PRIVACY POLICY

This Privacy Policy explains how LG Chem, Ltd. (“LG Chem”, “the Company,” “we”, “our”, or “us”) collects your personal information as you use lgchem.com (the “Website”), how we use this personal information, with whom we share this personal information, and your choices in connection with this.

This Policy consists of the following contents:

■ What data do we collect and how we use it?

■ With whom do we share with your data?

■ Where do we transfer your data?

■ What are your rights?

■ Collection and use of information from children

■ How do we protect your data?

■ How to contact us

■ How to contact the supervisory authority

■ Changes to our Privacy Policy

- Appendix I. Supervisory authority

- Addendum to Privacy Policy for California

This Privacy Policy applies specifically to the processing of personal data through the Website and does not apply to any other LG Chem related websites, apps, services or survey.
• To learn how we use or share personal information when you apply for a position with LG please see here
• To learn how we use or share personal information when you contact our ethics hotline see here
• To learn how we use or share personal information when you use lgchemon.com please see here
• To learn how we use or share personal information when you use procurement.lgchem.com please see here
• To learn how we use or share personal information when you use partners.lgchem.com please see here
• To learn how we use or share personal information when you use lamp.lgchem.com please see here
• To learn how we use or share personal information when you use innovation.lgchem.com please see here
• To learn how we use or share personal information when you participate our clinical trial please see

■ What data do we collect and how we use it?

A. Information we collect from you

If you choose to engage in the services offered on our Website, we will collect personal information from you when you contact us through the submission of your personal identifiers. We use this personal information to respond to your questions or inquiries, and provide consultation. We may also use the personal information we collect as described in this section to comply with the law or for the purpose of the legitimate interests, and for other limited circumstances as described in With Whom do we share your information?

• Information from You

Categories of Service/Information		Description	Purpose and Legal Basis	Retention Period
1:1 Inquiry	Product Inquiry	Company name, Email, Phone number, Region	To provide customer service based on your consent	1 year from the inquiry/survey submission
1:1 Inquiry	General Inquiry	Email, Phone number		1 year from the inquiry/survey submission
Customer Satisfaction Survey		Company name, Name, Email, Contact		3 months from the survey submission
Sustainable Partnership Program		Name, Email, company (research institute) name, country		To be disposed of when the information subject requests its disposal
Sensitive Information		We do not collect sensitive information from you for any purpose.	N/A	N/A

B. Information Collected Automatically

In addition to the personal information you provide, when you use our Website, LG Chem automatically collects the usage, device, and location information via cookies and similar technologies. We use cookies to collect information on your use of the Website to improve our Website. We do not combine the information collected through cookies with personally identifiable information. The retention period of cookies used on the Website is notified in the Cookie Setting

• Usage information.

This includes information such as: your time of visit to the Website, pages visited, search terms, actions taken, how much time you spend on each page, transactions and payment method and amount, or customer objects throughout the Website and frequency of access. We use this personal information to: (i) conduct analytics; (ii) enhance user experience; (iii) prevent fraudulent use of the Website; and (iv) diagnose and repair errors.

• Device information.

This includes information about the device you use to access our Website, such as browser type, browser language, hardware model, operating system, and your preferences. We use this personal information to: (i) conduct analytics; (ii) enhance user experience; (iii) prevent fraudulent use of the Website; (iv) diagnose and repair errors; and (v) provide enhanced functionality.

• Location information.

This includes information about your location, which may be determined through your IP address.

• Google Analytics.

We use Google Analytics to collect information on your use of the Website to improve our Website. In order to collect this information, Google Analytics may set cookies on your browser, or read cookies that are already there. Google Analytics may also receive information about you from applications you have downloaded that partner with Google. You may choose not to allow analytical cookies in the Cookie Setting on our Website. To see a list of all cookies we use and to control your cookie preferences, please follow the instructions in the What are your rights? section.

