VISTA WALKERHILL SEOUL

Privacy Statement of Walkerhill Hotel & Resorts

Walkerhill Hotels & Resorts (hereinafter referred to as "Walkerhill"), operated by SK Networks Co., Ltd., considers customers' personal information extremely important and is fully committed to ensuring that all information provided through its website http://www.walkerhill.com (hereinafter referred to as the "Website") is thoroughly protected. Accordingly, Walkerhill complies with the Personal Information Protection Act and all related regulations and guidelines applicable to information and communications service providers.

This Privacy Policy of the Website includes the following matters:

1. Scope of Personal Information Collected

1. Walkerhill collects customers' personal information by lawful and fair means.
2. The personal information collected is limited to the minimum necessary to provide services. Sensitive personal information—such as race, religion, ideology, place of birth, permanent domicile, political orientation, criminal records, health, or sexual life)—that could infringe upon customers' fundamental rights shall not be collected in principle. However, certain sensitive information may be collected when using specific programs, in which case Walkerhill will provide separate notice and obtain consent.

2. Purpose of Processing Personal Information

Walkerhill processes personal information for the following purposes. The personal information collected shall not be used for any purpose other than those listed below. If the purpose of use changes, Walkerhill shall take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Website Membership Subscription and Management

   To confirm membership intent, verify and authenticate identity for membership services, maintain and manage membership eligibility, prevent unauthorized use of services, send notices and notifications, and notify members of processing results.

2. Provision of Goods or Services

   To deliver products, process reservations and provide services, send contracts or invoices, provide content, offer customized services, verify identity and age, process payments and settlements, and collect debts.

3. Complaint Handling

   To verify the complainant's identity, confirm the details of the complaint, contact and notify for fact-finding purposes, and notify the results of complaint handling, among other related purposes.

3. Collection and Use of Personal Information

1. Walkerhill collects personal information for the following purposes.

   Collection and Use of Personal Information Table

   	Items Collected / Purpose of Use / Method of Collection / Retention Period
   Walkerhill Prestige Club Membership	[Mandatory Items] Full name (in Korean/English), gender, mobile phone number, email address, date of birth, wedding anniversary (for Walkerhill Wedding customers only) For identity verification required for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints Credit card information (card number, expiration date) Payment for annual membership fees and product purchases (used only at the time of payment and not stored in the system) [Optional Items] Company name, department, position, and mailing address (excluding online submission via the website) Statistical analysis of membership service usage Use of information on membership service usage Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes related to hotel products, promotions, and events through SMS, e-DM, and TM For encouraging membership renewal through TM Mailing address Delivery of membership card and brochure Referrer (employee ID number and full name) Provision of additional benefits upon membership subscription Verification of subscription channel [Method of Collection] Website / Phone / Email / Electronic subscription tablet / Affiliation with card companies [Retention Period] 3 years from the date of membership expiration
   Walkerhill Membership Rewards	[Mandatory Items] Full name (in Korean/English), gender, mobile phone number, email address, date of birth For identity verification required for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints [Optional Items] Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes, including publicity and research related to hotel products, promotions, and events through SMS, e-DM, and TM Referrer (employee ID number and full name) Verification of subscription channel [Method of Collection] Phone / Email / Electronic subscription tablet / Mobile application [Retention Period] 3 years from the date of the last transaction
   Walkerhill Rewards Membership (when staying with a Stamp Benefit Accommodation Voucher)	[Mandatory Items] Full name, resident registration number, mobile phone number, address Withholding income tax filing (collected pursuant to the Income Tax Act) [Method of Collection] In writing [Retention Period] Immediately destroyed after withholding income tax filing
   Walkerhill Rewards Online Member	[Mandatory Items] Email Address(ID), password, full name (in Korean/English), mobile phone number, date of birth, gender For identity verification required for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints [Optional Items] Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes, including publicity and research related to hotel products, promotions, and events through SMS, e-DM, and TM Referrer (employee ID number and full name) Verification of subscription channel [Method of Collection] Website (web/app) [Retention Period] 3 years from the date of the last transaction
   Google login integration service	[Mandatory Items] Email address or phone number Identification of users through SNS-based simple sign-up for Walkerhill Rewards Membership [Method of Collection] Website (web/app) [Retention Period] Until the SNS account linkage is canceled
   Naver login integration service	[Mandatory Items] Email address Identification of users through SNS-based simple sign-up for Walkerhill Rewards Membership [Method of Collection] Website (web/app) [Retention Period] Until the SNS account linkage is canceled
   KAKAO login integration service	[Mandatory Items] Email address Identification of users through SNS-based simple sign-up for Walkerhill Rewards Membership [Method of Collection] Website (web/app) [Retention Period] Until the SNS account linkage is canceled
   Apple login integration service	[Mandatory Items] Email address Identification of users through SNS-based simple sign-up for Walkerhill Rewards Membership [Method of Collection] Website (web/app) [Retention Period] Until the SNS account linkage is canceled
   ROO Membership	[Mandatory Items] Full name (in Korean/English), date of birth, mobile phone number, email address For identity verification required for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints Mailing address Delivery of membership card and brochure Resident registration number Submission of taxation data to the National Tax Service (Inheritance and Gift Tax Act Enforcement Decree, Article 84) Submission of supporting documents for acquisition tax filing (Local Tax Act Article 20(1) and Enforcement Decree of the Local Tax Act Article 33(1), Local Tax Act Article 152(1), and Special Rural Development Tax Act Article 7) Bank account number For returning the deposit upon withdrawal from ROO (collected and used only at the time of withdrawal) [Optional Items] Photo Provision of customized services and prevention of use by unauthorized third parties Phone number (home, work) Handling of inquiries, consultations, and complaints Company name, department, occupation Provision of services based on demographic characteristics and statistical analysis of membership service usage Name of primary account holder For verification of the primary account when adding family members Medical history (health information) Used as reference in emergency situations during facility use Body composition information (InBody check) For health analysis and management, and customer service and consultation Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes related to hotel products, promotions, and events through SMS, e-DM, and TM For encouraging membership renewal through TM [Method of Collection] In writing [Retention Period] 3 years from the date of membership expiration
   Wellness Program	[Mandatory Items] Full name (in Korean/English), contact information, e-mail address For identity verification required for the provision of Wellness programs and services Handling of reservations, inquiries, consultations, and complaints related to Wellness programs [Method of Collection] Website/app [Optional Items] Full name, age, gender, additional contact information For the operation of Wellness programs Identity verification and customer service Means of providing reservation notices [Method of Collection] Phone/email [Retention Period] 1 year from the date of service termination
   Grand Fitness Membership	[Mandatory Items] Full name, gender, date of birth, mobile phone number, email address Identity verification for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints Mailing address Delivery of membership cards and brochures Credit card information (card number, expiration date) For payment of the annual membership fee (used only at the time of payment and not stored in the system) [Optional Items] Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes related to hotel products and events through SMS, e-DM, and TM [Method of Collection] Electronic registration tablet [Retention Period] 3 years from the date of membership expiration
