GS Energy Co., Ltd. (hereinafter referred to as 'GS Energy') complies with the relevant laws and regulations, including the 'Personal Information Protection Act' and the 'Act on Promotion of Information and Communication Network Utilization and Information Protection, Etc.,' to protect the valuable personal information of the information subject (hereinafter referred to as the 'information subject') and ensure that the information subject can use the services with peace of mind.
The company informs the information subject through its privacy policy about the purposes and methods for which the personal information provided by the information subject is being used and the measures taken to protect personal information.

This policy has been in effect since 3rd January, 2012.
The privacy policy contains the following contents:

1. Items of Personal Information Processed
2. Purposes of Processing Personal Information
3. Provision of Personal Information to Third Parties
4. Outsourcing of Personal Information Processing
5. Period of Processing and Retention of Personal Information
6. Destruction of Personal Information
7. Rights and Methods of Information Subjects and Legal Representatives
8. Installation, Operation, and Refusal of Personal Information Automatic Collection Devices
9. Measures to Ensure the Security of Personal Information
10. Personal Information Protection Manager and Methods of Remedying Privacy Rights Violations
11. Changes to the Privacy Policy on Personal Information Processing
GS Energy's recruitment website collects the minimum amount of personal information necessary for using the site, except for personal information required for job applications and application processing. The website provides a procedure for the information subject to choose "Agree" or "Disagree" for terms of use of this website, collection and use of personal information, collection and use of sensitive information, provision of personal information to third parties, and outsourcing of personal information processing.
[Job Application - Completing Job Application Form]

• Required l Name (Korean/English), desired position, gender, date of birth, photo, nationality, address, contact information (email, mobile phone number, emergency contact), disability status, veteran status, military service information, high school education details, self-introduction, health-related information (for candidates subject to medical examinations as part of the hiring process), video information/voice information (for candidates subject to AI competency assessments).
• Optional l College-level education details, work experience, foreign language proficiency, international experience, certifications, awards, extracurricular activities, volunteer work.

[Website Usage - Automatically Generated]

• Access records (IP address, access time, browser information, operating system information), session cookie information.

The purposes of processing (collecting, using, etc.) the information subject's personal information are as follows:

• Progressing the progress and step-by-step guidance of the recruitment process.
• Utilizing information subjects' profiles for regular recruitment and other purpose, when they have agreed to register in the talent POOL.
• Processing inquiries, handling complaints, and notifying the results of such processing when inquiries are received.

GS Energy uses the personal information of the information subject within the scope notified in '2. Purposes of Processing Personal Information,' and does not use it beyond this scope or provide it to third parties, individuals, or other companies or organizations. However, the information subject's personal information may be provided to third parties under the following circumstances:

• When separate consent has been obtained from the information subject (you).
• When there is a special provision in the law or when it is unavoidable to comply with legal obligations.
• When the information subject (you) or their legal representative is unable to express opinions, or due to circumstances such as an unknown address, where prior consent cannot be obtained, and it is clearly deemed necessary for the urgent benefit of the information subject or a third party's life, body, property.

1) GS Energy outsources the processing of personal information for smooth handling of personal information tasks and service enhancement as follows. If the content of the personal information processing tasks and the parties (subcontractors) receiving the outsourcing change, the company will notify the information subject in advance.

• Outsourced Task Content: Operation of the recruitment website and recruitment management information system, and related complaint handling. Operation of AI competency assessment candidate website information system.
• Subcontractor (Consignee): Midas IT Co,. Ltd.
• Personal Information Items Outsourced: All personal information collected in the process of providing services.
• Outsourcing Period: Until the termination of the outsourcing agreement between GS Energy and Mydus IT Co., Ltd.
• Outsourced Task Content: Testing, health examinations, verification of job application information, etc.
• Subcontractor (Consignee): The Korean Association of Behavioral Science(Corporation), Green Cross Corporation, Korea TOEIC Committee, Korean Literature Association, Alumni and Educational Institutions, Certification-related organizations, etc.
• Personal Information Items Outsourced: Name, date of birth, contact information.

2) When outsourcing the processing of personal information, GS Energy adheres to privacy protection-related laws and includes in the contract or other documents matters related to confidentiality of personal information, prohibition of processing personal information beyond the purpose of performing outsourced tasks, technical and administrative protective measures, supervision and management of consignees, restrictions on re-outsourcing, destruction of personal information, and liability, in accordance with privacy protection-related laws. The company also supervises subcontractors to ensure the secure handling of personal information. 1) GS Energy processes and retains personal information within the personal information retention and use period in accordance with the law or the personal information retention and use period agreed upon when collecting personal information from the information subject, and after the purpose of processing personal information is achieved. The information will be destroyed without delay.
2) The personal information processing and retention period is as follows, and if the information subject explicitly requests destruction for each of the items below, it will be destroyed without delay.