- Google’s ability to use and share information collected by Google Analytics about your visits to our Website or to another application which partners with Google is restricted by the Google Analytics Terms of Use and the Google Privacy Policy available here.
- To prevent your data from being used by Google Analytics, you can download the Google Analytics opt-out browser add-on for Google Analytics which can be found here.

■ With Whom do we share with your data?

LG Chem may need to make the personal information identified in this Privacy Policy available within LG Chem subsidiaries, with its service provider, or with other third parties.

• Within LG Chem.

We may share your personal information with LG Chem subsidiaries for legitimate business purposes and general business management. When a customer registers an inquiry or survey, the inquiry or survey details are sent by e-mail to the person in charge of the selected product and region, and the person in charge registers an answer by accessing the admin page. For your personal information collected by Ethics Hotline connected by link on the Website, Ethics Hotline may provide your personal information to LG Chem if the case is related to LG Chem. If the inquiry or survey or grievance is related to LG Chem subsidiaries, we may need to share your personal information with our subsidiaries for a legitimate business purpose.

• With service provider.

LG Chem shares your personal information with its service provider for Website maintenance, inquiry processing, sending and processing customer satisfaction surveys.

• For legal purposes.

LG Chem will share your personal information where legally required, in response to court orders, law enforcement or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to contracts; to defend against legal claims or demands; to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person; or to comply with the requirements of any applicable law.

■ Where do we transfer your data?

As a global company, we, our subsidiaries, and service providers may need to transfer your information outside the country where you are located. This includes transferring your information outside the European Economic Area, if this is where you are located. We transfer your personal information in connection with providing this manner in order to provide you with our Website. You will need to provide your consent to this in order to use the Website. LG Chem located in Republic of Korea (“Korea”) and the EU and Korea formally adopted an adequacy agreement on transfers of personal information This adequacy decision means that the Korea ensures an adequate level of protection with regard to the protection of personal information. You should also bear in mind that the data protection laws in many of these countries may not offer the same level of protection as those in the country where you are located. However, before transferring your Personally Identifiable Information we will take steps to ensure that safeguards are put in place aimed at ensuring such information will be afforded the same level of protection.

■ What are your rights?

You have all applicable data protection rights under relevant laws including the following:
The right to access – You have the right to request us for copies of your personal information.
The right to rectification – You have the right to request that we correct any information that is inaccurate. You also have the right to request us to complete information that is incomplete.
The right to erasure – You have the right to request that we erase your personal information, under certain conditions.
The right to restriction of processing – You have the right to request that we restrict the processing of your personal information, under certain conditions.
The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
The right to object – You have the right to object the processing of your personal information which we process in connection with website under the conditions given under applicable law. If in exceptional cases the data processing is based on your consent, your consent can be revoked at any time with effect for the future. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the revocation.
Do Not Track – We do not respond to Do Not Track (“DNT”) requests. Do Not Track is a preference you can set in your web browser to inform the Website that you do not want to be tracked. You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser.

To the extent applicable, please also refer to the “Addendum to Privacy Policy for your country or region” hereto.

If you make a request, we will respond to you without undue delay, but at any rate within the timeframe as stipulated by law if such exists. If you would like to exercise any of these rights, please contact us by using the information in the How to contact us section below

■ Collection and use of information from children

Our Website is designed for a general audience and is not directed towards children. In connection with our Website, we do not knowingly collect or maintain personal information from anyone under the age of sixteen (16) or knowingly allow such persons to use our Website. If you are under the age of sixteen (16), please do not attempt to register for our Website or provide us with any personal information. If we learn that a person under the age of sixteen (16) has provided us with any personal information, we will promptly delete such personal information. If you believe that a child under the age of sixteen (16) may have provided us with personal information, please contact us using the information specified in the How to contact us section.

■ How do we protect your data?

