Privacy Policy

KT CORPORATION PRIVACY & COOKIES NOTICE

Last updated May 11, 2023

KT CORPORATION (“KT,” “we,” or “us”) is committed to the lawful, fair, and transparent collection and use of personal data. This notice is intended to help you understand how we collect and use your personal data, as well as how we share, store, and protect that data. If at any time you have questions about this notice, please let us know by contacting us at the information listed below in the section titled, “How to contact us.” We may update this notice and any supplemental privacy notices to reflect changes in our practices and applicable law. We will post a notice of any material updates on our sites.

When this notice applies

Our sites

This notice applies to personal data we collect, including through this website, other KT website, mobile applications, online portals, electronic forms, surveys, interactive exhibits, and any other channel or mobile feature that we operate (collectively, “our sites”). In these instances, KT is the controller responsible for your personal data.

Supplemental privacy notices

This notice may be supplemented by a supplemental privacy notice applicable to a particular interaction with us, which may be either embedded in this notice or made available to you separately. We will tell you when a supplemental privacy notice applies.

Links to third-party sites

This notice does not apply to any third-party sites that may link to, or be accessible from, our sites. We are not responsible for any of the content, features, functionality, or privacy practices of other linked sites or services. The data collection and use practices of any linked third-party site will be governed by that third party’s applicable privacy notice, statement, or policy, and its terms of use. We encourage you to read them.

What data we collect about you

Data you provide about yourself

We collect your personal data when you voluntarily provide it to us. For example, you may give us: your email address, country of residence, and areas of interest if you choose to receive newsletters, updates, or other information from us; your contact information, and any other personal data you choose to include, if you email, text, or instant message us, or contact us through our sites; and any personal data contained in, or included with, any proposal documents, feedback, comments, photos, videos, or other information you submit via online portals, forms, surveys, or interactive portions of our sites. It is always your choice whether to provide this personal data. However, some personal data must be provided to participate in certain programs, activities, or events (such as to sign up for a newsletter, apply for a job, or register to participate in one of our events), so the decision not to provide information might limit or eliminate such functions of our sites or your ability to participate in such programs, activities, or events. Please do not disclose more personal data than is requested.

Personal data you provide about others

Do not provide personal data about others unless you are authorized or required to do so by contract or applicable law. You may provide personal data on behalf of another person if you have provided them with a copy of this notice and any applicable supplemental privacy notice, and obtained their explicit consent. We may ask you to provide evidence of that notice and consent.

Data we collect automatically, including cookies, pixels, and similar technologies

We may collect some personal data automatically. For example, when you visit our sites, we may collect your Internet Protocol (“IP”) address, Internet service provider (“ISP”) information, and browser type and language. We also may use cookies, pixels, and similar technologies to collect data about your interaction with our sites, including, for example, referring webpage, pages visited on our sites, and crash data. In addition, we may link the information we collect automatically or the information from any cookie or pixel with the information you provide in other contexts on our sites (newsletters, etc.) to personalize, connect and streamline your experience when visiting our sites. For example, this may include connecting your use of our site from your desktop, mobile, or other device. Please see Cookies & Similar Technologies for more information, including how to manage cookies, pixels, and similar technologies.

Special categories of data

We will not intentionally collect any “special categories of data” under the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (“UK GDPR”), or the Protection of Personal Information Act (“POPIA”) without your explicit consent for one or more specified purposes or as otherwise permitted or required by applicable law. Special categories of data include personal data (a) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; or (b) concerning health or data concerning a natural person’s sex life or sexual orientation.

Minors

Our sites are not intended for minors (individuals under the age of 13, or equivalent minimum age depending on jurisdiction), and we do not knowingly collect personal data from minors. If you become aware of any personal data we have collected from a minor, please contact us. If we learn that we have collected personal data from a minor, we will take steps to delete the data without notice as soon as possible.

How we use your data

Purposes

We may use your personal data to: send you information that you have expressly chosen to receive [with your consent]; review and respond to proposal documents, feedback, comments, photos, videos, or other information you submit via online portals, electronic forms, surveys, or interactive portions of our sites [for our legitimate interests and/or to perform a contract with you]; administer, safeguard, and improve our sites, systems, facilities, events, and other business operations [for our legitimate interests]; protect our rights and the safety of others [for our legitimate interests]; contribute to our archive of information in the public interest [for our legitimate interests]; and/or comply with applicable law, court order, subpoena, or legal process served on us [to comply with legal obligations].

Additional purposes

Additional purposes for using your personal data may be described in a supplemental privacy notice.

