Article 1 (Purpose of Personal Information Management)

S&K manages the personal information for the following purposes. The personal information will not be used by S&K for any purpose other than the following purposes, and in the event of change in such purposes of management, S&K will take the necessary actions, such as acquisition of separate consent from the data subjects pursuant to Article 18 of the PIPA.

1. Personal Information of Clients (Prospective Clients, Applicants for Participation in Seminars)
   • Purpose of Managing Personal Information: To provide services for cases related to clients, to send clients and prospective clients S&K newsletters, promotional materials, information and invitations on events hosted by S&K, to file tax returns, and to otherwise provide other information to clients and prospective clients.
2. Personal Information of Job Applicants
   • Purpose of Managing Personal Information: To maintain a human resources database and to facilitate hiring decisions.

Article 2 (Management and Retention Period of Personal Information)

S&K manages and retains the personal information within such period of retention and use of the personal information as set forth by the law or such period of retention and use as agreed by the data subject at the time of collection of the personal information.

Management and retention period of the personal information is as follows:

1. Personal Information of Clients (Prospective Clients, Applicants for Participation in Seminars)
   1. Collection Methods: Business cards, documents (e.g., powers of attorney, contracts, etc.), phone and fax numbers, email addresses.
   2. Retention Period: Until the above purpose of collecting personal information is achieved or until the client or prospective client requests the destruction of his/her personal information.
2. Personal Information of Job Applicants
   1. Collection Methods: Documents, phone and fax numbers, email addresses.
   2. Retention Period: 3 years from the date of the employment decision or until destruction of the personal information is requested by the job applicant

Article 3 (Outsourcing Management of Personal Information)

1. For effective management of the personal information, S&K has outsourced certain management of the personal information as follows:
   • Access information
     • Contractor (Agent): CBRE Korea Co., Ltd. and Daelim Corporation
     • Work Description: To manage access by visitors to the building and its facilities
   • Information sent through emails
     • Contractor (Agent): Maillink
     • Work Description: To manage outgoing newsletters, seminar invitations, etc.
2. Pursuant to Article 26 of the PIPA, S&K includes the following when entering into outsourcing agreements: (i) provisions that prohibit the use of the personal information for any purpose other than the outsourced work; (ii) technical requirements and required administrative measures to protect the personal information; (iii) restrictions on subcontracting its obligations, and requirements for supervising entrusted parties; and (iv) liability provisions (indemnification), etc. S&K supervises the outsourced service provider to ensure that the personal information is safely managed.
3. Should there be any changes in the outsourced work or the contractor, S&K will promptly update this Privacy Policy to reflect such changes.

Article 4 (Rights and Obligations of Data Subjects)

1. A data subject may exercise his/her right to request inspection, correction, deletion, suspension of management, etc. of his/her personal information at any time.
2. To exercise his/her rights under Paragraph (1) above, the data subject may submit a request form by personal delivery, email or fax to S&K as set forth in Article 41(1) of the Enforcement Decree of the PIPA, in which case S&K will take actions without delay in response to such request.
3. Any data subject may exercise his/her rights under Paragraph (1) above through his/her legal representative, any other appointee or agent, subject to the submission of a power of attorney in the form of Form No. 11 of the Notification on Management Methods of Personal Information (No. 2020-7).
4. The data subject’s right to request inspection, or suspension of management, of his/her personal information may be restricted in accordance with Articles 35(4) and 37(2) of the PIPA.
5. If collection of the relevant personal information is required by other laws, the data subject may not request correction or deletion of his/her personal information.
6. If S&K receives a request for inspection, correction, deletion, or suspension of management, of his/her personal information from the data subject, S&K will verify whether a person, who made such request, is the data subject or his/her lawful representative.

