General Provisions
This website values your personal information and is committed to complying with the Personal Information Protection Act. Through this Privacy Policy, POSCO Holdings Inc. ("the Company") explains for what purposes and in what manner the personal information you provide is used, and what measures are taken to protect it. If this Privacy Policy is revised, the Company will announce the changes through notices on its website.
Consent to the Collection of Personal Information
On the POSCO Holdings website (www.posco-inc.com), the Company provides an "Agree" or "Do Not Agree" option regarding the collection of personal information in the IR Inquiries and Reporting Center sections. Clicking "Agree" is deemed consent to the collection of your personal information.
Purpose of Processing and Categories of Personal Information Collected
The Company collects only the minimum personal information necessary to provide the IR Inquiries and Reporting Center services. The personal information processed will not be used for any purpose other than those stated below. Should the purpose of use change, the Company will take the necessary measures, including obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
Ethical Misconduct Reports (Named)
① For named reports to the Ethics Center, the POSCO Holdings website collects only the minimum personal information necessary.
- [Required] name, phone number, password
- [Optional] email
② The specific purposes for collecting and using each item are as follows:
- [Required] name, phone number, password: to verify identity and maintain a reliable channel of communication for delivering notices, handling concerns, and similar purposes.
- [Optional] email: to maintain a reliable channel of communication for delivering notices, handling concerns, and similar purposes.
③ The following information may be generated and collected automatically while you use the service:
- Your visit records (log data, IP address, and access date) and cookies
④ Personal information collected through cookies is limited to access statistics (such as the number of visits by authenticated users and by general users); no other information is collected.
Ethical Misconduct Reports (Anonymous)
① For anonymous reports to the Ethics Center, the POSCO Holdings website collects only the minimum personal information necessary.
- [Required] password
- [Optional] name, phone number, email
② The specific purposes for collecting and using each item are as follows:
- [Required] password: to verify identity.
- [Optional] name, phone number, email: to maintain a reliable channel of communication for delivering notices, handling concerns, and similar purposes.
③ The following information may be generated and collected automatically while you use the service:
- Your visit records (log data, IP address, and access date) and cookies
④ Personal information collected through cookies is limited to access statistics (such as the number of visits by authenticated users and by general users); no other information is collected.
Human Rights Reports
① For reports to the Human Rights Center, the POSCO Holdings website collects only the minimum personal information necessary.
- [Required] name, phone number, password
- [Optional] email
The specific purposes for collecting and using each item are as follows:
- [Required] name, phone number, password: to verify identity and maintain a reliable channel of communication for delivering notices, handling concerns, and similar purposes.
- [Optional] email
③ The following information may be generated and collected automatically while you use the service:
- Your visit records (log data, IP address, and access date) and cookies
④ Personal information collected through cookies is limited to access statistics (such as the number of visits by authenticated users and by general users); no other information is collected.
IR Inquiries
① For IR inquiries, the POSCO Holdings website collects only the minimum personal information necessary.
- [Required] country, name, company name, phone number, email
② The specific purposes for collecting and using each item are as follows:
- [Required] country, name, company name, phone number, email: to verify identity and maintain a reliable channel of communication for delivering notices, handling inquiries, and similar purposes.
③ The following information may be generated and collected automatically while you use the service:
- Your visit records (log data, IP address, and access date) and cookies
④ Personal information collected through cookies is limited to access statistics (such as the number of visits by authenticated users and by general users); no other information is collected.
Installation, Operation, and Refusal of Automatic Data Collection Devices
① To provide you with personalized services, the Company uses "cookies," which store and retrieve your information from time to time.
The personal information collected through cookies is limited to access statistics (such as the number of visits by authenticated users and by general users); no other information is collected. The personal information collected through cookies is used for the following purposes.
② The Company analyzes how often and how long you visit the site, and identifies your preferences and interests, to inform targeted marketing and improvements to its services.
③ You have the right to choose whether to accept cookies. Through your web browser settings, you can allow all cookies, be prompted for confirmation each time a cookie is stored, or refuse the storage of all cookies.
Retention and Use Period of Personal Information
The retention periods for personal information collected through the POSCO Holdings website are as follows. Personal information collected through inquiries and reports is destroyed five years after the report or inquiry is made. Upon destruction, the personal information is promptly and permanently deleted in a manner that prevents its recovery. (Where the information has been provided to a third party, the Company also instructs that third party to destroy it.) However, in the following cases, personal information is retained for the period specified in each:
① Where retention is required under the Commercial Act or other applicable laws, transaction records and minimal basic information are retained for the period prescribed by the relevant law.
② Where the retention period has been notified to you in advance and has not yet expired, or where your separate consent has been obtained, the information is retained for the agreed period.
Use Beyond the Stated Purpose and Provision to Third Parties
As a rule, the Company processes personal information only within the scope of the stated purposes for its collection and use. Except in the following cases, the Company does not process personal information beyond its original purpose or provide it to third parties without the data subject’s prior consent:
① Where separate consent is obtained from the data subject
② Where specifically required by law
Outsourcing of Personal Information Processing
① To ensure the smooth handling of personal information, the Company entrusts the processing of personal information to third parties as set out below.
| Service provider | Outsourced tasks | Retention and use period |
|---|---|---|
| POSCO | Receipt and handling of reports to the Reporting Center | Until termination of the outsourcing contract |
| POSCO DX | Service operation | Until termination of the outsourcing contract |
② POSCO outsources the operation of the Reporting Center services for both POSCO Holdings and POSCO to POSCO DX.
