Article 1 General Provisions

• A. Personal information is information about an individual who is alive, and information that can identify the individual by the name, ID, etc. including the information that if it is combined with other information, it can identify that person although the information by itself cannot identify individual.
• B. Hotel Shilla Co., Ltd. Duty Free Store attaches great importance to protecting the customer's privacy and complies with the Personal Information Protection Act and the Information Communication Network Promotion and Information Protection Act. Hotel Shilla Co., Ltd. Duty Free Store will inform you of the purpose and how the personal information provided by the customer is used and what measures are being taken to protect the personal information through the personal information processing policy.
• C. Hotel Shilla Co., Ltd. Duty Free Store establishes the procedures necessary to revise the personal information processing policy in order to continuously improve the personal information processing policy. When revising the personal information processing policy, we give the version number and so on so that the customer can easily recognize the revised information.

Article 2 Purpose of Collecting and Using Personal Information

※ Unauthorized use: act to receive economic benefits such as discount coupons, event benefits, etc. provided by "Shilla Internet Duty-free". Those include, for example, repeated re-entry after withdrawal of membership, cancellation of purchase after purchase and acts that are prohibited by the Terms such as illegal acts, and impersonation.

Article 3 Collection Items of Personal Information

• A. Hotel Shilla Co., Ltd. Duty Free Store collects the only essential information for basic service provision and we obtain consent from customers when collecting information to provide services that meet the customers' preferences and needs.
• B. Hotel Shilla Co., Ltd. Duty Free Store collects and uses personal information as follows. Provided however that if the Member enrolled in jurisdictions other than Korea through QR code at Off-line S Rewards Participating Stores, enrolled jurisdiction's applicable laws shall apply. For details, please refer to consent forms for applicable jurisdictions here.
  • ① Items of personal information collected at the time of membership registration and purchase of goods

    Collection Items of Personal Information

    Classification	Collection Items	Prurpose of Use
    Required Information	① Collected information when joining When joining, ID, password, customer number, name, date of birth, e-mail address(e-mail address of employees of partership companies), mobile phone number, Issuing Place of Passport. However, the following exception is applied: i) members who join through the SNS would not provide his or her member ID and password. ii) members who are not Korean nationality would not provide his or her iPIN(CI, DI). iii) If you sign up through the QR code membership subscription system, your passport number, passport expiration date, and English name are collected. ② Collected information when use specific services - When creating Shilla prepaid card, name in English, passport number, the expiration date of passport. - When utilizing On/Off-line S Rewards Services, name in English, passport number, the expiration date of passport. - When purchasing, name in English, passport number, the expiration date of passport, credit card information, bank account information, point transaction information, departure information(departure place, departure date, flight number, destination), operator information(when applying for a cash receipt) ③ SNS member - Name, date of birth, e-mail address(e-mail address of employees of partership companies), mobile phone number, Issuing Place of Passport. ※ Other information generated during service use process or business process - Service usage record, connection log, cookie, connection IP information, payment record, suspension record - (When using mobile device) Terminal identification number (UUID), terminal OS information, terminal model name, PUSH dispatch key, token for PUSH, receive PUSH or not UUID: universally unique identifier, A unique value of an arbitrarily created application rather than an assigned value of a terminal	- Providing membership services and identity verification or certification - Maintain certification per internet session Preventing abuse of membership privileges - Used in after-sales service policy such as Return / Refund etc.
    Personally Identifiable Information	passport number.	Providing membership services and identification or certification, Confirm cases of fraudulent use of service by repeating membership and withdrawal
    Optional information	Mobile phone number, email address, address	shopping marketing/promotion guide

