IR Letter (Mar. 2021)

Pearl Abyss Corp. (hereinafter referred to as the "company") collects and uses personal information in accordance with Personal Information Protection Act and other relevant laws. This Privacy Policy discloses what personal information the company collects, how they being used, and how the personal information is handled.

This Privacy Policy applies to the Pearl Abyss official website and the image information processing equipment operated and managed by the company.

1. Types of Information Collected and Method of Collection

The company collects required information when you use the official website.

1) Corporate Ethics Report
- Required Information: Password
- Optional Information: Name, phone number, email

※ You can report or receive consultation anonymously for corporate ethics and compliance related issues.

2. Purposes of Handling Personal Information

The company handles personal information for the following purposes and only for those purposes. If the purposes change, the company will follow relevant laws by acquiring permission and taking the necessary steps.

1) Submitting a report or receiving consultation for corporate ethics and compliance related issues
2) Securing clear communication and for sending results about corporate ethics compliance reports and consultations

3. Providing Personal Information to Third Parties

The company only uses personal information as stated under "Purpose of Handling Personal Information." The personal information is not provided to third parties except when permitted by your consent, in accordance with special provision and within the boundaries of relevant laws.

4. Handling Personal Information and Duration of Use

The company retains and uses personal information collected for the duration agreed upon when collecting the personal information. The personal information will be destroyed without delay when the purposes of handling personal information are achieved.
However, certain information that are required by law will be retained for the duration as stated by those laws.

5. Destroying Personal Information

The company will destroy personal information when they exceed the retention period, achieved their purpose, and if the information is no longer required.
If the information is required by relevant laws to be retained for a period past their retention period or their purpose, then the information is moved to a different database or their location is moved for storage. The procedure and method of disposing the information is as follows:

Destroying Procedure: Your personal information will be destroyed without delay after its purpose has been achieved. However, certain information that are required by law will be retained for the duration stated by those laws. The personal information will not be used for any other purpose if it is being kept in accordance with relevant laws.

Destroying Method: Printed personal information will be shredded through a paper shredder or incinerated. If the information is stored as a data file, it will be deleted using technology that makes the data unrecoverable.

6. Your Rights and How to Exercise Your Rights

You reserve the right to view, correct, delete, and request the company to stop handling your registered personal information at any time. In this case, contact the staff in charge of personal information protect o the department in-charge of handling personal information issues by letter, phone, or email. Then your personal information will be destroyed without delay.

7. Installing, Operation, and Rejecting Automated Personal Information Collecting Technology

The company uses "Cookies" to store and use your information on the website. Cookies are small text files that is sent by the website's server to the user's browser and saved within the hard drive. We use cookies for the following purposes:

1) Purpose of Using Cookies and Others Applications
The company employs analytical tools with data on the user's visiting frequency, visiting time, user's field of interest. and records.

The company and other third parties providing analytical service can use cookies, beacons, tags or scripts to track down data. Data is collected for purposes of statistical analysis on website management, trend review, and user's activity in the website. The company may receive aforementioned data in package from third parties that provide analytical services.

2) Settings to Refuse Cookie Saves
Users have a right to choose how cookies are installed. A user may use the web browser settings to either completely allow all cookies, check everytime a cookie is installed, or refuse all cookies. However, users that refuse cookies may experience some inconveniences the our services.

- Internet Explorer: [Tools] → [Internet Options] → [Privacy] → [Advanced]
- Chrome: [⋮] → [Settings] → [View Advanced Settings] → Privacy[Content Settings]

※ Other web browsers may have different methods to change their settings.

The company also uses external web log analyzing tools such as Google Analytics and etc.
- Block Google Analytics: https://tools.google.com/dlpage/gaoptout/

※ Other Web Log Analyzing Tools have different refuse settings.

8. Measures Used to Protect Personal Information

The company takes the following precautions to protect your personal information from getting lost, stolen, exposed, changed, and damaged. However, the company is not liable for situations caused for the carelessness of users such as not keeping their password safe and others, or for situations outside of the company control.

1) Technological Measures

- Files and transmission of data that include personal information are encrypted or locked by a password.
- The company stays vigilant to protect against hackers, computer viruses, and other possible threats to your personal information. Additionally, the company constantly backs up data just in case and uses antivirus programs, firewalls, and other various methods to protect the company devices.
- The company has taken measures to ensure the safety of the systematically configured database system to handle personal information.

2) Managerial Measures

- The company has limited and minimized the number of staff that has access to personal information
- The company provides regular training to personal information service personnel and trustees regarding their privacy obligations.
- The company establishes and manages personal information processing guidelines through the department in-charge of personal information protection. The company also makes as effort to check compliance with internal regulations on a regular basis to rectify any problems found.

