Privacy Notice
This English version is provided for convenience only. In the event of any discrepancy between the Korean version and this English version, the Korean version shall prevail.
HRE Co., Ltd. and its affiliates (Hankook Renewable Energy Co., Ltd., Emax Energy Co., Ltd., Goheung Energy Holdings Co., Ltd., Ecoroof Holdings Co., Ltd. and Yeongwol Yeondang Energy Co., Ltd.), together with their subsidiaries (collectively, “we”, “us”, “our”, “HRE” or the “Company”), establish and disclose this Privacy Notice pursuant to Article 30 of the Personal Information Protection Act of the Republic of Korea (the “PIPA”) in order to protect the personal information of data subjects and to handle related grievances promptly and effectively. The Company processes personal information primarily in accordance with the laws of the Republic of Korea, and adheres to the principles of accountability, purpose specification, minimal collection, restriction on use, provision and retention, accuracy, security measures, transparency, and the protection of data subjects’ rights.
Article 1 (Purposes of Processing, Personal Information Processed, Legal Bases and Retention Periods)
The Company processes only the minimum personal information necessary for the purposes set out below. Where the purpose of processing changes, the Company obtains separate consent or takes other necessary measures in accordance with the applicable laws.
(1) Personal Information Processed with the Consent of Data Subjects
The personal information that the Company processes with the consent of the data subject is as follows:
| Purpose of Processing | Personal Information Processed | Retention/Use Period |
|---|---|---|
| Supplementary information for employee HR, labor, payroll and benefits administration | Emergency contact details, dependent information | Period of employment and the period thereafter, in accordance with relevant laws or the Company’s internal document-retention standards |
| Operation of recruitment procedures through a dedicated recruiting website (the “Talent Pool”) | Additional materials voluntarily submitted by applicants (portfolio URLs, personal social media, references’ contact details, certifications) | Retained during the period for requesting the return of recruitment documents, or during the separate retention-consent period indicated through the Talent Pool |
| Renewable energy project development and stakeholder consultations (pre-contract consultation stage) | Names, contact details, addresses, information on rights and interests, and details of consultations and complaints of stakeholders, landowners, rights holders, residents and contact persons at relevant authorities | Following completion of the relevant project, contract or permit, for the period required under applicable laws or for the duration of the relevant rights and interests |
| Access control for office premises or secured areas | Biometric data (fingerprints) | Destroyed without delay upon separation from the Company |
| Occupational safety and health, sick leave and leaves of absence, employee benefits, or accommodations for employees with disabilities | Health information: medical certificates, medical opinions, hospital admission/discharge confirmations, treatment plans, pregnancy or childbirth-related information, illness information of family members in connection with family care leave, disability-related medical certificates or opinions, copies of disability registration cards, and opinions on the need for assistive technology devices | Documents relating to leaves of absence are retained for three years from the date of separation and then destroyed; documents relating to disability accommodations are destroyed without delay upon separation |
(2) Personal Information Processed without the Consent of Data Subjects
The personal information that the Company processes without the consent of the data subject is as follows:
| Legal Basis | Purpose of Processing | Personal Information Processed | Retention/Use Period |
|---|---|---|---|
| Article 15(1)2 of the PIPA (special provisions in laws); Article 68(3) of the Enforcement Decree of the Framework Act on National Taxes; Articles 127 and 164 of the Income Tax Act; Article 7 of the Enforcement Decree of the Employment Insurance Act; Article 113-2 of the Enforcement Decree of the National Pension Act; Article 96-4(2) of the National Health Insurance Act | Payroll, tax, social insurance, corporate registration and statutory filings | Name, contact details, resident registration number, alien registration number | Five years from the date of separation (Article 85-3 of the Framework Act on National Taxes; aligned with the longest period under tax laws). Alien registration numbers are destroyed without delay upon termination of the relevant stay or employment relationship |
| Article 15(1)4 of the PIPA (entering into and performance of a contract) | Assessment of candidates for the relevant recruitment in the course of operating recruitment procedures | Name, contact details, email, education/work experience, qualifications, cover letter, interview evaluations | Destroyed without delay upon completion of the recruitment process, except where retained until expiration of the period for requesting the return of application documents or for any separate consent period indicated through the Talent Pool |
| Article 15(1)4 of the PIPA (entering into and performance of a contract) and Article 15(1)6 of the PIPA (legitimate interests) | Information essential for the performance of employment contracts in connection with employee HR, labor, payroll and benefits administration | Name, contact details, address, date of birth, hiring/separation and HR records, payroll and bank account information, tax/social insurance information | During the period of employment and, following separation, for the period required under applicable laws or internal document retention standards |
