Article 1 [Purpose of Collection and Use of Personal Information]

• The "Company" shall not use the User's personal information and personal location information beyond the scope notified in this Article, except with the User's consent or as prescribed by laws and regulations. The purposes of using the collected personal information and personal location information (hereinafter referred to as "Personal Information, etc.") are as follows:

1. Conclusion, Maintenance, Fulfillment, Management, and Improvement of Contracts
2. Member Management: Identity verification for the use of membership services, personal identification, prevention of unauthorized and fraudulent use by malicious members, confirmation of intent to subscribe, subscription restrictions, subsequent identity verification of legal representatives, record retention for dispute resolution, age verification, handling of complaints and civil petitions, and delivery of updated information such as notices.
3. Fulfillment of Contracts Regarding Service Provision: Matters necessary for providing various services, such as purchasing mobility products and providing content.
4. Daedong e-Mobility Service: Service improvement and new content development, extraction of statistics on service use, tracking of mobility mileage/usage history and remote control, emergency rescue, management of consumables and failure history, BSS (Battery Swapping Station) information, delivery of informational notices for service purposes such as battery charging, and other matters necessary for service operation.
5. Daedong Mobility Vehicle Fleet Management System (FMS) Service: Control services for Daedong Mobility product lines (dashboard, vehicle management, workplace management, member management, statistics on service use, etc.) and delivery of informational notices for service purposes.
6. Collection and Use for Cause Determination and Resolution in the Event of Accidents
7. ※ Only in cases where separate consent has been obtained from the member, the information may be used for improving promotional information (events, promotions, etc.), satisfaction surveys, providing tailored services and advertisements for Daedong e-Mobility products, identifying access frequency, or extracting statistics regarding the user's service utilization.

Article 2 [Items of Personal Information Collected]

1. The items of Personal Information, etc., collected by the "Company" for the User to utilize the services are as follows.
   The "Company" categorizes and collects/uses personal information by dividing it into 'Required Items' necessary for service provision and 'Optional Items' to provide better services to customers.

   Service Category	Collected Information
   Daedong e-Mobility Service	■ [Required Items] • Subscriber Information: Name, mobile phone number, date of birth, email, gender, ID, password ■ [Optional Items] • When using paid services: Payment records including card issuer name, card number, card expiration date, first 2 digits of the password (collected in encrypted form), mobile phone number and telecommunications carrier information, bank name, and account information.
   Daedong Mobility Vehicle Fleet Management System (FMS) Service	■ [Required Items] • Subscriber Information: Name, mobile phone number, address (home or workplace), email, ID, password, business name, business registration certificate, address ■ [Optional Items] • When using paid services: Payment records including card issuer name, card number, card expiration date, first 2 digits of the password (collected in encrypted form), mobile phone number and telecommunications carrier information, bank name, and account information.

2. Information directly entered by the user in forms when applying for or using other supplementary services may be collected after separate notification and consent.
3. Additionally, the following information may be additionally collected during the course of service utilization or business processing:
   1. When using wireline or online consultation services: Consultation history (service usage history, recorded audio of wireline/online consultations, etc.)
   2. When using websites and mobile services: Access device and environmental information (IP Address, cookies, date and time of visit, device information, etc.)
4. In the event of an accident, the "Company" may capture and record driving videos of the mobility product (including when stationary) through sensor devices attached inside the product to determine the cause of the accident and ensure swift handling.

Article 3 [Method of Collecting Personal Information, etc.]

The "Company" collects Personal Information, etc., through the following methods:

1. Obtaining the member's consent during the process of membership registration and service use through the member's website or mobile services.
2. Obtaining the member's consent during the process of using wireline or online consultation services.
3. Obtaining the member's consent during the process of entering event giveaways or requesting deliveries.
4. Automated collection through generated information collection tools within the scope of the member's consent.

Article 4 [Retention and Use Period of Personal Information, etc.]

The "Company" may retain and use the collected Personal Information, etc., while the user maintains membership status. If the user withdraws or loses eligibility, the collected personal information will be deleted and destroyed even without a separate request from the user. However, notwithstanding the user's withdrawal or loss of eligibility, the retention period may vary in accordance with [Company Internal Policies] and [Relevant Laws and Regulations].

• [Information Retention Based on "Company" Internal Policies]
  1. Registration authentication information of restricted members and fraudulent users: 1 year after termination of service use to prevent unauthorized re-registration of withdrawn members and related disputes (unless otherwise specified by relevant laws and regulations, in which case such period shall apply).
  2. Member information records for restricting re-registration of withdrawn members: 3 months.
  3. Mobility usage history information and personal location information: Until the purpose of collection and use is achieved or until consent is withdrawn.
  4. In cases where fee payment and settlement are incomplete: Until the completion of payment and settlement.
  5. In cases where disputes such as customer complaints, civil petitions, or lawsuits are ongoing or anticipated: Until the completion of handling.

