Sunhan Law Firm (hereinafter referred to as “the Firm”) has the following processing policy in place to protect users’ personal information and rights in accordance with the Personal Information Protection Act and to smoothly handle users’ grievances related to personal information. When the corporation revises its personal information processing policy, it will announce it through a website notice (or individual notice).

1. Purpose of processing personal information

The corporation processes personal information for the following purposes. The processed personal information will not be used for purposes other than the following, and if the purpose of use changes, prior consent will be sought.

• Civil complaint processing: Verification of the identity of the complainant, confirmation of the complaint, contact/notification for factual investigation, notification of processing results
• Reception and processing of legal consultation applications: Verification of the applicant’s identity, consultation schedule information, consultation result reply
• Provision of goods or services: provision of legal services, sending of bills, payment/settlement of fees
• Record preservation for notice/notification, grievance handling, and dispute mediation

2. Personal information file status

3. Processing and retention period of personal information

① The corporation processes and retains personal information within the personal information retention and use period pursuant to the law or within the personal information retention and use period agreed upon when collecting personal information from the information subject.

② Personal information related to legal consultation is retained and used for the above purposes from the date of consent to collection and use until the end of the retention period. (Retention basis: Act on Consumer Protection in Electronic Commerce, etc., records on contracts or subscription cancellation, etc. for 5 years)

4. Matters regarding provision of personal information to third parties

The corporation provides personal information to third parties only in cases that fall under Articles 17 and 18 of the Personal Information Protection Act, including the consent of the information subject and special provisions of the law. Currently, the corporation does not provide personal information to third parties.

5. Entrustment of personal information processing

① When a corporation entrusts personal information processing for smooth personal information processing, in accordance with Article 26 of the Personal Information Protection Act, matters related to responsibilities such as prohibition of processing of personal information for purposes other than the purpose of performing the entrusted work, technical and managerial protection measures, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages are specified in documents such as contracts, and supervise whether the trustee processes personal information safely.

② If the contents of the entrusted work or the trustee changes, it will be disclosed without delay through this personal information processing policy.

6. Rights and obligations of information subjects and methods of exercising them

① The information subject may exercise the following rights related to personal information protection against the corporation at any time.

• Request to view personal information
• Request for correction if there is an error, etc.
• Request for deletion
• Request to stop processing

② Rights pursuant to paragraph 1 may be exercised through writing, e-mail, facsimile (FAX), etc., and the Corporation will take action without delay.

③ If the information subject requests correction or deletion of errors in personal information, the corporation will not use or provide the personal information until correction or deletion is completed.

④ Rights under paragraph 1 may be exercised through an agent, such as the information subject's legal representative or a person authorized to do so. In this case, you must submit a power of attorney in the form attached to the Enforcement Rules of the Personal Information Protection Act.

7. Items of personal information processed

• Required items: name, mobile phone number
• Optional items: Email

8. Destruction of personal information

In principle, when the purpose of processing personal information has been achieved, the corporation destroys the relevant personal information without delay.

• Destruction procedure: The information entered by the user is transferred to a separate database after the purpose is achieved (separate documents in the case of paper) and stored for a certain period of time or immediately destroyed in accordance with internal policies and other relevant laws. Personal information transferred to the DB will not be used for any other purpose unless required by law.
• Destruction period: If the retention period has elapsed, it will be destroyed within 5 days from the end date. If it becomes unnecessary due to fulfillment of processing purpose, etc., it will be destroyed within 5 days from that date.
• Method of destruction: Electronic files are deleted in an irrecoverable manner, and personal information printed on paper is destroyed by shredding or incineration.

9. Measures to ensure the safety of personal information

In accordance with Article 29 of the Personal Information Protection Act, the corporation is taking the following technical, managerial and physical measures to ensure safety.

• Conduct regular self-audits (once a quarter)
• Minimization and training of employees handling personal information
• Control access to unauthorized persons and manage access to storage areas

10. Personal information protection officer

Information subjects may contact the personal information protection manager for all personal information protection-related inquiries, complaint handling, damage relief, etc. that arise while using the company's services. The corporation will respond and process inquiries from information subjects without delay.

11. Changes to personal information processing policy

This personal information processing policy is applied from the effective date, and if there are additions, deletions, or corrections of changes in accordance with laws and policies, they will be notified through notices 7 days prior to the implementation of the changes.

This policy will take effect from April 1, 2022, and the notation has been revised in accordance with the website reorganization on August 18, 2026.