| Management of vendors, advisors and contractual counterparties | Contact person’s name, affiliation, title, business contact details, contract/settlement information, personal bank account information (where applicable) | Following termination of the contract, for the period required under applicable laws and/or necessary for dispute response | |
| Renewable energy project development and stakeholder consultations (contract execution and performance stage) | Names, contact details, addresses, information on rights and interests, and contract performance details of landowners, rights holders, residents and contact persons at relevant authorities | Following completion of the relevant project, contract or permit, for the period required under applicable laws or for the duration of the relevant rights and interests | |
| Real estate leasing, site acquisition and management of rights and interests | Name, contact details, address, date of birth, contract/rights information, payment account | Following termination of the relevant contract and rights, for the period required under applicable laws or internal document retention standards | |
| Equity transactions, shareholder/director/officer and corporate governance administration | Name, contact details, address, date of birth, title, share/transaction/payment information | For the period required under applicable laws and internal document retention standards | |
| Article 15(1)6 of the PIPA (legitimate interests) | Information systems, information security and access control | Company accounts, user IDs, device information, IP addresses, access/authentication/change/security logs, entry and exit records | For the period necessary for security and audit purposes and as set out in relevant policies |
| Facility safety and protection of property | CCTV footage, date/time and location of recording, entry and exit records | 30 days from the date of recording | |
| Handling of privacy rights requests, inquiries and disputes | Name, contact details, identity verification information, details of requests/inquiries and their handling | Three years from the date of completion of handling | |
| Audit, internal controls, and legal and regulatory response | The minimum information necessary for an audit or investigation from among business, transaction, contract and HR-related information | Following completion of the audit or investigation, for the period required under applicable laws and internal document retention standards | |
| Screening of counterparties for sanctions designations, politically exposed person (PEP) status and adverse media | Counterparty due diligence (KYC) information: name, date of birth | Following termination of the business relationship, for the period prescribed by applicable laws or under internal document retention standards |
Article 2 (Processing of Personal Information of Children under the Age of 14)
The Company generally does not provide services directly to children under the age of 14. However, the Company may process information on the minor dependents of employees and officers for purposes of year-end tax settlement, welfare, or the performance of statutory obligations, and, where necessary, verifies a lawful basis or obtains consent through a legal representative.
Article 3 (Provision of Personal Information to Third Parties)
In principle, the Company processes personal information within the scope of the collection and use purposes, and provides personal information to third parties only where permitted under applicable laws, such as where the data subject has consented or where otherwise specifically provided for by law.
Where personal information is provided to third parties on a recurring or ongoing basis, the Company specifically discloses in the tables below the recipients, purposes of provision, categories of information provided and retention periods.
The Company provides personal information to third parties with the consent of data subjects as follows:
| Recipient | Purpose of Provision | Information Provided | Retention/Use Period |
|---|---|---|---|
| Hana Bank; Hana Card Co., Ltd. | Payment of payroll and expenses; benefits administration | Name, bank account, and information necessary for enrollment and payment | As required under the laws and contracts applicable to each institution |
| Wefun Co., Ltd.; KT Alpha Co., Ltd. | Sending gifts for employee family events and recognition, and appreciation gifts to customers and business partners | Recipient’s name, mobile phone number (or messenger account identifier), delivery address (for physical gifts) | In accordance with the retention policies of the relevant platform |
The Company may provide personal information to the relevant authorities and institutions without the consent of data subjects as follows:
| Legal Basis | Recipient | Purpose of Provision | Information Provided |
|---|---|---|---|
| Article 129 of the Framework Act on Local Taxes; Articles 127 and 164 of the Income Tax Act | The competent tax office | Withholding of employment income tax and submission of payment statements; filing and payment of local income tax (special collection) | Name, resident registration number, address, salary details (including monthly salary, bonuses and non-taxable income), and the names, resident registration numbers and relationships of dependents (spouse, children, etc.) for year-end tax settlement |
| Article 7 of the Enforcement Decree of the Employment Insurance Act; Article 113-2 of the Enforcement Decree of the National Pension Act; Article 96-4(2) of the National Health Insurance Act | The competent branches of the Korea Workers’ Compensation & Welfare Service (KCOMWEL), the National Pension Service (NPS), and the National Health Insurance Service (NHIS) | Reporting of acquisition and loss of eligibility under the four major social insurance schemes (national pension, national health insurance, employment insurance and industrial accident compensation insurance), reporting of changes in remuneration or income, and support for medical care benefit claims in the event of an industrial accident | Name, resident registration number (or alien registration number), hire/separation dates, standard monthly income (national pension) and monthly remuneration (health insurance), total annual remuneration (health, employment and industrial accident insurance), average monthly remuneration (employment insurance), employment type, reason for separation (upon separation), accident details and work history (in the event of an industrial accident), and dependents’ names, resident registration numbers and relationships (health insurance) |
