The Company processes personal information for purposes as described below. The personal information processed is not used for purposes other than the intended purposes described below. If the purpose of use is changed, necessary measures, such as obtaining separate consent, will be taken in accordance with Article 18 of the PIPA.

Personal information will be processed for the following purposes: confirmation of subscription to the Company’s Clarios Experience Platform services (“CXP”); identification and authentication related to CXP; maintenance and management of subscription to CXP; prevention of wrongful use of CXP; announcements and notifications; and handling of grievances.

A. The Company processes and retains personal information within the period prescribed by laws and regulations or within the period agreed upon by the data subject at the time of collecting personal information.

B. The period of processing and retaining personal information will be as follows:

• Subscription to CXP and management thereof: until withdrawal of subscription, except otherwise provided below:
1. If any investigation is pending related to violation of relevant laws and regulations, until the investigation is completed; and
2. If any claim-obligation relationship exists related to the use of CXP, until the claim is settled.

The Company processes the following items of personal information.

• Required items: name, address, and phone number

A. For the efficient processing of personal information, the Company outsources personal information processing as follows.

Outsourcee	Scope of Outsourcing
WD
POS
Clarios Affiliates

B. When entering into an outsourcing agreement, the Company

(a) Ensures that the outsourcing agreement contains clauses related to

1. The prohibition of personal information processing for purposes other than that necessary to perform the outsourced work
2. Technical and administrative measures to protect personal information
3. Restriction on re-outsourcing
4. Management and supervision over the outsourcee
5. Liabilities and damage

(b) Supervises the outsourcee to ensure that they safely process personal information, in accordance with Article 26 of the PIPA.

(c) If the outsourcee or the scope of the outsourced work is changed, the Company will disclose it through this Privacy Policy without delay.

A. For efficient business processing, the Company outsources the processing of collected personal information to Phase Zero Ventures LLC, an overseas entity, as follows:

• Name of Transferee: Phase Zero Ventures LLC
• Address of Transferee: 4906 El Camino Real 201, Los Altos, CA 94022, USA
• Date and Method of Transfer: To be hosted on cloud servers located in the United States on May 16, 2022
• Items of Personal Information to Be Transferred: Name, Address, Phone Number
• Contact Information of Chief Privacy Officer: Baeyoung.park@clarios.com
• Purpose of Use of Personal Information: Identification, authentication, subscription maintenance and management, and prevention of illegal use of services in connection with providing subscription services
• Retention/Use Period: Same as prescribed in this Privacy Policy

A. If personal information is no longer needed due to lapse of the retention period or the achievement of the processing purpose, the Company will destroy the personal information without delay.

B. Notwithstanding the foregoing, if it is required to retain personal information under other laws and regulations, the personal information will be transferred to a separate database (DB) or stored at a separate place.

C. Procedures and methods for destroying personal information are as follows:

• Destruction Procedure : The Company selects personal information for which a reason for destruction has occurred, and destroys the personal information upon approval from the Company’s Chief Privacy Officer.
• Destruction Method : The Company destroys personal information recorded and stored in the form of electronic files to the extent that they cannot be reproduced. Personal information recorded and stored in paper documents is shredded or incinerated.

A. The data subject may, at any time, exercise the rights to access, correct, delete, and suspend the processing of, personal information.
The exercise of these rights relating to the personal information of a child under the age of 14 must be made by the child’s legal guardian. The data subject who is the age of 14 or over may exercise these rights directly or through the data subject’s legal guardian.

B. These rights can be exercised in writing, e-mail, or fax in accordance with Article 41(1) of the Enforcement Decree of the PIPA, and the Company will take relevant actions without delay.

C. These rights can also be exercised through a legal guardian or a delegated proxy of the data subject by submitting a power of attorney in accordance with Annex Form No. 11 of the Notice on Method of Personal Information Processing (No. 2020-7).

D. The rights to access and suspend the processing of personal information may be restricted pursuant to Articles 35(4) and 37(2) of the PIPA.

E. The data subject may not exercise the rights to correct and delete personal information, if the collection of the personal information is required by other laws and regulations.

F. When the rights to access, correct, delete and suspend the processing of, personal information are exercised, the Company will verify whether the exercising party is the data subject or a legitimate proxy.

A. The Company designates the following individual as Chief Privacy Officer who is responsible for the overall management of personal information processing, addressing grievances of the data subject related to personal information processing and providing remedies.

	Chief Privacy Officer
Name	Park, Baeyoung
Email	baeyoung.park@clarios.com

B. The data subject may contact Chief Privacy Officer and the department-in-charge as to inquiries, grievances, remedies related to personal information which may occur while using the CXP. The Company will respond and address inquiries from the data subject without delay.

Pursuant to Article 35 of the PIPA, the data subject may request access to personal information to the following department. The Company shall endeavor to respond to the data subject’s request for access to personal information in a prompt manner.

A. The data subject may filed an application for dispute resolution or consultation to the Personal Information Dispute Mediation Committee or the Center for Reporting Privacy Infringement of the Korea Internet and Security Agency, seeking remedies from personal information infringement. In addition, for reports or consultations concerning personal information infringement, the data subject may contact the following agencies: