Art. 1Legal Basis and Purposes of Installation

① Pursuant to Article 25(1) of the Personal Information Protection Act, the Company installs and operates fixed visual data processing devices for the following purposes.

1. Safety and management of facilities and equipment

2. Prevention of and response to incidents such as fire and theft

3. Ensuring the safety of employees and visitors

4. Safety management of workplaces and production facilities, prevention of accidents, and identification of their causes

② The Company does not install or operate fixed visual data processing devices in a way that allows viewing the inside of places where personal privacy may be seriously infringed, such as baths, toilets, saunas, and changing rooms used by many unspecified persons.

Art. 2Number of Devices, Installation Locations, and Recording Range

① The number, installation locations, and recording range of the fixed visual data processing devices installed and operated by the Company are as follows.

② If the number of devices, installation locations, or recording range changes, the Company will amend this Policy and disclose it.

Art. 3Managers, Responsible Departments, and Persons Authorized to Access Visual Data

① The Company designates managers of fixed visual data processing devices as follows to protect visual data and to respond to requests from data subjects regarding visual data.

② Access to visual data is limited to the manager and the employees of the responsible department designated by the manager, and no other persons may access visual data.

③ The Company records and manages the designation of persons authorized to access visual data and any changes thereto.

Art. 4Recording Hours, Retention Period, Storage Location, and Processing Methods

① The recording hours and retention periods are as follows.

② Storage location: Areas within the business sites where visual data storage devices are installed

③ Processing method: The Company records and manages matters concerning the use, provision, and destruction of visual data, and destroys visual data without delay once the retention period has expired. However, where other laws require retention, the Company retains it for the required period.

Art. 5How and Where the Company Checks Visual Data

① Method: Real-time monitoring on control screens and playback of video stored in storage devices

② Location: Areas within the business sites where visual data storage devices are installed

Art. 6Measures in Response to Data Subjects' Requests for Access, etc.

① Data subjects may request access to, confirmation of the existence of, or deletion of visual data in which they are recorded. In this case, they shall make the request to the manager under Article 3, and the Company may ask them to specify the time and place of recording.

② Upon receiving a request under paragraph (1), the Company will take the necessary measures without delay and, within 10 days from the date of receiving the request, allow access to the visual data or confirm and notify its existence.

③ The Company may restrict or refuse access, etc. in any of the following cases, and in such cases will notify the reasons and how to file an objection in writing, etc. within 10 days from the date of receiving the request.

1. Where it would seriously hinder a criminal investigation, the institution and maintenance of prosecution, or the conduct of a trial

2. Where it is likely to unfairly infringe on the life, body, property, or other interests of another person

3. Other cases where laws allow access, etc. to be restricted or refused

④ Where persons other than the data subject are recorded in the visual data subject to access, the Company will make those parts unidentifiable before allowing access.

Art. 7Measures to Ensure the Security of Visual Data

① Pursuant to Article 29 of the Personal Information Protection Act, the Company takes technical, managerial, and physical measures to manage visual data securely, such as differentiated access rights, access control, and locking devices for storage devices.

② To prevent forgery or alteration of visual data, the Company records and manages the date and time of creation of visual data and, where it has been used or provided, the date, time, and purpose thereof.

③ The Company does not arbitrarily operate fixed visual data processing devices for purposes other than the purposes of installation or point them at other places, and does not use the audio recording function.

④ Other matters concerning the installation and operation of fixed visual data processing devices and the processing of visual data are governed by the Company's information security regulations and guidelines.

Art. 8Entrustment of the Installation and Operation of Fixed Visual Data Processing Devices

① Where the Company entrusts the installation and operation of fixed visual data processing devices, it includes the matters prescribed by law in the entrustment contract and discloses the trustee and the details of the entrusted work in this Policy.

② As of the date of disclosure of this Policy, the status of entrustment is as follows.

③ The devices installed in the production and testing areas of Hanam GMP are installed and operated directly by the Company and are not entrusted.

Art. 9Changes to the Policy

① This Policy (Version 1.0) applies from November 2, 2026.

② Where there are additions, deletions, or modifications to this Policy, the Company will disclose the changes through the website.