LG Chem shall take the following technical and organizational security measures to protect your data:

• Maintain Information security policies and make sure that policies and measures are regularly reviewed and where necessary improved.
• Communication with the Company applications utilizes cryptographic protocols such as TLS to protect information in transit over public networks. At the network edge, firewalls, web application firewalls, and DDoS protection are used to filter attacks.
• Data security controls which include logical segregation of data, restricted (e.g. role-based) access and monitoring, and where applicable, utilization of commercially available and industry-standard encryption technologies.
• Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.Physical and environmental security of data center, server room facilities and other areas containing client confidential information designed to: (i) protect information assets from unauthorized physical access, (ii) manage, monitor and log movement of persons in and out of the Company facilities, and (iii) protections against environmental hazards such as heat, fire and water damage.
• Operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from the Company possession.
• Network security controls that provide for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
• Vulnerability assessment, patch management, and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.

As described above, we implement and maintain reasonable security measures to protect the personal information we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. However, no security measure or modality of data transmission is 100% secure and we are unable to guarantee the absolute security of the personal information we have collected from you.

■ How to contact us

If you have any questions or concerns on this Privacy Policy, please contact us at:

LG Chem
LG Twin Towers 128, Yeoui-daero, Yeongdeungpo-gu, Seoul
security@lgchem.com

LG Chem will promptly respond to address the concern.

For the purposes of EU data protection legislation, LG Chem Europe subsidiaries’ Data Protection Officer can be contacted at drewes@privacy-advice.com.
LG Chem HQ Data Protection Officer can be contacted at dpo.lgchem@kdpc.uk.

■ How to contact the supervisory authority

Should you wish to report a complaint or if you feel that the Company has not addressed your concern in a satisfactory manner, you may contact the responsible supervisory authority using the contact details:

[Appendix I.] Supervisory Authority

■ Changes to our privacy policy

LG Chem keeps this Privacy Policy under regular review and places any updates on this web page. This Privacy Policy was last updated on [2023-08-29].

Appendix I. Supervisory Authority

Table 1: Supervisory Authority

Country	Organization name	Point of Contact
Republic of Korea	Korea Internet & Security Agency	https://privacy.kisa.or.kr
Germany	Landesdatenschutzbeauftragten Hessen	https://datenschutz.hessen.de/
US	Federal Trade Commission	https://www.ftc.gov
Poland	Urząd Ochrony Danych Osobowych	https://www.uodo.gov.pl/en
China	中华人民共和国国家互联网信息办公室	https://www.cac.gov.cn
Brazil	Autoridade Nacional de Proteção de Dados	https://www.gov.br/anpd/pt-br
Mexico	Instituto Nacional de Transparencia, Acceso a la Infomacion y Proteccion de Datos Personales	https://home.inai.org.mx
Türkiye	Kişisel Verileri Koruma Kurumu	https://www.kvkk.gov.tr/
Viet Nam	Ministry of Information and Communications	http://www.mic.gov.vn/
Indonesia	Badan Siber Dan Sandi Negara	https://bssn.go.id/
Thailand	Ministry of Digital Economy and Society	https://www.mdes.go.th/
Taiwan	國發會個人資料保護專區	pipa.ndc.gov.tw
Australia	Office of the Australian Information Commissioner	https://www.oaic.gov.au
Singapore	Personal Data Protection Commission	https://www.pdpc.gov.sg
Malaysia	Jabatan Perlindungan Data Peribadi	https://www.pdp.gov.my/jpdpv2/
India	Unique Identification Authority of India	https://uidai.gov.in/
Japan	Personal Information Protection Commission	https://www.ppc.go.jp/
UK	Information Commissioner's Office	https://ico.org.uk/

Addendum to Privacy Policy for California

This Addendum to Privacy Policy for California (this “Addendum”) applies to the processing of personal information collected from the California residents. This addendum explains the categories of personal data that we collect from you and how we collect and use personal data that is subject to the California Privacy Rights Act(the “CPRA”). It further describes the rights that California residents have with respect to their personal data. This addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this addendum will prevail as to personal data of California residents that is subject to the CPRA. For purposes of this addendum, the term “personal data” includes all “personal information” as defined in the CPRA.

