Privacy Policy

Article 1. Items, Purpose, and Retention Period of Personal Information Processed

The items, purpose, and retention/processing period of personal information processed by MAST are as follows:

In principle, MAST does not collect sensitive information that may heavily infringe upon the privacy of data subjects. If necessary, it collects such information with the separate consent of the data subject and uses it strictly within the limited scope of the agreed purpose.

Article 2. Provision of Personal Information to Third Parties

① In principle, MAST processes the personal information of data subjects only within the scope of the purposes specified in Article 1, and does not process it beyond the original scope or provide it to a third party without the prior consent of the data subject. However, in the following cases, personal information may be used for other purposes or provided to a third party, unless there is a risk of unfairly infringing on the interests of the data subject or a third party:

1. +Where the data subject has given prior consent to third-party provision.
2. +Where special provisions exist in other applicable laws.
3. +Where the data subject or their legal representative is unable to express their intent, or prior consent cannot be obtained due to unknown address, etc., and it is explicitly deemed necessary for the urgent benefit of life, body, or property of the customer or a third party.
4. +Where it is necessary for statistics compilation, academic research, etc., and personal information is provided in a form that renders specific individuals unidentifiable.

② When obtaining consent under paragraph (1) 1, MAST shall inform the data subject of the following matters. If any of the following matters are modified, MAST shall also notify the data subject and obtain consent:

1. +The recipient of the personal information.
2. +The purpose of use of the personal information by the recipient.
3. +The specific items of personal information to be provided.
4. +The retention and use period of personal information by the recipient.
5. +The fact that the data subject has the right to refuse consent, and the details of any disadvantages resulting from such refusal.

Article 3. Entrustment of Personal Information Processing

① MAST does not currently entrust the processing of personal information of data subjects to external entities. Information collected via cookies for website usage analytics is addressed separately in Article 7 (Installation, Operation, and Refusal of Cookies). If any changes occur regarding subcontractors or entrusted duties in the future, we will notify you through this Policy without delay.

② When entering into an entrustment contract, MAST will explicitly specify responsibilities such as prohibition of processing personal information for purposes other than entrusted duties, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages in accordance with relevant laws, and will supervise whether the trustee processes personal information safely.

Article 4. Rights and Obligations of Data Subjects and Methods of Exercise

① Data subjects may exercise their rights related to personal information protection, such as requesting access to, correction, deletion, or suspension of processing of their personal information from MAST in accordance with the Personal Information Protection Act and other relevant regulations.

② The exercise of rights under paragraph (1) may be done through a legal representative or an authorized agent. In this case, a power of attorney in accordance with the Enforcement Rules of the Personal Information Protection Act must be submitted to MAST.

③ MAST will take immediate action regarding the exercise of rights by data subjects in accordance with applicable laws and regulations.

Article 5. Destruction of Personal Information

① In principle, MAST destroys the relevant personal information without delay when the personal information becomes unnecessary, such as when the purpose of processing personal information has been achieved.

② If personal information must be continuously preserved under relevant laws despite achieving the processing purpose, MAST stores and manages the corresponding personal information separately from other personal information.

③ MAST selects personal information for which a cause for destruction has occurred and destroys it upon approval of the Privacy Officer.

④ Personal information stored in electronic file formats is permanently deleted using technical methods that prevent recovery, while other records, printouts, or written documents are shredded or incinerated.

Article 6. Measures to Ensure Safety of Personal Information

MAST takes the following technical, administrative, and physical measures necessary to ensure safety:

• +1. Administrative Measures: Regular data protection and privacy training for all members and employees.
• +2. Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of sensitive data, and installation of security programs.
• +3. Physical Measures: Access control to restricted areas where personal information is physically stored, such as server rooms or archives.

Article 7. Installation, Operation, and Refusal of Cookies

① MAST uses "cookies" that store and periodically retrieve usage information in order to provide optimized information to users. A cookie is a small piece of data sent from the server operating the website to the user's browser, and it may be stored on the user's computer hard disk.

② MAST uses "Google Analytics 4," a web analytics tool provided by Google, to analyze visitor numbers and usage patterns for the purpose of improving its services. Google Analytics collects de-identified statistical information via cookies, including pages visited, time spent, device and browser information, and general access region, and the collected information may be transmitted to and processed on servers operated by Google LLC (or Google Ireland Limited). Google's privacy policy is available at policies.google.com/privacy.

③ Users may refuse the storage of cookies or delete stored cookies through their web browser settings (e.g., Tools › Internet Options › Privacy menu). Please note that refusing cookies may cause some difficulty in using certain services.

④ If a user does not wish to have information collected through Google Analytics, they may opt out by installing the "Google Analytics Opt-out Browser Add-on" provided by Google: tools.google.com/dlpage/gaoptout

Article 8. Modification of Privacy Policy

This Policy may be amended in accordance with relevant laws, guidelines, or internal regulations of MAST. In the event of an amendment, the timing of implementation and the modified contents will be continuously disclosed on the website (www.mastlaw.co.kr). Modified versions will be presented with a clear comparison between pre- and post-amendment states for ease of verification.

Article 9. Remedies for Infringement of Rights

Data subjects may contact the following organizations for reports or consultations regarding personal information infringement:

1. +Personal Information Dispute Mediation Committee : www.kopico.go.kr (+82-1833-6972)
2. +Personal Information Infringement Report Center (KISA) : privacy.kisa.or.kr (Dial 118 within Korea)
3. +Cybercrime Investigation Division, Supreme Prosecutors' Office : www.spo.go.kr (+82-2-3480-3573)
4. +Cyber Bureau, National Police Agency : cyberbureau.police.go.kr (Dial 182 within Korea)