Article 5 (Personal Information to be Managed)

S&K manages the following personal information:

1. Personal Information of Clients (Prospective Clients, Applicants for Participation in Seminars)
   1. Required information: Applicant’s name, company, department, position, phone number, and email
   2. Optional information: Participant’s name, company, department, position, phone number, and email
2. Personal Information of Job Applicants
   1. Required information
      • Name in Korean/English, photo, date of birth, address, current occupation, mobile phone number, e-mail, whether the applicant is a family of patriots/veterans
      • Education (name of school, major, period of enrollment, GPA, status of graduation, year of completing the judicial training at Judicial Research and Training Institute and evaluation results, year of passing the judicial examination and exam results, year of admission to law school and GPA, year of passing the bar examination and exam results, etc.)
      • Work experience (employer, period of employment, department and position, title (intern), key roles and responsibilities, etc.)
      • Military service (period of service, military branch, rank, and reasons, if any, for exemption from mandatory military service)
      • All other personal information stated in the submitted resume and attached documents, including cover letter, academic transcript, etc.
   2. Optional information
      • Information inserted in the personal identification information tab other than the above required information
      • Foreign languages and qualifications, group activities, preferred practice and area of interest, overseas training experience, or any other information or skills
3. The following personal information may be automatically created and collected in the process of using the internet service:
   1. IP address, cookie, MAC address, service usage record, access record

Article 6 (Destruction of Personal Information)

1. S&K will promptly destroy the personal information that is no longer needed, including when the purpose of collecting the personal information is achieved or the retention period has expired.
2. If such retention period as agreed by the data subject has expired or the purpose of managing the personal information is achieved but S&K is required by other law to continuously retain the personal information, S&K will move such personal information to a separate database (DB) or store in a different storage location.
3. S&K will destroy the personal information according to the following procedures and methods:
   1. Procedure of Destruction

      S&K will select the personal information for which the cause for destruction occurred, and destroy the personal information with the approval of its Personal Information Protection Manager.

   2. Methods of Destruction

      S&K permanently deletes the personal information recorded and/or stored in electronic files so that restoration of data is impossible, and shreds or burns the personal information recorded and/or stored in paper documents.

Article 7 (Measures to Ensure Protection of Personal Information)

S&K employs the following measures to protect the personal information:

1. Administrative measures: Establishment and implementation of internal management plans, education of employees on a regular basis
2. Technical measures: Management of access rights to the personal information management system, installation of access control system, encryption of identification information, installation of security programs
3. Physical measures: Control of access to IT center, data storage center, etc.

Article 8 (Installation/Operation of Automated Collection Device of Personal Information and Refusal of Cookies)

1. Definition of a cookie

   A cookie is a small text file which the server for the operation of a website sends and stores on the user's computer hard disc. As the data subject may freely decide on whether to install or collect cookies, the data subject may, therefore, refuse the collection of cookies.

2. To manage your cookie settings,
   1. For Internet Explorer : Select “Tool” (at the top of the web browser) > “Internet Option” > “Personal Information” > select setting
   2. For Chrome : Select “Chrome Setting and Control“(at the upper-right side of the web browser ) > “Setting” > “Advanced” > “Contents Setting” in the “Personal Information and Security” section > select setting in the cookie section

Article 9 (Personal Information Protection Manager)

1. S&K’s personal information protection manager and department responsible for the protection of the personal information are as follows:
   • Personal Information Protection Manager

     Name: Kyung-Don Lee
     Title: Senior Partner
     Contact Numbers: Tel: 82-2-316-2677, Fax: 82-2-756-6226,
     Email: kdlee@shinkim.com

   • Department for the Protection of Personal Information

     Department: IT Center
     Manager: Jong-Ha Hwang, Head of IT Center
     Contact Numbers: Tel: 82-2-316-4099, Fax: 82-2-756-6226,
     Email: jhahwang@shinkim.com

2. The data subject may contact the personal information protection manager and the department responsible for the protection of the personal information regarding any inquiry on the personal information protection, complaints, relief, etc. that may arise in the course of the use of S&K services. S&K will promptly respond to and handle any such inquires raised by data subjects.

Article 10 (Standards for Additional Use or Production)

S&K may additionally use or provide the personal information without the consent of the data subject, in consideration of such matters as set forth in Article 14-2 of the Enforcement Decree of the PIPA in accordance with Article 15(3) and Article 17(4) of the PIPA.