③ When entering into an outsourcing contract, the Company specifies in the contract and other documents—in accordance with personal information protection laws—matters such as the prohibition of processing personal information beyond the purpose of the outsourced work, technical and administrative safeguards, restrictions on re-outsourcing, supervision of the service provider (processor), and liability including damages. The Company also oversees whether the service provider processes personal information securely.
④ If the outsourced tasks or the service provider change, the Company will disclose this without delay through this Privacy Policy.
Procedures and Methods for Destroying Personal Information
When personal information is no longer needed—for example, the retention period has expired or the purpose of processing has been achieved—the Company destroys it without delay. The procedures and methods for destroying personal information are as follows:
Procedure: Once the retention period expires, the personal information is destroyed without delay.
Method: Information in electronic file form is destroyed in a manner that prevents the records from being recovered, and personal information printed on paper is shredded or incinerated.
Rights and Obligations of the Data Subject and Legal Representative, and How to Exercise Them
Each quarter, a data subject may access their own information directly after completing an identity verification process; thereafter, they may request access to their information by phone, in writing, or by email through the contact person listed in the relevant notice. If a data subject's request to access, correct, delete, or suspend the processing of their personal information is denied, the procedure for filing an objection is as follows:
① If the personal information management department postpones or denies such a request, it notifies the data subject of the grounds and the means of filing an objection within 10 days of receiving the request.
② The data subject files an objection with the personal information management department (in writing, by phone, or by email), and the staff member in charge reviews its contents.
③ The Chief Privacy Officer conducts a final review of the outcome.
④ The personal information management department notifies the data subject of the outcome.
Measures to Ensure the Security of Personal Information
In handling your personal information, this website implements the following technical safeguards to keep it secure and to prevent loss, theft, leakage, alteration, or damage:
① Your personal information is protected by passwords, and sensitive data is further protected through separate security measures, such as encrypting files and transmitted data or applying file-locking.
② This website uses antivirus software to guard against damage from computer viruses. The software is updated regularly, and when a new virus emerges, the corresponding update is applied as soon as it becomes available to prevent any compromise of personal information.
③ This website uses security protocols (SSL or SET) that employ encryption algorithms to transmit personal information securely over the network.
④ To prevent your personal information from being leaked through hacking or similar attacks, this website uses systems that block external intrusions and has installed an intrusion detection system on each server to monitor for intrusions 24 hours a day.
Privacy Officers and Contacts
Each operating company of POSCO Holdings has designated a department to protect your personal information and address privacy-related complaints. For the contact person’s details, please refer to those listed in the relevant section of this website. You may raise any privacy concern arising from your use of the Company’s services with the relevant department, and the Company will respond promptly and thoroughly.
| Category | Responsible Department | Contact Details |
|---|---|---|
| Chief Privacy Officer | Group DX Strategy Office of POSCO Holdings | Phone: 02-3457-2600 E-mail: humanright@posco-inc.com |
| Ethics Center | Privacy officer | Corporate Audit Office of POSCO Holdings | Phone: 080-390-3366 E-mail: holdings_ethics@posco-inc.com |
| Ethics Center | Privacy contact | Corporate Audit Office of POSCO Holdings | Phone: 080-390-3366 E-mail: holdings_ethics@posco-inc.com |
| Human Rights Center | Privacy officer | ESG Office of POSCO Holdings | Phone: 02-3457-0375 E-mail: esg@posco-inc.com |
| Human Rights Center | Privacy contact | ESG Office of POSCO Holdings | Phone: 02-3457-1039 E-mail: esg@posco-inc.com |
| IR Inquiries | Privacy officer | IR Office of POSCO Holdings | Phone: 02-3457-0627 E-mail: ir@posco-inc.com |
| IR Inquiries | Privacy contact | IR Office of POSCO Holdings | Phone: 02-3457-2561 E-mail: ir@posco-inc.com |
| Personal information management officer | PR Office of POSCO Holdings | E-mail: goeun.park@posco-inc.com |
| Personal information management contact | PR Office of POSCO Holdings | E-mail: minz@posco-inc.com |
Remedies for Infringement of the Data Subject’s Rights
If the data subject wishes to resolve a dispute or seek advice or other remedies regarding personal information infringement, they may lodge a complaint or request assistance from the following organizations:
1. Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr) 2. Personal Information Infringement Report Center: 118 (within Korea) (privacy.kisa.or.kr) 3. Korean National Police Agency: 182 (within Korea) (ecrm.police.go.kr)
The POSCO Holdings website is committed to safeguarding the data subject’s right to informational self-determination and to providing support and remedies in the event of personal information infringement. If you need to file a report or seek advice, please contact the department below.
Privacy-related Customer Inquiries and Reports
- PR Office of POSCO Holdings
- E-mail: minz@posco-inc.com