Purpose of Processing Personal Information

The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those stated below, and if the purpose of use changes, necessary measures will be taken in accordance with Article 18 of the Personal Information Protection Act, including obtaining separate consent.

1. 1. Provision of Accommodation Services
   1. Personal information is processed for the purpose of confirming accommodation reservation information, verifying reservation details, providing consultation, processing payment and settlement for accommodation services, and delivering refund notices and information.
2. 2. Handling Civil Complaints and Consumer Dispute Resolution
   1. Personal information is processed for the purpose of collecting opinions for service improvement and handling complaints and civil requests.

Retention and Use Period of Personal Information

1. ① The Company processes and retains personal information within the retention and use period prescribed by laws or agreed upon by the data subject at the time of collection.
2. ② The respective retention and use periods of personal information are as follows.
   1. 1. Provision of accommodation services: retained for 12 months after use of accommodation services
   2. 2. Handling civil complaints and consumer dispute resolution: retained for 1 year after completion of complaint handling
3. ③ However, even if the agreed retention period has expired or the purpose of processing has been achieved, if personal information must be retained for a certain period according to relevant laws, it will be separately stored for that period in accordance with the provisions of the law.
   1. 1. Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
   2. 2. Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
   3. 3. Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)
   4. 4. Records on labeling and advertising: 6 months (Act on Consumer Protection in Electronic Commerce)
   5. 5. Website visit records: 3 months (Protection of Communications Secrets Act)

Items of Personal Information Collected

The Company processes the following items of personal information.

1. 1. Accommodation services: Accommodation services
   1. • Required items: Name, Mobile Phone Number, Email Address
2. 2. Handling civil complaints and consumer dispute resolution
   1. • Required items: Name, Mobile Phone Number

Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in the purpose of processing and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or special provisions of law, and does not provide personal information to third parties otherwise. However, for smooth service provision, personal information may be provided to third parties after prior notice and consent of the data subject, and the details are as follows.

Destruction of Personal Information

1. ① The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.
2. ② The procedures and methods of destruction are as follows.
   1. 1. Destruction Procedure
      Personal information for which the reason for destruction has occurred is selected, and such information is destroyed with the approval of the Personal Information Protection Officer.
   2. 2. Destruction Method
      Personal information recorded and stored in electronic file form is destroyed so that the records cannot be reproduced, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.

Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them

1. ① The data subject may exercise the rights such as access, correction, deletion, and suspension of processing of personal information at any time.
2. ② The exercise of rights may be made in writing, by e-mail, or by facsimile (FAX) in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.
3. ③ The exercise of rights may also be made through a legal representative or an authorized agent. In this case, a power of attorney in accordance with Form No. 11 of the “Public Notice on the Methods of Processing Personal Information (No. 2020-7)” must be submitted.
4. ④ Requests for access and suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
5. ⑤ Requests for correction and deletion may not be made if the personal information is specified as a collection target under other laws.
6. ⑥ The Company verifies whether the requester is the data subject or a legitimate representative.

Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information.

1. 1. Administrative measures: establishment and implementation of internal management plans, regular internal training, internal audits
2. 2. Technical measures: access control, encryption, security programs
3. 3. Physical measures: access control to computer rooms and data storage rooms

Matters concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

1. ① The Company uses cookies to store and retrieve usage information in order to provide customized services.
2. ② Cookies are small pieces of information sent by the server (http) used to operate the website to the user’s browser and may be stored on the user’s computer hard disk.
   1. 1. Purpose of cookies: used to store session information and analyze visit and usage patterns to provide optimized services
   2. 2. Installation, operation, and refusal of cookies: users may refuse cookie storage through browser settings (Tools > Internet Options > Privacy)
   3. 3. If cookie storage is refused, there may be difficulties in providing optimized services
3. ③ The Company uses Naver Analytics, and anonymized information that cannot identify individuals is used. Users may refuse its use through cookie settings.

Personal Information Protection Officer and Remedies for Infringement of Rights

1. 1. Personal Information Protection Officer
   1. • Name: Brian Yoon
   2. • Position: Head of F&B Operations F&B
   3. • Contact: 032-729-1101, hofb@gwjbywalkerhill.com
2. 2. Department in Charge
   1. • Department: Rooms Division
   2. • Person in charge: Dustin Wi
   3. • Contact: 032-729-1133, gwjdor@gwjbywalkerhill.com
3. If consultation regarding personal information infringement is required, inquiries may be made to the following institutions.
   1. • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
   2. • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
   3. • Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
   4. • National Police Agency: 182 (ecrm.cyber.go.kr)

Installation and Operation of Fixed Video Information Processing Devices

The Company installs and operates fixed video information processing devices as follows.

1. 1. Purpose: facility safety and fire prevention
2. 2. Number, location, and scope: installed in major facilities such as the hotel lobby and exhibition hall, and covering all major areas
3. 3. Manager and department: Facilities Team, Team Leader Jin Kwon, 032-729-1151
4. 4. Recording time, retention period, storage location, and processing method
   1. • Recording time: 24 hours
   2. • Retention period: 30 days
   3. • Storage location and processing: control room of fixed video information processing devices of the Facilities Team
5. 5. Method of confirmation and location: request to the manager (Facilities Team)
6. 6. Measures regarding requests for access by data subjects: requests must be made using a prescribed application form and are permitted only when the data subject is recorded or when necessary to protect life, body, or property
7. 7. Measures for protection of video information: establishment of internal management plans, access control, prevention of falsification, secure storage, and locking devices
8. 8. Changes to operation policy
   This policy was established on June 1, 2015, and if there are any additions, deletions, or modifications due to changes in laws, policies, or security technology, such changes will be announced on the Company’s website without delay.

Changes to the Privacy Policy

1. ① This Privacy Policy shall take effect from May 1, 2025.