   Personal Training	[Mandatory Items] Full name, mobile phone number For identity verification [Optional Items] Body composition information (InBody check) For health analysis and management, and customer service and consultation [Method of Collection] In writing [Retention Period] 1 year
   Room Registration Card	[Mandatory Items] Full name (in English), phone number, nationality, email address, room number, check-in and check-out dates Provision of hotel and room services For identity verification related to service use Handling of complaints, lost items, and other customer service matters Handling and resolution of issues related to hotel use [Optional Items] Address, company name, date of birth, membership number Provision of services based on demographic characteristics and statistical analysis of membership service usage For identity verification required for membership services Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For delivering advertising information related to hotel products and events, and for providing guidance on hotel membership applications through SMS and e-DM [Method of Collection] In writing, mobile app [Retention Period] 3 years from the date of check-out
   Inquiries regarding Weddings, Meetings, and Family Banquets	[Mandatory Items] Full name, email address, contact information Handling of reservations, consultations, and inquiries [Method of Collection] Website [Retention Period] 6 months
   Voice of Customer	[Mandatory Items] Full name, email address, contact information For identity verification Handling of inquiries, consultations, and complaints [Method of Collection] Website [Retention Period] 3 months
   Online Reservation for Rooms	[Mandatory Items] Full name (in Korean/ English), contact information, email address Identification and verification of service users Notification and guidance regarding reservation details Provision of hotel room services Provision of mobile check-in services Handling of customer complaints and grievances Prevention of unauthorized use and handling of legal disputes and related matters Credit card information (card type, card number, expiration date) Used to guarantee payment for the use of rooms and facilities Used for mobile check-in and check-out services [Retention Period] 3 months from the date of check-in [Mandatory Items] Date of birth, the first two digits of the credit card password Verification of the validity of the cardholder's own credit card [Retention Period] Deleted immediately after the initial payment [Optional Items] Gender For identity verification Credit card information (card type, card number, expiration date, the first two digits of the card password), date of birth Payment method for hotel charges [Method of Collection] Website [Retention Period] 3 months from the date of check- in
   Online Reservation for Activities	[Mandatory Items] Full name, mobile phone number, email address For identity verification Means of providing reservation notices Handling of service-related inquiries and complaints [Optional Items] Age, gender, additional contact information For identity verification and customer service Means of providing reservation notices [Method of Collection] Website (web/app) [Retention Period] 6 month from the date of service use
   Online Reservation for Dining and Promotions	[Mandatory Items] Full name, mobile phone number, email address For identity verification Means of providing reservation notices/ conducting satisfaction surveys [Method of Collection] Website [Retention Period] 3 months from the date of service use
   Dining Reservation	[Mandatory Items] Full name, mobile phone number, email address For identity verification Means of providing reservation notices/ conducting satisfaction surveys [Method of Collection] Phone [Retention Period] 3 months from the date of service use
   31 Geumryong Reservation	[Mandatory Items] Full name, mobile phone number, email address Reservation at 31 Geumryong [Method of Collection] Online [Retention Period] 3 months
   Family Banquet Reservation	[Mandatory Items] Full name, mobile phone number For identity verification Handling of inquiries, consultations, confirmations, and the management of banquet event preparation, operation, and records [Optional Items] Date of birth Provision of services and statistical analysis of customer service usage Mailing address Mailing of event-related materials [Method of Collection] In writing [Retention Period] 5 year
   Store	[Mandatory Items] Full name, contact information, email address, mailing address For identity verification Delivery of invoices and ordered products Provision of notices Credit card information (card number, expiration date) Payment for product purchase (used only at the time of payment and not stored in the system) Refund account information (account holder's name, account number, bank name) Processing of refunds for payments made by bank transfer [Method of Collection] Website (web/app) [Retention Period] 5 years from the date of delivery completion [Mandatory Items] Full name, contact information, email address For reviewing and responding to bulk purchase inquiries [Method of Collection] Website (web/app) [Retention Period] 3 years from the date of response completion date
   Employee Authentication	[Mandatory Items] Full name, company name, employee ID number, email address Provision of services through verification of executives' and employees' employment status [Method of Collection] Website [Retention Period] 1 year
   Event	[Mandatory Items] Full name (in Korean), mobile phone number Notification of event prize winners Securing smooth communication channels (e.g., delivery of notices, handling of inquiries/complaints) [Optional Items] Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) Provision of services and statistical analysis of customer service usage Marketing and promotional activities for hotel products, promotions, and events via SMS, e-DM and TM [Method of Collection] Website / event brochure [Retention Period] 1 year after the end of the event
   Foreign Exchange Transactions	[Mandatory Items] Full name, passport number Exchange and foreign exchange transactions [Method of Collection] In writing [Retention Period] 1 year
   Golf Club	[Mandatory Items] Full name, phone number, gender, date of birth, license plate number For identity verification required for membership services Provision of membership benefits, notification of amendments to the terms of service and other notices, and handling of inquiries, consultations, and complaints [Optional Items] Date of consent for receiving marketing and promotional communications and consented channels (SMS, e-DM, TM) For marketing and promotional purposes related to golf club products, promotions, and events through SMS and e-DM For encouraging membership renewal through SMS [Method of Collection] In writing / via app [Retention Period] 3 years (from the end of the personal data usage period) 12 months