• Job application information, talent pool registration information, AI competency test application information
  : Hired employees – kept during employment
  : Non-employed applicants (those who were not selected) – 3 months after completion of recruitment process
• Inquiry registration information: Up to 3 years after completion of complaint processing

However, in accordance with the provisions of the Communications Secrets Protection Act, the Internet log records and access location tracking data of the information subject are stored separately for 3 months. 1) when personal information becomes unnecessary, such as when the personal information retention period has passed or the purpose of processing has been achieved.
2) When the agreed-upon personal information retention period from the information subject has expired, or when the purpose of processing has been achieved, yet, despite this, there is an obligation to continue retaining the personal information under other laws (refer to '5. Personal Information Processing and Retention Period'), the relevant personal information will be transferred to a separate database (DB) or retained in a different storage location.
3) The process and method of personal information destruction are as follows:

• Destruction Process: The company selects personal information for destruction when the reason for destruction arises and obtains approval from the company's personal information destruction manager.
• Destruction Method: Personal information recorded or stored on paper documents is destroyed by shredding or incineration. Personal information recorded or stored in electronic file format is destroyed using technical methods that make it irrecoverable.

1) Information subjects have the right to exercise the following personal information protection-related rights with GS Energy at any time:

• Request to view personal information
• Request for correction in case of errors
• Request for deletion of personal information
• Request to stop processing personal information

2) If you exercise rights such as viewing, correcting, deleting, or stopping the processing of personal information by contacting the Personal Information Protection Manager in writing, by phone, or via email, the company will take action without delay. However, please note that if the submission of an application has closed, there may be limitations on accessing and correcting personal information in the application.
3) When an information subject requests correction or deletion of personal information due to errors, GS Energy will not use or provide such personal information until the correction or deletion is completed.
4) GS Energy does not collect the personal information of children under the age of 14. However, in situations where the personal information of children under the age of 14 is collected, GS Energy ensures the legal rights of the legal guardian regarding the processing of personal information of children under the age of 14.
5) GS Energy verifies whether the requester of access, correction, deletion, or processing suspension in accordance with the information subject's rights is the information subject themselves or their legitimate representative. What is Cookie?
The very small text files that the server used to operate the website sends to the information subject's computer browser are stored on the information subject's computer hard drive.
What is Session?
It refers to storing user information on the server while the user accesses the server used to operate the website.
Purpose of Use
The company website does not use 'cookies' to continuously store and retrieve information from information subjects. However, it uses 'sessions' to provide users with a faster web environment and enhance convenience as part of our efforts to improve our services. GS Energy has implemented the following administrative, technical, and physical measures through the consignees mentioned in Article 4 to ensure the security of personal information:
1) Establishment and Implementation of an Internal Personal Information Management Plan
The company establishes and implements an 'Internal Personal Information Management Plan' based on the 'Personal Information Security Measures Criteria.
2) Minimization of Designation of Personal Information Handlers and Education
The company minimizes the designation of personal information handlers and conducts regular education.
3) Access Restrictions to Personal Information
The company controls access to personal information by managing access rights to database systems processing personal information, ensuring control over unauthorized access from both internal and external sources.
4) Storage and Prevention of Alteration of Access Records
The company stores and manages access records (access logs) to the personal information processing system in compliance with legal requirements and prevents unauthorized alteration of access records.
5) Encryption of Personal Information
Important personal information of information subjects is encrypted when stored and transmitted, using separate security features.
6) Installation of Security Programs and Regular Inspection and Updates
To prevent personal information leakage and damage due to hacking, computer viruses, etc., the company installs security programs and conducts regular inspections and updates.
7) Access Control for Unauthorized Individuals
The company establishes protected zones for locations where personal information is stored and controls access to these areas. GS Energy takes overall responsibility for personal information processing and has designated a Personal Information Protection Manager to handle complaints, damage relief related to personal information processing, and other matters. If you have inquiries or concerns related to personal information or if you discover any potential breaches of your rights while using the website, please contact the following Personal Information Protection Manager, who will promptly take action and notify you of the results:
※ Personal Information Protection Manager:

