Article 1 (Items of Personal Information Processed, Purpose of Processing, and Retention Period)

1. Personal information of clients (including prospective clients)

Items processed	Name, contact information (telephone number, e-mail address), address, company name, position and title within the company, bank account information, etc.
Purpose of processing	Handling of matters related to clients, distribution of newsletters and promotional materials produced by the Firm, notices and invitations to events hosted by the Firm, tax filings, and other information delivery purposes
Retention period	Until the purposes above are achieved

2. Personal information of employees

Items processed	- Mandatory items: name, resident registration number, contact information (telephone number, e-mail address), address, academic background, certificates held, career history, military service, bank account number, etc. - Optional items: vehicle information, family information, etc.
Purpose of processing	Recruitment, personnel management, and provision of welfare benefits for the Firm's employees (execution and maintenance of employment contracts, payment of salary and severance pay, training, issuance of various certificates, welfare benefits for employees and their families, insurance and pension-related matters, etc.)
Retention period	Up to three years after an employee leaves the Firm

3. Personal information of job applicants

Items processed	- Mandatory items: name, gender, date of birth, contact information (telephone number, e-mail address), address, academic background, grades (undergraduate, law school, language scores, etc.), certificates held, career history, military service, etc. - Optional items: family information
Purpose of processing	Carrying out recruitment procedures for the Firm's employees and building a talent database
Retention period	Up to three years after the recruitment process ends

Article 2 (Provision of Personal Information to Third Parties)

The Firm processes personal information only within the scope specified in Article 1 and provides personal information to third parties solely with the prior consent of the data subject or when permitted by the Personal Information Protection Act or other relevant laws and regulations.

Article 3 (Outsourcing of Personal Information Processing)

The Firm does not currently outsource the processing of personal information.

If the Firm outsources personal information processing in the future, it will disclose, through its privacy policy, the contractor, details of the outsourced tasks, and the outsourcing period.

Article 4 (Rights and Obligations of Data Subjects and Methods of Exercise)

1. Data subjects may exercise their rights—such as the right to access, rectify, delete, or suspend the processing of personal information—against the Firm in accordance with the Personal Information Protection Act and other relevant laws, and the Firm will respond without delay in accordance with those laws.
2. Such rights may be exercised through a legal representative or a delegated agent of the data subject. In this case, a power of attorney in the form prescribed by the Enforcement Rule of the Personal Information Protection Act must be submitted.
3. Data subjects must not infringe on their own or others' personal information and privacy processed by the Firm in violation of the Personal Information Protection Act or other relevant laws.

Article 5 (Destruction of Personal Information)

1. When the retention period expires or the processing purpose has been achieved, the Firm will, without undue delay and in accordance with the Personal Information Protection Act and other relevant laws, destroy the personal information unless there is a legitimate reason to retain it.
2. Printed materials or written documents containing personal information will be destroyed by shredding or incineration, and personal information in electronic files will be permanently deleted in a manner that prevents recovery.

Article 6 (Measures to Ensure the Security of Personal Information)

The Firm takes the following measures to ensure the security of personal information:

1. Administrative measures: establishing and implementing internal management plans, providing regular employee training, etc.
2. Technical measures: managing access rights to personal information processing systems, installing access control systems, encrypting unique identification information, installing security programs, etc.
3. Physical measures: controlling access to computer rooms, document storage rooms, and similar facilities.

Article 7 (Amendment of the Privacy Policy)

If the Firm amends this privacy policy, it will continuously disclose the effective date and the amended details.

Article 8 (Personal Information Protection Officer)

1. The Firm designates the following Personal Information Protection Officer and department responsible for the overall management of personal information and for handling complaints and remedies related to personal information.

   Personal Information Protection Officer	Name: Kim Yong Gab Title: Attorney-at-law Contact: 02-3477-8695, ygkim@law-lin.com
   Personal Information Protection Department	Department: General Affairs Team Person in charge: Director Ho-hyun Joo Contact: 02-3477-8500, hhjoo@law-lin.com

2. Data subjects may direct any inquiries, complaints, or requests for remedies related to personal information that arise while using the Firm's services (or business) to the Personal Information Protection Officer or the responsible department. The Firm will respond promptly to such inquiries.