• [Information Retention Based on Relevant Laws and Regulations]
  1. Records on transactions, such as contract details and performance, pursuant to the 「Act on the Consumer Protection in Electronic Commerce」
     1. Records on contract or subscription withdrawal, etc.: 5 years
     2. Records on payment and supply of goods, etc.: 5 years
     3. Records on consumer complaints or dispute resolution: 3 years
     4. Records on labeling and advertising: 6 months
  2. Information related to commercial books, important documents, and slips concerning the business of the company under the 「Commercial Act」
     1. Commercial books and important documents concerning business: 10 years
     2. Slips or similar documents: 5 years
  3. Information related to books and evidential documents for all transactions under the 「Framework Act on National Taxes」 and the 「Corporate Tax Act」
     1. 5 years from the day following the statutory filing deadline for the national tax for the taxable period to which the transaction facts belong.
     2. Books and tax invoices or receipts issued under the 「Value Added Tax Act」: 5 years
  4. Communications confirmation data under the 「Protection of Communications Secrets Act」: 3 months
  5. Member's service access date and time, prime mover start and end times, frequency of use, and location tracking data of the base station that detected access information: 1 year
  6. Login records, tracking data of the access point capable of verifying the location of the mobile phone used by the member to access the service: 3 months

Article 5 [Right to Refuse Consent and Disadvantages of Refusal]

Users have the right to refuse consent to the collection and use of Personal Information, etc. However, if a user refuses consent to the collection and use of personal information essential for contract conclusion, etc., the service cannot be provided (due to unverified identity and intent to conclude the contract).
If a user refuses consent to the collection, use, or optional collection/use of personal information for marketing and promotional activities, they may not receive information on events and benefits, or may be restricted from receiving giveaways, promotional materials, and using affiliate services.

Article 6 [Procedures and Methods for Destruction of Personal Information, etc.]

• In principle, the "Company" destroys the relevant information without delay after the purposes of collection and use of Personal Information, etc., have been achieved. However, when personal information must be preserved in accordance with relevant laws and regulations, it shall be destroyed in an irreversible manner without delay after the expiration of the corresponding period. The "Company's" procedures and methods for destroying personal information are as follows:
  1. Destruction Procedure: Information entered by users is transferred to a separate database (a separate filing cabinet in the case of paper) after the purpose of collection and use has been achieved, and is stored for a certain period or destroyed immediately in accordance with internal regulations and other relevant laws. At this time, the personal information transferred to the database will not be used for any other purpose unless permitted by law.
  2. Destruction Deadline: If the retention period of personal information has expired, it shall be destroyed within 5 business days from the expiration date. When the personal information becomes unnecessary due to the achievement of the processing purpose, discontinuation of the service, or termination of the business, it shall be destroyed within 5 business days from the date it is deemed unnecessary.
  3. Destruction Method: Information in the form of electronic files is destroyed using technical methods that prevent recovery and regeneration, such as low-level formatting or wiping methods. Personal information printed on paper is destroyed by shredding with a shredder or through incineration.

Article 7 [Matters Concerning the Refusal of Automatically Collected Personal Information, etc.]

The company installs and operates cookies to provide customized services to members. The purposes of using cookies and matters concerning their refusal are as follows:

1. What is a Cookie?: A cookie is a very small text file sent to the member's browser by the server used to operate the website, and it is stored and operated on the member's computer or mobile phone.
2. Purpose of Using Cookies: Cookies are used to provide optimized, customized services by identifying members' access management, providing user environments for each member, understanding member activity information, and checking event and promotion statistics.
3. Installation, Operation, and Refusal of Cookies: Members have the right to choose whether to install cookies when using the facilities. Members can allow all cookies, go through verification each time a cookie is saved, or refuse to save all cookies by configuring options in their web browser. However, if cookie installation is refused, there may be difficulties in using some services that require login. The methods for specifying whether to allow cookie installation are as follows:
   1. Internet Explorer: Web browser > Top right menu [Settings] > [Internet Options] > [Privacy] > [Advanced] > Configure [First-party Cookies]
   2. Chrome: Web browser > Top right menu [Settings] > [Privacy and Security] > [Site Settings] > Configure [Third-party Cookies]
   3. Safari: Web browser > [Settings] > [Safari] > [Block All Cookies] > Configure

Article 8 [Rights of Users and Methods of Exercise]

1. Users may view or modify their registered personal information at any time. If they do not agree with the "Company's" processing of Personal Information, etc., they may refuse consent or request cancellation of subscription (membership withdrawal).
2. If a user requests correction of errors in Personal Information, etc., the "Company" will not use or provide the relevant personal information until the correction is completed. Furthermore, if incorrect personal information has already been provided to a third party, the result of the correction will be notified to the third party without delay to ensure that the correction is made.
3. The "Company" processes personal information that has been terminated or deleted at the user's request in accordance with Article 6, ensuring that it cannot be viewed or used for any other purposes.