   • *In the process of using service, the following personal information may be collected:
     • IP address, cookies, service usage records, visitation records, and call records from customer inquiries
2. "Walkerhill" may access and use the information and functions of members' mobile devices as follows in order to provide the mobile app service.

   Use of Information on Mobile Devices

   Category	Optional Items
   Access Items	Biometric authentication information (fingerprint, face recognition)
   Purpose of access	For login and simple authentication services * Fingerprint and face login methods are provided for member convenience; however, only arbitrary authentication values are verified, and no additional personal information is collected.
   Remarks	Basic services are available without consenting to optional access permissions.

4. Retention Period of Personal Information

1. When a request for membership withdrawal from the Website or for the deletion of personal information is made, Walkerhill shall immediately process the request so that the collected personal information can no longer be accessed or used. However, the member's ID will be remained for the purpose of managing website subscription history.
2. However, upon termination, if it is necessary to retain certain information in accordance with the Commercial Act or other applicable laws, Walkerhill may retain transaction records and the minimum necessary basic information for the retention period prescribed by law. In cases where the retention period has been notified to members in advance or individual consent has been obtained, personal information will be retained for retention period agreed with the member. In such cases, Walkerhill shall use the retained information only for the stated purpose of retention. The retention periods are as follows.
   1. Records on contract or offer withdrawal, etc.

      Reason for retention

      Act on Consumer Protection in E-Commerce Period, etc.

      Retention period

      5 years

   2. Records on supply of goods, etc.

      Reason for retention

      Act on Consumer Protection in E-Commerce, etc.

      Retention period

      5 years

   3. Records on consumer complaints or dispute resolution

      Reason for retention

      Act on Consumer Protection in E-Commerce, etc.

      Retention period

      3 years

5. Procedure and Method of Personal Information Destruction

After the purpose of collecting and using personal information has been achieved, Walkerhill shall promptly destroy the relevant information in accordance with the retention and usage period of personal information, based on the principle of timely disposal. Specifics for the destruction procedure, period, and method are as follows:

1. Destruction procedure

   Information entered for membership subscription, etc., shall be retained for a certain period in accordance with internal policies and applicable laws after the purpose has been achieved, and then destroyed. Such personal information shall not be used for any purpose other than retention, unless required by law.

2. Destruction period

   When the retention period of personal information has expired, it shall be destroyed within 5 days from the end of that period. Personal information that is no longer necessary (e.g., the purpose of processing has been achieved, the service has been discontinued, or the business has been closed) shall be destroyed within 5 days from the date it is deemed unnecessary.

3. Destruction method

   1. Personal information printed on paper shall be shredded or incinerated.
   2. Personal information stored in electronic files shall be deleted using technical methods that prevent the recovery or restoration of the records.

6. Collection of Personal Information through Cookies

1. Walkerhill operates cookies that store and, from time to time, retrieve members' information. A cookie is a small amount of information transmitted by a website to the member's computer web browser (e.g., Internet Explorer, Chrome). When a member logs in to the Website, Walkerhill's server reads the content of cookies stored in the member's browser, retrieves additional information from the member's computer, and provides services. Such cookie information is used to provide members with useful, more convenient, and customized services. Cookie information can identify the member's computer, but it cannot identify an individual member.
2. Members may choose whether or not to allow the use of cookies. Through browser option settings, members may allow all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies.
   • How to set cookies: (In Internet Explorer) Tools (top of web browser) > Internet Options > Privacy
     (In Microsoft Edge) Settings (top right) > Cookies and Site Permissions
     (In Google Chrome) Settings (top right) > Privacy and Security
     (In Safari) Preferences > Prevent Cross-Site Tracking and Block All Cookies
   However, if a member refuses the storage of cookies, some services may not be available.

7. Protection of Personal Information of Minors under the Age of 14

Walkerhill does not collect personal information from minors under the age of 14, and such minors are not permitted to register as members. When collecting the personal information of children under the age of 14, we obtain consent from their legal representative for processing. We may collect the legal representative's information, including full name and contact number, from the child. However, the legal representative's personal information collected shall be used only for the purpose of obtaining consent for collecting the child's personal information and will be destroyed if consent is not obtained within 5 days.

8. Provision of Personal Information to Third Parties

Walkerhill shall process personal information only to the extent specified in the purpose of personal information processing. Walkerhill shall provide such personal information to a third party only with the data subject's consent or permitted under the special provision of law, pursuant to Articles 17 and 18 of the Personal Information Protection Act.

Provision of Personal Information to Third Parties

Recipient	Personal Information Provided, Purpose of Use by Recipient, Retemtion Period by Recipient
JAL	Personal Information Provided Customer name (in English), JAL membership number Purpose of Use by Recipient Identity verification for membership services Accumulation of JAL mileage Retemtion Period by Recipient 3 years from the date of collection
Singapore Airlines	Personal Information Provided Customer name (in English), SIA membership number Purpose of Use by Recipient Identity verification for membership services Accumulation of SIA mileage Retemtion Period by Recipient 3 years from the date of collection
Hyundai Department Store Co., Ltd.	Personal Information Provided Walkerhill Rewards membership number, remaining points, convertible points, points requested for conversion Purpose of Use by Recipient To verify Walkerhill Rewards membership status, confirm point balances / conversion of points Retemtion Period by Recipient Until membership withdrawal or service cancellation However, once withdrawal is confirmed, the information will be retained and used only to the extent necessary for incident investigation, dispute resolution, complaint handling, and compliance with legal obligations related to the purposes stated above.

