Law Firm Chowol (the “Firm”) has established and publicly discloses this CCTV Operation and Management Policy to protect the personal data and rights of data subjects and to ensure prompt and appropriate handling of related concerns, in accordance with the Personal Information Protection Act of Korea. 

Article 1: Legal Basis and Purpose of Installation 

The Firm installs and operates CCTV systems pursuant to the Personal Information Protection Act for the purposes of crime prevention, facility safety, and fire prevention. 

Article 2: Installation Location, Recording Scope and Hours, and Number of Cameras 

• Installation Location: Installed inside the 10th floor of Elin Tower 

• Recording Scope and Hours: Operates 24 hours a day and records upon motion detection, covering the lobby and entrance area 

• Number of Cameras: 1 unit 

Article 3: Management Officer, Responsible Department, and Authorized Personnel 

• Management Officer and Responsible Department: Manager Chanyu Kim 

• Authorized Personnel with Access Rights: Attorney Donghee Cho 

Article 4: Retention Period, Storage Location, and Handling of Footage 

• Retention Period: Up to 12 months from the date of recording 

• Storage Location: 10th floor of Elin Tower 

• Handling: All access, use for other purposes, third-party disclosures, destruction, or access requests are documented and managed. Upon expiration of the retention period, recorded footage is permanently deleted using an irreversible method (physical records are shredded or incinerated). 

Article 5: Access Procedures and Location 

Recorded footage may be accessed by visiting the Firm in person after making prior arrangements with the Management Officer. 

Article 6: Requests by Data Subjects to View Recorded Footage 

1. A data subject may request access to or confirmation of recorded footage that contains their personal image. However, such requests are limited to footage that includes the data subject or is necessary to protect the data subject’s urgent interests in life, body, or property. 

2. The data subject must submit a written request specifying the location of the camera, date and time of recording, and the reason for the request. The Firm may require identification (e.g., resident registration card, driver’s license, or passport) to verify the identity of the requester as the data subject or their authorized representative. 

3. The Firm may refuse such request if (i) the footage has already been deleted due to expiration of the retention period, or (ii) there are legitimate grounds to reject the request. 

Article 7: Administrative, Technical, and Physical Safeguards 

1. The Firm implements an internal management plan to ensure the secure handling of personal video data. 

2. Access to video footage is granted only to personnel whose duties require it, with varying levels of access granted depending on the job role. Unauthorized access is strictly prohibited. 

3. Recorded footage is encrypted when transmitted and stored in password-protected files. 

4. Access logs are maintained, including the identity of the viewer, the reason, and the time of access. Measures are taken to prevent tampering with these logs. 

5. All footage is stored in a secure location with lock-and-key access control. 

Article 8: Amendments to this Policy 

This Policy may be amended in accordance with applicable laws, regulations, and internal policies. Any changes will be disclosed as required under the relevant laws.