| Articles 13 and 42 of the Labor Standards Act; Article 15 of the Employment Insurance Act and Article 7 of its Enforcement Decree | The competent Regional Employment and Labor Office | Responding to requests for the submission of materials during labor inspections; reporting acquisition and loss of insured status under employment insurance; administrative support relating to unemployment benefits and maternity protection subsidies | (For labor inspections) documents relating to working conditions, such as wage ledgers, employment contracts and rules of employment / (for employment insurance filings) name, resident registration number, hire/separation dates, wages, working hours |
| Article 43 of the Enforcement Decree of the Guarantee of Workers’ Retirement Benefits Act | Hana Bank; Korea Investment & Securities Co., Ltd. | Operation of retirement pension plans (DB/DC), payment of contributions, and payment and administration of retirement benefits | Name, email, resident registration number, mobile phone number, salary information (for calculating contributions) |
Article 4 (Outsourcing (Entrustment) of Personal Information Processing)
The Company may outsource the processing of personal information to external service providers for the efficient performance of its business. The Company’s outsourcing agreements address the prohibition of processing beyond the outsourced purposes, security safeguards, management of sub-outsourcing, oversight and supervision, incident notification and liability, and the Company supervises its service providers.
| Service Provider | Outsourced Services |
|---|---|
| Douzone Bizon Co., Ltd. | Maintenance of, and remote technical support for, the Amaranth 10 ERP/groupware system |
| IT Concept Co., Ltd. | Limited access in the course of supporting internal services, networks, security and IT operations |
| Saramin, JobKorea, Wanted, Prosearch Korea, CareerCare, Briscan Young, Unico Search, Atlas NextWave | Posting job openings, receiving applications and managing application status |
| Hurampro Co., Ltd. | Operation of electronic signature services |
| Anthropic PBC (Claude Enterprise) | Provision of AI-based work support services for employees, including document drafting, summarization and analysis |
| OneTrust, LLC | Vendor risk assessment and compliance management services |
| Dow Jones & Company, Inc. | Counterparty screening (KYC) services covering sanctions designations, politically exposed persons (PEPs) and adverse media |
| SK Shieldus Co., Ltd. | Remote video verification and on-site dispatch response upon detection of anomalies (such as unauthorized intrusion) by fixed visual data processing devices (CCTV) |
If there is any change to the outsourced services or the service providers, the Company will disclose such change through this Privacy Notice without delay.
Article 5 (Cross-Border Transfer of Personal Information)
Where the Company provides, permits access to, outsources the processing of, or stores personal information overseas, the Company secures a lawful basis under Article 28-8 of the PIPA and discloses the recipients, destination countries, categories of information transferred, purposes, timing and methods of transfer, retention periods, and the methods of refusing the transfer and the effects of such refusal.
| Recipient (Contact) | Destination Country | Purpose of Transfer | Information Transferred | Timing/Method | Basis/Retention Period |
|---|---|---|---|---|---|
| OneTrust, LLC (privacy@onetrust.com) | United States | Vendor risk assessment and compliance management | Vendor contact persons’ names, emails, contact details, and assessment responses | Real-time entry and transmission through an online system | Outsourced processing and storage (Article 28-8(1)3 of the PIPA); following termination of the contract, for the period required under applicable laws |
| Anthropic PBC (Claude Enterprise) (privacy@anthropic.com) | United States | AI-based work support for employees | Prompts entered, attached documents and conversation records; account information (email, etc.); usage logs | Real-time transmission over the network each time the service is used | Outsourced processing and storage (Article 28-8(1)3 of the PIPA). Deleted conversations are removed from back-end systems within 30 days (up to two years in cases of policy violations). Enterprise plan data is not used for model training |
| Dow Jones & Company, Inc. (privacypolicy@dowjones.com) | United States | Counterparty screening (KYC) for sanctions designations, politically exposed persons (PEPs) and adverse media | Names, affiliations and titles, and screening results of screened individuals | Queries and receipt of results through an online system | Outsourced processing and storage (Article 28-8(1)3 of the PIPA). For the period required under applicable laws or until a deletion request is made |
Data subjects may refuse the cross-border transfers described above by contacting the Privacy Officer and the contact points for exercising privacy rights set out in Article 12 below. However, if a data subject refuses a transfer relating to a system essential to the performance of employees’ duties, such as Claude Enterprise, the performance of work through that system may be limited, and if a data subject refuses a transfer for vendor due diligence and risk management purposes, such as OneTrust or Dow Jones, the progress of the related procedures may be limited.
