Policy on the Operation and Management of Video Surveillance Devices

Sofitel Ambassador Seoul Hotel & Serviced Residences (hereinafter referred to as “the Company”) hereby informs you of the purposes and methods of use and management of video information processed by the Company through this policy on the operation and management of video surveillance devices.

1. Legal Basis and Purpose of Video Surveillance Device Installation

The Company installs and operates video surveillance devices in accordance with Article 25, Paragraph 1 of the Personal Information Protection Act for the following purposes:

1) Facility safety and fire prevention

2) Crime prevention for customer safety

3) Prevention of vehicle theft and damage

2. Number of Installations, Locations, and Recording Range (CCTV)

• Business Name: Sofitel Ambassador Seoul Hotel & Serviced Residences

• Number of Installations: 800 units

• Locations and Recording Range: Hotel lobby, corridors on each floor, parking lots, elevators, and all areas accessible to customers

3. Responsible Persons for Management and Access

To protect customer video information and handle any inconvenience related to personal video information, the Company has designated the following persons responsible for the protection of personal video information:

• Person in Charge of Management: Jina Oh, Rooms Division Manager (Contact: 02-2092-6090)

• Persons with Access Authorization: Min-Sook Cho, General Manager (Contact: 02-2092-6000)

• Persons with Access Authorization: Seok-Hwan Lee, Director of Talent & Culture (Contact: 02-2092-6070)

4. Recording Time, Retention Period, Storage Location, and Processing Method

• Recording Time: 24 hours

• Retention Period: 30 days from the date of recording

• Storage Location: Security Office

The Company records and manages matters related to the use, provision to third parties, destruction, and viewing requests for personal video information for purposes other than the original intent. Upon expiration of the retention period, the information is permanently deleted using methods that prevent restoration (shredding or incineration for printed materials).

5. Outsourcing of Video Surveillance Device Installation and Management

The Company outsources the installation and management of video surveillance devices as follows and stipulates necessary measures in the outsourcing contracts to ensure the safe management of personal information in accordance with relevant laws and regulations.

• Contractor: UNS Korea

• Task: Security

• Contact Person: Tae-Han Lee

• Contact: 02-2092-6098

1) Details of Outsourced Tasks

– Operation of video surveillance devices and access control and management of video information storage locations

– Management of access records and information provision for video information viewing, etc.

– Management of video information retention and destruction

– Implementation of encryption technology, security program installation, and updates to ensure safety, and restriction of access to video information to prevent alteration or tampering

2) Outsourcing Standards

– Prohibition of processing video information for purposes other than the outsourced tasks

– Prohibition of re-outsourcing tasks and enforcement of technical and managerial protective measures

– Provision of education to contractors for securing the safety of video information and inspection of management status

– Imposition of liability for damages in case of violation of obligations by the contractor

6. Methods and Locations for Checking Personal Video Information

• Method: Contact the person responsible for video information management in advance and visit the Company for confirmation.

• Location: Security Office

7. Measures for Requests to View, Confirm, or Delete Personal Video Information

Customers may request to view, confirm the existence of, or delete personal video information at any time by contacting the operator of the video surveillance devices. However, this is limited to personal video information in which the customer is captured, and information necessary for the urgent protection of the customer’s life, body, or property. The Company may refuse requests to view, confirm, or delete personal video information in the following cases, and the person in charge will notify the customer of the reason for refusal in writing within 10 days:

• If the information has been destroyed after the retention period

• If fulfilling the request is likely to cause significant infringement on the privacy rights of others

• Other valid reasons for refusing the customer’s request to view, confirm, or delete the information

8. Measures to Ensure the Security of Video Information

Video information processed by the Company is securely managed through encryption and other measures. Additionally, the Company implements managerial measures for the protection of personal video information by granting differentiated access rights to personal information, and records and manages the date and time of creation, purpose of viewing, viewers, and the date and time of viewing to prevent alteration or tampering. Moreover, physical security measures, such as the installation of locks, are in place for the safe storage of personal video information.

9. Changes to the Policy on the Operation and Management of Video Surveillance Devices

This policy on the installation and operation of video surveillance devices was enacted on September 30, 2021. If there are any additions, deletions, or modifications to the content due to changes in laws, policies, or security technology, the Company will announce the changes, along with the reasons for them, on the hotel website at least seven days before implementation.

*** Date of Enactment of the Policy on the Operation and Management of Video Surveillance Devices: August 1, 2024.***