A. Your legal rights

In addition to the rights explained in the Privacy Policy, under certain circumstances, California residents have the following rights in relation to their personal data:

• Right to opt-out. You have the right to opt out of any sale or “sharing” of your personal information (as the term “sharing” is defined under California law, which means a disclosure to a third party for purposes of cross-context behavioral advertising).
• Right to non-discrimination. You have the right to exercise any of the rights listed above (and any other rights under CPRA) without discrimination by us.
• Right to limit the use and disclosure of sensitive information.

To exercise your right to access or delete your personal information, you may submit a request via telephone at 82-1644-7119 or via email in How to contact us.

For requests submitted via telephone, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.

B. Sources of, purposes for collecting, and categories of personal data collected and disclosed

We obtain your personal data mainly from or via you, and we collect and process personal data for a business purpose.

In the preceding twelve (12) months, we have collected the following categories of personal data from California residents. Please note that the following list represents categories of personal data across all California residents whose personal data we may have collected or received and does not necessarily represent information we have collected specifically about you. Please also note that the definition of “personal information” under CPRA is subject to certain exceptions as set forth therein and does not include information that is publicly available or has been aggregated or deidentified in accordance with CPRA.

• Identifiers. This includes information such as name, email address, telephone number, national identification number(or unique identification data equivalent thereto) and other similar identifiers.
• Personal information as defined by Cal. Civ. Code § 1798.80(e): The types of personal data in this category include several of the identifiers described above but also includes, among other things, information such as corporate credit card number.
• Certain protected classifications. Information under this category may include medical history.
• Professional or employment-related information. This includes information such as name of company/department and job title.
• Education Information. Educational background including majored fields of study.
• General information such as date of birth, age, sex, height, and weight.
• Internet or network activity. The types of information in this category includes information that relates to IP address and access records.

In the preceding 12 months, we may have disclosed or shared to service providers and our subsidiaries for a business purpose the categories of personal data listed above.

C. Sales of personal data

We do not sell your personal data for monetary consideration.

This Privacy Policy explains how LG Chem Ltd., Korea, (“LG Chem”, “Company”, “we”, “our”, or “us”) collects your personal information when we conduct clinical trials (a “Trial” or the “Trials”), how we use this personal information, with whom we share this personal information, and your choices in connection with this.
LG Chem as the sponsor of the Trial, is the “Data Controller”for your personal information in connection with the Trial. We will contract with service providers, such as Contract Research Organizations (“CROs”), or other service partners to collect and analyze Trial data.

This Privacy Policy consists of the following contents:

■ What data do we collect?

■ How will we use your data?

■ How long do we keep your data?

■ With whom do we share with your data?

■ Where do we transfer your data?

■ What are your rights?

■ Collection and use of information from children

■ How do we protect your data?

■ How to contact us

■ How to contact supervisory authority

■ Changes to our Privacy Policy

■ What data do we collect?

• Trial Participants

Through our CROs, LG Chem collects, uses, stores, and analyses data and biological samples related to Trial participants. Information which immediately identifies a Trial participant such as individual’s name, contact number, and date of birth are not included in records or samples collected by LG Chem during Trial process. Data collected by each clinical site is given a unique sequential identification code number instead of individual’s name before it is transferred to LG Chem to protect privacy. As a Trial sponsor, LG Chem may request direct access to your personal information for a legitimate purpose such as Trial participant’s safety in the case of an adverse event. In such cases, some third parties such as an insurance company may engage with the investigation of an adverse event as needed.

• Trial Personnel

LG Chem may process the personal information of Trial personnel such as CVs and medical licenses based on our legitimate interests or legal obligations in facilitating the operation of our business and conducting trials.

■ How will we use your data?