Legal bases under the GDPR, UK GDPR, or POPIA

If you are in the European Economic Area (EEA), the United Kingdom (UK) or South Africa, we will collect and use your personal data only if we have one or more legal bases for doing so under the GDPR, UK GDPR, or POPIA. The legal bases depend on your interaction with us and our sites. This means we collect and use your personal data only where: you have given your consent for one or more specific purposes; it is necessary to perform a contract we are about to enter into or have entered into with you; it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; it is necessary to protect the vital interests of you or another natural person; or it is necessary to comply with a legal obligation. We will indicate the legal basis or bases on which we are relying for each purpose. Where we are relying on consent as the legal basis, we will notify you and seek additional consent before using your personal data for a new purpose that is inconsistent with the original purpose for which we collected it.

Your Data Protection Rights Under General Data Protection Regulation (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data. If you wish to be informed what personal data we hold about you and if you want it to be removed from our systems, please contact us as specified in the contact information section of this privacy notice. In certain circumstances, you have the following data protection rights: - Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. - Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. - Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. - Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party). You can object to the processing of your personal information in some circumstances. - Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. - Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. - Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. If you wish to exercise any of the rights set out above, please contact us.

Do Not Share My Personal Information

The California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”), collectively referred to as “California Consumer Privacy Laws,” allow you to limit the sale and sharing of your personal information. We do not sell any of your personal information. We share your personal information for limited purposes, including responding to your requests and assisting with our internal operations.

Limit the Use or Disclosure of My Sensitive Personal Information.

The California Consumer Privacy Laws also allow you to limit the use or disclosure of Sensitive Personal Information (“SPI”). We collect SPI of SHINE Data applicants to process their requests for SHINE Data. We do not collect SPI for general marketing purposes.

When we share your data

Employees, agents, affiliates, service providers, and partners

We may share your personal data with our employees, agents, and affiliates who have a business need to know, our services providers (including contingent workers, consultants, contractors, vendors, and out-sourced service providers) to process it for us based on our instructions and for no other purpose, and with partners that are collaborating with us. We do not share your personal data with any third party (including our service providers) for marketing purposes unless you have provided consent for us to do so. If you believe personal data you provided to us is being misused by a third party, please contact us right away.

Law enforcement

We may share your personal data with law enforcement, other government agencies or authorities, or third parties as required by applicable law, court order, subpoena, or legal process served on us.

How we store and protect your data

Storage and transfers

Your personal data may be stored in your region or in any other country where we or our service providers have facilities. We may also allow employees and service providers located around the world to access personal data as provided in this notice. Your consent to this privacy notice followed by your submission of such information represents your agreement to that transfer. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy notice and no transfer of your personal data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information. We will also comply with similar applicable laws regarding the storage and transfer of personal data in other jurisdictions where your personal data may be collected or provided.

Storage period

We will store your personal data until it is no longer needed to fulfill the purpose(s) for which it was collected or as otherwise required or permitted by law. After such time, we will either delete or anonymize your personal data or, if this is not possible, we will securely store your personal data and isolate it from any further use until deletion is possible. We may dispose of any data in our discretion without notice, subject to applicable law. Please contact us if you would like more details regarding our retention periods for different categories of personal data.

Protection

As the transmission of data via the internet is not completely secure, we cannot guarantee the security of your information transmitted to our sites and any such transmission is at your own risk. However, we maintain appropriate technical and organizational measures, including performing regular self-assessments, to prevent unauthorized disclosure of, or access to, personal data. We limit access to personal data and require that employees authorized to access personal data maintain the confidentiality of that data. We hold our service providers to at least the same data privacy and security standards to which we hold ourselves. Our standard information security requirements for service providers are available here.

How you can access and control your data; your rights

To the extent provided by applicable laws, you may have the right to obtain confirmation that we hold personal data about you; to access, correct, or delete your personal data; to withdraw any consent you previously provided to us; to object to or restrict our processing of your personal data in any other context; to deactivate, block, anonymize, or delete personal data as appropriate; or to request and receive a copy of the personal data you have provided us and to transmit this data to a third party. To exercise any of these rights that you are not able to do directly, please contact us. You may also have the right to lodge a complaint with the applicable data protection authority. If you do not wish to receive promotional communications from us, you can opt-out by e-mailing us. Even if you opt-out of receiving these promotional communications, we reserve the right to send you certain communications relating to our sites, including administrative messages. We do not offer you the opportunity to opt-out of receiving those communications.

How to contact us

Please e-mail us for questions, concerns and requests. If you prefer to contact us by mail: Mail: shineforall@kt.com Attn: Ah-Reum Jang 209, Jamsil-ro, Songpa-gu, Seoul

KT SUPPLEMENTAL PRIVACY NOTICE FOR SHINE DATA APPLICANTS

This notice supplements our Privacy & Cookies Notice and describes how we collect, use, and share additional personal data when you submit your application for SHINE Data, and how to access and control this additional data. Please let us know if you have any questions about this supplemental notice.

What additional data we collect about SHINE Data applicants

SHINE Data Application

When you apply for SHINE Data, we will ask you to provide your name, affiliation, email address and purpose of use. These are asked to evaluate your application and to send you the SHINE Data. Please contact us if you have any questions about why certain data is required.

