How Your Credit Information is Used

This is designed to help you understand how your credit information is used by us in accordance with Article 31 of the Use and Protection of Credit Information Act and Article 27 of the Enforcement Decree of the Act.

Purpose of Use and Type of Credit Information

1. Purpose of Use

• To establish financial relationship (including but not limited to financial services requested by you) or decide whether to maintain such relationship
• Debt collection
• Marketing
• Other cases permitted by the Act or other applicable laws

2. Type of Credit Information

• Personally Identifiable Information (PII): any information that could potentially identify a specific individual
  Name, Contact Number, Residence Registration Number (for foreigners, foreigner registration number, for compatriots with foreign nationality, domestic residence registration number, passport number, sex, nationality, etc.), Name of Corporation (including individual company and corporation), Business Registration Number, Corporation Registration Number, Name of Representative, etc.
• Credit Transaction Information: any information that could potentially show credit transactions of a specific individual
  Type, period, amount, limit, etc, of commercial transactions including loan, guarantee, provision of collateral, current account transactions, credit card and installment financing
• Information used to determine credit rating
  Information on default, bankruptcy, payment by subrogation ^{Note 1}, substitute payment ^{Note 2)} arising out of commercial transactions activities disrupting credit order by fraud, deception and other dishonest means (amount, date when it took place or was resolved)
• Credit Worthiness Information: Information based on which you can determine an individual’s credit limit
  <Individual Customer>
  Occupation, property, debt, income, tax payment records, etc.
  <Corporate Customer>
  Information on a corporate including history, purpose, business performance, shareholding, CEO and executive information, important deals such as sales record, order lists or business contracts, financial information including financial statements, auditor’s opinion, tax payment records, etc.
• Record with Public Organization
  Information on failure in tax (national tax, local tax, customs) and insurance premium (employment/industrial disaster insurance) payment, defaulter record, customers under debt workout program or credit recovery program, and customers exempted from liabilities due to bankruptcy, etc.

^Note1) One party to make a payment hat is actually owed by another party

^{Note 2)} Payment is made by a bank (or a government) providing payment guarantee in case where a debtor fails to make payment by due date

Purpose of Credit Information Provision, Party to Whom We Provide Credit Information, Type of Credit Information Provided

1. Purpose of provision and persons/institutions to whom information is provided

• Collection of credit information to be provided to financial institutions: Credit Information Collection Agency (Korea Federation of Banks, Credit Finance Association, etc.), Credit Reference Agency (Seoul Credit Information Service, Korea Credit Bureau, Nice Information Service, etc.)
• Public organizations requiring the information in accordance with the relevant laws and regulations: for the purpose set forth in the laws and regulations
• Counterparty to product/service purchase agreement

• Foreign Regulatory Authorities, Head Office/ Affiliates

• Service providers to whom the Bank outsourced part of its businesses

2. Type of credit information to be provided

• Personally Identifiable Information (PII)
• Credit Transaction Information
• Credit Worthiness Information
• Public record, etc.

3. Security of Information

The Bank takes technical/managerial/physical measures to ensure safety of outsourced processing of credit information etc., in accordance with Article 5 Paragraph ② of the Regulation on Outsourcing of Information Processing of Financial Companies.

- Encryption of Information
The Bank keeps information or password of customers secure by powerful encryption methods. In order to keep important data secure, the Bank employees separate sophisticated security functions such as software to encrypt or lock files/data during data transfers.

- Technical Support to Prevent Hackers’ Attack
The Bank has established security programs to prevent information from being leaked or damaged by hackers’ attacks or computer viruses and checked and updated the programs on a regular basis. The information processing systems are established in a restricted area and technical/physical measures are taken in order to monitor and to control access.

- Access Control of Information Processing System
By granting, changing or canceling authority to access the database system to process information, the Bank strictly controls access to information. In addition, the Bank employs sophisticated fire-walls to control unauthorized access to the system.

- Supervision of Information Managers
The Bank is granting access to the information processing system to a minimum number of employees who need to carry out the processing for their duties (“information managers”) and also keeps the scope of processing information to a minimum required for the business.

