1. Purpose of Personal Information Processing

The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those listed below, and if the purpose of use is changed, necessary measures such as obtaining separate consent will be implemented in accordance with the Personal Information Protection Act.

2. Processing and Retention Period of Personal Information

• The Company processes personal information for the following purposes:

  • Identity verification for visitor access registration
  • Employee management including HR, payroll, welfare, and training
  • Facility and security management, accident prevention, and CCTV operation
  • Delivery of work-related notices and information
  • Record retention for compliance with laws and internal regulations

• Personal Information Retention Period

  • Visitor information: Retained for 3 years from the last exit date, then destroyed
  • Employee information: Retained for 3 years from the resignation date, then destroyed
  • However, if retention is required by applicable laws, the information will be retained for the required period

4. Provision of Personal Information to Third Parties

The Company provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as when the data subject has given consent or when special provisions exist under applicable laws.

• When separate consent is obtained from the data subject
• When required by special provisions of other laws
• When necessary to protect the urgent life, body, or property interests of the data subject or a third party
• When necessary to perform statutory duties and approved by the Personal Information Protection Commission
• When necessary for the implementation of treaties or international agreements
• When necessary for criminal investigations or prosecution
• When necessary for court proceedings
• When necessary for the execution of punishment, detention, or protective measures
• When urgently required for public safety and welfare

6. Procedures and Methods for Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary due to expiration of the retention period or achievement of processing purposes.

• Destruction Procedure

  • Personal information of visitors, partners, and employees is deleted immediately using irrecoverable technical methods after the purpose of use is achieved and the retention period has expired.

• Destruction Method

  • Printed personal information: Shredded or incinerated
  • Electronic files: Permanently deleted using methods that prevent recovery
  • If separate retention is required by other laws, information is stored separately and destroyed accordingly

7. Rights and Obligations of Data Subjects and Legal Representatives

• Data subjects may exercise rights such as access, correction, deletion, suspension of processing, and withdrawal of consent at any time.
• Rights may be exercised in writing, by email, or by fax in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act.
• Rights may also be exercised through an authorized representative with a power of attorney.
• Access and suspension requests may be restricted under Articles 35(4) and 37(2) of the Act.
• Requests for correction or deletion cannot be made if personal information is required to be collected by other laws.
• The Company verifies the identity of the requester when handling rights-related requests.
• Requests for access to personal information may be submitted to the department listed below.
• If objections arise regarding the handling of personal information, data subjects may submit an objection, and the Company will review and respond within 10 days.

8. Measures to Ensure the Security of Personal Information

• Administrative Measures

  • Establishment and implementation of internal management plans
  • Minimization of access rights through role separation and least privilege principles
  • Regular inspections and restriction of personal information handling tasks
  • Operation of a dedicated organization for personal information protection

• Technical Measures

  • Encryption of personal information during storage and transmission
  • Installation and regular updates of security systems to prevent leakage and damage
  • Regular vulnerability assessments against internal and external hacking threats
  • Retention of access logs for at least two years
  • Strict control over access rights to database systems

• Physical Measures

  • Separate physical storage locations with access control procedures

10. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation regarding personal information infringement through the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency.

- Related Organizations

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)

11. Fixed Video Information Processing Devices

The Company operates fixed video surveillance systems (CCTV) for facility safety, fire prevention, and crime prevention in accordance with Article 25(1) of the Personal Information Protection Act.

Details such as installation locations, recording scope, managers, and retention periods are provided in the separately established “Fixed Video Information Processing Device Operation and Management Policy.”

12. Notification of Changes to This Policy

This Personal Information Processing Policy shall take effect on January 1, 2026.

Any additions, deletions, or modifications to this policy will be announced on the Company website or through notices at least seven days prior to the effective date.

1. Basis and Purpose of Video Device Installation

The Company installs and operates video processing devices in accordance with Article 25, Paragraph 1 of the Personal Information Protection Act for the following purposes:

• Security, facility safety, and fire prevention
• Crime prevention to ensure customer safety
• Prevention of vehicle theft and damage

5. How and Where to Access Video Data

• Access Method: Contact authorized personnel in advance and visit the designated location.
• Access Location: JR Energy Solution Security Office and designated site (17 Geori-naegil, Eumseong-gun, Chungbuk)

6. Requests for Viewing or Deletion by Data Subjects

Individuals may request to view, confirm, or delete personal video data at any time through the IT & Information Security Team. Requests are limited to data clearly involving the individual or necessary for the protection of life, body, or property. Required actions will be taken promptly upon request.

7. Measures to Ensure Video Data Security

Video data is securely managed through encryption and access control measures. Management measures include recording creation time, access purpose, personnel, and access time to prevent tampering. Additional secure physical storage is also provided.