Philippine Airlines Korea Office (Rakso Holdings Ltd) Policy on Personal Information (Amended on 2023.3.31) Philippine Airlines Korea Office (Rakso Holdings Ltd, hereafter referred to as “corporation”) values customers’ personal information, and observes all legislations related to its protection, including the Act on the Protection of Personal Information.
Through our policy on personal information, corporation informs you how the personal information you provide is being used and for what purposes, and what actions are being taken to protect it.

This policy will be enforced from March 31, 2023.

Our personal information policy includes the following.

1. Types of personal information collected General and Contact Info: name, email, phone number, address, date of birth
Travel information: flight ticket number, reservation number, itinerary, mileage number, special meal information, medical assistance
Payment information: credit/debit card number, card approval number, name of bank, account number
Personal identification: passport information
Information collected when using Philippine Airlines’ website: general and contact information, website username, password, access log, cookies, IP information

* Method of collecting personal info: membership, non-member reservation, remedy against injury, access to flight ticket reservation page, subscription to newsletter

2. Collection of Personal Information and Purpose of Use Corporation uses the collected personal information for the following purposes.
*Provision of service by Philippine Airlines, and charging fees for the services
*Resolution of customer complaints and disputes
*Marketing and advertisement (special prices and events announcements) from Philippine Airlines
*Development or specialization of new service (product), provision of services and advertisement according to demographic characteristics, membership management, identification of member access frequency or statistics about members’ use of services

▶Customer reserves the right to not agree to the corporation’s collection of their personal information. If they do not agree to the use of marketing and advertisements, they may not receive news and event notifications. If they do not agree to other collection and use of personal information, they may not be provided with the corporation’s services.

▶Customer may voluntarily provide travel information regarded sensitive information (special meal requests, medical assistance), and we will acquire clear consent from the customer to collect and use such information.

▶Pursuant to Article 50 clause 3 of the Act on the Promotion of Information and Communications Network Utilization and Information Protection, etc., we shall acquire separate consent when we send advertising information using email, mail, fax, phone, or other similar methods from 9PM to 8AM of the next day.

▶Pursuant to Article 50 of the Act on the Promotion of Information and Communications Network Utilization and Information Protection, etc., and Article 62.3 of the Act’s enforcement ordinance, we shall reaffirm the recipient’s consent every 2 years since the day we acquire their consent to receive advertising information.

▶Pursuant to Article 50 of the Act on the Promotion of Information and Communications Network Utilization and Information Protection, etc. and Article 30.8 of the Personal Information Protection Act, we shall inform members regularly of the usages of the collected personal information.

3. Duration of Storage and Use of Personal Information The personal information of the user is collected for use only under the consent of the user. In case of the fulfillment of the purpose of collecting the information, user’s request to dispose of the information, or expiration of the period of use, the information shall be disposed of without delay. However, the information may be preserved for the duration specified for the following reasons.

1. [Reasons for Storage of Information Pursuant to Relevant Laws]
   Corporation stores members’ information for a specified duration of time as stipulated in relevant regulations if there is need to do so pursuant to commercial law, Act on Consumer Protection in the Electronic Commerce Transactions, etc., and other related regulations. In this case, corporation uses the stored information only for the purposes of storage, and the duration of storage is as follows.

A. Documentation on contract, withdrawal of subscription, etc. Cause: Act on Consumer Protection in the Electronic Commerce Transactions, etc.
Duration of Storage: 5 years

B. Documentation on payment of charges and supply of products and others Cause: Act on Consumer Protection in the Electronic Commerce Transactions, etc.
Duration of Storage: 5 years

C. Documentation on resolution of consumer complaint or dispute Cause: Act on Consumer Protection in the Electronic Commerce Transactions, etc.
Duration of Storage: 3 years

D. Documentation on identity confirmation Cause: Act on Consumer Protection in the Electronic Commerce Transactions, etc.
Duration of Storage: 6 months

E. Documentation on access Cause: Protection of Communications Secrets Act
Duration of Storage: 3 months

▶Pursuant to Article 39.6 clause 1 of Act on the Personal Information Protection Act, and Article 48.5 clause 1 of its enforcement decree, we will store separately the personal information of the members who do not log in for a certain period (unused period) and manage it safely.

4. Procedure and Method of Disposal of Personal Information In principle, corporation disposes of the personal information without delay after the purposes of collecting and using it have been achieved. The procedure and method of the disposal are as follows.

* Procedure of Disposal the personal information you have entered is moved to a separate DB (a separate document box for papers) after its purposes have been fulfilled. Then, in accordance with our internal policies and other relevant regulations (refer to Storage and Duration of Use), it is stored for a specified period of time and disposed of. The personal information moved to a separate DB is never used for purposes other than the purposes of collection, unless in cases pursuant to regulations.

* Method of disposal - the information saved in an electronic format is deleted using the technology that prohibits the reproduction of its records.

5. Provision of Personal Information to Third Parties In principle, corporation does not provide users’ personal information to external parties. However, the cases below shall be exceptions.

