Privacy and Information Processing Policy, etc.

Personal information is information regarding a living person. That is, personal information refers to information that through which a person can be identified such as name, resident registration number, and image. This includes information which may not identify a person on its own, but when combined with other information, may identify a person. Personal information provider is a person who can be identified by the processed information. Doosan will disclose the Privacy and Information Processing Policy on the first page of its Website(www.doosan-iv.com) so that you can always easily check the policy. When the Policy is amended, we will publically notify you of the amendment through a notice on our Website or individually.

Unless permitted by relevant laws and regulations or without the personal information provider’s prior consent, Doosan will not process any sensitive information and personal identification information issued for the purpose of identifying an individual that may seriously infringe the privacy of personal information provider.

A. Processed Information

[Concerning the customer]

Name, postal address, email, company name, service usage data, access information, cookies, and IP address.

[Concerning employment]

Name, resident registration number, photo, password, postal address, telephone number, cellphone number, email, education, military service, foreign language competence, computer competence, license/certificate, family, and work experience.

B. Purpose of Processing

[Concerning the customer]

Member management and customer service including handling of complaints
Online market research or opinion poll
Marketing or advertising
Service offerings and settlement of fees

[Concerning employment]

Recruitment screening and contact with applicants
Wage/salary payment, fringe benefits, HR management including various job performance supports, and evaluations.

Once the purpose of collection and the use of personal information are met and completed, as a fundamental rule, the relevant information will be immediately destroyed. However, we will retain the following information during the period specified below and for the reasons specified below, and we will obtain consent from the person who provided his or her own personal information, as necessary.

• Retained information: Name, postal address, email, and company name
• Retention period: One year
• Reason of retention: User inquiries/requests control, user identification, etc.

• Retained information: Service usage data, access information, cookies, and IP address
• Retention period: Three years
• Reason of retention: Improve service quality through data analysis of the user’s service usage

• Retained information: Name, resident registration number, photo, password, postal address, telephone number, cellphone number, email, education, military service, foreign language competence, computer competence, license/certificate, family, and work experience
• Retention period: Until the expiration of employment relationship
  ※ However, the personal information of an applicant for employment, who was not employed, will be retained for 5 years for future employment management purposes with the person’s consent.
• Reason for retention: wage/salary payment, fringe benefit, HR management including various job performance supports, and evaluations

Any personal information saved in an electronic file format will be deleted using a technology that prevents the recovery of the deleted records. The personal information retained on paper will be shredded or burned.

Doosan will collect personal information within the scope of the purpose of the collection, and will not use your personal information beyond the scope of collection purpose or offer or disclose it to a third party. However, the following are the exception to the above rule:

• Consent was received from the person who provided his or her own personal information.
• According to specific provisions in other relevant laws.
• The person providing their own personal information or his/her legal representative is in a state in which an opinion/intention cannot be expressed, or prior consent cannot be gained due to an invalid address, but disclosure to a third party is urgently needed for the sake of the data provider or a third party’s life, body, and property.
• Necessary for statistical purposes and academic studies, where personal information is provided in a way as not to identify a specific individual.

Doosan currently offers personal information as follows:

• Institutions receiving personal information: Credu, TOEIC Korea, and the Korea Chamber of Commerce and Industry
• Offered personal information: Name and resident registration number
• Usage purpose: Verify qualification
• Retention and use period: Destroyed immediately

Doosan will not commission personal information processing to an outside agency without your consent. We commission personal information processing as follows, and regulate necessary matters/issues so that personal information can be safely managed upon commission of service as contracted under the relevant laws and regulations:

• Commissioned agency: N-shaper
• Details of commissioned service: Wage/salary management, fringe benefits, etc.

