BNB Asset Management Co., Ltd. (the "Company") values the personal information of its customers in accordance with Article 30 of the Personal Information Protection Act, and complies with the Act on Promotion of Information and Communications Network Utilization and Information Protection and related notifications on technical and administrative safeguards. Through this Privacy Policy, the Company explains the purposes and manner in which personal information provided by customers is used, and the measures taken to protect it. This Policy takes effect from its effective date, and if any provision is added, deleted, or amended pursuant to applicable laws or policy changes, the Company will give notice through the website's notice board (or individual notice) before the change takes effect.

The Company processes personal information only for the purposes stated below and will not use it for any other purpose. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act. "Processing" means the collection, creation, recording, storage, retention, use, provision, disclosure, correction, retrieval, or destruction of personal information, and other similar acts.

• Identity verification, consultation, and complaint handling, and delivery of notices.

Personal information is retained only for as long as necessary for business purposes — including audit and record-keeping — after which it is destroyed.

The Company processes personal information only within the scope stated in Section 2 above, and does not use it beyond that scope or provide it to third parties without the data subject's consent, except where:

• ① Separate consent has been obtained from the data subject
• ② Otherwise required by law
• ③ The data subject or legal representative cannot express intent or give prior consent (e.g., unknown whereabouts), and disclosure is clearly necessary to protect the urgent life, body, or property interests of the data subject or a third party
• ④ Needed for statistics or academic research in a form that does not identify any individual
• ⑤ Processing for another purpose is unavoidable to perform duties required by other statutes, and the Personal Information Protection Committee has so resolved
• ⑥ Required to fulfill a treaty or international agreement
• ⑦ Necessary for a criminal investigation or prosecution
• ⑧ Necessary for a court's judicial duties
• ⑨ Necessary to execute a sentence or protective disposition

In principle, the Company does not consign the processing of personal information to any third party without the user's consent. Should such consignment become necessary, the Company will disclose the consignee, scope of work, consignment period, and terms of the consignment agreement (including compliance with data-protection laws and prohibition on third-party disclosure) through its notices and this Policy, and will obtain prior consent where required.

Data subjects may exercise the following rights:

• ① Request to access their personal information
• ② Request correction of errors
• ③ Request deletion
• ④ Request suspension of processing

Collected for recruitment purposes:

• Required: name, contact number, email address, resume, and other information necessary for the hiring process.
• Method: submission of application materials by email.
• Purpose: to conduct the recruitment process and notify applicants of results.

Destruction: Personal information is destroyed without delay once its retention period has elapsed or its purpose has been achieved, except where retention is required for business or record-keeping purposes.

Electronic records are destroyed using methods that prevent recovery; paper records are shredded.

Administrative: internal management plan and regular employee training.
Technical: access-rights management, access-control systems, encryption of unique identifiers, and security software.
Physical: access control for server rooms and similar facilities.

Personal Information Protection Officer

• Name: Lee Heung-il
• Title: Compliance Officer
• Email: hilee@bnbasset.com
• Phone: 02-786-5329

Data subjects may direct all inquiries, complaints, and requests for remedy to the Officer above; the Company will respond without delay.