Article 6 (Procedures and Methods for the Destruction of Personal Information)
The Company destroys personal information without delay when the personal information has become unnecessary, such as upon expiration of the retention period or achievement of the purpose of processing. Where personal information must continue to be retained under other laws, the Company stores such personal information separately in a distinct database or storage location.
- Destruction procedure: The Company identifies the personal information to be destroyed, approves and carries out the destruction in accordance with its internal procedures and authorizations, and maintains destruction records where necessary.
- Electronic information: Destroyed using methods appropriate to the form of the information and the storage medium that are designed to prevent recovery or reconstruction, such as secure deletion, overwriting or destruction of encryption keys.
- Paper and other physical media: Destroyed using irreversible methods such as shredding, incineration or secure disposal through a specialized service provider.
The Company retains the following information for the periods specified below in accordance with applicable laws:
| Legal Basis for Retention | Information Retained | Retention Period |
|---|---|---|
| Article 42 of the Labor Standards Act | Important documents relating to employment contracts | 3 years |
| Article 39 of the Labor Standards Act; Article 19 of its Enforcement Decree | Documents for issuing employment certificates to former employees, such as certificates of work experience | 3 years |
| Article 91 of the Labor Standards Act | Important documents relating to accident compensation | Until expiration of the statute of limitations for accident compensation claims (3 years) |
| Article 33 of the Equal Employment Opportunity and Work-Family Balance Assistance Act | Documents relating to equal employment opportunity | 3 years |
| Article 164 of the Occupational Safety and Health Act | Records of industrial accidents and documents relating to work environment monitoring | 3 years (for documents recording work environment monitoring results) |
| Article 85-3(2) of the Framework Act on National Taxes | Documents relating to the Income Tax Act | 5 years from the day after the statutory filing deadline |
Article 7 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)
Data subjects may exercise against the Company, as prescribed by applicable laws, rights such as the right to access personal information, to correct or delete it, to suspend its processing, to withdraw consent, and to refuse or request an explanation regarding automated decisions. Rights may be exercised in writing, by email, or by another method notified by the Company, as indicated in Article 12 below, and the Company processes such requests in accordance with the periods and procedures prescribed by applicable laws. Where rights are exercised through a legal representative or a duly authorized agent, the Company may request a power of attorney and documentation verifying the identity of the data subject and the agent.
Requests to delete or suspend the processing of information that other laws designate as subject to collection may be restricted, in which case the Company informs the data subject of the grounds for restriction or refusal and the method of objection.
Data subjects may notify the Company of any changes so that their information remains current and accurate, and must not infringe the personal information or rights of others.
Article 8 (Automated Decisions)
The Company does not currently make decisions that significantly affect the rights or obligations of data subjects entirely by automated means without substantive human involvement. If the Company introduces such automated decision-making in the future, it will disclose in this Privacy Notice the relevant facts, the principal criteria and procedures, the manner in which personal information is processed, and how data subjects may exercise their rights.
Article 9 (Measures to Ensure the Security of Personal Information)
To prevent the loss, theft, leakage, forgery, alteration or damage of personal information, the Company implements managerial, technical and physical protective measures commensurate with the sensitivity of the personal information and the scale of its processing.