9. Entrusted Contractors and Their Service Related to Personal Information

Walkerhill entrusts certain tasks to specialized contractors for the maintenance and management of member services, customer consultation, and other service-related communications. The entrusted contractors are not permitted to use personal information beyond the intended purposes. Walkerhill is conducting regular supervision of these contractors to prevent any unlawful use of personal information. When outsourcing part of its operations, Walkerhill notifies members in advance. The following contractors have been entrusted with handling personal information.

Entrusted Contractors and Their Services

Name of Contractor	Entrusted Services	Retention and Use Period of Personal Information
Infinity Consulting	Telemarketing (TM) and membership management for the Walkerhill Prestige Club	Until membership withdrawal or termination of the entrustment agreement
SK Inc. AX	Information system processing, maintenance and management
SK Inc. AX (subcontractor: C&Thoth Plus)	Information system processing, maintenance and management
SK Inc. AX (subcontractor: Soulbit Information Technology)	Walkerhill F&B POS Operation
SK Inc. AX (subcontractor: Microsoft Korea)	Data storage (within Korea)
Daou Tech	Maintenance of SMS delivery program
Lotte Global Logistics	Product delivery services
Logen Logistics	Product delivery services
Neulpum Maru	Logistics service agency
Seoul Credit Rating & Information Inc.	Identity verification via i-PIN and mobile phone
ADT CAPSTEC	Operation and management of fixed video surveillance equipment
Netpathy Inc.	Maintenance of e-DM delivery program
Korea Information & Communication Co., Ltd	Purchase and payment services
Amadeus Hospitality	Maintenance of the banquet management system
Pentabreed Inc.	Website operation and management, and maintenance of the electronic subscription application system
Health Connect Inc.	Operation and management of the Wellness Program
Cnet technology Inc.	Operation and management of the recording system
BizTalk Co., Ltd	Maintenance of the KakaoTalk notification message dispatch program
SK Broadband Co., Ltd.	Management of opt-out information for text message services
TableCheck	Operation and management of the dining reservation program
WHONEED	Room maintenance and order taking service
Nexus Community	Operation and management of the call recording system
ntelslabs	Operation and management of the store website, and system maintenance and management
LB Ucess Co.,Ltd.	Outsourced reservation services for Pizza Hill and The Buffet
Dowhat	Maintenance and management of the e-Reg (electronic registration card) system at the front desk
Early sloth	Maintenance and management of the Walkerhill GEI (customer satisfaction survey) system
Ujung Info System Co., Ltd.	Maintenance and management of the credit card payment program at the front desk
BADA RENTCAR	Wedding customer transportation (shop pick-up & airport sending)
KYUNGSUNG RENT A CAR	Wedding customer transportation (Shop pick up & Airport sending)
Daekyung F&B Co., Ltd.	Logistics service agency
DBWD Co., Ltd.	Logistics service agency
Blooming Korea Co., Ltd.	Logistics service agency

10. Rights of Data Subjects and Methods of Exercising Them

As a member and data subject, you may exercise the following rights with respect to your personal information.

1. A data subject may, at any time, exercise the following rights related to personal information protection with Walkerhill.
   1. Request access to personal information
   2. Request correction of personal information in case of inaccuracies or changes
   3. Request deletion of personal information
   4. Request suspension of personal information processing
2. The rights under Paragraph 1 may be exercised with Walkerhill in writing, by email, by facsimile, etc., using Form No. 8 under the Notice on the Methods of Processing Personal Information (No. 2025-5). Walkerhill shall promptly take the necessary measures.
3. If a data subject requests that correction or deletion of personal information, Walkerhill shall not use or provide the relevant personal information until the correction or deletion has been completed.
4. The rights under Paragraph 1 may be exercised through an legal representative or authorized agent. In such cases, a power of attorney in accordance with Form No. 11 under the Notice on the Methods of Processing Personal Information (No. 2025-5) shall be submitted.
5. The data subject's right to request access to or suspension of the processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
6. A request for correction or deletion of personal information cannot be accepted if the collection of such personal information is explicitly required under other laws or regulations.
7. The Company verifies whether a request for access, correction/deletion, or suspension of processing of personal information is made by the data subject or a duly authorized representative.

