Pursuant to Article 31 of the 「Credit Information Use and Protection Act」 and Article 27 of the Enforcement Decree of the Act, we disclose the following systems for the utilization of credit information managed by the Company.

Types of Credit Information and Purpose of Use

1. Purpose of Use

1) Internal Business Management such as Credit Management

2) Determining whether to establish and maintain commerce such as financial transactions requested by subjects of relevant credit data

3) In cases prescribed by other laws

2. Types of Credit Information Managed

1) Identification data: Individual's name, address, resident registration number (alien registration number for foreigners, domestic residence report number for overseas Koreans, etc.), trade names of individual companies and corporations, corporate registration number, business registration number, business address, CEO’s name, etc.

2) Credit Transaction Data

• A) Personal Credit Transaction Data: Loans, Debt Guarantees and Credit Card Cash Service Status, Facts of Opening or Closing Household Current Deposit Accounts or Checking Accounts, the Fact of Credit Card Issuance and Termination, Overdue Information, Subrogation/Payment Information, Bills and Checks Default information, etc.
• B) Corporate Credit Transaction Data: Facts of Opening or Closing Household Current Deposit Accounts or Checking Accounts, the Fact of Credit Card Issuance and Termination Loans, Overdue Information, Subrogation/Payment Information, Bills and Checks Default information, Debt Guarantees and Credit Card Cash Service Status, Draft and Check Default Information, Loan/Payment Guarantee, Credit Lending Status, etc.
• C) Information of disrupting the order in credit transactions: The fact that the financial transaction order was disturbed, such as by obtaining loans in an illegal manner.
• D) Creditability information: General information (individual's occupation, total amount of property/debt/income, tax performance, company's status and business content), other financial matters (financial status and financial ratio) and non-financial matters (auditor's opinion and tax performance, etc.)
• E) Public Record Information: Nonpayment of national taxes, local taxes, customs duties, penalties, and unemployment insurance premiums; the fact of being registered as a defaulter by court judgment; clients in process of rehabilitation; clients with credit recovery support, clients who have received immunity decision due to bankruptcy, etc.

Ⅱ. Recipient, the purpose of use of the recipient, and the types of credit information provided

1. Credit Information Recipient

1) Public institutions requiring submission by law

2) Institutions that can be provided by law

2. Recipient’ Purpose of Use

Only for purposes determined by the law

3. Types of Credit Information Provided

Information that can be provided by the provisions of law among identification information, personal credit transaction information, Information of disrupting the order in credit transactions, and credit capacity information

Ⅲ. Retention & Use Period and Credit Information Destruction Procedure & Method

1. Period of Retaining and Using Credit Information: Until the period of retention and provision of customer information is withdrawn or required to stop providing it according to the law

2. Procedures and Methods for Destroying Credit Information: Credit information specified in the form of electronic files is destroyed using technical methods that cannot reproduce records. Personal data recorded and stored on paper documents is destroyed by shredding or incineration.

Ⅳ. Credit Information Processing Consignment and Consignee (not applicable) Ⅴ. The Rights of Credit Information Subjects and How to Exercise Them

1. The Right to Provide/Request Credit Information: A credit information subject may display a certificate showing his or her identification and request to provide or view his/her data.

2. The Right to Request Correction of the Credit Information: A credit information subject may request a correction if his or her credit information is different from the fact.

3. The Right to Notify of the fact that the credit information is provided: A credit information subject may request to notify the details of providing his/her credit information about the past year.

4. The Right to Withdraw from Providing the Personal Credit Information, etc.: If a credit information subject agrees to provide his/her personal data for purposes other than the purpose of evaluating his/her creditworthiness, etc., he/she may withdraw the right to provide personal credit information through visits or in writing.

Ⅵ. Ombudsmen for credit information management and protection

1. Credit Information Controller/Manager: Compliance Officer Young-seok Hong

2. Department of Credit Information Protection: Compliance Team (02-799-2258 ~ 9)

Please note that the e-mail address posted on this website may not be collected by an e-mail collection program or other technical devices, and that the violation is criminally punished by the Information and Communication Act.

Established on August 22, 2014

Chapter 1: General Provisions

Article 1 (Purpose) These guidelines aim to provide the details related to the processing of personal data or information of AK PARTNERS ASSET. Inc. (hereinafter referred to as "company") in accordance with the Personal Information Protection Act, the Enforcement Decree and the Enforcement Regulations of the same Act.

Article 2 (Scope of Application) These guidelines apply to the company's personal data protection and management activities.

Article 3 (Definition of Terms) The definitions of terms used in these guidelines are as follows.

1. “Personal Information or Data” is any information that a living individual can be identified from, such as a person’s name, the person’s resident registration number (social security number) or video footage (including information that the individual can be easily identified by combining with other information, even if that information alone does not identify a specific individual).

2. "Processing" means the collection, creation, recording, storage, retention, processing, editing, search, output, correction, retrieval, use, provision, disclosure, destruction of personal information, and other similar activities.

3. "Data Subject" means any individual who can be identified by the processed data and who is the subject of that data.

4. “Personal Data File” means a collection of personal data arranged or organized systematically according to certain rules so that personal data can be easily retrieved.

5. "Personal Data Processor (Controller)" means a public institution, corporation, organization, or individual that processes personal data on its own or through others in order to operate a personal data file for the purpose of business.

Article 4 (Personal Data Protection Principles)

① The company shall make the personal data processing purposes explicit and specified, and shall collect minimum personal data lawfully and fairly to the extent necessary for such purposes.

② The company shall process personal data compatibly to the extent necessary to attain the personal data processing purposes, and shall not use beyond such purposes.

③ The company shall ensure the personal data accurate, complete and up to date to the extent necessary to attain the personal data processing purposes.

④ The company shall manage personal data in a safe way according to the personal data processing methods, types, etc. in consideration of the possibility that the data subject rights are infringed upon and the degree of such risks.

⑤ The company shall make public its privacy policy and other personal data processing matters, and shall guarantee the data subject rights including the right to access to his/her personal data.

⑥ The company shall process personal data in a manner to minimize the possibility to infringe upon the privacy of data subject.

⑦ The company shall make efforts to process personal data in anonymity, if possible.

⑧ The company shall make efforts to obtain trust of data subjects by observing and carrying out such duties and responsibilities as stated in this Act and other related laws and regulations.

Chapter 2 Security Measures to Project Personal Data

Article 5 (Purpose)

① We shall protect personal data of all employees including executives and other employees of the company by securing the legality of personal data processing and appropriateness of procedures.

Article 6 (Designation of Data Protection Officer)

① The company shall designate the privacy officer who comprehensively takes charge of the personal data processing.

② The data protection officer shall carry out the job in the following Subparagraphs:

• 1. To establish and implement the data protection plan;
• 2. To make regular survey of the actual state and practices of personal data processing, and to improve shortcomings;
• 3. To treat grievances and remedial compensation in relation to personal data processing;
• 4. To set up the internal control system to prevent the leak, or abuse and misuse, of personal data;
• 5. To prepare and implement the data protection education program;
• 6. To protect, and control and manage the personal data files; and
• 7. Other functions for the appropriate processing of personal data.

③ In carrying out the job as stated in each Subparagraph of Paragraph ②, the data protection officer may inspect the personal data status and systems more often than not, if necessary, and request the report thereon from the relevant parties.

④ The data protection officer shall, when he/she gets to know any violation of this Act and other relevant laws and regulations in relation to data protection, take immediately corrective measures, and shall, if necessary, report such corrective measures to the head of institution itself or relevant organizations.

⑤ The personal data processor or controller shall not have the data protection officer give or take disadvantage without any justifiable ground while conducting the job as stated in the Subparagraphs of Paragraph (2).

Article 7 (Measures to Ensure the Safety of Personal Data or Data) The Company shall take technical, physical, and managerial safeguards to prevent personal data or data from being lost, stolen, leaked, altered or damaged.

1. Technical or Technological Protection Measures

• A. Approval of the data protection officer for the management of access rights and restrictions, and verifying access rights.
• B. Measures such as the installation of a system to block unauthorized access
• C. Measures such as encryption for safe storage and transmission of personal data
• D. Measures to prevent storing, counterfeiting and tampering of access records
• E. Measures such as installation of security programs and periodic updates and checks

2. Physical Protection Measures

• A. Access control locks, etc.