Article 4 How to Collect Personal Information

• A. Hotel Shilla Co., Ltd. Duty Free Store collects personal information in the following ways.
  • - Joining membership through homepage, written form, QR Code, telephone, and fax, counseling bulletin, sweepstakes application, delivery request
  • - Collection through generation information tool
  • - Provided from affiliates
• B. Customer shall have the right to refuse to provide personal information and optional information. Hotel Shilla Co., Ltd. Duty Free Store presents the contents of the Hotel Shilla Co., Ltd. Duty Free Store's Personal Information Collection Agreement or Terms of Use so that customers can choose agree or diagree with providing their personal information. If customer chooses "Consent", customer will be regarded as the one who agrees with the collection of personal information.
• C. If you refuse to provide your personal information, you will not be able to join the membership. Therefore, you will not be able to receive services such as purchase of duty-free goods and information delivery provided by Hotel Shilla Co., Ltd. Duty Free Store.
• D. If the customer refuses to provide the optional information, customer cannot receive personalized service provided by Hotel Shilla Co., Ltd. Duty Free Store.
• E. If the customer wants to receive purchasing and information delivery services without register, customer should agree with the collection of necessary personal information. If you refuse, you couldn’t receive purchasing and information delivery services provided by Hotel Shilla Co., Ltd. Duty Free Store.

Article 5 Personal Information Sharing and Third Party Provision

• A. Hotel Shilla Co., Ltd. Duty Free Store shall not use the personal information of the customer beyond the notice stated in the purpose of collecting and using personal information except for the consent of the customer or the provisions of related laws and regulations. However, in the following cases, we use our personal information with care.
  • ① If the rights and obligations of the service provider are fully succeeded or transferred since there are such as disposal, merger and acquisition, we will give detailed notice of reasonable cause and procedure in advance and give the option of withdrawing consent to providing customer's personal information.
  • ② In addition to providing or sharing personal information with affiliations, it is necessary for the customer to know in advance what the affiliate is, what personal information items are provided or shared, why such personal information should be provided or shared, and how long personal information will be kept. We will notify customers individually in written-form, e-mail or other means to obtain consent. If you do not agree, you will not provide to or shared with affiliates. Also, when there is a change in the partnership or termination with affiliations, we will notify or seek consent by the same procedure.
  • ③ If we obtain selective consents from customers in accordance with laws related to privacy policy, we provide the personal information to below affiliates with great care:

    Collection Items of Personal Information

    Recipient (transferred country, contact of security manager)	Shilla Travel Retail Hong Kong, Ltd. (Hong Kong, dannyoungb.lee@samsung.com), Shilla Travel Retail Pte. Ltd. (Singapore, youngsub43.kim@samsung.com), Shilla Retail Ltd. (Macau, dannyoungb.lee@samsung.com), Hotel Shilla China Corporation (China, cc.shilla@partner.samsung.com)
    Recipient’s Purpose of Use	to identify individuals for the purpose of providing On/Off-line S Rewards services, to provide information and send notices regarding The Shilla Duty Free Membership program, to resolve and manage customer complaints, to deliver announcements, to improve the goods and services offered by The Shilla Duty Free, to prevent abuse of membership privileges
    Provided Personal Information	name(English), nationality, date of birth, gender, passport number, expiration date of passport, mobile phone number, e-mail address, member ID, member number
    Transferring Timing and Method	through safe network when personal data is necessary to provide services
    Recipient’s Retention and Use Period	withdrawal from membership, member disqualification or withdrawal of consent whichever is earlier

• B. In the following cases, it is possible to provide personal information to affiliations without the consent of the customer under the provisions of relevant laws and regulations.
  • ① If there are special regulations in other laws
  • ② In case the information subject or its legal representative is in a state where he / she is unable to give his / her intention to present their statement, or we are unable to obtain prior consent due to an unknown address or the like and when it is admitted for third-party’s imminent life, body, fortunate interests.
  • ③ In case of providing for statistical processing, research, and market research provided in the non-discernible form.

Article 6 Consignment of Handling Personal Information

• A. Hotel Shilla Co., Ltd. Duty Free Store entrusts the following personal information handling tasks to external professional companies for service implementation.

