DAEWOO E&C

02. Items of Personal Data Processed

1. Daewoo E&C collects and uses personal data only within the minimum necessary scope in accordance with the Personal Information Protection Act.

2. Under Article 15(1)(4) of the Act (“Contract Performance”), Daewoo E&C may process certain items without the data subject’s consent. Other items are processed with consent under Articles 15(1)(1), 17(1)(1), 23(1)(1), 24(1)(1) of the Act and Articles 32(1)-(2), 33, and 34 of the Credit Information Use and Protection Act.

   Required Items :

   Name, Phone Number, Email, Password

   Optional Item :

   Mobile Phone Number

03. Method of Collecting Personal Data

Personal data is collected via the website (Customer Service Center, Cyber Audit Office, Ethics Help Line).

04. Personal Data of Children Under 14

1. Where consent is required to process the personal data of a child under 14 years of age, Daewoo E&C obtains consent from the child’s legal guardian.
2. In doing so, Daewoo E&C may request minimal information from the child, such as the name and contact details of the legal guardian.

05. Period of Retention and Use of Personal Data

1. Daewoo E&C retains and processes personal data within the period stipulated by relevant laws or the period consented to by the data subject at the time of collection.

2. The retention and processing period of personal data according to its collection purpose is as follows.

   Retention Items :

   Records related to customer inquiries, complaints, dispute handling, and responses

   Legal Basis :

   Article 15(1)(1) of the Personal Information Protection Act

   Retention Period :

   Until the completion of the complaint handling

06. Personal Data Disposal Procedures and Methods

1. Daewoo E&C promptly destroys personal data without delay when the retention period has expired or the purpose of processing has been achieved.
2. If the retention period consented to by the data subject has expired or the purpose of processing has been fulfilled, but the data must be retained in accordance with other applicable laws, the relevant personal data will be transferred to a separate database (DB) or stored in a different location.
   ※Details regarding the items of personal data retained under other laws and the legal basis for such retention can be found in Section 5: “Retention and Use Period of Personal Data.”

3. The procedures and methods for destroying personal data are as follows.

   • Disposal Procedure :

     Personal data subject to destruction is selected and destroyed upon approval by the Chief Privacy Officer or authorized personnel.

   • Disposal Method :

     Electronically stored data is permanently deleted using a non-recoverable method. Printed documents are shredded or incinerated.

07. Entrustment of Personal Data Processing

1. To ensure smooth operations, Daewoo E&C entrusts the processing of personal data to third parties as follows:
2. When entering into an outsourcing contract, Daewoo E&C specifies obligations such as prohibition of processing beyond the intended purpose, security measures, restrictions on re-entrustment, supervision of the trustee, and liability in documents in accordance with Article 26 of the Personal Information Protection Act.

3. Any changes in the entrusted tasks or trustees will be promptly disclosed via this policy.

   Entrusted Task	Retention and Use Period	Trustee (Entrusted Party)
   Website and system management	Until termination of the outsourcing contract	Real Estate Info (New Media Division)

   • Inquiries related to sales or defects are handled on the Prugio website.

08. Measures to Ensure the Security of Personal Data

In accordance with Article 29 of the Personal Information Protection Act and the “Standards for Ensuring the Security of Personal Data” (Notification No. 2023-6), Daewoo E&C takes the following measures:

• Administrative Measures :

  Establishment and implementation of internal management plans, operation of dedicated teams, regular employee training

• Technical Measures :

  Access control to data processing systems, installation of access control systems, encryption of personal data, installation and update of security software

• Physical Measures :

  Operation of secured facilities and access control

09. Rights and Obligations of Data Subjects and Legal Guardians

1. Data subjects may exercise their rights at any time, including the right to access, correct, delete, suspend processing of their personal data, withdraw consent, and object to automated decision-making.
   ※ For children under 14, such requests must be made by their legal guardian. For minors over 14, requests may be made either by the data subject or their legal guardian.
2. Requests can be submitted via written document, email, or fax using Form No. 8 of Notification 2023-12, in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. We will respond without delay.
3. Authorized representatives must submit a power of attorney (Form No. 11) when exercising rights on behalf of a data subject.
4. The right to access or suspend processing may be restricted under Articles 35(4) and 37(2) of the Act.
5. Deletion may not be granted where the data is required to be retained under law.
6. Objections to automated decision-making may be denied if the decision was consented to in advance, specified in a contract, or clearly permitted by law. Requests may also be denied if they infringe on the rights or safety of others.
7. Daewoo E&C will verify whether the requester is the data subject or a legitimate representative.

10. Personal Information Protection Officer and Contact Information

1. Daewoo E&C has designated the following officer and department for overall responsibility and for handling data subject complaints and inquiries:

   • Chief Privacy Officer : Head of Information Security Office
     Phone: 1670-1000 / Email: privacy@daewooenc.com
   • Privacy Department (Website Contact)
     Phone: 02-2288-3690 / Email: sangmin.kang@daewooenc.com
2. Data subjects can contact these entities for any privacy-related matters. We will respond without delay.

11. Remedies for Infringement of Rights

1. If you believe your rights have been violated, you may contact the following organizations for dispute resolution or consultation:

   • Personal Information Dispute Mediation Committee : 1833-6972 (www.kopico.go.kr)
   • Personal Information Infringement Report Center : 118 (privacy.kisa.or.kr)
   • Supreme Prosecutors’ Office : 1301 (www.spo.go.kr)
   • National Police Agency : 182 (ecrm.cyber.go.kr)

2. For internal inquiries and complaints

   • Privacy Department (Website Contact)
     Phone: 02-2288-3690 / Email: sangmin.kang@daewooenc.com

12. Changes to the Privacy Policy

1. This privacy policy is effective as of June 1, 2024.