We will process Trial participants’ personal information so that we can:
• assess eligibility of potential participants for Trials;
• conduct the Trials;
• conduct related scientific and medical research;
• ensure that Trial drug is safe;
• meet any legal and regulatory requirements LG Chem is subject to, or that may be imposed upon LG Chem.
We also may process your information for the additional purposes as described in the Informed Consent Form (“ICF”) provided to you.

For the processing of personal data relating to individuals in the European Economic Area and the UK, we will rely on the GDPR lawful basis of legitimate interests (Article 6(1)(f) and the Article 9(2)(j) exception of the management of approved clinical trials.

We will process Trial personnel information so that we can:
• assess qualification of Trial personnel to conduct Trials;
• manage our relationship with Trial personnel;
• contact Trial personnel for planning and organizing the Trials;
• meet any legal and regulatory requirements LG Chem is subject to, or that may be imposed upon LG Chem.

For the processing of personal data relating to individuals in the European Economic Area and the UK, we will rely on the GDPR lawful basis for compliance with a legal obligation (Article 6(1)(c) and the Article 9(2)(b) exception of employment.

■ How long do we keep your data?

LG Chem will keep your personal information until we fulfill the purpose of Trials, or for as long as required by applicable law.
LG Chem is required to retain data in accordance with the laws relating to Trials. For example, European Union law requires us to keep personal information that is part of the Trial for at least twenty-five years after the completion of the applicable trial. Other laws may require different retention periods.

■ With whom do we share with your data?

LG Chem may make the personal information identified in this Privacy Policy available within LG Chem subsidiaries, with regulatory agencies, with its service providers or with other third parties for purposes where lawful to do so or when legally obliged to do so under applicable law. Below, we list some purposes for which we may share your data.

• Within LG Chem

We may share Trial data including your personal information with LG Chem subsidiaries for purposes that are relevant to LG Chem to sponsor and conduct Trials, legitimate business purposes and business management.

• With Regulatory Agencies

We may share your data with certain applicable regulatory agencies who have authority over the conduct of Trials. For example, we may share your data with the regulatory agencies as required to comply with certain reporting and regulatory obligations.

For the processing of personal data relating to individuals in the European Economic Area and the UK, we will rely on the GDPR lawful basis of legal obligation (Article 6(1)(c) and the Article 9(2)(i) exception of ensuring high standards of quality and safety of health care.

• With Service Provider/Third Parties

We may share your data with service providers such as CROs, or third parties who reasonably need to process your data for conducting Trials. The service providers and third parties will protect your data through the adoption of adequate security measures.

■ Where do we transfer your data?

LG Chem, service providers and other third parties may be located in a third country in which you are not located.

LG Chem is located in Republic of Korea (“Korea”) and the EU and Korea formally adopted an adequacy agreement on transfers of personal information. This adequacy decision means that the Korea ensures an adequate level of protection as the EU with regard to the protection of personal information.

When required to by law and international agreements, we may need to transfer data to regulatory authorities (for example when there has been a reportable health incident in one of the trials).

The laboratory for clinical trial can be located outside EU or countries where an adequacy agreement has not been adopted. Samples collected from all trial sites will be sent to the laboratory for analysis. The information sent to the laboratory, and the transmitted results, will carry the sample collection information (e.g date, time) and identifier of the trial participant depending on clinical trial design. In so far as this is personal data protected by the UK and EU GDPR, adequate safeguards have been put in place to protect the data, and UK and EU Standard Contractual Clauses have been put in place to protect personal data that are processed.

We will maintain agreements with all applicable parties related to ensure privacy at all times. The agreements will comply with the latest legal requirements of your country, including the requirements from the European General Data Protection Regulation if applicable.

■ What are your rights?

You have all applicable data protection rights under relevant laws including the following:
The right to access– You may have the right to request us for copies of your personal information.

The right to rectification– You may have the right to request that we correct any information that is inaccurate. You also may have the right to request us to complete information that is incomplete.

The right to erasure– You may have the right to request that we erase your personal information, under certain conditions.

