal use by identifying visiting records and security access
   2. 2. Allow and block cookies
      • ▶ Internet Explorer web browser : You can refuse to store cookies by setting options at [Tools] on the top > [Internet Options] > [Personal Data] menus.
      • ▶ Chrome web browser : You can refuse to store cookies by setting [Setting] in the upper-right corner > [Personal Data and Security] > [Cookies and Site Data].
   3. 3. If you block cookies, certain aspects of the provision of services may be difficult.

Article 11 (Matters concerning the Collection, Use, and Rejection of Behavioral Data)

SEM does not collect, use, or provide behavioral data for customized online advertisements.

Article 12 (Person in Charge of Personal Data Protection)

1. ① The SEM designates the person in charge of personal data protection as follows in order to protect personal data and handle complaints relating to personal data.

   The SEM designates the person in charge of personal data protection as follows in order to protect personal data and handle complaints relating to personal data

   Classification	Manager/Department	Contact Information
   Personal Data Protection Officer	Legal Team Leader	Phone number : +82-31-210-5114 Email : privacy.semco@samsung.com ※ It is connected to the personal data protection department.
   Personal Data Protection Division	Personal Data Protection Secretariat, Legal Team	Phone number : +82-31-210-5114 Email : privacy.semco@samsung.com

2. ② The Data Subject may contact the person in charge of personal data protection and the department with respect to all inquiries relating to personal data protection, handling of complaints, remedy, etc. that have occurred while using SEM’s service (or business). SEM will answer and deal with the Data Subject’s inquiries without delay.

Article 13 (Request for Access to Personal Data)

1. ① The data subject may make a request for access to personal data to the following department under Article 35 of the Personal Information Protection Act. SEM will try to promptly handle the data subject’s request for access to personal data.

   The Data Subject may make a request for access to personal data to the following department under Article 35 of the Personal Data Protection Act. SEM will try to swiftly handle the Data Subject’s request for access to personal data.

   Description	Name of Department	Contact Information
   Department of receiving and handling request for access to personal data	Personal Data Protection Office	Phone number : +82-31-210-5114 Email : privacy.semco@samsung.com

Article 14 (Remedies for Infringement on Rights and Interests)

The data subject may contact the following institutions to inquire about damage relief, etc. in relation to personal data infringement. The following institutions are independent from SEM, you can contact if you are not satisfied with SEM’s own handling of personal data complaints or damage relief results, or if you need further assistance, please contact them.

• ▶ Personal Data Infringement Report Center (privacy.kisa.or.kr, +82-118)
• ▶ Personal Data Dispute Mediation Committee (www.kopico.go.kr, +82-1833-6972)
• ▶ Supreme Prosecutors’ Office (www.spo.go.kr, +82-1301)
• ▶ National Police Agency (ecrm.police.go.kr, +82-182)

Article 15 (Change of Privacy Policy)

1. ① This Policy is effective from [August 23, 2024]. When the content of this Policy is added, deleted or modified in accordance with the change of laws/policies or security technology, the modified Privacy Policy will be disclosed on the website, etc.

For Consumers Residing in California

This section supplements the Samsung Electro-Mechanics’ Privacy Policy and applies to consumers who reside in California.

Article 1 (Collection, Use, and Disclosure of Personal data)

The chart below describes the categories of personal data that SEM collects, as well as the categories of third parties to whom we may disclose each category of personal data for our business purposes (as described below). SEM does not “sell” personal information or “share” personal information for cross-context behavioral advertising (as those terms are defined under applicable law). We do not use your sensitive personal data for purposes other than permitted under applicable local law.

1. ① Categories of Sources of Personal Data: SEM may have collected the categories of personal data described above about you from the following categories of sources:
   1. • From you, or your device, for example, through your use of our services; and
   2. • SEM’s affiliated companies which provide services on SEM’s behalf, such as web site operation support.
2. ② Business & Commercial Purposes for Collecting Personal Data: SEM may have collected personal data about you for the following business or commercial purposes (in addition to the purposes listed above in the Samsung Electro-Mechanics’ Privacy Policy):
   1. • Performing services, including providing customer service, verifying customer information, providing analytics services, or providing similar services;
   2. • Auditing, auditing compliance, short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business;
   3. • Helping to ensure the security and integrity of the service;
   4. • Debugging to identify and repair errors that impair existing intended functionality;
   5. • Undertaking internal research for technological development and demonstration; and
   6. • Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

Article 2 (Data Retention)

SEM takes appropriate steps to ensure that SEM processes and retains personal information about you for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. The criteria typically used to determine our retention periods include: (1) the duration for which the information is used to provide you with a service; (2) whether there is a legal obligation to which we are subject, including as required under law, a contract, or with regard to SEM’s statutory obligations (e.g., tax laws); or (3) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).