  Consignment of Handling Personal Information

  Contracting Division (Controller)	A Company Who Is Entrusted (Processor)	Outsourced Work
  Hotel Shilla Co., Ltd	SAMSUNG SDS	Computing system maintenance and development
  Hotel Shilla Co., Ltd. Duty Free Store	HYOSUNG ITX	Customer consultation and customer reception
  	UNIES Co., Ltd	Reception, Chinese interpretation, selling products guide
  	KUJEPLAN	Duty-free shop customer information, packaging, delivery and logistics agency
  	ELIMBMS Co., Ltd	Duty-free shop customer information, delivery and logistics agency
  	STANDARD NETWORKS Co., Ltd	Mass SMS,MMS sending agency
  	ESTEC Co., Ltd	CCTV security management, parking management
  	MEGAZONE CLOUD Corp.	Mobile user notification service
  	CIZION Co., Ltd	Provide sign-in service with SNS ID
  	BIZTALK	Kakaotalk notification agency
  	COLEO MARKETING GROUP	Event winner selection and personal information gathering for prize delivery, shipping & handling for prize delivery.
  	SHILLA TRAVEL RETAIL PTE. LTD.	to help customers’ membership enrollment in Singapore, to solicit and explain S Rewards Services to customers.
  	SHILLA TRAVEL RETAIL HONG KONG LTD.	to help customers’ membership enrollment in Hong Kong, to solicit and explain S Rewards Services to customers.
  	Shilla Retail Ltd.	to help customers’ membership enrollment in Macau, to solicit and explain S Rewards Services to customers.
  	Planit Partners	Operate analystic system of The Shilla duty free online
  	MOBILEFACTORY CO., LTD	Online app development and operation
  	Korea Duty Free Shops Association	Logistics and Delivery Operations
  	Korea Duty Free Service System	Logistics and Delivery Operations
  	S-Way Korea	Parking management
  	KRPartners	Paypal paymentservice
  	GS Mbiz	Personal information gathering for prize delivery and shipping.

• B. Hotel Shilla Co., Ltd. Duty Free Store complies with laws and regulations related to the protection of personal information, keep confidentiality of personal information, prohibit third party provision, and have burden of responsibility at the time of accident, the obligation to destroy personal information through the consignment service contracts.
• C. We will notify you in more than one way through homepage, written, e-mail, telephone, SMS, or similar, if the content of the entrusted business or entrusted company is changed.

Article 7 Personal Information Retention and Use of Period

• A. Hotel Shilla Co., Ltd. Duty Free Store shall destroy the personal information of the member without delay when the purpose of collection of the personal information is achieved. Specific destruction time is as follows.
  • ① Membership information: When a member withdraws from membership or is dismissed from membership save that for the purpose of preventing abuse of membership privileges, history of withdrawal or forfeiture of membership, passport number shall further be retained and used for further 6 months (passport number and CI& DI information are retained after irreversibly hash-encrypted)
  • ② Shipping Information: When the goods or services are delivered or provided
  • ③ When collected for the purpose of survey, event, etc.: When the questionnaire survey and event end
  • ④ Non-Member Purchasing Information: When all the procedures have been completed when the non-member purchase and service were delivered or provided
• B. When there needs to be retained for the reason of confirmation of relationship related with transaction in accordance with related laws and internal policies, the purpose of collecting personal information above is to be held for a certain period of time although the principle of immediate cancellation will be activated as soon as it reached the purpose of collecting

  Personal Information Retention and Use of Period

  Classification	Reasons of Retention	Retention Period
  Records on contract of subscription withdrawl etc.	The consumer protection act on e-commerce	5 years
  Records on payment and supply of goods		5 years
  Records on consumer complaints or dispute handling		3 years
  Records on display advertisement		6 months
  Records on website visit	Communications Secret Protection Act	3 months

