posco HOLDINGS

General Provisions

POSCO Lithium Solution Co., Ltd. (“Company”) establishes and discloses the following privacy policy to protect your personal information and handle any related complaints quickly and efficiently according to Article 30 of the Personal Information Protection Act.

The Company informs you of how the personal information you provide to us is used, for which purpose, and what kind of measures are taken to protect it.

1. Consent to the Collection of Personal Information

The Company has a procedure of clicking either the “I agree” or “I do not agree” button with regard to the terms and conditions of the Company website (https://www.posco-lithium.com/kor). If you click the “I agree” button, you will be deemed as having provided consent to the collection of your personal information.

2. Purpose for the Collection and Use of Personal Information

The Company processes private information for the following purposes. The processed private information will not be used for any purpose other than the following, and in any case where the purpose of use changes, we will take due measures, such as obtaining separate consent according to Article 18 of the Personal Information Protection Act.

3. Retention and Usage Periods of Personal Information

The Company processes and retains personal information within the retention and usage periods in accordance with the law or within the retention and usage periods you agreed to at the time your personal information was collected.
The retention period of your personal information collected in our website is as follows. Personal information collected for consultation or reports is deleted after six months of the consultation and the report.

• ▶ Customer Inquiry, Fair Trade Consultation/Report, Voice of the Customer, Abuse Report Center, Workplace Harassment and Sexual Harassment, Consultation Center
• - How we collect information: You enter your information on the Company website.
• - Basis of operation of information: Your consent.
• - Retention period: For six months after a report is made or consultation is provided.

When deleting your information, the Company website will immediately delete your personal data in a non-retrievable manner (or instruct the third party to do so if the personal information has been provided to a third party). In any of the following events, however, personal information will be retained for the period specified in each paragraph.

• ① If it is necessary to retain personal information according to laws, such as the Commercial Act, the transaction details and the minimum basic information will be retained for the retention period set forth in the laws.
• ② The retention period will be notified to members in advance, and if the retention period has not expired, and your consent was obtained, personal information will be retained for the promised retention period.

4. Out-of-purpose Use and Provision to a Third Party

In principle, the Company website processes information within the scope specified for the purpose of collection and usage, and does not handle it beyond the scope of the original purpose or provide it to a third party without receiving prior consent from you except for in the cases below.

• ① In case we receive separate consent from you.
• ② In case there is a special provision in the law.

5. Your, and Your Legal Representative's, Rights and Obligations and How to Exercise Them

• ① You can exercise the following privacy rights at any time against the Company.
• 1. Request access to your personal information.
• 2. Request to revise your personal information when an error is found.
• 3. Request to have your personal information deleted.
• 4. Request to have the processing of your personal information stopped.
• ② You may exercise your rights according to paragraph 1 in writing, by phone, email, fax, etc. after filling out a form pursuant to Attachment 8 of the Enforcement Rule of the Personal Information Protection Act. The company will take action without delay.
• ③ Should you request the Company to revise or delete errors found in your personal information, the Company will not use or provide the personal information until the correction or deletion is complete.
• ④ The exercise of the rights under paragraph 1 may be made through an agent, such as your legal representative or delegated person. In this case, you must submit a power of attorney in a form pursuant to Attachment 11 of the Enforcement Rule of the Personal Information Protection Act.
• ⑤ You must not infringe upon the personal information and privacy of others the company is handling in violation of related laws such as the Personal Information Protection Act.
• ⑥ The procedure for appealing against the refusal of your request for access, correction, deletion, or suspension of processing is as follows.
• 1. If the personal information management department delays or denies your request for access, etc., you will be provided notification of the justification and how to appeal within 10 days from the date of the request.
• 2. The Privacy Manager in the personal information management department checks and receives the claim (document, phone call or email).
• 3. The Chief Privacy Officer performs the final review of the result.
• 4. The personal information management department notifies you of the result.
• * [Attachment 8 of the Enforcement Rule for the Personal Information Protection Act] Request for personal information (For viewing, correction/deletion, suspension of processing)
• * [Attachment 11 of the Enforcement Rule for the Personal Information Protection Act] Power of attorney

6. Technical Measures to Protect Personal Information

When handling personal information, the Company website has the following technical measures in place to ensure safety in processing your personal information so that it is not lost, stolen, leaked, altered, or damaged.

• ① Your personal information will be protected by a password, and important data will be protected by using separate security features, such as the encryption of files and transferring of data in a locked file.
• ② The Company website uses a vaccine program to prevent damage caused by computer viruses. The vaccine program is updated periodically, and when a virus is discovered suddenly, we provide a vaccine as soon as it becomes available to prevent any infringement of personal information.
• ④ The Company website has a security device (SSL or SET) that can use an encryption algorithm to safely transmit personal information on the network.
• ③ To prevent your personal information from being leaked due to hacking, or other reason, we use a device that prevents intrusion. We have also put in place an intrusion detection system in each server for 24-hour monitoring.

7. Items of Private Information Processed

The Company processes private information as follows:

• ①Mandatory information: Your name, email, and phone number.
• ②The following information may be automatically generated and collected during the process of using the service.
  - Your IP address, cookies, MAC address, record of services used, your visits, and bad access.

8. Use of Cookies for Collection of Personal Information

The Company website uses cookies that constantly save and find your personal information. Your personal information, which the Company website collects through cookies, is limited to purposes including page view status, and no other information will be collected. Such information is used for the following purposes.

We analyze the frequency of access to our website and the length of the visit, and identify users' preferences and interests for use as a measure for targeted marketing and service reorganization. We analyze your level of participation in various events held on our website and the number of visits to provide differentiated application opportunities as well as to provide differentiated information based on individual interests.

You can choose your preference for the use of cookies. Go to Tools > Internet options > Security > Preference to allow all cookies, or confirm every time a cookie is saved, or refuse to save any cookies.

9. Disposal of Personal Information

The Company processes private information as follows:

• ① If personal information becomes unnecessary because the purpose of processing the personal information is achieved, or its retention period has expired, the Company immediately disposes of your personal information.
• ② When it becomes necessary to retain your personal information pursuant to other laws even after the retention period has elapsed or the purpose of processing the personal information is achieved, we transfer your information to another location including a separate database to be stored.
• ③ We dispose of your private information as follows.

1. Disposal process
The Company selects the personal information to be disposed of, gets approval from the Chief Privacy Officer, and then disposes of the information.

2. How we dispose of your personal information
The Company disposes of your personal information recorded/stored as electronic files using technical methods so that the record cannot be reproduced. Personal information recorded/stored as a paper document is destroyed by shredding or incineration.

10. Measures to Ensure the Safety of Personal Information

The Company takes the following measures to ensure the safety of your personal information.

• ① Administrative measures: Establishment/implementation of internal management plan and regular training of our employees, etc.
• ② Technical measures: Management of access to the personal information processing system, etc., installation of an access control system, encryption of the identification information, and installation of security programs.
• ③ Physical measures: Access control of the computer room, data storage room, etc.