The Bank is supervising the information managers by having them submit a security agreement, etc. If an information manager is transferred to other position, the Bank makes change to his/her access authority to information as appropriate.

Retention, Use and Destruction of Credit Information

1. Retention of credit information: We use your credit information solely for the purpose of screening loan applications or following up loans provided, and we shall separately obtain your consent to use your credit information for other purposes. We use the information which may cause disadvantage to customers including but not limited to overdue payment record for the period of maximum 5 years from the date when the cause for such disadvantage is cleared up. When it comes to credit information provided by credit information companies, we use such information in compliance with the period prescribed in Credit Information Management Rule of the applicable credit information company.

2. Destruction of credit information: We shred or burn up paper copies containing credit information while deleting electronic files containing credit information by using technical means disabling restoration of the content.

Your Right to Credit Information

1. Right to Request Inquiry on the Use and Provision of Your Credit Information

- You are entitled to request in writing the statement on the use and provision of your credit information by the Bank for the recent three (3) years or visit the Bank to inquire about the followings (However, this shall not apply if the Bank uses the information for internal business management purposes or provides it for outsourcing repeatedly.) Expenses directly incurred in connection with the inquiry may be borne by you and the Bank shall retain the information inquired by you for three (3) years.

In case where the Bank used personal credit information: who used the information, what was the purpose of such use, date of the use, content of the credit information used, retention period and period of use of your credit information, etc.

- In case where personal credit information was provided: who provided the information, to whom it was provided, purpose of provision, date of provision, content of the information provided, period of retention and use of your credit information, etc.

2. Right to Request to Notify Any Use and Provision of Your Credit Information

Upon your request, the Bank shall notify you of the matters under Paragraph 1 when using or providing your credit information, and from the time it receives the request, the Bank shall notify the use and provision of your credit information on a regular basis. The cost directly incurred in relation to the notification may be borne by you, and the Bank shall retain the information notified to you for three (3) years.

3. Right to Withdraw Consent to Provision and Use of Your Credit Information

- You are entitled to withdraw consent to provision of your credit information for purposes other than evaluation of wired/wireless communication, writing, and personal creditworthiness by providing it to a personal credit rating company, individual business credit rating company, or credit information concentration agency; Provided, that where it becomes difficult to perform a contract or serve the purposes of determining whether to establish and maintain a commercial relationship, including failure to perform certain services agreed with you, unless the personal credit information concerned is provided to another credit information provider/user that has not obtained his/her consent, if you intend to revoke consent, you shall clarify your intention not to be provided with the services concerned, and may not apply for withdrawal of consent for three months from the date of contract conclusion.

- You may withdraw your consent even if you have consented to the use of your credit information for marketing purposes.

4. Right to Request ‘Do-Not-Call’

- You are entitled to request the Bank and its affiliated companies to not call you for the purpose of introducing products or services or soliciting purchases through wired/wireless communication, in writing, or by visiting the Bank, and the Bank shall act upon the request within one (1) month from the date of receipt of the request. However, you cannot make ‘Do-Not-Call’ request for three (3) months from the date of contract conclusion.

5. Right to Request View, Correction and Deletion of Your Credit Information

- You are entitled to request to print out or show your credit information held by the Bank after confirmation that you are the owner of the credit information by presenting a document indicating your identity or by using means that ensures the safety and reliability of identity verification.

- If you find your credit information held by the Bank is incorrect, you may request correction thereof.

- If the Bank deems that there is a justifiable reason for the correction request, it shall stop providing and using the credit information concerned, without delay, and examine as to whether it is true. If such information turns out to be incorrect or unverifiable, the credit information shall be deleted or corrected.

- You may request the deletion of optional information after three (3) months from the end of commercial relationship including financial transactions, and may request deletion of essential information after five (5) years have elapsed.

