SL Investment Co., Ltd. (hereinafter "the Company") establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act, in order to protect the personal information of data subjects and to handle any related grievances in a prompt and smooth manner.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information will not be used for any purpose other than those stated below. If the purpose of use changes, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• Processing investment inquiries and consultations
• Handling complaints from website visitors
• Fulfilling obligations under applicable laws and regulations

Article 2 (Retention Period for Personal Information)

The Company processes and retains personal information within the retention and use period stipulated by applicable laws and regulations, or within the period agreed upon when collecting personal information from data subjects.

• Investment inquiry and consultation records: 3 years from the date of collection
• Where retention is required by law: for the period specified by the applicable law

Article 3 (Categories of Personal Information Processed)

The Company processes the following categories of personal information.

Article 4 (Disclosure of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and discloses personal information to third parties only where the data subject has consented, or where there are special provisions under applicable laws, or in cases falling under Article 17 of the Personal Information Protection Act.

The Company does not currently provide personal information of data subjects to any third party.

Article 5 (Outsourcing of Personal Information Processing)

The Company may outsource personal information processing tasks to facilitate smooth operations.

The Company does not currently outsource any personal information processing tasks to external parties.

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise the following personal information protection rights against the Company at any time.

• Request to access personal information
• Request for correction if there are errors or inaccuracies
• Request for deletion
• Request to suspend processing

Rights may be exercised in writing, by telephone, or by email, and the Company will take action without delay.

Article 7 (Destruction of Personal Information)

When personal information becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose, the Company will destroy such personal information without delay.

• Electronic files: Permanently deleted by means that prevent recovery or restoration
• Paper documents: Shredded or incinerated

Article 8 (Measures to Ensure Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

• Minimizing staff with access to personal information and providing training
• Restricting access to personal information
• Managing access rights to database systems that process personal information
• Installing security programs and performing periodic updates and inspections

Article 9 (Privacy Officer)

The Company designates a Privacy Officer as follows to take overall responsibility for personal information processing activities and to handle complaints and remediation related to data subjects' personal information.

• Privacy Officer
  Department: Management Support Division / Tel: 02-6241-5400 / Email: info@slinvestment.com

Data subjects may contact the Privacy Officer with any questions, complaints, or requests for remediation arising in connection with the Company's services (or business).

Article 10 (Remedies for Infringement of Rights)

Data subjects may contact the following authorities for consultation or remediation regarding personal information infringement.

• Personal Information Infringement Report Center (operated by KISA): (without area code) 118 / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: (without area code) 1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: (without area code) 1301 / www.spo.go.kr
• National Police Agency Cyber Investigation Bureau: (without area code) 182 / ecrm.cyber.go.kr

Supplementary Provisions

This Privacy Policy shall be effective from January 1, 2026.