How we use this additional data

SHINE Data Application

We may use this information for purposes and legal basis addressed in the chart below.

Data Type	Legal Basis for Processing
Name	Contract & Legitimate Interest – KT requires this to process your application.
E-mail Address for receiving SHINE Data	Contract & Legitimate Interest – KT requires this to process your application, to inform you whether your application was successful and to send you the requested SHINE Data if successful.
Affiliation	Contract & Legitimate Interest – KT requires this to process your application.
Purpose of Use	Contract & Legitimate Interest – KT requires this to process your application.

When we share this data

Application Forms

Unless otherwise stated on an application form, we use Microsoft Forms to process and manage SHINE Data application forms. By accessing the link for SHINE Data application, your data such as IP address and cookies will be passed to Microsoft server. Please refer to the “Links to third-party sites” Section for more information.

How long we keep your data

We store personal data of SHINE Data applicants in accordance with the Privacy & Cookies Notice. If you request to receive SHINE Data, we will retain your information on the application form for as long as necessary to send you SHINE Data and/or to decide whether the purpose of request/use is appropriate.

How you can access and control this data

If you wish to access or correct your personal data submitted through SHINE Data application form, or object to our data processing, please contact us. Please note that neither changes to, or deletion of, such personal data will alter personal data already relied upon or no longer in our control.

KT COOKIES & SIMILAR TECHNOLOGIES

This notice describes the different types of cookies and similar technologies we may use in connection with our sites. Unless you have adjusted your browser setting so that it will refuse cookies, cookies may be issued when you visit our sites. We use strictly necessary cookies to make our site work. We and our partners also use additional cookies and similar technologies to collect information when you interact with our site to improve your experience including, to provide you with tailored content, personalized experience, and analyze site usage. If the site has a “Manage Cookies” button, you can view, change and manage your cookie settings at any time. By clicking “Accept All,” you consent to the placement of these additional cookies and similar technologies. If the site does not have a "Manage Cookies" button, your continued use of the site represents your consent to the relevant cookies and similar technologies being placed on your computer or device. For more information, please see “Managing cookies and similar technologies” section below.

Cookies and similar technologies we use

Cookies

Our sites may use cookies, which are small text files stored on your computer or device when you access a website. More information about cookies is available at www.aboutcookies.org. We may use cookies to: (1) allow you to use the sites without having to re-enter your user name and password; (2) understand how you engage with the sites and to enhance or personalize your experience, including across devices; (3) monitor the site usage; (4) manage the sites; and (5) improve the sites and our services, including providing you with interest-based ads. We may also use web beacons on our sites, in our emails, and in our advertisements on other websites. Web beacons are tiny graphic images that are used to collect information about your visit to our sites, such as the pages you view and the features you use, as well as information about whether you open and/or act upon one of our emails or advertisements. We may also collect the URL of the website you visited immediately before coming to our sites. Web beacons help us analyze our site visitors' behavior and measure the effectiveness of our sites and our advertising. We may work with service providers that help us track, collect and analyze this information.

Click-through URLs

If you “opt in” to receive SHINE Data, updates, or other information from us, our emails may use a “click-through URL” linked to content on our sites. When you click one of these URLs, they pass through a separate web server before arriving at the destination page on our sites. We use this click-through data to help us understand how recipients respond to, or interact with, our emails.

Third-party cookies and similar technologies

Third-party analytics services

We use third-party analytics services, including Google Analytics and others, to collect information about your use of our sites and enable us to improve our sites. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners. Google Analytics and other third-party analytics services use cookies and similar technologies to collect information about use of our sites and to report website trends to us, without identifying individuals to us. We use this information to see the overall patterns of usage on our sites, help us record any difficulties you have with our sites, and tell us whether our communication efforts are effective. We may also link the information provided by third party analytics services with the information we collect, or you provide in other contexts on our site (newsletters, etc.), to personalize, connect and streamline your experience when visiting our sites.

Managing cookies and similar technologies

Cookies

You do not need to have cookies enabled to browse our sites unless you want us to remember you and your preferences when you return. If you prefer not to allow cookies, most cookies can be managed or blocked through your browser. However, if your browser is set to reject cookies or you manually delete cookies, you may have some trouble accessing and using some of the pages and features that are currently on our sites, or that we may put on our sites in the future. Note that browser-management tools for cookies are outside of our control and we cannot guarantee their effectiveness. If you prefer not to be tracked in this way, please do not click text or graphic links in emails you receive from us.

Third-party analytics services

You can opt out of data collection or use by Google and other third-party analytics services we may use on some of our sites at the following links: Google Analytics: tools.google.com/dlpage/gaoptout (requires you to install a browser add-on)

Do-not-track requests

There is no standard for how online service should respond to “Do Not Track” signals or other mechanisms that may allow you to opt out of the collection of information across networks of websites and online services. Therefore, we do not honor “Do Not Track” signals. As standards develop, we will revisit this issue and update this notice if our practices change.