The right to restriction of processing– You may have the right to request that we restrict the processing of your personal information, under certain conditions.

The right to data portability– You may have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

The right to object– You may have the right to object the processing of your personal information which we process in connection with Trials under the conditions given under applicable law. If in exceptional cases the data processing is based on your consent, your consent may be revoked at any time with effect for the future. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the revocation.

To the extent applicable, please also refer to the “Addendum to Privacy Policy for your country or region” hereto.

If you make a request, we will respond to you without undue delay, but at any rate within the timeframe as stipulated by law if such exists. If you would like to exercise any of these rights, please contact us by using the information in the “How to contact us” section below. Trial participants should also consider contacting their clinical site directly.

LG Chem will also ensure contractually that the CROs provide all required support to comply with lawful requests made by persons whose data LG Chem controls or processes.

■ Collection and use of information from children

Trials will be conducted only for adults over the age of 18 (or the legal age of adulthood in your country). We do not knowingly collect or solicit information from anyone under the age of 18 (or the legal age of adulthood in your country) or knowingly allow such persons participate our Trials, in each case without the consent given or authorized by the holder of parental responsibility over the child..

■ How do we protect your data?

LG Chem takes the following technical and organizational security measures to protect your data:

• Maintain Information security policies and make sure that policies and measures are regularly reviewed and where necessary improved.
• Communication with the Company applications utilizes cryptographic protocols such as TLS to protect information in transit over public networks. At the network edge, firewalls, web application firewalls, and DDoS protection are used to filter attacks.
• Data security controls which include logical segregation of data, restricted (e.g. role-based) access and monitoring, and where applicable, utilization of commercially available and industry-standard encryption technologies.
• Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.
• Physical and environmental security of data center, server room facilities and other areas containing client confidential information designed to: (i) protect information assets from unauthorized physical access, (ii) manage, monitor and log movement of persons in and out of the Company facilities, and (iii) protections against environmental hazards such as heat, fire and water damage.
• Operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from the Company possession.
• Network security controls that provide for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
• Vulnerability assessment, patch management, and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.

■ How to Contact Us

If you have any questions or concerns about how your personal information is used, or if you want to exercise your rights granted under the applicable data protection law, please contact us at:
LG Chem
LG Twin Towers 128, Yeoui-daero, Yeongdeungpo-gu, Seoul
security@lgchem.com LG Chem will promptly respond to address your question or concern. Trial participants should also consider contacting their clinical sites directly.

For the purposes of EU data protection legislation, LG Chem Europe subsidiaries’ Data Protection Representative can be contacted at drewes@privacy-advice.com.

LG Chem HQ Data Protection Officer can be contacted at dpo.lgchem@kdpc.uk.

■ How to contact the supervisory authority

Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact the responsible supervisory authority using the contact details below:

[Appendix I.] Supervisory Authority

■ Changes to our Privacy Policy

We keep this Privacy Policy under regular review and place any updates on LG Chem official homepage. This Privacy Policy was last updated on [2023-03-21].

Addendum to Privacy Policy for California

This Addendum to Privacy Policy for California (this “Addendum”) applies to the processing of Trial participants’ personal information collected from the California. This Addendum explains the categories of personal data that we collect from you and how we collect and use personal data that is subject to the California Privacy Rights Act(the “CPRA”). It further describes the rights that California residents have with respect to their personal data. This Addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this Addendum will prevail as to personal data of California residents that is subject to the CPRA. For purposes of this Addendum, the term “personal data” includes all “personal information” as defined in the CPRA.

Your legal rights

In addition to the rights explained in the Privacy Policy, under certain circumstances, California residents have the following rights in relation to their personal data:

• Right to opt-out.You have the right to opt out of any sale or “sharing” of your personal information (as the term “sharing” is defined under California law, which means a disclosure to a third party for purposes of cross-context behavioral advertising).
•Right to non-discrimination. You have the right to exercise any of the rights listed above (and any other rights under CPRA) without discrimination by us.
•Right to limit the use and disclosure of sensitive information.