• Name: Yoon-gyu Jang (Director)
• Department: DX Lab Division

※ Personal Information Protection Manager:

• Name: Yong-seon Lee (Manager)
• Department: IT Security
• Contact : yslee@gsenergy.co.kr

Additionally, for remedies in case of personal information breaches or for consultations, you can contact the following organizations:

• Personal Information Dispute Mediation Committee: (without area code)1833-6972 (www.kopico.go.kr)
• Personal Information Breach Report Center: 118 (without area code) (privacy.kisa.or.kr)
• Cyber Investigation Division, Supreme Prosecutors' Office: 1301 (without area code) (www.spo.go.kr)
• Cyber Safety Bureau, National Police Agency: 182 (without area code) (cyberbureau.police.go.kr)

If there are any additions, deletions, or modifications to the contents of the privacy policy due to changes in laws, policies, or security technology, the company will announce the reasons and details of the changes on our website before implementing them.

• Personal Information Processing Policy Version: v2.1
• Date of Changes to Personal Information Processing Policy: 1st January, 2026
• Effective Date of Personal Information Processing Policy: 1st January, 2012

GS Energy Corporation (hereinafter referred to as "the Company") established and disclosed the following privacy policy to protect the personal information of visitors, employees, and other visitors, and to handle related complaints promptly and smoothly, in accordance with relevant laws and regulations, including the ‘Personal Information Protection Act’. The company may change the privacy policy in accordance with changes in laws and regulations, revisions, and changes in government policies, and internal policies. When amended, the company will notify the changes through the company's website or bulletin board. 가. Required Items

• Visitors
  - General Information: Name, address, date of birth, gender, phone number, affiliated company, vehicle registration number, CCTV video information
• Workers
  - General Information: Name, address, date of birth, gender, phone number, mobile phone number, affiliated company, educational history, career history, vehicle registration number, CCTV video information
  - Unique Identification Information: Resident registration number

나. Collection Methods

• Website, written forms, fax, phone, email

The ‘Company’ processes personal information for access permission and registration for restricted areas, re-entry management, access control in accordance with 'company' security regulations, work history management, work performance certification, safety management, and integration with 'company' systems for contract performance and related tasks. The 'Company' retains personal information until the purpose of processing is achieved. The 'Company' outsources the handling of personal information as follows, and takes necessary measures to ensure that personal information is safely managed under the relevant laws and regulations. The information processed through outsourcing is limited to the minimum information necessary for the tasks. The 'Company' shall provide personal information to third parties only in the following cases or with the separate consent of the data subject."

- When there is a special provision in the law.
- When it is necessary to comply with legal obligations.
- When providing personal information in a form that cannot identify specific individuals is required for statistical analysis, academic research, or market research purposes. 가. Destruction Procedure
-The 'Company' promptly destroys the relevant personal information when it becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose.
However, if personal information must be retained in accordance with internal policies or other legal requirements, it may be transferred to a separate database (DB) or stored in a different location for continued retention.
나. Destruction Method

• Personal information in electronic file format is destroyed using technical methods that make it irrecoverable or regenerable, while personal information printed on paper is destroyed through shredding or incineration.

가. Data subjects may exercise the following rights at any time with respect to the 'Company.' However, these rights may be limited in accordance with Article 35(3), Article 36(1), and Article 37(2) of the Personal Information Protection Act
- Request to view personal information
- Request to suspend the processing of personal information
- Request to correct or delete personal information
나. The methods for exercising these rights are as follows:
① The data subject's rights can be exercised through written documents, email, or other designated forms, and the 'Company' will promptly take action.
② If a data subject requests correction or deletion of personal information due to errors, the 'Company' will not use or provide the relevant personal information until the requested action is completed.
③ If a data subject exercises their rights through a legal representative or a delegate, a separate power of attorney in accordance with the designated form must be submitted. The 'Company' takes the following measures to ensure the security of personal information.

가. Administrative Measures: Establishment and implementation of internal management plans, regular employee training, etc.
나. Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs, etc.
다. Physical Measures: Access control in computer rooms, data storage rooms, etc. The 'Company' designates a Personal Information Protection Manager responsible for receiving opinions and handling complaints regarding personal information. The Personal Information Protection Manager is as follows.

• Personal Information Protection Manager
  - Name: Yoon-gyu Jang (Director)
  - Department: DX Lab Division
• Personal Information Protection Manager
  - Name: Yong-seon Lee (Manager)
  - Department: IT Security
  - Contact: yslee@gsenergy.co.kr