General provisions

POSCO will establish and disclose the following privacy policy to protect the personal information of data subjects and handle related problems quickly and efficiently according to Article 30 of the Personal Information Protection Act. POSCO will inform you of what purpose the personal information you provide through the privacy policy is used and what measures are taken to protect personal information.

Consent to personal information collection

POSCO has a procedure for clicking the 「Consent」button or 「Do not consent」button with regard to personal information collection when you make an inquiry on the website for promoting POSCO steel products (product.posco.co.kr). If you click the 「Consent」button, you will be deemed to have consented to personal information collection.

Purpose of collecting and using personal information

The PR website for POSCO steel products will collect only the minimum personal information necessary for using the service during membership signup. Personal information will not be used for any purposes other than the following, and if the purposes of using personal information are to be changed, necessary measures will be taken according to Article 18 of the Personal Information Protection Act, such as obtaining separate consent.

Q&A service

To use the ‘Q&A’ services of POSCO website, you must enter (Country, Name, Email address). Even if you do not enter options (relationship with POSCO, etc.), however, you will not be limited in using the services.
Specific purposes of collecting and using each personal information item are as follows:

• Country, name and e-mail: Used for receiving replies to customer inquiries and self-identification
• Email address: securing efficient communication channels for delivering notices and handling complaints, and providing information on new services and news and event information
• Other options: data necessary for providing personalized services

Accessing/correction of personal information

You may access or correct your registered personal information at any time. If you want to access or correct your personal information, POSCO will immediately take the necessary measures.

If you request the correction of errors in your personal information, the personal information will not be used until the correction is completed. Also, if wrong personal information has already been provided to a third party, the result of correction will be immediately notified to the third party so that it will be corrected.

If the data subject's request for access, correction, deletion or suspension of processing is rejected, the procedure for raising an objection is as follows:

• ①① If the personal information management department delays the handling of the access request, etc. or rejects the request, it will notify a valid reason and the method of raising an objection within 10 days after receiving the request.
• ② The personal information management department will receive the data subject's objection (in writing, by phone and email) and the personal information manager will check the details.
• ③The Chief Privacy Officer will finally review the result.
• ④The personal information management department will notify the result to the data subject.

Withdrawal of consent to personal information collection, use and provision

You may withdraw your consent to personal information collection, use and provision that you gave during the procedure for consenting to personal information collection, etc. at any time. To withdraw your consent, contact the Chief Privacy Officer in writing, by phone or e-mail. POSCO will immediately take necessary measures, such as deleting personal information.

Period of retention and use of personal information period

The retention period for the personal information on the PR website for POSCO steel products is as follows. Membership information will be immediately destroyed upon your request, and even if you do not make a separate request for destruction, your personal information will be destroyed 5 years after replying to your inquiry.

The PR website of POSCO steel products will immediately destroy your personal information beyond recovery (if personal information was provided to a third party, the third party will also be instructed to destroy it). In any of the following events, however, personal information will be retained for the specified period.

• ①If it is necessary to retain personal information according to laws, such as the Commercial Act, the transaction details and the minimum basic information will be retained for the retention period set forth in the laws.
• ②The retention period will be notified to members in advance, and if the retention period has not expired, and if consent was obtained from individual members, personal information will be retained for the promised retention period.

Using personal information for purposes other than the intended ones and providing it to a third party

In principle, the PR website of POSCO steel products will process the personal information of data subjects within the scope specified in the purposes of personal information collection and use, and except for the following events, personal information will not be processed or provided to a third party beyond the original scope of purposes without the prior consent of data subjects.

