Article 1 (Purpose of Processing Personal Information, Categories of Personal Information Processed, and Retention Period)

The Firm collects and uses personal information to the minimum extent necessary for the provision of legal services in accordance with the Personal Information Protection Act. The purposes for which personal information is processed, the categories of personal information processed, and the corresponding retention periods are as follows.

1. Personal Information of Clients

(1) Purpose of Processing

• Receipt of legal consultation inquiries and responses thereto
• Provision of legal advice and related communications
• Handling matters related to the clients
• Delivery of newsletters, promotional materials, and other information created and distributed by the Firm
• Handling of complaints and fulfillment of other statutory obligations

(2) Categories of Personal Information Processed

• Name, contact information (telephone number, email), address, company name, job title and position within the company, and any information created or provided in the course of delivering legal advice and related communications

(3) Retention Period

• Until the purpose of processing is fulfilled or until the data subject withdraws consent

2. Personal Information of Job Applicants

(1) Purpose of Processing Personal Information

• Assessment and review of the applicant’s suitability for employment

(2) Categories of Personal Information Processed

• Name, contact information (telephone number, email), address, educational background, military service record, employment history, photograph, academic transcripts, foreign language and other certificates, and any other information provided during the recruitment process

(3) Retention Period

• Until the purpose of processing is fulfilled or until the data subject withdraws consent

Article 2 (Provision of Personal Information to Third Parties)

In principle, the Firm processes personal information within the scope specified in Article 1 and does not process such information beyond that scope or provide it to third parties without the prior consent of the data subject. However, the Firm may use personal information for purposes other than those specified or provide such information to third parties in the following circumstances, unless doing so would unduly infringe upon the interests of the data subject or a third party:

• Where the data subject has given prior consent to the provision to a third party
• Where such provision is required by law
• Where it is clearly necessary to protect the urgent interest of the life, body, or property of the data subject or a third party
• Where it is urgently necessary for public safety and well-being, such as public health

Article 3 (Entrustment of Personal Information Processing)

The Firm does not currently entrust any personal information processing to external service providers. Should entrustment become necessary in the future, the Firm will comply with its obligations as a data controller under applicable laws and regulations.

Article 4 (Rights and Obligations of Data Subjects and Their Legal Representatives, and Methods of Exercise)

1. Data subjects may exercise their rights regarding personal information—such as requests for access, transmission, rectification, deletion, suspension of processing, and withdrawal of consent—against the Firm in accordance with the Personal Information Protection Act and other applicable laws.

2. The rights set forth in Paragraph 1 may be exercised through a legal representative or an authorized agent of the data subject. In such cases, a power of attorney must be submitted to the Firm.

3. The Firm will take necessary measures without delay to facilitate the exercise of such rights in accordance with applicable laws and regulations.

Article 5 (Procedures and Methods for Destruction of Personal Information)

1. The Firm destroys personal information without delay once the purpose of processing has been achieved or the retention period has expired.

2. Where personal information must be preserved pursuant to applicable laws, the Firm stores and manages such information separately from other personal information.

3. The Firm selects personal information for which a reason for destruction has arisen and destroys it upon approval by the Privacy Officer.

4. The Firm permanently deletes personal information in electronic file format using methods that prevent recovery, and shreds or incinerates records, printouts, and written documents.

Article 6 (Measures to Ensure the Security of Personal Information)

To ensure the safe management of personal information, the Firm implements the following security measures:

• Administrative Measures: Establishment and implementation of internal management plans, and regular privacy protection training for members
• Technical Measures: Access control for personal information processing systems, installation of access control systems, encryption of unique identifiers and other sensitive data, and installation of security programs
• Physical Measures: Access control for computer rooms, data storage rooms, and other facilities where personal information is stored

Article 7 (Privacy Officer)

The Firm designates the following Privacy Officer who is responsible for overseeing personal information processing and addressing complaints and remedies related to personal information:

• Privacy Officer: Seungjun Oh, Managing Attorney
• Contact: +82-2-2038-9185

Article 8 (Installation and Operation of Video Surveillance Devices)

1. Basis and Purpose of Installation: Safety management, facility security, and crime prevention for the Firm

2. Number of Devices, Locations, and Areas Monitored

Number of Devices	Location	Area Monitored
3	Hallway, 4th Floor	Hallway
3	Hallway, 5th Floor	Hallway

3. Manager and Authorized Personnel: Doha Kim (Finance Team) / +82-2-521-2999

4. Recording Hours, Retention Period, Storage Location, and Processing Method

• Recording Hours: 24 hours
• Retention Period: 30 days from the date of recording
• Storage Location: Firm’s CCTV control room
• Processing Method: Records of requests for use beyond the original purpose, third-party provision, destruction, or access to personal video information are maintained. Upon expiration of the retention period, the information is permanently deleted using methods that prevent recovery (paper outputs are shredded or incinerated).

5. Methods and Location for Reviewing Video Footage: Video surveillance management department

• Doha Kim (Finance Team) / +82-2-521-2999

6. Measures for Requests to Access Video Information: Data subjects must submit an application for access or confirmation of existence. Access is permitted only when the data subject appears in the footage or when access is clearly necessary to protect the life, body, or property interests of the data subject.

7. Technical, Administrative, and Physical Measures for Video Information Protection: Internal management plans, access control and limited access rights, secure storage and transmission of video data, maintenance of processing logs and measures to prevent tampering, secure storage facilities, and locking mechanisms.

Article 9 (Amendments to the Privacy Policy)

This Privacy Policy may be amended in accordance with applicable laws, guidelines, or the Firm’s internal regulations. The Firm will disclose any revisions to this Privacy Policy in the manner prescribed by applicable laws.

This Privacy Policy is effective from March 14, 2024.