• C. Hotel Shilla Co., Ltd. Duty Free Store divides and manages the personal information of members who meet all of the following conditions according to the Personal Information Expiration Period.
  • ① Members who have not logged in Service homepage (PC/mobile web, including apps) more than one year
  • ② Members who do not have sales history in Online and Offline more than one year

Article 8 Procedures and Methods of Personal Information Destruction

• A. Discard procedure
  • ① Information entered by a user for membership, etc., is transferred to a separate DB after the purpose is achieved (separate filing cabinet in case of paper). According to the internal policy and other information protection reasons (see Retention and Use of Period) It is stored for a certain period and then destroyed.
  • ② This personal information will not be used for any other purpose other than those held by law.
• B. How to destroy
  • ① Personal information printed on paper is crushed by crusher or destroyed by incineration.
  • ② Personal information stored in the form of an electronic file is deleted using a technical method that cannot reproduce the record.

Article 9 Rights of Users and Legal Representatives and How to Exercise Them

• A. Customers can view or correct registered personal information and withdraw from membership at any time.
  ① After logging in to the homepage, you can view or modify your personal information through the [MY Shilla > Member Information] menu.
  ② Membership withdrawal is possible from the [MY Shilla > Member Information > Withdrawal] menu after logging in to the homepage.
  ③ If you contact the customer service center by phone (1688-1110), in writing, or by e-mail, we will take action without delay through the identity verification process.
  ④ However, if there are undelivered product details for purchased items or if cash equivalent points/deposits are held, membership withdrawal will proceed after delivery of the items is completed and points are refunded.
• B. If a customer requests correction of an error in personal information, the information will not be used or provided until the correction is completed. In addition, if wrong personal information has already been provided to a third party, we will notify the third party of the result without delay so that correction can be made.
• C. Hotel Shilla Duty Free Shop handles personal information requested to be deleted by customers in accordance with the period of retention and use of personal information collected by Hotel Shilla Duty Free Shop and as specified in other laws, and makes sure that it is not viewed or used for any other purpose.

Article 10 Rights of users and legal representatives and how to exercise them

• A. Customers can view, correct, delete, suspend processing, or request withdrawal of their registered personal information at any time, and the exercise of rights accordingly can be done through an agent, such as a legal representative or a person entrusted with the information subject. In this case, you must submit a power of attorney in accordance with the [Notice on Personal Information Processing Methods] of the Personal Information Protection Commission, Attachment No. 11.
• B. Customers are requested to prevent unexpected accidents by entering their personal information accurately and up-to-date. Customers are responsible for accidents caused by inaccurate information entered by customers, and membership may be lost if false information is entered, such as stealing other people's information.
• C. Customers have the right to have their personal information protected, as well as the obligation to protect themselves and not infringe on other people's information. Be careful not to leak your personal information and be careful not to damage other people's personal information, including posts. If you fail to fulfill these responsibilities and damage the personal information and dignity of others, you may be punished under relevant laws and regulations.

Article 11 Matters Concerning the Installation / Operation of the Automatic Collection Device of Personal Information and Its Rejection

• A. An Explanation of Cookie?
  Hotel Shilla Co., Ltd. Duty Free Store uses cookies to store information about customers. A cookie is a small amount of information that a website sends to a customer's Internet browser (Netscape, Internet Explorer, etc.). When the customer accesses the website, Hotel Shilla Co., Ltd. Duty Free Store's computer can read the contents of the cookie in the customer's browser and provide the service without further input such as the name of the connection.
• B. Cookie Management of Hotel Shilla Co., Ltd. Duty Free Store
  Hotel Shilla Co., Ltd. Duty Free Store operates cookies for the convenience of users. The information collected by Hotel Shilla Co., Ltd. Duty Free Store through

  Matters Concerning the Installation / Operation of the Automatic Collection Device of Personal Information and Its Rejection