• Commissioned agency: Lexken
• Details of commissioned service: HR evaluation system operation

• Commissioned agency: Doosan Donga
• Details of commissioned service: Provision of online education service and related education materials

All the persons providing their personal information may request for the inspection, revision, deletion, and cessation of the processing of their personal information. However, Doosan may reject or restrict such a request in the following cases:

• When specifically required under the law or to comply with obligations under laws and regulations.
• When there is a concern for harm to another person’s life or body, or when there is a concern of unlawfully infringing upon another person’s property and profits.
• In a case where the service contracted with the personal information provider cannot be offered without processing his or her personal information, or when it is difficult to perform the service contracted with the personal information provider, but her or she does not clearly express his/her intention to terminate the contract.

[Method and Procedure to Exercise Rights]
A person wanting to exercise the above rights regarding their personal information may complete the Read/Inspect, Revise, Delete, and Suspend the Processing Form and sent it by email or fax to the department in charge of personal information (See “09. Customer Request Service on Personal Information” concerning the department). Unless there is a legitimate reason, Doosan will take a proper action within 10 days of receiving such a request. When there is a reason to reject or restrict the request, we will inform you of the reason and a method to appeal the decision within 5 days upon receiving the request. When the concerned person or legal representative makes a request as above, we can confirm the identity of the person or legal representatives by checking their identification cards such as a resident registration card or a recognized electronic signature.

Doosan takes the following safeguards in handling personal information so that it will not be lost, stolen, leaked, modified, or damaged:

[Technical actions]
Doosan complies with the criteria set forth by laws and regulations for the safe storage and transmission of personal information. We protect against computer virus by using a vaccine program. The vaccine program is periodically updated, but if there is a sudden emergence of a new virus, we will implement the appropriate vaccine as soon as it becomes available so that personal information infringement can be prevented. To deal with outside infiltration, including hacking, we use an infiltration interruption system and a weakness analysis system.

[Administrative actions]
Doosan restricts the rights to access personal information to the following cases: a person carrying out sales and marketing activity involving the personal information provider, a person engaging in personal information management, and a person whose task requires the use of personal information. We conduct regular in-house training and external commissioned training for those employees that handle personal information, and we thoroughly manage and supervise them to comply with the laws and regulations regarding personal information protection.

[Physical actions]
To protect personal information, we limit physical access to the information through the use of locks and similar devices. We control access to the computer room and archives by designating and operating them as specially protected areas.

Doosan has appointed the following department and personal information protection administrator to protect personal information and to process complaints related to personal information:

A. CPO(Chief Privacy Officer)

• Name : David Yang

B. Personal Information Department

• Department : Compliance team
• Tel : 82-31-5179-3417
• Email : [email protected]

Should you need to report a personal information infringement or receive consultation regarding infringement, please contact the following agencies:

• Ministry of Security and Public Administration (http://www.privacy.go.kr Tel: 02-2100-3399)
• Korea Internet Security Agency (http://privacy.kisa.or.kr Tel: 118, 02-405-5118)
• National Information Society Agency (http://www.privacy.nia.ro.kr Tel: 02-2131-0114)

When the current Privacy and information Processing Policy is amended or deleted, we will provide notice on our Website 10 days before such amendment or deletion takes place.

Date of Public Notification: December 7, 2012
Date of Enforcement: December 7, 2012

Doosan operates a cookie that frequently stores and finds our information. A cookie is a very small text file that is sent to your browser by a server used to operate a website, and it is stored on your computer’s hard disk. We use cookies for the following purposes:

• To identify user’s tastes and areas of interest through an analysis of access frequency or visit time and tracking the trace.
• To offer target marketing and individual-tailored service through the identification of participation extent in the events and the number of visits to various events

You have a selection right about the setting of cookies: you may allow all cookies; you may go through confirmation, whenever cookies are stored; or you may reject the storage of all cookies by setting an option on the Web browser.

How to set (Internet Explorer): Tool > Internet Option > Personal Information at the top of the Web browser. However, when you choose to reject cookies, you may not be able to take full advantage of all our Website features.