Article 9 [Processing of Personal Location Information]

The "Company" manages the member's personal location information in accordance with the 「Act on the Protection and Use of Location Information」 as follows:

1. Purpose of Processing and Retention Period of Personal Location Information: The company collects, uses, and provides personal location information within the scope of purposes set forth in the Location Information Terms and Conditions, and retains it for a maximum of 3 months to fulfill services and respond to customer complaints.
2. Grounds for Retention and Retention Period of Evidentiary Data on the Collection, Use, and Provision of Personal Location Information: The company automatically records and preserves evidentiary data confirming the collection, use, and provision of personal location information pursuant to Article 16, Paragraph 2 of the 「Act on the Protection and Use of Location Information」, and retains the data for 6 months.
3. Procedures and Methods for Destruction of Personal Location Information: When the processing purpose is achieved, such as membership withdrawal, or when the retention period expires, the company destroys it without delay using a method that cannot be recovered or regenerated. The destruction procedure and method follow those notified in Article 5.
4. Matters Concerning Third-Party Provision and Notification of Personal Location Information: The company does not provide location information externally without the prior consent of the personal location information subject. However, personal location information is provided only when the subject directly consents, when an obligation to submit to relevant institutions arises under relevant laws and regulations, or when an urgent danger to the life or safety of the user is confirmed and it is necessary to resolve it. When providing personal location information to a third party designated by the user, the company immediately notifies the user of the recipient, date/time, and purpose of provision via email or pop-up notification.
5. Rights and Obligations of Persons Responsible for Protection and Methods of Exercise: The company deems that consent has been given by the subject themselves if a person responsible for protection (hereinafter referred to as "Person Responsible for Protection") under Article 26, Paragraph 2 of the 「Act on the Protection and Use of Location Information」 consents to the use or provision of personal location information for the protection of life or body of those falling under the following categories (hereinafter referred to as "Children under 8, etc."):
   1. Children aged 8 or under
   2. Wards under adult guardianship
6. Persons with mental disabilities under Article 2, Paragraph 2, Subparagraph 2 of the 「Act on Welfare of Persons with Disabilities」 who qualify as severely disabled under Article 2, Subparagraph 2 of the 「Act on Employment Promotion and Vocational Rehabilitation for Persons with Disabilities」 (limited to those registered as disabled under Article 32 of the 「Act on Welfare of Persons with Disabilities」).
   A Person Responsible for Protection who wishes to consent to the use or provision of personal location information for the protection of the life or body of Children under 8, etc., must submit a written consent form to the company along with a document proving their status as a Person Responsible for Protection. When consenting, the Person Responsible for Protection possesses all the rights of the user under the Location Information Terms and Conditions.

Article 10 [Third-Party Provision of Collected Personal Information, etc.]

1. The "Company" uses the member's personal information collected with prior consent within the scope notified in Article 1 and provides it to third parties (specific details are as described in Paragraph 4). It will not use it beyond the scope of consent or provide it to third parties without the user's prior consent. However, exceptions are made in the following cases:
   1. When the user has consented to third-party provision in advance.
   2. When requested by investigative agencies or supervisory authorities in accordance with procedures and methods prescribed by laws and regulations for the purpose of investigation or inquiry.
   3. When provided in a form that renders specific individuals unidentifiable, as necessary for statistical compilation, academic research, or market research.
2. In other cases where the provision of Personal Information, etc., to a third party is required to provide better services, the "Company" will seek the user's consent in advance by specifying the recipient, the recipient's purpose of use, the items to be provided, the recipient's retention and use period, the right to refuse consent, and the disadvantages resulting from refusal.
3. Even if the third party receiving the personal information achieves the purpose of provision or the user requests withdrawal, information necessary for internal reporting, audits, examinations, and preparation for disputes may be retained and used until the completion of performance or dispute resolution if non-performance or disputes continue. It can also be stored if there are special provisions in relevant laws such as the Commercial Act.
4. The company currently does not provide personal information to third parties.
5. When the company provides Personal Information, etc., to a third party, the user has the right to refuse consent. However, if a user refuses consent to the provision of the minimum personal information necessary for contract conclusion, etc., disadvantages such as service unavailability or delays in mobility accident processing operations may occur.

