Suprema Privacy Policy

Suprema Inc. (hereinafter referred to as the “Company”) shall establish the Privacy Policy and make it public to protect the personal information of data subjects and deal with related grievances quickly and smoothly, as follows:

Article 1. Particulars of personal information to be collected and collection methods

Article 2. Purpose of the processing (collection and use) of personal information

Article 3. Period for processing, using, and retaining personal information

Article 4. The rights and obligations of data subjects (users) and how to exercise the rights

Article 5. Procedure for and method of destroying personal information

Article 6. Privacy Officer

Article 7. Changes to the Privacy Policy

Article 8. Measures to ensure the safety of personal information

Article 9. Provision of personal information to a third party

Article 10. Outsourcing personal information processing

Article 11. Matters concerning the purpose of automatic collection of personal information, and denial thereof

Article 1. Particulars of personal information to be collected and collection methods

1. Particulars of collection

In order to manage company-related inquiries, customer support, employment inquiries, and event participation registration service, etc., the Company collects the following personal information.

- The following information may be generated and collected in the process of service use.

- Access logs, cookies, IP addresses, service use records

2. Method of collection

- Direct input made by the user through the website

- Collection through tools for gathering information generated (e.g., connection logs and cookies, etc.)

Article 2. Purpose of the processing (collection and use) of personal information

The Company collects and uses personal information for the following purposes. The personal information collected shall not be used for any purpose other than the following purposes, and if the purpose of use is changed, necessary measures under the law shall be taken by seeking prior consent, etc.

1. Use of information for the provision of services: Handling inquiries, giving information and guidance, providing content and information on event reservation

2. Use for marketing and advertising: Notice through TM, SMS, DM, e-mail, and push-mail, etc., providing promotional information, market survey, customer satisfaction survey, product/service development research, statistical analysis data for each customer and access frequency

Article 3. Period for processing, using, and retaining personal information

Unless it is necessary to retain personal information under related laws, in principle the Company shall immediately destroy relevant information after fulfilling the purpose of the collection and use of personal information.

Article 4. The rights and obligations of data subjects (users) and legal representatives, and how to exercise the rights

1. The data subject (user) may exercise the rights related to personal information set forth in each of the following subparagraphs with respect to the Company any time.

• ① To request access to personal information
• ② To request correction of errors, etc. if any
• ③ To request deletion
• ④ To request stopping processing

2. The rights set forth in paragraph 1 above may be exercised in writing and by telephone, e-mail or fax, etc., and the Company shall take measures immediately after completing the user identification process.

6. In principle the Company shall not collect personal information on the data subject under the age of 16.

Article 5. Procedure for and method of destroying personal information

In principle the Company shall destroy relevant information immediately after fulfilling the purpose of the collection and use of personal information or after the passage of the retention period. Procedure for and method of destroying it are as follows:

1. Destruction procedure

The Company shall determine personal information subject to destruction and destroy relevant personal information with the approval of the Privacy Officer.

2. Destruction method

The personal information printed in paper shall be destroyed with a shredder or by incineration and the personal information stored in an electronic file format shall be deleted by a technical method which makes it impossible to reproduce the records.

Article 6. Privacy Officer

The Company designates a related department and a person in charge of personal information management to protect personal information and deal with complaints related to personal information as follows:

▶ Privacy Officer

Name: Andy Ahn

Email: andyahn@suprema.co.kr

Office: +82-31-783-2466

Fax: +82-31-783-4503

▶ Privacy Manager

Name: Jeong Gi-Tae

Title: Assistant Manager of Marketing Division

Office: +82-31-710-4409

Fax: +82-31-783-4503

Article 7. Changes to the Privacy Policy

In case of addition, deletion, or modification of the Privacy Policy, the Company will give notice of the fact through the company website (the Company’s website address).

Article 8. Measures to ensure the safety of personal information

The Company takes technical, managerial, and physical measures necessary for ensuring safety as follows:

Managerial measures

Establish, implement, check, and train information security regulations/guidelines and plans for internal management of personal information

Technical measures

Manage and authenticate access to the personal information processing system, etc., install and operate the access control system and security program, personal information encryption, etc

Physical measures

Establish and operate the access control system for the data processing room

Article 9. Provision of personal information to a third party

Unless the user's consent is given or it is mandatory to provide personal information under related laws, the user's personal information shall not be used or provided to a third party in any case.

Article 10. Outsourcing personal information processing

The Company outsources personal information processing task to process personal information task smoothly, as follows.

In the case of making an outsourcing contract, the Company shall have matters concerning responsibility in writing by specifying them in the agreement and storing it in an electronic format. In the case of changing the outsourcing company, the Company will give notice of the fact through the Privacy Policy.

Article 11. Matters concerning the purpose of automatic collection of personal information, and denial thereof

The Company installs and operates automated means to collect personal information such as cookies that frequently find and store the user's information. A cookie is a very small text file that is sent to the user's browser by the server used for operating the Company's website and is stored in the user's computer hard disk.

