Article 1 (Purposes of Processing Personal Information and Categories of Personal Information Processed)

The purposes for which the Firm processes personal information and the categories of personal information processed are as follows. The categories or items of personal information processing may vary depending on the position for which the Data Subject is applying.

General Personal Information

Applicants for Professional Positions (Attorneys, etc.)

• Mandatory
  • Purposes of processing personal information: verification of the applicant’s identity, educational background, and work experience; management of past application history; determination and notification of hiring decisions; confirmation of interest in future employment opportunities, etc.
  • Categories of personal information: name, photograph, address, home telephone number, mobile telephone number, date of birth, gender, military service status, email address, educational background, work experience, and all other personal information contained in documents such as personal statements and transcripts submitted to the Firm
• Optional
  • Purposes of processing personal information: use as reference materials in reviewing hiring decisions
  • Categories of personal information: qualifications, language proficiency, awards and honors

Applicants for General Staff Positions

• Mandatory
  • Purposes of processing personal information: verification of the applicant’s identity, educational background, and work experience; management of past application history; determination and notification of hiring decisions; confirmation of interest in future employment opportunities, etc.
  • Categories of personal information: name, photograph, gender, date of birth, address, home telephone number, mobile telephone number, email address, nationality, educational background, work experience, qualifications, awards/disciplinary records, military service status, evaluation results from assessments conducted by the Firm, and all other personal information contained in documents such as resumes, personal statements, and transcripts submitted to the Firm
• Optional
  • Purposes of processing personal information: use as reference materials in reviewing hiring decisions
  • Categories of personal information: veterans’ status

Part-Time Worker Applicants

• Mandatory
  • Purposes of processing personal information: verification of the applicant’s identity, educational background, and work experience; management of past application history; determination and notification of hiring decisions; confirmation of interest in future employment opportunities, etc.
  • Categories of personal information: name, photograph, gender, date of birth, address, home telephone number, mobile telephone number, email address, nationality, educational background, work experience, qualifications, awards/disciplinary records, military service status, evaluation results from assessments conducted by the Firm, and all other personal information contained in documents such as resumes, personal statements, and transcripts submitted to the Firm
• Optional
  • Purposes of processing personal information: use as reference materials in reviewing hiring decisions
  • Categories of personal information: veterans’ status

Clients

• • Purposes of processing personal information: provision of legal advice and related communications; notification of enactment and amendment of laws and regulations and seminars hosted or participated in by the Firm, etc.
  • Categories of personal information: name, contact information such as telephone number and email address, affiliated corporation/organization name and address, department and title/position, information generated or provided during the course of providing legal advice and related communications

Unique Identification Information

Applicants for General Staff and Part-Time Worker Positions

• Optional
  • Purposes of processing personal information: identification and verification of identity
  • Categories of personal information: (for foreign nationals) alien registration number, passport number

Sensitive Information

Applicants for General Staff and Part-Time Worker Positions

• Optional
  • Purposes of processing personal information: review of hiring decisions
  • Categories of personal information: health-related information

Article 2 (Period of Processing and Retention of Personal Information)

Unless there is an obligation to retain personal information pursuant to the provisions of applicable laws and regulations, the personal information of Data Subjects is, in principle, retained and used until the purposes of processing such personal information are achieved, and shall be destroyed without delay once such purposes are achieved. However, the retention and use period for achieving the purposes of processing shall not exceed three (3) years from the date of application.

Article 3 (Provision of Personal Information to Third Parties)

The Firm processes the personal information of Data Subjects only for the purposes specified in this Privacy Policy, and provides personal information to third parties only with the prior consent of the Data Subject or in accordance with the provisions of the Personal Information Protection Act and other applicable laws and regulations. The Firm currently does not provide personal information to third parties.

Article 4 (Delegation of Personal Information Processing)

The Firm delegates some of its personal information processing tasks to external parties as follows. When delegating personal information processing, the Firm specifies in contracts and other documents, in accordance with the provisions of the Personal Information Protection Act and other applicable laws and regulations, matters concerning: prohibition of processing personal information for purposes other than performing delegated work; technical and managerial safeguards for personal information; purpose and scope of delegated work; restrictions on sub-delegation; supervision and inspection of the person delegated; and liability including compensation for damages. The Firm supervises whether the person delegated safely processes personal information.

• Status of Delegation of Personal Information Processing

Article 5 (Overseas Transfer of Personal Information)

The Firm transfers personal information overseas in accordance with the grounds set out in Article 28-8(1) of the Personal Information Protection Act. Data subjects who do not wish to have their personal information transferred overseas may refuse such transfer by contacting the Personal Information Protection Officer or the department responsible for personal information, as set out below. Please note that refusing overseas transfer may result in restrictions on the provision of services or the performance of tasks that involve such transfer.

• Status of Overseas Transfers of Personal Information

Article 6 (Rights and Obligations of Data Subjects and Methods of Exercising Such Rights)

• ⑴ Data Subjects may exercise personal information protection-related rights against the Firm, including requesting access to, correction and erasure of, suspension of processing of their personal information, and withdrawal of consent in accordance with the Personal Information Protection Act and other applicable laws and regulations.
• ⑵ The exercise of rights under Paragraph 1 may be made in writing, by telephone, email, or other means, and may also be made through a legal representative or an authorized agent of the Data Subject. However, in such cases, a power of attorney pursuant to the Enforcement Rules of the Personal Information Protection Act must be submitted to the Firm.
• ⑶ The Firm will take action without delay regarding the exercise of rights by Data Subjects in accordance with the Personal Information Protection Act and other applicable laws and regulations.

Article 7 (Destruction of Personal Information)

• ⑴ In principle, when personal information becomes unnecessary, such as when the purposes of processing personal information have been achieved, the Firm destroys such personal information without delay.
  
• ⑵ When the Firm is required to retain personal information without destroying it in accordance with the provisions of applicable laws and regulations, the Firm stores and manages such personal information or personal information files separately from other personal information.
  
• ⑶ The Firm selects personal information for which grounds for destruction have arisen, obtains approval from the Privacy Officer, and destroys such personal information.
  
• ⑷ When personal information to be destroyed is in the form of electronic files, the Firm permanently deletes it using methods that make recovery impossible. For other records, printed materials, written documents, or other recording media, the Firm shreds or incinerates them.

Article 8 (Collection of Opinions and Handling of Complaints)

Data Subjects may contact the Chief Privacy Officer or Privacy Officer below for inquiries, complaints, damage relief, and other matters related to personal information protection. The Firm will provide prompt and sufficient responses to inquiries from Data Subjects.

	Chief Privacy Officer	Privacy Officer
Name	Yoonjung Chung	Keunho Chang
Contact	privacy@kimchang.com

Article 9 (Changes to the Privacy Policy)

The Firm’s Privacy Policy may be changed in accordance with applicable laws and regulations, guidelines, and the Firm’s internal policies. When the Privacy Policy is changed, such changes will be disclosed in accordance with the methods prescribed by applicable laws and regulations. This Privacy Policy shall be effective from August 31, 2026.

Article 10 (Measures to Ensure the Safety of Personal Information)

The Firm takes the following measures to ensure the safety of personal information:

• Managerial measures: establishment and implementation of internal management plans, regular personal information protection training for employees, etc.
• Technical measures: access control management for personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs, etc.
• Physical measures: access control at personal information storage locations such as computer rooms and document storage rooms