11. Cross-border Transfer of Personal Information

The Company entrusts the processing of personal information to overseas entities as specified below, for the purpose of providing customer services.

Cross-border Transfer of Personal Information

Recipient	Tablecheck	Salesforce
Transfer Country	Japan	USA
Information Management Officer and Contact Information	Alexander Nicholson / dpo@tablecheck.com Dai-27 Chuo Bldg 4th floor 2-14-5 Ginza Chuo-ku, Tokyo, Japan 104-0061	Salesforce Data Protection Officer 415 Mission St., 3rd Floor San Francisco, CA 94105, USA Email: privacy@salesforce.com Phone: 1-844-287-7147
Time and Method of Personal Information Transfer	Transferred to remote servers via network when making dining reservations	Transferred to remote servers via network upon receipt of reservation inquiries
Personal Information Transferred	Customer name, mobile phone number, email address	Name, email address, contact information
Purpose of Use by the Recipient of Personal Information	To verify customer identity and provide reservation details when making dining reservations	To respond to reservation inquiries
Retention and Use Period by the Recipient of Personal Information	3 months	3 years

12. Measures to Ensure the Security of Personal Information

Walkerhill takes the following technical, administrative, and physical measures necessary to ensure the security of personal information under Article 29 of the Personal Information Protection Act.

1. Minimization of personal information processing personnel

   To protect personal information, Walkerhill minimizes the authority granted to personnel who process personal information.

2. Regular training for personnel handling personal information

   To raise awareness of personal information protection, Walkerhill performs regular training.

3. Regular internal inspections

   To ensure the security of personal information processing, Walkerhill conducts regular internal inspections.

4. Establishment and implementation of an internal management plan

   For the safe processing and management of personal information, Walkerhill has established and implements an internal management plan.

5. Encryption of personal information

   Members' personal information and passwords are encrypted, stored, and managed. A separate security function is also applied during transmission to ensure safe management.

6. Technical measures against hacking and viruses

   To prevent leakage or damage of personal information caused by hacking, computer viruses, etc., Walkerhill installs and regularly updates security programs. Systems are placed in areas with restricted external access, where technical and physical monitoring and blocking are implemented.

7. Access restrictions to personal information

   Walkerhill grants, modifies, and revokes access rights to its personal information databases as necessary to control access. Unauthorized external access is blocked using firewalls and intrusion prevention systems.

8. Retention of access logs and prevention of forgery or tampering

   Walkerhill retains and manages records of access to the personal information processing system for at least two years and uses security functions to prevent access logs from being forged, tampered with, stolen, or lost.

9. Use of locking devices for document security

   Documents and auxiliary storage media containing personal information are kept in secure locations equipped with locking devices.

10. Access control for unauthorized personnel

    Physical storage locations for personal information are segregated, and access control procedures are established and enforced

11. Safety measures against disasters and emergencies

    To prepare for natural disasters and other emergencies, Walkerhill establishes and reviews response procedures, including crisis response manuals.

12. However, Walkerhill shall not be held responsible for issues arising from members' personal mistakes or the inherent risks of the Internet.

13. Operation and Management of Fixed Video Surveillance Equipment

Walkerhill has installed and is operating fixed video surveillance equipment as follows:

1. Basis/purpose of installation

   To protect the safety of customers and employees entering Walkerhill, and safeguard the hotel's assets, provide evidence in case of crimes or various accidents, and ensure the safety of facilities and users from disasters such as terror or fire.