S&K will consider the following matters for such additional use or production of the personal information without the consent of the data subject:

1. Whether the purpose of such additional use or production is related to the original purpose for which the personal information was collected;
2. Whether such additional use or production is foreseeable in light of the circumstances under which the personal information was collected and processing practices;
3. Whether such additional use or production does not unfairly infringe on the interests of the data subject; and
4. Whether the measures required to ensure security such as pseudonymization or encryption have been taken.

Article 11 (Request for Access to Personal Information)

A data subject may request the following department to permit access to his/her personal information in accordance with Article 35 of the PIPA.

1. Department responsible for receipt/handling of request for access to the personal information
   1. Name of department : IT Center
   2. Person in charge : Jungho Lee, Manager
   3. Contact : T 82-2-316-4895, F 82-2-316-0378, juhlee@shinkim.com

Article 12 (Remedies for Infringement of Rights and Interests)

Data subjects may seek relief and advice on the personal information infringement from the following organization (As the following organizations are independent from S&K, please contact them directly if you need more detailed support or if you are not satisfied with S&K’s handling of complaints related to your personal information or remedies provided by S&K).

1. Personal Information Infringement Reporting Center (operated by the Korea Internet & Security Agency)

   Function: Processing reports of personal information infringement, providing advice
   Website: https://privacy.kisa.or.kr
   Telephone Number: 118 (No Area Code)
   Address: Personal Information Infringement Reporting Center, 135, Jungdae-ro, Songpa-gu, Seoul, Korea (05717)

2. Personal Information Dispute Mediation Committee (operated by the Korea Internet & Security Agency)

   Function: Processing of personal information dispute applications, mediation of class action disputes (civil resolutions)
   Website: https://privacy.go.kr
   Telephone Number: 118 (No Area Code)
   Address: Personal Information Infringement Reporting Center, 135, Jungdae-ro, Songpa-gu, Seoul, Korea (05717)

3. Cybercrime Investigation Division of the Supreme Prosecutors’ Office
   82-2-3480-3573 (https://www.spo.go.kr)
4. Cyber Bureau of the Korean National Police Agency
   1566-0112 (https://cyberbureau.police.go.kr)

Article 13 (Installation and Operation of Video Processing System)

S&K installs and operates a video processing system as follows:

1. Purpose of installation and operation of a video processing system: Safety management of S&K, safety of facilities, and prevention of crime
2. Installation location, scope of recording: Installed in major facilities such as lobby and office, and recordings of all entries and exits to and from major facilities and the entire space thereof.
3. Person and department in charge of management, and authorized personnel to access videos: Hyeong-Seok Choi, Head of General Affairs Team
4. Recording time, retention period, storage place, and management procedure of the video information
   1. Recording time: 24 hours
   2. Retention period: 30 days after recording
   3. Storage place and management procedure: Stored and managed at the IT System Operation Center
5. How and where to check the video processing system: Department in charge of the video processing system
   1. Name of department : General Affairs Team
   2. Person in charge : Hyeong-Seok Choi, Deputy General Manager
   3. Contact : T 82-2-316-4902, hsechoi@shinkim.com
6. Actions in response to any request by the data subject to access the image data: A written request must be filed for access, or confirmation of existence, of the personal video data. Such access will be permitted only when the data subject is recorded or when such access is obviously necessary to protect the life, body or property of the data subject.
7. Technical/administrative/physical measures to protect the video data: Establishment of internal management plan, access control, restriction on right of access, safe storage of video data, application of transmission technology, management of storage records, measures for prevention of forgery, preparation of storage facilities, installation of locking devices, and others

Article 14 (Amendment of Privacy Policy)

1. This Privacy Policy is effective as of February 15, 2023
2. The previous version of Privacy Policy can be found at the below.

Privacy Policy version: v. 1.7
Enactment date of Privacy Policy: January 1, 2015
Amendment date of Privacy Policy: February 15, 2023

See the previous Privacy Policy (2015.01.01~2021.12.28)

See the previous Privacy Policy (2021.12.29~2023.01.30)

See the previous Privacy Policy (2023.01.31~2023.02.14)