To exercise your right to access or delete your personal information, you may submit a request via telephone at 82-1644-7119 or via email in “How to contact us.”

Sources of, purposes for collecting, and categories of personal data collected and disclosed

We obtain your personal data mainly from or via you, and we collect and process personal data for a business purpose.

• Identifiers. This includes information such as name, email address, telephone number, national identification number(or unique identification data equivalent thereto) and other similar identifiers.
• Personal information as defined by Cal. Civ. Code § 1798.80(e): The types of personal data in this category include several of the identifiers described above but also includes, among other things, information such as corporate credit card number.
• Certain protected classifications. Information under this category may include medical history.
• Professional or employment-related information. This includes information such as name of company/department and job title.
• Education Information. Educational background including majored fields of study.
• General information such as date of birth, age, sex, height, and weight.
• Internet or network activity. The types of information in this category includes information that relates to IP address and access records.

In the preceding 12 months, we may have disclosed or shared to service providers and our subsidiaries for a business purpose the categories of personal data listed above.

Sales of personal data

We do not sell your personal data for monetary consideration.

Addendum to Privacy Policy for Taiwan

This Addendum to Privacy Policy for Taiwan (this “Addendum”) applies to the processing of Trial participants’ personal information collected from Taiwan. This Addendum explains more details of how we use personal data and what are your rights subject to the relevant laws of Taiwan. This Addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this Addendum will prevail as to personal data processing of Taiwan residents. For purposes of this Addendum, the term “personal data” includes all “personal information” as defined in the relevant laws of Taiwan.

What are your data protection rights?

If you make a request in terms of your right to access your data, we will determine whether to accept or reject your request within fifteen days; such deadline may be extended by up to another fifteen days if necessary, and we will notify you of the reason for the extension in writing. If you make a request in terms of your other rights above, we will determine whether to accept or reject your request within thirty days; such deadline may be extended by up to another thirty days if necessary, and we will notify you of the reason for the extension in writing.

How will we use your data?

We do not use your personal data for conduct marketing activities. All processing purposes mentioned above are considered primary purposes.

Addendum to Privacy Policy for Thailand

This Addendum to Privacy Policy for Thailand (this “Addendum”) applies to the processing (as defined below) of Trial participants’ personal data located in Thailand. This Addendum supplements and constitutes an integral part of the Privacy Policy.

Definition and Interpretation

1. The term "process/processing" as used in the Privacy Policy shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as the collection, use, disclosure or cross-border transfer of the personal data.
2. The terms "personal data", "data controller", "data protection officer" and "representative" as used in the Privacy Policy shall have the meanings as defined in the Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
3. All references to the term "personal information" in the Privacy Policy shall be replaced with the term "personal data".
4. The terms used in this Addendum shall have the same meanings as defined under the Privacy Policy unless otherwise defined in this Addendum.

The Information We Process

The personal data as mentioned in this Privacy Policy is collected mainly if you choose to provide it, although some personal data has to be provided. If mandatory information is not provided, to the extent permitted by law, may affect our ability to perform our contractual or legal obligations.

How We Process Information

We process your personal data on the following legal bases: (a) consent; (b) contractual basis (e.g., for our performance of or fulfilment of obligations under a contract with you); (c) legal obligation (for the fulfilment of our legal obligations); (d) legitimate interests (for the purpose of our legitimate interests and the legitimate interests of third parties, in proportion to your interest and fundamental rights and freedoms in relation to the protection of your personal data); (e) vital interest (such as preventing or suppressing a danger to a person’s life, body or health); (f) public interest (for the performance of a task carried out in the public interest or for the exercise of official authorities); (g) establishment of, compliance with, exercise of or defense against legal claims; or (h) any other basis permitted by applicable laws, including the PDPA.

In certain limited circumstances and where required under the PDPA, we may need to ask for your specific consent separately to process your personal data in a particular way. However, in most cases we will process your personal data for the reasons set out in this Privacy Policy and it will not be appropriate or necessary for you to provide consent.