Doosan may collect your personal information for the following purposes:

• Customer request handling including member management, complaint handling, etc.
• To offer better services and to improve the quality of this Website through online market research or opinion polls that receive user IDs.
• To use for the purpose of marketing or advertising with the user’s prior consent.
• To provide service fee settlement content and to carry out the service and perform the terms of the service contract.

Doosan collects the following personal information for consultation, application for service, and so on:

• Collected information: Name, postal address, email, company name, service usage data, access information, cookie, and IP address.
• How personal information is collected: Website (Contact Us, Cyber Reporting Center).

We will not externally disclose any personal information that has been collected through the Website, except with your prior consent or under situations where we are required by law to disclose your personal information to such third parties as law enforcement authorities, judicial authorities, or other government authorities.

However, the following exceptions will apply for the following cases:

• When users have agreed in advance.
• In the case when it is required by law or when an government agency requests pursuant to the procedures and methods set forth in the relevant laws and regulations for the purpose of investigation.

In the event that we consider it necessary to release your personal information to an outside agency for commissioned services, we will notify you about the identity of the agency as well as the nature of the commissioned service, and obtain your prior consent.

A user and his/her legal representative may request to inquire, revise the user’s registered personal information, and withdraw their consent at anytime. We will take the proper action upon receiving your request in writing, telephone, or email to the department in charge of personal information control. In the event that you request the revision of an error in your personal information, we will not use or provide it until the revision is complete. If the wrong information has already been provided to a third party, we will immediately notify that third party of the revision processing result so that they can revise your personal information. Doosan handles personal information that has been terminated or deleted pursuant to the request of a user or his/her legal representative in accordance with the provisions of the “Retention and Use Period” section, and will prevent it from being read/inspected or used for other purposes.

Any information provided by a user will be banned from being used for the reasons other than the purpose of retention or to comply with relevant laws and regulations. After the purpose of collection and use of personal information is completed, the information concerned will be immediately destroyed without exception. If a user requests us to destroy his/her personal information, unless the required period to retain such information by law expires later than the time the request was made, the user’s information will be completely destroyed upon the receipt of such a request. The destruction procedure and method are presented below:

A. Retention and Use Period

• Retained information: Name, postal address, email, and company name
• Retention period: One year
• Reason of retention: User inquires/requests control, user identification, etc.

• Retained information: Service usage data, access information, cookie, and IP address
• Retention period: Three years
• Reason of retention: Collect user’s service use statistics

B. Destruction Procedures

Any information provided by you will be transferred to a separate DB (separate document box in the case of paper) upon compleition of the purpose of its use, and it will be stored for a certain period of time, and then destroyed under our policy and other relevant laws and regulations. Such information will then be banned from use, other than for the purpose of retention or otherwise prohibited by law.

C. Destruction Method

Personal information stored in an electronic file format will be deleted using a technical method which prevents the retrieval of the deleted file.

The Website may include links to the other websites, and we are not responsible for the content of linked websites or the use of such websites. Users agree that your use of such linked websites will be governed by that websites’ own privacy and information handling policies.

We maintain strict safeguards to protect your personal information from unauthorized or inappropriate access by limiting employee access to and use of the information.

To protect customer’s private information and to processed related complaints, we have appointed a relevant department and personal information administrator as follows:

A. CPO(Chief Privacy Officer)

• Name : David Yang

B. Personal Information Department

• Department : Compliance team
• Tel : 82-31-5179-3417
• E-mail : [email protected]

Should you need to file any reports regarding the infringement of personal information or if you have inquiries about the Privacy and Information Handling Policy, please contact the following agencies:

• Ministry of Security and Public Administration (http://www.privacy.go.kr Tel: 02-2100-3399)
• Korea Internet Security Agency (http://privacy.kisa.or.kr Tel: 118, 02-405-5118)
• National Information Society Agency (http://www.privacy.nia.ro.kr Tel: 02-2131-0114)

Date of Public Notification: December 7, 2012
Date of Enforcement: December 7, 2012

The Image Information Processing Equipment Operation & Management Policy (“the Policy”) sets forth the rules for Doosan Corporation Electro-Materials (“Doosan”) to comply with concerning the installation and operation of the image information processing equipment (IIPE), and personal image information protection requirement under Article 25 of the Personal Information Protection Act. The Policy aims to promote the adequate performance of work and to contribute to the protection of the rights and interests of the persons providing personal information.