The Company shall collect and use cookie information for the following purposes.

Purpose of the use of cookies, etc

- To remember the customer's login ID and provide automatic setup convenience features such as "Pop-ups not allowed

- The user reserves the option for cookie installation. Therefore, the user may set the web browser to allow all cookies or confirm cookies whenever they are stored or deny storage of all cookies.

Method of disabling cookies

Example: As a method of denying cooking settings, the user may set the web browser to accept all cookies or confirm them whenever cookies are stored or deny the storage of all cookies.

Setting method (e.g., Internet Explorer)

Please be advised that disabling cookies might limit your access to some of the services offered.

Addenda

[Revision history]

Date of establishment: November 4, 2018

Date of revision: Enter the date of revision if applicable

Consent to the collection and use of personal information

Suprema Inc. gives notice of the following matters when collecting personal information from you in accordance with related laws such as the「Act on Promotion of Utilization of Information and Communications Network」and the「Personal Information Protection Act」, etc. Please carefully read the following matters and decide whether or not to give consent after fully understanding all matters.

1. Purpose of the collection and use of personal information

To provide useful information by making a reply to your inquiry or request regarding products or services

2. Particulars of personal information to be collected and used

A. Mandatory information

Name, e-mail, contact information, company name, country

3. Particulars not to be collected

This Company does not collect your resident registration number unless it is permitted under the law; your driver's license number and other personally identifiable information under the Personal Information Protection Act and your thought, political party, health, and other sensitive information under the Personal Information Protection Act are not collected unless you give your consent thereto.

4. Period for retaining and using personal information

5 years from the date of collecting personal information

This Company will not use all the information you provide for any purpose other than the purposes of collection and use as mentioned above or the purpose of complying with related laws and will destroy relevant information when the period of retention and use has expired or after the purpose of the collection and use of personal information has been fulfilled unless there are proper reasons such as obligation to retain personal information under the law.

However, if you request us to destroy your personal information, unless it is required to retain such information under related laws, we will destroy all of your information on receipt of your request and will not retain any of such information

Regarding the right to deny consent

You have the right to deny consent to the collection and use of personal information pursuant hereto. Please note that if you deny consent to the collection and use of mandatory information, your use may be limited because the purpose of the collection and use of personal information cannot be fulfilled.

I have read and understood all matters above and consent to the collection and use of my personal information by your company according to this consent.

Consent to use for marketing and advertising

To receive e-mail regarding Suprema’s product launches, events, and newsletter, etc., please carefully read matters concerning the collection and use of personal information below and decide whether or not to give consent.

1. Purpose of the collection and use of personal information

To use the receipt of e-mail regarding Suprema’s product launches, events, and newsletter, etc.

2. Particulars of personal information to be collected

- Mandatory information: Name, e-mail, contact information

- Optional information: Company name, department name, position

※ For the user's convenience, cookie information is used

3. Period for retaining and using the personal information collected

After obtaining your consent to the collection and use of personal information, we retain such personal information for one year and destroy it immediately thereafter. Provided, that if it is mandatory to retain personnel information under the law, such information shall be retained for a certain period specified by law.

4. You may not consent to the collection and use of personal information as above.

If you deny consent, receipt of Suprema's solution and event information may be limited.

※ For more information about the collection and use of personal information, please see at Suprema’s website (www.supremainc.com).

Consent to overseas transfer of personal information

Suprema Inc. is providing personal information to third parties overseas as below and may process the user’s personal information on the server located in areas outside of the country where the user reside.

1. Particulars of personal information to be transferred

- Mandatory information: Name, e-mail, contact information

- Optional information: Company name, department name, position

※ For the user's convenience, cookie information is used.

※ The above mandatory information and optional information include the information changed due to information modification as well as the information initially collected.

※ The above mandatory information and optional information include the information changed due to information modification as well as the information initially collected.

2. Country, time and method of personal information to be transferred

- Country to which personal information is to be transferred: Australia

- Method of time and method of transfer: Transfer through a network at the time of using Internet-related services provided to the main site of the company

3. Name of the personal information transferee

Company name: Oracle Corporation Data Center (Australia)

Contact information: https://www.oracle.com/legal/privacy/services-privacy-policy.html

Chief Privacy Officer, Oracle Corporation

10 Van de Graaff Drive

Burlington, MA 01803

USA

4. The personal information transferee’s purpose of use of personal information

The Company transfers personal information so that external companies can conduct business necessary for providing the following services and supervises transferee companies not to violate laws related to personal information protection.

- Provision of events and other services, and e-mail marketing activities

- Provision of feedback on customers' inquiries regarding partner program support, etc., and management

5. The personal information transferee’s period for retaining and using personal information

After obtaining your consent to the collection and use of personal information, we retain such personal information for one year and destroy it immediately thereafter. Provided, that if it is mandatory to retain personnel information under the law, such information shall be retained for a certain period specified by law.

6. The right to deny consent and disadvantages caused by denial of consent

The user has the right to deny collection of information. Provided, that if the user denies consent, services may be limited.