Article 11 [Entrustment of Personal Information Processing]

1. The "Company" entrusts some of the operations essential for service provision to external companies. To ensure that the entrusted company (trustee) handles personal information safely in accordance with the Personal Information Protection Act, the company defines matters concerning responsibilities—such as the prohibition of processing personal information for purposes other than the execution of entrusted operations, technical and managerial protective measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages—through the "Personal Information Processing Entrustment Agreement."
2. If the entrustment of personal information processing is necessary for the fulfillment of service provision contracts and the enhancement of user convenience, it is disclosed through this Privacy Policy pursuant to Article 26, Paragraph 2 of the Personal Information Protection Act. If the details of the entrusted operations or the trustee change, the "Company" will disclose it through this Privacy Policy without delay.
3. The "Company" entrusts the following operations to external companies to fulfill service provision contracts and improve member convenience:

Article 12 [Measures to Ensure the Safety of Personal Information]

Pursuant to Article 29 of the Personal Information Protection Act, the "Company" takes technical, managerial, and physical measures necessary to ensure safety as follows:

1. Conducting Regular Self-Audits: Self-audits are conducted regularly to secure safety related to personal information handling.
2. Minimization and Training of Personnel Handling Personal Information: Measures are implemented to manage personal information by designating specific employees who handle personal information and minimizing the number of personnel in charge.
3. Establishment and Implementation of Internal Management Plans: Internal management plans are established and implemented for the secure processing of personal information.
4. Technical Countermeasures Against Hacking, etc.: To prevent leakage and damage of personal information caused by hacking or computer viruses, the "Company" installs security programs, performs periodic updates and inspections, installs systems in areas controlled from external access, and monitors and blocks access technically and physically.
5. Encryption of Personal Information: The user's personal information is stored and managed in an encrypted form so that only the user can know it. For important data, separate security functions such as encrypting files and transmission data or using file lock functions are utilized.
6. Retention of Access Records and Prevention of Forgery/Alteration: Records of access to the personal information processing system are retained and managed for the period required by relevant laws and regulations, and security functions are used to prevent access records from being forged, altered, stolen, or lost.
7. Access Restrictions to the Personal Information Processing System: Necessary measures are taken to control access to personal information by granting, changing, and canceling access rights to the database system that processes personal information. Unauthorized external access is controlled using an intrusion prevention system.
8. Use of Locking Devices for Document Security: Documents containing personal information and auxiliary storage media are stored in a safe place equipped with locking devices.
9. Access Control for Unauthorized Persons: A separate physical storage location for personal information is established, and access control procedures are formulated and operated.

Article 13 [Department and Chief Privacy Officer in Charge of Personal Information Protection]

1. The "Company" designates a relevant department and a Chief Privacy Officer as follows to protect users' personal information and handle complaints related to personal information. Users may report all civil petitions related to personal information protection that occur while using the "Company's" services to the Chief Privacy Officer or the department in charge. The "Company" will provide prompt and sufficient answers to users' reports.

   [Department in Charge of Personal Information Protection]

   Department: M Business Planning Team

   Contact: +82-2-2270-7813

   Email: willkwon@daedong.co.kr

    

   [Chief Privacy Officer]

   CPO Name: Kyung-jun Park

   Contact: +82-1666-0965 (Customer Center)

   Email: kjpark26@daedong.co.kr
    

2. For reports or consultations regarding other infringements of personal information, you may contact the following organizations:
   • Personal Information Infringement Report Center (https://privacy.kisa.or.kr / Dial 118 without area code)
   • Supreme Prosecutors' Office Cyber Crime Investigation Division (https://www.spo.go.kr / Dial 1301 without area code)
   • National Police Agency Cyber Bureau (https://cyberbureau.police.go.kr / Dial 182 without area code)

Article 14 [Revision and Notification of Privacy Policy]

1. This Privacy Policy is disclosed on the first screen of the homepage so that members and users can view it at any time. If there are additions, deletions, or modifications to the content of the Privacy Policy, notices regarding the reasons and details of the changes will be made through the homepage and mobile application at least 7 days prior to the implementation of the amended Privacy Policy. Since the contents of this Privacy Policy may change from time to time, please check it when visiting the website or mobile application.
2. While this Privacy Policy applies to all of the company's online services (including mobile web/apps), separate privacy policies may apply to some individual services. Such separate privacy policies for individual services will be notified through the website and mobile application.