PGT Co., Ltd. (hereinafter referred to as the “Company”) lawfully processes and securely manages personal information in compliance with the Personal Information Protection Act and other applicable laws and regulations, in order to protect the freedom and rights of data subjects. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company hereby establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for the processing and protection of personal information and to ensure the prompt and smooth handling of related grievances.

1. Purpose, Items, and Retention Period of Personal Information Processing

2. Provision of Personal Information to Third Parties
The Company provides personal information to third parties only where required by law, where an investigative agency requests such information in accordance with the procedures and methods prescribed by law for investigative purposes, or where separate prior consent has been obtained.

3. Procedures and Methods for Destruction of Personal Information
① The Company shall destroy personal information without delay when such information becomes unnecessary due to the expiration of the retention period, achievement of the processing purpose, or other similar reasons.
② If personal information must continue to be retained under other applicable laws even after the retention period consented to by the data subject has expired or the purpose of processing has been achieved, such personal information shall be transferred to a separate database (DB) or stored in a different storage location.
③ The procedures and methods for destroying personal information are as follows.
1. Destruction Procedure
The Company establishes and implements a destruction plan for personal information (or personal information files) that must be destroyed. The Company selects the personal information (or personal information files) for which grounds for destruction have arisen and destroys them with the approval of the Chief Privacy Officer.
2. Destruction Method
Personal information recorded and stored in electronic file form shall be destroyed in a manner that prevents the records from being restored or reproduced, and personal information recorded and stored in paper documents shall be destroyed by shredding or incineration.

4. Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercising Them
① A data subject may exercise the right to request access to, correction of, deletion of, suspension of processing of, or withdrawal of consent for personal information, as well as the right to refuse or request an explanation of automated decisions, at any time with respect to the Company, and may also exercise such rights through an agent pursuant to Article 38(1) of the Personal Information Protection Act.
※ The legal representative of a child under the age of 14 may request access to the child’s personal information pursuant to Article 38(2) of the Personal Information Protection Act.
② Such rights may be exercised against the Company in writing, by e-mail, facsimile (FAX), or other means pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company shall take action without delay.
③ Such rights may also be exercised through a legal representative of the data subject or another duly authorized agent. In such case, a power of attorney in the form set forth in Appendix Form No. 11 of the Public Notice on the Methods of Processing Personal Information (Notice No. 2020-7) must be submitted.
④ The right to request access to personal information and suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
⑤ Where the collection of such personal information is expressly required under other laws, deletion of such personal information may not be requested.
⑥ Where the data subject has consented to the fact that automated decisions will be made, where such fact has been notified in advance through a contract or otherwise, or where it is clearly prescribed by law, refusal of automated decisions shall not be recognized, and only requests for explanation and review may be made. In addition, a request to refuse or seek an explanation of automated decisions may be denied where there are legitimate grounds, such as a risk of unjustly infringing upon the life, body, property, or other interests of another person.
⑦ When a request for access, correction, deletion, suspension of processing, or refusal or explanation of automated decisions is made pursuant to the rights of a data subject, the Company verifies whether the person making such request is the data subject or a duly authorized representative.

5. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information.
1. Administrative measures: establishment and implementation of internal management plans, minimization of personnel handling personal information, and training
2. Technical measures: management of access rights to personal information processing systems, installation of security programs
3. Physical measures: access control to computer rooms, records storage rooms, and other restricted areas

6. Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information
The Company does not operate devices that collect personal information automatically generated when using internet services, such as cookies.

7. Chief Privacy Officer and Department Responsible for Access Requests
① he Company is responsible for overall personal information processing affairs and has designated the following Chief Privacy Officer to handle complaints and provide remedies for damages relating to personal information processing.
② Data subjects may contact the Chief Privacy Officer and the responsible department regarding complaints related to personal information protection, damage relief, and other related matters arising from the use of PGT’s services. PGT will respond to and handle such inquiries without delay.
③ Where a data subject requests access to personal information pursuant to Article 35 of the Personal Information Protection Act, the Company will endeavor to ensure that such request is processed promptly. 1. Chief Privacy Officer
Name: SUNG-HOON SHIM
Title: Team Manager
Contact: shshim@pgtchem.com

8. Remedies for Infringement of Data Subject Rights
① To obtain relief for infringement of personal information rights, a data subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, or other relevant institutions. For other reports or consultations regarding personal information infringement, please contact the following organizations.
1. Personal Information Dispute Mediation Committee : 1833-6972 (www.kopico.go.kr)
2. KISA Privacy Center : 118 (privacy.kisa.or.kr)
3. Electronic Cybercrime Report & Management system : 182 (ecrm.police.go.kr)

9. Changes to the Privacy Policy
This Privacy Policy shall take effect on July 7, 2025.

[No Unauthorized Collection of Email Addresses]
PGT refuses the unauthorized collection of e-mail addresses posted on this website by means of e-mail collection programs or any other technical devices. Please note that violations may be subject to criminal penalties under the Act on Promotion of Information and Communications Network Utilization and Information Protection.

Date of Posting: July 7, 2025

We hereby inform you that no personal information related to this system will be provided to any third party.
In addition, the information provided will be destroyed without delay after verification of the reported facts and completion of the case.

Collected personal information will not be shared with anyone other than the responsible internal personnel and will not be used for commercial or marketing purposes.

Except as required by law, information will not be provided to any third party without prior consent.

To protect personal information, we implement technical and administrative safeguards in accordance with applicable laws and regulations.