Your Rights

Your rights under the PDPA. If you are in Thailand, you may have the following rights in accordance with the PDPA:

• Right to access under Section 30 of the PDPA;
• Right to rectification under Section 36 of the PDPA;
• Right to erasure under Section 33 of the PDPA;
• Right to restriction under Section 34 of the PDPA;
• Right to data portability under Section 31 of the PDPA;
• Right to object to the data processing under Section 32 of the PDPA;
• Right to withdraw your consent under Section 19 of the PDPA; and
• Right to lodge a complaint with the competent supervisory authority under Section 73 of the PDPA.

Where is your Information - International Transfer of Information

Where the data recipients are located in a country outside of Thailand ("Third Country"), we rely on (where applicable) the adequacy decisions issued by the Personal Data Protection Committee declaring that the Third Country in question ensures an adequate level of protection comparable to the ("Adequacy Decision").

Where the data recipients are located in Third Countries which are not covered by an Adequacy Decision, we will rely on the appropriate safeguards within the meaning of Section 29 of the PDPA, such as Standard Contractual Clauses which (as supplemented by additional contractual, technical or organizational measures, where necessary) ensure an adequate level of data protection. You can contact our DPO in order to obtain more information about our international data transfers and the appropriate safeguards we rely on.

Security

In order to prevent unauthorized or unlawful loss, access, use, alteration, correction or disclosure of your personal data, we have established and/or opted to use a system to process personal data, whether in hard copy, electronic files and/or any other form, with appropriate security measures, including organizational, technical and physical measures, covering the components of the relevant information system, taking into account the security implementation specified by the applicable laws on personal data protection in order to properly maintain confidentiality, integrity, and availability of the personal data according to the relevant level of risk. This includes controlling access to personal data and critical information system components, appropriate handling of user access, determining user's responsibilities, and putting in place appropriate measures for audit logging to detect access, alteration, correction or deletion of personal data. We also arrange the enhancement of knowledge and understanding related to personal data protection and security of the personnel concerned.

Appendix I.

Supervisory Authority

Table 1: Supervisory Authority

Country	Organization name	Point of Contact
Republic of Korea	Korea Internet & Security Agency	https://privacy.kisa.or.kr
Germany	Landesdatenschutzbeauftragten Hessen	https://datenschutz.hessen.de/
US	Federal Trade Commission	https://www.ftc.gov
Poland	Urząd Ochrony Danych Osobowych	https://www.uodo.gov.pl/en
Brazil	Autoridade Nacional de Proteção de Dados	https://www.gov.br/anpd/pt-br
Thailand	Ministry of Digital Economy and Society	https://www.mdes.go.th/
Taiwan	國發會個人資料保護專區	pipa.ndc.gov.tw
Australia	Office of the Australian Information Commissioner	https://www.oaic.gov.au
Czech Republic	Office for Personal Data Protection	https://www.uoou.cz
Spain	Agencia Española de Protección de Datos	https://www.aepd.es/es
Argentina	Agencia Española de Protección de Datos	https://www.argentina.gob.ar/aaip
Belgium	Autorité de protection des données	https://www.dataprotectionauthority.be/citizen
Bulgaria	Комисия за защита на личните данни	http://www.cpdp.bg/
Colombia	Superintendent of Industry and Commerce	https://www.sic.gov.co/en/about-us
France	Commission Nationale de l'Informatique et des Libertés	https://www.cnil.fr/
Georgia	State Inspector Service	www.personaldata.ge
Italy	Garante per la protezione dei dati personali	https://www.garanteprivacy.it/
Lithuania	State Data Protection Inspectorate and the Inspector of Journalist Ethics	https://vdai.lrv.lt/en
New Zealand	Privacy Commissioner’s Office	www.privacy.org.nz
Philippines	National Privacy Commission	https://www.privacy.gov.ph/