• - In case of prior consent of users
• - In pursuance to legal regulations, or in cases of requests from investigative authorities for investigative purposes in accordance with procedures and methods stipulated in regulations

6. Entrustment of Personal Information collected

Corporation may provide personal information to partner corporations/institutions for the following purposes, with the consent of the users.
Should they not agree to the consignment of the collected personal information, they cannot be provided with the corporation’s services.

Information provided	Recipient Partners	Purposes of using provided information	Duration of storage/use of provided information
Name, email, phone number, address, flight ticket number, passport number, reservation number, itinerary, additional contact, additional email, mileage number, special meals, medical assistance	Tour Soft, Amadeus	Storage/management of records on flight reservation / ticket issuance	Until termination of affiliated services
Credit/debit card number, card authorization number, name of bank, account number	Inicis	Storage/management of payment information for flight tickets	Until termination of affiliated services
Contact number	Humuson	Transmission of message	Until termination of affiliated services
Name, email, Phone number, address, flight information	Twowin Tech	Customer Service	Until termination of affiliated services

7. Rights of User and Legal Representatives, and Modality of Exercise User may view or modify their registered personal information at any time, and may request for a termination of subscription. Children under the age of 14 may not sign up for an account.

To view or modify user’s personal information, click on “modify personal information (or ‘modify member information’), and to terminate subscription (withdrawal of consent), click on ‘unregister,’ go through personal identification steps, and you can directly view, modify, or unregister.

Or, we will process it without delay once you contact us via mail, phone, or email.

In case of your request to modify errors in personal information, we do not use or provide the information until the modification is complete. Additionally, in case we already provided third parties with erroneous personal information, we will notify them without delay of the modifications to ensure the completion of the change.

Corporation ensures that the personal information withdrawn or deleted upon requests from users or their legal representatives is disposed of in accordance with “Duration of Storage and Use of Collected Personal Information,” and that it is not viewed or used for any other purposes.

User may withdraw their consent simply by clicking on “unsubscribe” within the advertising text they received. We shall process the unsubscription and notify you via text message within 14 days of your request.

Subject of information may raise complaints to authorities charged with protection of personal information (in particular, in case of residence in an EU country, or working in an entity of an EU country, for violations of the Act on Protection of Personal Information).

8. Installation and operation of devices for automatic collection of personal information, and its rejection To manage the website effectively and to provide better user experience, corporation is using cookies. Cookies are small files made up of letters and numbers, used to recognize users’ web browser or devices within the website.

By using online services like the website, mobile website, or the mobile application, the user is assumed to have agreed to that cookies may be saved and used for the purposes of collecting data on the use of corporation’s website and to improve the user’s online settings.

Some pages on the website are accessible only when cookies have been enabled. If cookies are disabled, some contents may not be available, and you may not be able to use the corporation’s website.

9. and Managerial Measures for Protection of Personal Information Corporation is seeking for the following technical/managerial measures to secure the safety of dealing with users’ personal information, so that the information does not get lost, stolen, leaked, distorted, or damaged.

1. A. Technical Measures ① We are using security measures (SSL or SET) that can securely transmit personal information on the network using encrypted algorithms.
2. B. Managerial Measures ① Corporation’s management of personal information is entrusted with one employee, and we issue a separate password for this job, which gets updated regularly. The employee in charge goes through regular training to emphasize the observance of our policies on managing personal information.

10. Customer Complaints Service about Personal Information To protect customers’ personal information and to address complaints related to personal information, corporation designates a division and an employee in charge of protecting personal information as follows.

• Employee in charge of protection of information (DPO): Choi Don-hee (Vice President)
• Phone: 02-2085-8612
• E-mail: cs@philippineair.co.kr

You may contact the employee in charge of any complaints related to the protection of personal information that may arise while using our services. Corporation will provide prompt and sufficient responses to all users’ complaints.
Please contact the institution below in case of a complaint or consultations for other violations of privacy.

1. A. KISA (http://privacy.kisa.or.kr )
2. B. Department of Modern Crime Investigation, Supreme Prosecutors’ Office (www.spo.go.kr / 02-3480-2000)
3. C. Cyber Terror Response Center, National Police Agency (www.ctrc.go.kr / 02-392-0330)

11. Overseas Transmittal of Personal Information We entrust Amadeus, a provider of air travel information system, with the operation of the system for the provision of reservation and transportation services. The transmittal to overseas of personal information takes place as follows.

• A. Recipient of the transmitted personal information: Amadeus
• B. Transmitted personal information: mileage number, name of passenger, date of birth, gender, phone number, email
• C. Country, date, and method of transmittal: Flight reservation information (Germany/USA/Australia, upon completion of booking, transmitted using a private network)

12. Changes in Policies for Managing Personal Information In cases of any additions, deletions, or modifications to the measures regarding personal information stipulated here as a result of amendments of regulations, changes in government policies, or changes in corporation’s internal policies, we shall notify you of the reasons and details of the changes through the Philippine Airlines website, or, if need be, via email.