  The Purpose of Collection	Collection Items	Cookie Retention Period
  Provide customer convenience	Today's special deal focus movement	10 seconds
  	Encrypted ID, key value for auto login, Information on current app version (Android), latest app version information (Android), app-downloaded mobile phone number (Android), mobile OS name (Android), name of mobile device's model (Android), device unique identification information (Android), user access environment (Android), Key/tag for log collection(Android)	20 minutes
  	Login status	1日
  	Viewed items today	1 week
  	Current app version information (iOS), latest app version information (iOS), mobile OS name (iOS), user access environment (iOS)	1 month
  	Recent seahches, product search criteria	1 year

• C. How to deny cookie settings
  By selecting the «Options» menu of the web browser you use, you can either allow all cookies, or you can go through confirmation whenever you save cookies, or reject the save of all cookies. In the Internet Explorer, you can delete all cookies stored on the user's PC by simply pressing the Delete button from the Tools > Internet Options > Search History. Alternatively, if you check down the «Delete Search History when Exiting» item, you can automatically delete cookies each time you exit the browser, but if you reject the cookie installation, there may be restrictions on providing services such as conveniece.
• D. Hotel Shilla CO., LTD Duty Free Store works with Microsoft Clarity to improve Internet services through behavioral metrics, heatmaps, and session replay features, using cookies and other tracking technologies. All text data is collected after being masked, and cookie collection can be rejected through [C. How to deny cookie settings]. For more information about how Microsoft collects and uses the data, please check the Microsoft Privacy Statement.

Article 12 Measures to Ensure the Safety of Personal Information

Hotel Shilla Co., Ltd Duty-free and Distribution Department takes the following technical, managerial, and physical measures to ensure the safety of personal information in order to prevent personal information from being lost, stolen, leaked, altered or damaged.

• A. Minimization and Training of Personal Information Handling Staff
  • - Minimize the assignment of personal information handlers and conduct regular training.
• B. Perform Regular Self-audits
  • - We regularly conduct our own audits to ensure the safety of handling personal information.
• C. Establishment and Enforcement of Internal Management Plan
  • - We have established and implemented an internal management plan for the safe handling of personal information
• D. Encryption of Personal Information
  • - The personal information of the user is encrypted and stored and managed so that only the user can know it, and the file and the transmission data are encrypted and the important data is protected by the separate security function.
• E. Technical Measures against Hacking
  • - In order to prevent leakage and damage of personal information caused by hacking or computer virus, we install security program with doing periodical update and checking as well as technically / physically monitor and block it by installing the system in area controlled from outside.
• F. Restrict Access to Personal Information
  • - We take necessary measures to control access to personal information through the granting, modification and deletion of access rights to the database system that processes personal information, and we control the unauthorized access from outside using the intrusion prevention system.
• G. Preservation Customer’s Connection History and Prevention of Forgery
  • - We keep and manage the records that are connected to the personal information processing system for at least 2 years, and use the security function to prevent forgery, theft, and loss of access records.
• H. Use Locks for Document Security
  • - Documents containing personal information and auxiliary storage media are stored in a safe place with lock.
• I. Access Control to Unauthorized Persons
  • - Separate the physical storage place where personal information is stored and establish access control procedure for it.

Article 13 Feedback and Complaints

• A. We value your feedback and you deserve the right to receive sincere responses at any time. We have set up a customer consultation phone for smooth communication with you.
  • 【Customer Consultation Center】
  • ○ E-mail : cc.shilla@partner.samsung.com
  • ○ Phone : 1688-1110
  • ○ Fax number : 0505-551-5520
  • ○ Address : Online CS 3F, 28, Jangchungdan-ro 8-gil, Jung-gu, Seoul, Republic of Korea
• B. Telephone consultation is only possible from 9:00 am to 7:00 pm. We will respond to your inquiries by e-mail, fax, and mail within 24 hours of receipt. However, after working hours or on weekends and holidays, it is the principle to process the next business day.
• C. If you need to report or consult about other privacy infringement, please contact the following organizations.
  • - Personal Information Infringement Notification Center（www.118.or.kr / 118)
  • - Information Protection Mark Certification Committee（www.eprivacy.or.kr / 02-580-0533~4)
  • - Supreme Prosecutor's Office, Advanced Crime Investigation Department（www.spo.go.kr / 02-3480-2000)
  • - Cyber Terror Response Center（www.ctrc.go.kr / 02-392-0330)