3. Managerial Protection Measures

• A. Establishing and implementing internal management plans
• B. Training of personal data handling staff
• C. Implementing regular compliance in-house audits

Article 8 (Establishment and Disclosure of Personal Data Processing Guidelines)

① The company shall define the guidelines for processing personal data (hereinafter referred to as “personal data processing guidelines”) including the following guidelines in each subparagraph.

• 1. The purposes for which personal data is processed;
• 2. The period for processing and retaining personal data;
• 3. Provision of personal data to a third party;
• 4. Outsourcing of personal data processing;
• 5. The rights and obligations of personal data subjects and legal representatives, and how to exercise the rights;
• 6. Items of personal data processed
• 7. Matters concerning the destruction of personal data
• 8. Other matters concerning the processing of personal data

② When the personal data processor establishes or changes the personal data processing guidelines, it must be made public through the first screen of the Internet website or the connection screen with the first screen for the data subjects to be able to check it easily.

Chapter 3 Processing of Personal Data

Section 1 Collection, Use, Provision, etc. of Personal Data

Article 9 (Collection and Use of Personal Data)

① The company may collect personal data in any of the following circumstances, and use it with the scope of the purpose of collection:

• 1. Where the consent is obtained from a data subject;
• 2. Where special provisions exist in laws or it is inevitable to observe legal obligations;
• 3. Where it is inevitably necessary to execute and perform a contract with a data subject;
• 4. Where it deems necessary explicitly for the protection, from impending danger, of life, body or economic profits of a data subject or a third party in case that the data subject or his/her legal representative is not in a position to express intention, or prior consent cannot be obtained owing to unknown addresses;
• 5. Where it is necessary to attain the justifiable interest of a personal information controller, which is explicitly superior to that of a data subject. In this case, it is allowed only when substantial relation exists with the justifiable interest of the personal information controller and it does not go beyond the reasonable scope.

② The company shall inform a data subject of the following matters when it obtains the consent under paragraph (1) 1. The same shall apply when any of the following is modified.

• 1. The purpose of the collection and use of personal information;
• 2. Particulars of personal information to be collected;
• 3. The period for retaining and using personal information;
• 4. The fact that the data subject is entitled to deny consent, and disadvantage affected resultantly from the denial of consent.

Article 10 (Provision of Personal Data to a Third Party)

① The company may provide (or share; hereinafter the same shall apply) the personal data of a data subject to a third party in any of the following circumstances:

• 1. Where the consent is obtained from the data subject;
• 2. Where the personal data is provided within the scope of purposes for which it is collected pursuant to Article 9 (1) 2, 3, and 5.

Article 11 (Limitation to Out-of-Purpose Use and Provision of Personal Data) When the Company uses personal data for out-of-purpose use or provides it to a third party, the company shall inform the following matters and obtain consent from the data subject. In the event that any of the following changes are made, it must be informed and agreed.

• 1. The recipient of personal data;
• 2. The purpose of use of personal data (in the case of provision of personal data, it means the purpose of use by the recipient);
• 3. Particulars of personal data to be used or provided;
• 4. The period for retaining and using personal data (in the case of provision of personal data, it means the period for retention and use by the recipient);
• 5. The fact that the data subject is entitled to deny consent, and disadvantage affected resultantly from the denial of consent.

Article 12 (Destruction of Personal Data)

① The company shall destroy personal data without delay when the personal data becomes unnecessary owing to the expiry of the retention period, attainment of the purpose of processing the personal data, etc.: Provided, That this shall not apply where the retention of such personal data is mandatory by other statutes.

② When a personal information processor destroys personal data pursuant to paragraph (1), necessary measures to block recovery and revival shall be taken.

③ Where a personal data processor is obliged to retain, rather than destroy, personal data pursuant to the provision to paragraph (1), the relevant personal information or personal information files shall be stored and managed separately from other personal data.

Article 13 (Methods of Obtaining Consent) When the company obtains the consent of the data subject for the processing of personal data, the company distinguishes each agreement, informs the data subject so that it can be clearly recognized and obtains the consent of the data subject by any of the following methods:

• 1. To issue a document stating the matters requiring consent, either in person or by mail or facsimile, to the data subject, and obtain a written consent on which the data subject has affixed his/her signature or seal;
• 2. To inform the data subject of the matters requiring consent, and confirm his/her intent of consent by telephone;
• 3. To inform the data subject of the matters requiring consent by telephone, let the data subject to confirm the matters requiring his/her consent posted on the designated website, etc.; and reconfirm his/her intent of consent by telephone;
• 4. To post the matters requiring consent on the designated website, etc., and let the data subject to express his/her consent to it;
• 5. To send an electronic mail containing the matters requiring consent to the data subject, and receive the return e-mail with his/her consent to it;
• 6. Other methods to inform the data subject of the matters requiring consent by a method similar to those referred to in subparagraphs 1 through 5, and confirm his/her intent of consent.