3) Physical Measures

- The company establishes and operates access control procedures for the separate physical storage of the personal information system where personal information is stored.
- Documents containing personal information, auxiliary storage media, and others are stored in a safe location with a lock.

9. Installation and Operation of Image Information Processing Equipment

The company installs and operates image information processing equipment for the purpose of facility safety and fire prevention, personnel and vehicle access control, crime prevention for the safety of employees and visitors, vehicle theft and damage prevention, and illegal intrusion of outsiders pursuant in accordance with Article 25 (1) for the Personal Information Protection Act.

[Image Information Processing Equipment Status]

Locations and Recorded Areas	Number Installed
Building Lobby	2
Main Gate	1
Back Gate	1
Underground Parking and Storage	22
Cafe	2
Outside the building	17
Total	45

[Image Information Processing Equipment Management and Access]

Groups	Personnel	Contact Information
Manager of Image Information Processing Equipment	General Affairs Team Leader in Corporate Affairs Division	031-476-8583 (Extension: 4)
Personnel with access to Image Information Processing Equipment	General Affairs staff in Corporate Affairs Division
	Facilities Team Staff in Corporate Affairs Division
	Security Staff

[Image Information Recording, Retention, Storage Location, and Handling]

The company retains the image information after recording. The data is deleted in a way it cannot be recovered after the retention period is over.

Recorded	Retention Period	Stored Location	Handling
24Time	30 days after recording	Pearl Abyss 1F, Security Room	Records/manages all actions regarding the image information such as usage outside its stated purpose, being provided to third parties, access, etc. and all image information is deleted safely after the retention period expires

[Image Information Processing Equipment Installation and Management Consignment]

The company entrusts the installation and management of the image information processing equipment to the following companies.

Companies	Entrusted Duties	Assigned Personnel	Contact Information
S1	Installation & Maintenance	Deok Hyeon Hong	1588-3112
Kyobo Realco	Operation & Management	Jung Ju Lee	02-2290-4053

[Measures Regarding Requests to View Image Information, Etc.]

If you desire to view, confirm, or delete your recorded image information, you may request the relevant matter to the company. However, this is limited to personal image information personally recorded and clearly needed for the benefit of your imminent life, body, and assets.

The company will take the appropriate measure without delay once a request to view, confirm, or delete one's personal image information has been made. However, your request may be denied regarding viewing your personal image information in the following cases:

- Causing serious disruption to a criminal investigation, the sustainment of public prosecution, and procession of trial
- If personal image information has been deleted after the expiration of the retention period
- If taking the necessary measures for the request to view the information leads to great concerns of invasion of privacy
- If there are other valid reason to reject your request to view the information

[Image Information Verification Method and Stored Location]

- Verification Method: If you desire to verify your personal information, please contact the head of the department of personal information or image information prior to visiting the company in person.
- Stored Location: Pearl Abyss 1F, Security Room

[Image Information Measures for Safe Procurement]

- The company does not gather image information or recordings for reasons other than those stated in this Privacy Policy, and only those authorized to handle personal information are granted access to gathered/saved image information.
- The company prohibits any type of random perusal and playing of, as well as externally releasing the gathered image information.
- The company is recording/managing all actions regarding the image information such as usage outside its stated purpose, being provided to third parties, access, etc. and all image information is deleted safely after the retention period expires.

10. Personal Information Protection Officer and Personal Information Handling Department

To protect your person information and deal with relevant complaints, the company has assigned an officer responsible for person information protection to oversee your personal information and a channel to submit your opinions and complaints related to person information protection. Please contact the head officer and relevant department with any questions, opinions, or concerns on the infringement of rights and interests regarding your personal information and the company will get back to you without delay.

Personal Information Protection Officer	Personal Information Handling Department
Name: James Heo Title: CPO Phone: 070-4923-6372 E-mail: privacy@pearlabyss.com Fax: 031-476-8584	Department: Regulatory Compliance Division Phone: 070-4923-6372 E-mail: privacy@pearlabyss.com Fax: 031-624-5897

11. Remedies on Infringement of Rights and Interests

You may contact the following bodies for information on damage relief and consultation regarding infringement of person information.

- Infringement of Personal Information Report Center (privacy.kisa.or.kr / 118)
- Supreme Prosecutors' Office Cybercrime Investigation Division (spo.go.kr / 02-3480-3573)
- Korean Nation Police Agency Cyber Bureau (cyberbureau.police.go.kr / 182)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)

12. Addendum

This policy shall enter into force from September 16, 2020.