Privacy and Information Handling Policy

1. Doosan Engineering & Construction (“Doosan E&C”) greatly values users’ personal information, and complies with the Act on Information Communications Network Use Promotion and Information Protection. We inform you about how and for what purpose users’ personal information is used, and what actions are taken for the privacy protection of the users. In the event that any of the provisions of the Privacy and Information Handling Policy are amended or updated, we will publicly notify you of such amendments or updates through this Website or individually. The following Privacy and Information Handling Policy applies to this Website(www.doosanenc.com).

2. 01. Collection of Personal Information and Its Purpose

   The company, unless authorized by law or the individual’s consent is provided, does not collect sensitive personal information that can invade the privacy of the individual or personally identifiable information that identifies a specific individual.

   A. Information to be Collected
   • Name, home address, contact number, email, company name, service usage records, log information, cookies, IP address
   B. Collection Purpose
   • To support customer service, such as customer inquiries and complaints
   • A/S related issues after moving in
3. 02. Retention and Destruction of Personal Information

   In principle, once the purpose for which an individual’s personal information was collected and used is no longer being served, the personal information is destroyed immediately. Except, the following information may be retained for the period specified, when necessary, with the consent of the individual.

   A. Retention and Usage Period
   • Information to be Retained: Name, home address, email, company name
   • Retention Period: Up to one year
   • Retention Purpose: To manage user inquiries and requests, identify users, etc.
   • Information to be Retained: Service usage records, log information, cookies, IP address
   • Retention Period: Up to three years
   • Retention Purpose: To improve service quality by analyzing service usage by users

   The destruction procedure and method are as follows.

   B. Destruction Method
   • Personal information stored in a digital file format is technically deleted so that it cannot be recovered.
   • Personal information on paper is shredded or incinerated.
4. 03. Refusal of Consent to Release Personal Information

   You have the right to refuse to consent to the collection and usage of your personal information.
   
   Except, when you refuse to consent to the collection and usage of your personal information, your request may be rejected because we cannot collect or use your personal information.

5. 04. Installation, Operation, and Refusal of Automatic Personal Information Collection System

   The company uses cookies that frequently save and retrieve your information. Cookies are very small text files sent by the server, which is used to operate the company’s website, to your browser and saved on your system’s hard drive. The company uses cookies for the following purposes:

   • To identify users’ preferences and interests and track digital footprints by analyzing connection frequencies, visit time, etc.

   You may choose not to install cookies.
   
   As such, you may configure your browser’s cookie settings to enable all, confirm every time, or disable all cookies.
   Cookie Settings (e.g. Internet Explorer): Tools on the top of a browser > Internet Options > Privacy
   Please note that disabling cookies might block some services.

6. 05. Disclosure of Personal Information to a Third Party

   Doosan E&C will collect personal information within the scope of the purpose of the collection, and will not use your personal information beyond the scope of collection purpose or offer or disclose it to a third party. However, the following are the exception to the above rule:

   • Consent was received from the person who provided his or her own personal information.
   • According to specific provisions in other relevant laws.
   • The person providing their own personal information or his/her legal representative is in a state in which an opinion/intention cannot be expressed, or prior consent cannot be gained due to an invalid address, but disclosure to a third party is urgently needed for the sake of the data provider or a third party’s life, body, and property.
   • Necessary for statistical purposes and academic studies, where personal information is provided in a way as not to identify a specific individual.
7. 06. Outsourcing the Processing of Personal Information

   In the case that the company outsources the processing of personal information to a third party specializing in information processing, the consent of the individual whose information is being provided is required in accordance with the law. The company shall disclose the name of the outsourcing company and information to be outsourced.

8. 07. Rights and Obligations of the Person Providing Their Own Personal Information and Method to Exercise the Rights

   All the persons providing their personal information may request for the inspection, revision, deletion, and cessation of the processing of their personal information. However, Doosan E&C may reject or restrict such a request in the following cases:

   • When specifically required under the law or to comply with obligations under laws and regulations.
   • When there is a concern for harm to another person’s life or body, or when there is a concern of unlawfully infringing upon another person’s property and profits.
   • In a case where the service contracted with the personal information provider cannot be offered without processing his or her personal information, or when it is difficult to perform the service contracted with the personal information provider, but her or she does not clearly express his/her intention to terminate the contract.

   [Method and Procedure to Exercise Rights]

   • A person wanting to exercise the above rights regarding their personal information may complete the Read/Inspect, Revise, Delete, and Suspend the Processing Form and sent it by email or fax to the department in charge of personal information. (See “09. Customer Request Service on Personal Information” concerning the department)
   • Unless there is a legitimate reason, Doosan E&C will take a proper action within 10 days of receiving such a request. When there is a reason to reject or restrict the request, we will inform you of the reason and a method to appeal the decision within 5 days upon receiving the request.
   • When the concerned person or legal representative makes a request as above, we can confirm the identity of the person or legal representatives by checking their identification cards such as a resident registration card or a recognized electronic signature.
9. 08. Technical, Administrative, and Physical Protection Measures for Personal Information

   Doosan E&C takes the following safeguards in handling personal information so that it will not be lost, stolen, leaked, modified, or damaged:

   [Technical actions]

   • Doosan E&C complies with the criteria set forth by laws and regulations for the safe storage and transmission of personal information.
   • We protect against computer virus by using a vaccine program. The vaccine program is periodically updated, but if there is a sudden emergence of a new virus, we will implement the appropriate vaccine as soon as it becomes available so that personal information infringement can be prevented.
   • To deal with outside infiltration, including hacking, we use an infiltration interruption system and a weakness analysis system.

   [Administrative actions]

   • Doosan E&C restricts the rights to access personal information to the following cases: a person carrying out sales and marketing activity involving the personal information provider, a person engaging in personal information management, and a person whose task requires the use of personal information.
   • We conduct regular in-house training and external commissioned training for those employees that handle personal information, and we thoroughly manage and supervise them to comply with the laws and regulations regarding personal information protection.

   [Physical actions]

   • To protect personal information, we limit physical access to the information through the use of locks and similar devices.
   • We control access to the computer room and archives by designating and operating them as specially protected areas.
10. 09. Customer Request Service for Personal Information

    Doosan E&C has appointed the following department and personal information protection administrator to protect personal information and to process complaints related to personal information:

    A. Department in Charge of Personal Information
    • Department : IT Planning Team
    • Tel : +82 02-510-3262
    • Fax : +82 02-510-3598
    • Email: dsenc.prv@doosanenc.co.kr
    • Business hours : Mon-Fri. 09:00–18:00 (closed on Saturday and Sundays)
    B. Personal information Protection Administrator
    • Name : SANGSEON KIM
    • Tel : +82 02-510-3262
    • Email : dsenc.prv@doosanenc.co.kr
    • Personal Information Infringement Reporting Center : +82 118 (http://privacy.kisa.or.kr)
    • Personal Information Dispute Mediation Committee : +82 1833-6972 (http://www.kopico.go.kr)
    • Korea Online Privacy Association : +82 02-550-9531 (http://www.eprivacy.or.kr)
    • Supreme Prosecutors’ Office Cybercrime Investigation Department : +82 1301 (http://www.spo.go.kr)
    • National Police Agency Cyber Crime Reporting System : +82 1566-0112 (http://ecrm.police.go.kr)
11. 10. Obligation of Public Notification

    When the current Privacy and information Processing Policy is amended or deleted, we will provide notice on our Website 10 days before such amendment or deletion takes place.
    
    Date of Public Notification : January 2, 2024 (Version 3.1)
    Date of Enforcement : January 2, 2024 (Version 3.1)