The Company processes personal information for the following purposes and does not use it for purposes other than those specified. In the event that the purpose of using personal information changes, the Company plans to take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act. The personal information processor must state the purpose of processing personal information in a specific and detailed manner.

① The Company processes and retains personal information in accordance with the retention and usage period agreed upon by the data subject or relevant laws and regulations.

② The processing and retention periods for each type of personal information are as follows.

The company does not provide the personal information of data subjects to third parties or entrust its processing to external parties.

The company We do not outsource personal information processing tasks.

① The data subject may exercise the following rights related to personal information protection (hereinafter referred to as “Exercise of Rights”) against the Company at any time.

② You may exercise your rights pursuant to Paragraph 1 against the Company in writing, by phone (02-3705-7900), or by email (ykkkorea@ykk.com ) , and the Company will take action without delay.

③ If a data subject requests the correction or deletion of personal information, the Company will not use or provide the relevant personal information until the correction or deletion is completed.

④ The exercise of rights pursuant to Paragraph 1 may also be carried out through the data subject's legal representative or an authorized agent. In this case, a power of attorney in accordance with Form No. 11 of the Enforcement Rule of the Personal Information Protection Act must be submitted. * Information on children under the age of 14 is not collected.

⑤ Data subjects must not infringe upon their own or others' personal information or privacy in violation of relevant laws and regulations, such as the Personal Information Protection Act.

⑥ Requests for access to and suspension of processing of personal information may be restricted pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.

⑦ If the relevant personal information is specified as a subject of collection in other laws, you cannot request the deletion of personal information.

⑧ The Company verifies whether the person exercising the rights is the principal or a legitimate agent.

The Company processes the following items of personal information. The personal information processor collects only the minimum amount of personal information necessary for the purpose of processing, and this must be consistent with the actual processing status.

① When personal information becomes unnecessary due to the expiration of the retention period, the achievement of the processing purpose, etc., the Company shall, without delay (within 10 business days) Destroy the relevant information.

③ The procedures and methods for the destruction of personal information are as follows.

The Company takes the following measures to ensure the safety of personal information.

1. Conducting Regular Internal Audits : To ensure the safety of personal information processing, we conduct regular internal audits once a year.

2. Minimization and Training of Employees Handling Personal Information : We designate and limit employees who handle personal information to take measures to minimize the handling of personal information, and we conduct employee training.

3. Establishment and Implementation of Internal Management Plan : We establish and implement an internal management plan for the safe processing of personal information.

4. Technical measures against hacking, etc .: To prevent the leakage and damage of personal information caused by hacking and computer viruses, we install security programs and periodically update and check them . In addition, we install systems in areas controlled from the outside and monitor and block them technically and physically.

5. Personal Information Encryption : Users' personal information is encrypted and stored and managed, and important data is made known only to the user by using separate security features such as file and transmission data encryption or file locking functions.

6. Personal Information Access Control : We take necessary measures to control access to personal information by granting, modifying, or deleting access rights to database systems that process personal information, and we control unauthorized access from the outside using intrusion prevention systems.

7. Use locking devices for document security : Store documents and auxiliary storage media containing personal information in a secure place with a locking device.

8. Restriction on unauthorized access : Set up a separate physical storage space for personal information and establish access control procedures.

The company uses 'cookies' that store and frequently retrieve usage information to provide personalized services to users.

① The Company assumes overall responsibility for business related to the processing of personal information and designates a Personal Information Protection Officer as follows to handle complaints and provide relief for damages to data subjects regarding the processing of personal information.

② Data subjects may contact the Chief Privacy Officer and the Personal Information Department regarding all inquiries, complaint handling, and damage relief matters related to personal information protection arising during the use of the Company's services (or business). The Company will respond to and process the data subject's inquiries without delay.

Data subjects may request access to their personal information from the following departments in accordance with Article 35 of the Personal Information Protection Act. The Company will endeavor to process data subjects' requests for access to personal information promptly.

Data subjects may apply for dispute resolution or consultation with specialized agencies, such as the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency's Personal Information Infringement Reporting Center, to seek relief for personal information infringement. In addition, inquiries regarding other reports and consultations on personal information infringement may be made to the following agencies.

① This Privacy Policy is effective from June 1 , 2026 .

② The previous Privacy Policy can be viewed at the following link .