| Category | Key Measures |
|---|---|
| Managerial measures | Establishment, implementation and review of an internal management plan; designation of a Privacy Officer and privacy personnel; minimization, training and supervision of personnel handling personal information; periodic review of access rights; management of service providers; operation of incident response procedures |
| Technical measures | Role-based access controls; management of the granting, modification and revocation of accounts and privileges; multi-factor authentication; remote access controls; encryption in transit and at rest; retention, review and tamper-proofing of access logs; anti-malware measures; vulnerability assessments; backup, recovery and monitoring |
| Physical measures | Access controls for server rooms, document storage areas and CCTV storage devices; entry management; locking devices; secure storage and disposal of paper documents |
| Privacy by Design | Reviewing privacy impacts and risks in advance for new or modified systems, services, business processes, third-party provisions or cross-border transfers, and conducting the HRE Privacy Impact Assessment or an internal privacy review where necessary |
Article 10 (Installation and Operation of Fixed Visual Data Processing Devices (CCTV))
The Company may install and operate fixed visual data processing devices (CCTV) for facility safety, crime prevention and the protection of property.
| Item | Details |
|---|---|
| Basis and purpose of installation | The Company installs and operates visual data processing devices for facility safety and management, crime prevention and the protection of property in accordance with Article 25(1) of the PIPA and other applicable laws. |
| Number of devices, locations and scope of recording | 4 devices in total / office building entrance, common lounge area, outside the server room, inside the server room |
| Recording hours | 24 hours |
| Retention period, storage location and processing method | 30 days from the date of recording / server room / automatic or secure deletion upon expiration of the retention period |
| Person responsible / persons with access rights | Information Security and Privacy Officer / privacy@hre-korea.com; Head of the department responsible for information security and privacy / management-team@hre-korea.com |
| Outsourced remote monitoring and dispatch response | The Company outsources to SK Shieldus Co., Ltd. the verification of CCTV footage and on-site dispatch response upon detection of anomalies (such as unauthorized intrusion), and the outsourcing agreement incorporates safeguards such as the prohibition of viewing footage for any other purpose and the management of access records. |
| How and where recorded personal video information may be reviewed | Personal video information may be reviewed by contacting the Information Security and Privacy Manager (privacy@hre-korea.com) in advance and visiting the Management Team. |
| Requests to view footage | Data subjects may request access to footage in which they appear, or footage clearly necessary to protect their life, physical safety or property, and the Company will handle such requests in accordance with applicable laws and internal procedures. |
| Security measures | The Company manages personal video information securely through minimized access rights, passwords and access controls, management of viewing records, locking and physical protection of storage devices, and safeguards for external transmission. |
| Signage | Signage stating, among other things, the purpose and location of installation, the scope and hours of recording, and the contact details of the person responsible is posted where data subjects can easily see it. |
Article 11 (Tools for the Automatic Collection of Personal Information and Online Behavioral Information)
The Company does not currently collect, use or provide to third parties users’ online behavioral information for purposes of targeted advertising. In the course of using webpages, electronic forms or cloud services operated by the Company, access logs, IP addresses and browser/device information necessary for security and service provision may be automatically generated and collected.
Article 12 (Privacy Officer and Contact Points for Exercising Privacy Rights)
| Category | Contact | Telephone | Email/Contact Point |
|---|---|---|---|
| Privacy Officer | Privacy Manager | +82 10 2390 6239 | privacy@hre-korea.com |
| Department responsible for privacy | Management Team | +82 10 2390 6239 | privacy@hre-korea.com |
| Contact point for requests for access to personal information, etc. | Privacy Manager | +82 10 2390 6239 | privacy@hre-korea.com |
Data subjects may direct inquiries, complaints, requests for remedies or the exercise of their rights in relation to the processing of personal information to the contacts above, and the Company will respond and act without delay.
Article 13 (Remedies for Infringements of Data Subjects’ Rights and Interests)
Data subjects may contact the following organizations for consultation or relief regarding personal information infringements:
- Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972, no area code)
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118, no area code)
- Cybercrime Investigation Division, Supreme Prosecutors’ Office (www.spo.go.kr / 1301, no area code)
- Cyber Investigation Bureau, Korean National Police Agency (ecrm.cyber.go.kr / 182, no area code)
Article 14 (Disclosure of and Changes to this Privacy Notice)
The Company keeps this Privacy Notice continuously posted on its website or on the privacy rights information page operated by the Company. Where posting on a website is not possible, the Company discloses this Privacy Notice through appropriate means permitted under applicable laws, such as posting it in a readily visible location at its place of business or including it in contracts.
If this Privacy Notice is amended, the Company will disclose the effective date of, details of and reasons for the amendment in a manner that data subjects can easily verify, and will provide notice of material changes a reasonable period in advance.
| Version | Effective Date | Key Changes |
|---|---|---|
| 1.0 | 2026-10-15 | Initial enactment |