Doosan will collect personal image information within the narrow scope in line with the purpose of installing the IIPE and will insure that persons providing personal information will be able to clearly recognize the installation purpose, and will not use the information for any purpose other than the aforementioned purpose. Doosan will safely mange the personal image information, disclose the matters related to the processing of such information, and guarantee the rights of those persons on their personal image information.

Doosan manages the installation and operation of the personal IIPE through each business division, and the following information are disclosed on websites separately operated by each business division:

• Controller, department, and person in charge of the work
• Number, location, and shooting scope of the installed IIPE
• Shooting time, storage period, and place of the IIPE
• Matters on the commissioned service of installation and management of the IIPE

Doosan will take a necessary action such as posting an information sign containing the following so that the persons providing their own person information can easily notice the installation and operation of the IIPE:

• The purpose, location, shooting scope and time, controller’s name, position, and contact number
• In the case the installation and control is outsourced, the outsourced person/company’s name and contact number

The information sign shall be posted in a place where those who provide their own personal information can easily see it within the shooting scope. The size of the information sign shall be 40 x 30cm. However, the size is subject to change, according to the circumstances of the installation location.

A person providing their own personal information (“a person”) can request Doosan to view/inspect and confirm the identification (”Viewing/Inspection”) regarding their own personal image information.

Doosan will take a necessary action upon receiving a request for viewing/inspection. In doing so, Doosan may check through a submitted ID including resident registration card or driver’s license to confirm whether the requesting person is the person concerned or a legitimate representative.

Doosan may reject such a request in the following cases and in such cases, Doosan will give notice, in writing, to the requesting person or the representative of the reason for rejection or the method for appealing within 10 days of receiving the request:

• When the personal image information was destroyed because of the expiration of the retention period.
• When other legitimate reasons exist to reject such a viewing/inspection request.

When the personal image information is used for the purpose other the intended purpose of the collection or when it is transferred to a third party pursuant to your consent or according to the provisions of laws and regulations, the following will be recorded in the Personal Image Information Log:

• Name of the personal image information file
• Name of the user or person to whom the transfer was made
• Purpose of use or transfer
• In the event it exists, the legal grounds of use or transfer
• If it exists, period when the use or transfer occurred
• Type of use or transfer

When destroying personal image information, the following shall be recorded in the Personal Image Information Log:

• Destroyed personal image information (items)
• Date of destruction (destruction frequency, etc., when automatic deletion takes place preset destruction period)
• Person in charge of personal image information destruction

Doosan will immediately destroy the collected personal image information upon the expiration of the retention period specified in the Policy. However, it will not do so if required by specific provisions in relevant laws and regulations.

The methods of destroying personal image information are as follows:

The hardcopy recordings (photo, etc.) of personal image information will be shredded or incinerated. Electronic file format information will be permanently deleted in the technical manner through which the deleted personal image information cannot be retrieved.

The right to access personal image information collected and processed by the IIPE is limited to a minimum number of people, including the controller and the person in charge of the work. The place where the personal image information transmitted by the IIPE is viewed/inspected and retrieved is designated as being a restricted area, and only the authorized people are allowed to access and view/inspect the information. Doosan immediately changes or withdraws the access rights of a person, whose access right changes, due to HR changes such as job transfer or retirement. We take necessary safeguards to ensure the safety of personal image information, including setting a password in the event that we process personal image information or send and receive such a file so that it cannot be lost, stolen, leaked, modified, or damaged. We regularly inspect the status of the operation of the IIPE to prevent the forgery or modification of personal image information.

Date of Public Notification: December 7, 2012
Date of Enforcement: December 7, 2012