6. Right to Request Notification of Credit Information Giving Rise to Refusal of Commercial Transaction

- Where the Bank refuses or cancels a commercial transaction relationship with its counterparty on the basis of personal credit information, which has been provided by a personal credit rating agency, an individual business credit rating agency or a credit bureau and a credit information collection agency, the Bank shall, upon the request of the relevant owner of credit information, notify the relevant owner of credit information of the credit information that gave rise to the refusal or cancellation thereof and the name, address, and phone number of the personal credit rating agency, the individual business credit rating company, the credit bureau or the credit the information concentration agency that provided the credit information, etc.

7. Right to Request Explanation on Automated Evaluation Results and Right to Raise Objection thereon

- You are entitled to request the Bank to explain whether or not automated evaluation is carried out for your credit evaluation, the results of the automated evaluation, the main criteria for automated evaluation, and an overview of the basic information used in the automated evaluation.

- You may request the submission of information that is deemed advantageous to the calculation of the results of the automated evaluation, and if you determine that the basic information used for the automated evaluation is not accurate or up-to-date you may request correction or deletion of the basic information or re-calculation of the results of automated evaluation.

8. Right to Request Your Personal Credit Information and Withdraw It

- You are entitled to request your personal credit information in electronically processible form and may withdraw your request.

※ How to Apply for the Aforementioned Rights

- Those who provided credit information of their own through events or campaigns may apply for the aforementioned rights via telephone.

- The existing customers of the Bank may apply for the rights by visiting the Seoul Branch Office of the Bank and present a proof of identity or using other means that ensures the safety and reliability of identity verification. The legal representative of a child under the age of 14 can exercise rights related to personal credit information on behalf of the child.

-Request in writing

Please visit any branch of the Bank and submit "ReportㆍChangeㆍIssuance Request" with your ID card

Right to Request to Show Your Credit Information for Free

In addition to the aforementioned rights, you are entitled to request credit rating agencies below to print out or show your credit information at no cost within a certain limit. For more information, please contact the credit rating agencies.

Installation, Operation and Rejection of the Automatic Personal Information Collection Device

To analyze the number of visits to the website and general usage patterns of users, the related information is recorded and some of this information may be collected through the use of "cookies". A cookie is a small amount of information that is automatically stored in a web browser on a personal computer, and the Bank uses cookies for user authentication while the user accesses the website. Users have the option to install cookies, and can select options such as accepting all cookies in the user's web browser, checking each time a cookie is saved, or refusing to save all cookies.

- Example of setting method (in case of Internet Explorer): Tools at the top of the web browser > Internet Options > Personal Information

- If a user refuses to install cookies, there may be difficulties in providing the service.

Remedies for Infringement of Your Rights and Interests

If you need to report or have consultation on infringement of personal (credit) information, please contact the following organizations.

< Contact details >
* Personal Information Dispute Mediation Committee: ☎ 02-1833-6972 / www.kopico.go.kr
* Personal Information Infringement Report Center of the Korea Internet & Security Agency: ☎ 118 without area code / privacy.kisa.or.kr
* OPA (Online Privacy Alliance) PRIVACY: ☎ 02-580-0533~4 / www.eprivacy.or.kr
* Cyber Investigation Division of the Supreme Prosecutors' Office: ☎ 1301 without area code / www.spo.go.kr
* Cyber Security Guard of the National Police Agency: ☎ 182 without area code / cyberbureau.police.go.kr
* NICE (Inc.): ☎ 1588-2488 www.mycredit.co.kr
* Korea Information Service (Inc.): ☎ 02-3771-1004 www.creditbank.co.kr
* Seoul Credit Rating & Information (Inc.): ☎ 02-846-5000 www.siren24.com

Credit Information Protection Officer/Manager

Credit Information Protection Officer

• Name: Thomas De Montmarin
  Department: RISK, The Hongkong and Shanghai Banking Corporation Seoul Branch
  Contact: E-mail <thomas.de.montmarin@hsbc.com> HSBC Building #37, Chilpae-ro, Chung-Ku, Seoul

Credit Information Protection Manager

• Name: Jun Sung Oh
  Department: RISK, The Hongkong and Shanghai Banking Corporation Seoul Branch
  Contact: E-mail <jun.sung.oh@kr.hsbc.com>, HSBC Building #37, Chilpae-ro, Chung-Ku, Seoul