• ①If separate consent is obtained from data subjects
• ②If the laws have special provisions

Entrustment of personal information management

• ①The PR website of POSCO steel products outsources personal information management for efficient personal information management as follows:

  수탁업체,위탁업무 내용, 개인정보의 보유 및 이용기간 항목으로 구성

  Entrusted vendor	Description of entrusted duties	Personal information retention and use period
  POSCO DX	Service operations	Until withdrawal from membership or the entrustment contract is terminated

  
• ②When the outsourcing contract is concluded, the PR website for POSCO steel products stipulates matters concerning the prohibition of personal information management outside of the purpose of performing outsourced jobs, technical and administrative protection measures, restriction of re-outsourcing, management and supervision of entrusted vendors and responsibility for indemnification for damage in documents, such as the contract, according to Article 25 of the Personal Information Protection Act, and makes sure that the entrusted vendor safely manages personal information.
• ③If the details of entrusted duties or the entrusted vendor is changed, the company will immediately disclose it through this privacy policy.

Technical measures to protect personal information

The PR website for POSCO steel products has the following technical measures in place to ensure safety in processing your personal information so that it is not lost, stolen, leaked, altered or damaged.

• ①YYour personal information is protected by passwords, and important data is protected through a separate security function by encrypting files and transmission data or using a file lock function.
• ②The PR website for POSCO steel products takes measures to prevent damages due to computer viruses by using vaccine programs. Vaccine programs are periodically updated, and if a virus appears suddenly, the company will provide a vaccine as soon as it becomes available to prevent infringement of personal information.
• ③ The PR website for POSCO steel products uses a security device (SSL or SET) that utilizes an encryption algorithm to safely transmit personal information on the network.
• ④To prevent your personal information from being leaked due to hacking, etc., the company is using technology that prevents external intrusions, and installed an intrusion detection system in each server for 24-hour monitoring.

Chief Privacy Officer and collection of feedback/handling complaints

To protect your personal information and handle complaints related to personal information, the PR website for POSCO steel products has a personal information manager who manages your personal information, and operates a window for expressing your opinions and complaints with regard to personal information protection.
If you have any questions or complaints with regard to your personal information, please contact the following personal information managers, and the company will take actions immediately and notify you of the results.

You may contact the following agencies to request or inquire about counseling on the relief of damages in case of personal information infringement.

※ The following agencies are independent from the company. Please contact them if you are not satisfied with the company's handling of your complaints or the result of relief actions, or need help or more detailed information.

Cyber Terror Response Center, Korean National Police Agency

• Website : cyberbureau.police.go.kr
• Phone : (without exchange number) 182

Personal Data Protection Laws in Korea (operated by the Ministry of the Interior and Safety)

• Website : www.spo.go.kr
• Phone : 02-3480-3573

Supreme Prosecutor's Office Public of Korea (Center for Reporting Infringements of Personal Informatio)

• Functions : Accept reports or requests for counseling on infringement of personal information
• Website : privacy.kisa.or.kr
• Phone : (without exchange number) 118

Personal Information Dispute Mediation Committee (operated by Korea Internet and Security Agency)

• Functions : Accept requests for mediation of disputes related to personal information or collective disputes (civil) settlement
• Website : www.kopico.go.kr
• Phone : (without exchange number) 1833-6972

Matters concerning destruction of personal information

If personal information is not necessary anymore because the personal information retention period expired, or the purposes of handling personal information have been accomplished, the company will immediately destroy the personal information. The procedure and method of destroying personal information are as follows:

• Destruction procedure: Unnecessary personal information and personal information files are handled as follows according to internal guidelines.
  • Destruction of personal information: The company will destroy personal information immediately when the retention period expires.
• Destruction method: The company will destroy information in the form of electronic files beyond recovery, and shred or incinerate personal information printed in paper.

Obligation to notify policy changes

This privacy policy was established on April 1, 2019, and if there needs to be any addition/deletion or modification due to changes in laws/policies or security technologies, the company will notify the reason for change and details through the PR website for POSCO steel products at least 10 days before the enforcement of the changed privacy policy.

• Privacy policy version number: v2.0
• Privacy policy enforcement date: April 1, 2019
• Privacy policy's last revision date: October 29, 2020