2. CCTV information

   • Number of CCTVs installed: 855
   • Locations and coverage areas: Inside and outside the buildings, guest rooms, elevators, and parking lots

3. Responsible Manager, Department in Charge, and Authorized Personnel with Access to Video Data

   CCTV Installation Data

   Locations of Installation	Number of CCTVs	Person in Charge
   Rooms (GRAND/VISTA)	193(138/55)	Responsible Manager: Lee Jeong-shik (Business Support Team) Person in Charge: Lee Chung-jin
   Main Building (GRAND/VISTA)	237(146/91)
   Exterior Areas (GRAND/VISTA)	69(55/14)
   Camping Zone / EMERALD	26
   Parking Area	275
   ACADIA	55

   Contact Numbers

   Phone

   +82-2-450-4422
   +82-2-450-4481

4. Hours of recording, retention period, storage location, and processing method

   • Recording hours: 24 hours
   • Retention period: 30 days from the date of recording
   • Storage location and processing method: Stored and processed in the control room for the fixed CCTV systems

5. Method and place of accessing video data

   Available upon request to the Personal Information Protection Officer

6. Measures in response to requests for access to video data by data subjects

   Requests for access to, or confirmation of the existence of, personal video data must be submitted in writing. Access will only be permitted if the data subject is the person recorded, or if it is clearly necessary to protect the life, physical safety, or property interests of the data subject.

7. Technical, administrative, physical measures to protect video data

   An internal management plan has been established to control and restrict access rights; secure storage and transmission technologies are applied; processing records are maintained with measures to prevent forgery or unauthorized alteration; and storage facilities are equipped with locking devices.

14. Procedures for Handling Personal Information-related Complaints

1. If you believe that Walkerhill is not complying with this Privacy Policy, please contact the Chief Privacy Officer or the Privacy Manager listed below. Walkerhill will immediately verify the reported issue, and if correction is required, will take necessary measures without delay. Walkerhill also welcomes customers' opinions regarding their personal information and has established procedures and methods for handling complaints.
2. If you need to report or seek consultation regarding personal information infringements, please contact the Personal Information Infringement Report Center. If you have suffered financial or mental damage due to a personal information infringement, you may request relief through the Personal Information Dispute Mediation Committee. For other inquiries related to personal information, please contact the institutions listed below.

• Personal Information Infringement Report Center

  Responsibilities

  Receiving complaints of personal information infringements and providing consultation

  Website

  privacy.kisa.or.kr

  Telephone

  118 (no area code required)

  Address

  (58324) 3rd floor, 9 Jinheung-gil, Bitgaram-dong, Naju-si, Jeollanam-do

• Personal Information Dispute Mediation Committee

  Responsibilities

  Handing application for personal information dispute mediation and collective dispute mediation (civil resolution)

  Website

  www.kopico.go.kr

  Telephone

  1833-6972 (no area code required)

  Address

  (03171) 12th floor, Government Complex-Seoul, 209 Sejong-daero, Jongno-gu, Seoul

• Supreme Prosecutors' Office Cyber Investigation Division

  Telephone

  1301 (no area code required)

  Website

  www.spo.go.kr

• Cyber Bureau of the Korean National Police Agency

  Telephone

  182 (no area code required)

  Website

  ecrm.police.go.kr

15. Chief Privacy Officer

To protect customers' personal information and handle personal information-related complaints, Walkerhill has designated a Chief Privacy Officer (CPO). If you have any inquiries regarding personal information, please contact the Chief Privacy Officer or the Privacy Manager listed below. Your inquiries will be answered promptly and in good faith.

• Chief Privacy Officer Name

  Name

  Lim Jae-chang

  Department

  Management Support Division

  Position

  Head of Management Support Division

  Email

  contact@walkerhill.com

  Telephone

  +82-2-1670-0005

• Privacy Manager

  Name

  KIM Kyu-moon

  Department

  IT Team

  Position

  Manager

  Email

  contact@walkerhill.com

  Telephone

  +82-2-1670-0005

16. Notice of Policy Changes

1. This Privacy Policy is posted on the main page of the Website so that customers can easily view it at any time.
2. If there is any addition, deletion, or revision of this Privacy Policy due to changes in laws, policies, or security technologies, the reason and details will be announced on the Website at least 30 days prior to enforcement. For any other changes, the reason and details will be announced at least 7 days in advance.
3. This Privacy Policy may be amended from time to time, so customers are advised to check it each time they visit the Website.

17. Introduction to Information Security Certifications

Walkerhill Hotels & Resorts, operated by SK Networks Co., Ltd., has obtained the ISMS-P (Personal Information & Information Security Management System) certification from the Korea Internet & Security Agency (KISA) after undergoing KISA's audit. This certifies that its measures and activities for information security and personal information protection meet the certification criteria.

Scope of Certification

Operation of Walkerhill Hotels & Resorts services

Validity Perido

December 15, 2024 – December 14, 2027

[Addendum] 1.(Effective Date) This Privacy Policy shall take effect on October 2, 2025.