Article 14 Chief Privacy Officer (CPO)

Hotel Shilla Co., Ltd. Duty Free Store designates the relevant department and person in charge of personal information protection to protect customer's personal information and take charge of collecting opinions and complaints about personal information as follows.

【Chief Privacy Officer】
- Name: Lee, Jaewon
- Affiliation: TR Information Security Team
- Position: Team Leader
- Telephone: 1688-1110
- Email: cc.shilla@partner.samsung.com

【Department in charge of Personal Information Protection】
- Department: TR Information Security Team
- Telephone: 1688-1110
- Email: cc.shilla@partner.samsung.com

Article 15 Sending Advertising Information

• A. Hotel Shilla Co., Ltd. Duty Free Store does not transmit commercial information for commercial purposes without prior consent of the customer.
• B. When Hotel Shilla Co., Ltd. Duty Free Store sends the advertisement information by e-mail in order to optimize marketing for customers such as (new) product or event information guide, it contains the customer's prior consent about the advertisement information transmission. Take action to make it easier for you to find out:
  • - Title: Marked "Advertising" at the beginning of the title
  • - Text: The name, contact, e-mail, address, and withdrawal notice of the sender,
• C. When sender transmits commercial information for commercial purposes to the customer who agrees to receive the advertisement via other than e-mail, such as facsimile or mobile phone text transmission, they takes necessary measures such as indicating the name of the sender.

Article 16 Link Site

• A. Hotel Shilla Co., Ltd. Duty Free Store can provide customers with links to other companies' websites or materials. In this case, Hotel Shilla Co., Ltd has no control over external sites and materials, so we cannot be responsible for and cannot guarantee the usefulness of the services or materials provided by them.
• B. When the user clicks the link included in Hotel Shilla Co., Ltd. Duty Free Store and moves to the page of the other site, the personal information processing (handling) policy of the site is irrelevant to Hotel Shilla Co., Ltd. Duty Free Store. Please review your newly visited web site's policies.

Article 17 Posts

• A. Hotel Shilla Co., Ltd. Duty Free Store is committed to protecting the customer's posts with the utmost care not to be altered, damaged or deleted. However, this is not the case in the following cases.
  • - spammy posts (e.g., lucky letters, specific site ads, etc.)
  • - To spread the false facts to defame others
  • - The disclosure of the unauthorized person's identity, the copyright of the third party's rights, etc.
  • - In order to activate the culture of desirable bulletin board, Hotel Shilla Co., Ltd. Duty Free Store can delete certain parts or post them by modifying them in the case of disclosure of others' consent.
  • - When a post can be moved to another bulletin board as its different topic, we present the path to the post so that users cannot misunderstand about the change.
  • - In other cases, we can take action after an explicit or separate warning.
• B. Fundamentally, all rights and responsibilities related to the post are reserved for the author. In addition, since information that is voluntarily disclosed through the post is hard to be protected, please consider it before the information disclosure.

Article 18 Duty of Notification

If there is any revision, deletion or modification of contents due to change of law, government policy, hotel's internal policy, security technology, etc., at least 7 days before revision, we will set up an notification about the reason and contents through our website.

Privacy Policy Version Number: [V20.020250210]

Privacy Policy Enforcement Date: February 10th, 2025

Privacy Policy Last modified: February 10th, 2025

The personal information processing policy of Hotel Shilla Co., Ltd. Duty Free Store above is effective from JFebruary 10th, 2025