Section 2 Restriction on Processing of Personal Data

Article 14 ((Limitation to Processing of Sensitive Data) A personal information processor shall not process any data or information, including ideology, belief, admission to or withdrawal from a trade union or political party, political opinions, health, sexual life, and other personal data that is likely to threat the privacy of any data subject noticeably: Provided, That this shall not apply in any of the following circumstances:

• 1. Where the personal information processor informs the data subject of the matters provided for in Article 9 (2), and obtains the consent of the data subject apart from the consent to the processing of other personal data;
• 2. Where other statutes require or permit the processing of sensitive data.

Article 15 (Limitation to Installation and Operation of Visual Data Processing Devices)

① The company shall not install or operate any visual data processing device at open places, except in any of the following circumstances:

• 1. Where statutes allow it in a concrete manner;
• 2. Where it is necessary for the safety of facilities and prevention of fire;

② When the visual data processing devices are installed and operated pursuant to Paragraph 1, the company shall take necessary measures including posting on a signboard with the following matters, so that data subjects may recognize such devices with ease.

• 1. The purpose and place of installation;
• 2. The scope and hours of photographing;
• 3. The name and contact information of the person in charge of its management.

Article 16 (Limitation to Personal Data Processing Subsequent to Consignment of Work)

① The company shall undergo paper-based formalities stating the following when it consigns processing of personal data to a third party:

• 1. Prevention of personal data processing for other purposes than the consigned purpose;
• 2. Technical and managerial safeguards of personal data;
• 3. The purpose and scope of consigned work;
• 4. Matters regarding the limitation to reconsignment;
• 5. Matters regarding the measures to ensure safety, including limitation to access to personal data;
• 6. Matters regarding the inspection of the status of personal data management and the training of the consignee’s staff
• 7. Matters regarding damage liability in case of breach of contractual obligations on the part of the consignee

② When the processing of personal data is consigned pursuant to Paragraph 1, the Company shall disclose what has been consigned and who carries out the consigned processing of personal data by posting it on its website so that data subjects may recognize it easily at any time or other similar methods.

③ The company shall train the consignee so that personal data of the data subjects may not be lost, stolen, leaked, altered or damaged owing to the consignment of work, and supervise how the consignee processes such personal data in a safe manner by inspecting the status of consigned work of processing.

Article 17 (Data Breach Notification, etc.)

① ① The company shall notify the aggrieved data subjects without delay of the fact in the following Subparagraphs when it becomes to know that personal information is leaked:

• 1. What kind of personal information was leaked;
• 2. When and how personal information was leaked;
• 3. Any information how data subject can do to minimize probable damage suffered from personal information leakage;
• 4. Countermeasures of the personal information processor and remedial procedure; and
• 5. Help desk of the personal information processor and contact points for data subjects to report sufferings.

② The company shall prepare countermeasures to minimize the damage in case of personal information leakage, and take necessary measures.

Chapter 4. Guarantee of the Rights of Data Subject

Article 18 (Access to Personal Data)

① The data subject may demand access, correction or deletion of his/her own personal data, which is processed by the company. However, if the personal data is specified for collection in other legislation, the deletion cannot be requested.

② Upon receiving the access demand from the data subject pursuant to Paragraph (1), the company shall, without delay, allow the relevant data within the period provided by laws unless there is a good reason.

③ In case where any of the following Subparagraphs is applicable, the company may restrict or deny access after it notifies data subjects of the reason:

• 1. Where access is prohibited or restricted by law
• 2. Where access may probably cause damage to the life or body of others, or improper violation of properties and other benefits of others

Article 19 ( Miscellaneous Provisions)

ADDENDA

Article 1 (Enforcement Date) This rule shall enter into force on August 22, 2014. However, until the enforcement of these guidelines, it will be replaced by the Personal Information Protection Act.