Samsung SDS Privacy Policy

1. What and How Personal Information is Collected

Information We Collect

The Company collects the following personal information for administrative purposes. This includes inquiries related to the Company, inquiries related to services/products, investment inquiries, job-related inquiries, website-related inquiries, reports on wrongful practices, and security reports.

Inquiries

- Required Information
  : Name, company name, e-mail, contact information
- Refusal of Consent and Disadvantages
  : You have the right to refuse your consent for any data collection of information.
    However, your refusal will restrict our ability to answer your inquiries.

Reporting Wrongful Practices

- Required Information : Not applicable
- Optional : Name, contact information, e-mail
- Refusal of Consent and Disadvantages
  : You have the right to refuse to have your personal information collected. You will still can report security violations anonymously.

Security Report Center (Reporting)

- Required Information : Not applicable
- Optional : Name, contact information, e-mail
- Refusal of Consent and Disadvantages
  : You have the right to refuse to have your personal information collected. You will still can report security violations anonymously.
     However, if you refuse to provide your personal information, your report may not be processed in a timely manner.

How We Collect Information

The Company collects personal information through the following means
- “Inquiries,” “Reporting Wrongful Practice s,” and “Security Report Center” menus on its website.

The Purpose for Collecting and Using Personal Information

2. For What Purpose We Collect and Use Personal Information

To respond to and manage customer inquiries, reports on wrongful practices, and security reports
- The company is also able to provide feedback on and manage company-related inquiries.
These inquiries include, services/products, investment inquiries, job-related inquiries, website-related inquiries, reports on wrongful practices, and security reports.

3. Sharing and Provision of Collected Personal Information

In principle, the Company does not disclose any of the personal information collected; however, the following are exceptions
- If the user has given consent to disclose information in advance; or
- If the disclosure is required by law or requested by a law enforcement agency for investigative purposes in accordance with legal or criminal activities.

4. Use of Third Party for Handling of Personal Information

In principle, the Company does not use a third party to handle any of our users’ personal information; however, the following are exceptions:
- If the user has given consent to disclose information in advance; or
- If the disclosure is required by law or requested by a law enforcement agency for investigative purposes in accordance with legal or criminal activities

5. Retention Period of Personal Information

The Company disposes of personal information as soon as it is no longer required to fulfill the purposes of collecting and using the information.

6. Procedure and Methods for the Disposal of Personal Information

Upon fulfilling the purposes of collecting and using personal information, the Company immediately disposes the information.
The following describes the procedure and methods for disposal

Disposal Procedure

- The information customers provided will be stored for a certain period of time and then disposed of as soon as the purposes of collecting the information are fulfilled, under the Company’s policy (see Retention Period of Personal Information).
- he said information will not be used for purposes other than retention unless required by law.

Disposal Method

- The personal information printed in paper will be destroyed by either shredded or burned.
- The personal information stored in electronic files will be deleted using the technical methods that prevents the retrieval of records from replaying.

7. Measures to Ensure the Security of Personal Information

The Company takes the following technical, administrative, and physical measures needed to ensure security:

Establishment and Execution of Internal Management Plan

- The Company establishes an internal management plan and executes it to protect personal information. Reducing and Training Personal for the Handling of Information - The Company appoints and reduces the number of employees who handle personal information, and implements measures to manage personal information more efficiently.

Restrictions on Access to Personal Information

- The Company takes the necessary steps to monitor access to personal information. This is done by granting, changing, and removing the access to database systems where personal information is handled. The Company also deploys and uses an intrusion prevention system to control unauthorized access.

Keeping Access Records and Preventing Tampering

- The Company retains records of access to the personal information handling system (e.g. web log and summary data) for at least 6 months and uses security features to prevent tampering, theft and any loss of access records

Technical Measures against Hackers

- To prevent the loss, destruction of, or damage to personal data caused by hackers or computer viruses, the Company has installed security software that has regular updates and monitoring.
In addition, the Company has also installed a system in off-limits areas for technical/physical monitoring and blocking. Furthermore, the Company also provides network traffic monitoring and the detection of any attempts to, for example, make illegal changes to information.

Unauthorized Access Monitoring

- To prevent the loss, destruction of or damage to personal data caused by hacking or computer viruses, the Company has installed security software and implements regular updates and monitoring. In addition, the Company has also installed a system in off-limits areas for technical/physical monitoring and blocking. Furthermore, the Company also provides network traffic monitoring and the detection of any attempts to, for example, make illegal changes to information.

8. User’s or Legal Representative’s Rights and How to Exercise Them

Users and their legal representatives can access or edit their personal information provided to the Company anytime they want. Once a request to access, edit or delete personal information is made to the Privacy Officer by phone or by e-mail, the officer will immediately confirm the requester’s identity and take appropriate action.

If the user request has made an error in personal information that wants to be modified, the information will not be used or provided until the modification has been completed. In addition, if false personal information has been already provided to a third party, the Company will immediately notify the third party, so that corrections can be immediately made. Personal information that is cancelled or deleted, from the request of the user or their legal representative, will be handled and described as “Retention Period of Personal Information”. This information will not be accessed or used for any other purpose.

9. Installation and Operation, or Refusal to Install or Operate, the Means of Automatically Collecting Personal Information

The Company does not use any means of collecting the personal information created when cookies or other internet services are used.

10. Chief Privacy Officer and Department

The Company appoints the following department and officers to protect personal information and handles complaints relating to personal information.

Chief Information Security Officer

- Name : Vice President Chung Seok-Mog

Chief Privacy Officer

- Name : Group Leader Yoon Gi-Wone
- Telephone : 82-2-6155-6203
- E-mail : gw_yoon@samsung.com

Privacy Officer

- Name : Senior Specialist Moon Sea-Sun
- Telephone : 82-2-6155-1034
- E-mail : seasun.moon@samsung.com

Users can file complaints related to privacy and security issues that may arise from their use of the Company’s services to the Chief Privacy Officer or the responsible department. The Company will promptly provide satisfactory answers to users’ complaints. If you need to report any privacy infringement or need additional counseling, please contact the following:
- Privacy Infringement Report Center (www.118.or.kr/118)
- Privacy Mark Certification Committee (www.eprivacy.or.kr/02-580-0533~4)
- High-tech Crime Investigation Division of Supreme Prosecutor’s Office (http://www.spo.go.kr/02-3480-2000)
- Cyber Terror Response Center of Korea National Police Agency (www.netan.go.kr/1566-0112)

11. Duty to Notify

If the Company makes any additions, deletions, or changes to the present Privacy Policy, it will notify through “Notices” on its website at least seven (7) days prior to such changes.

Privacy Policy Version: V.1.6
Privacy Policy Effective Date: October 1, 2012
Latest Update to Privacy Policy: October 15, 2014