LESCAPE

This ‘Privacy Policy’ (hereinafter referred to as the “Policy”) is designed to inform customers of what means and purpose for which personal information collected have been used, and what measures L'Escape Hotel of JOSUN HOTELS & RESORTS Inc. (hereinafter referred to as the “L'Escape”) has taken to protect customers’ valuable information from illegal 3rd parties and from infringement of the basic human rights due to illegal leaks.

L'Escape places a high value on customers’ personal information and has established Policy to protect their information, complying with the Personal Information Privacy Act, the Promotion of Information and Communications Network Utilization and Information Protection Act and all other relevant laws and regulations. L'Escape informs customers of what measures it has taken to protect their valuable information according to Policy and what changes, including addition, deletion or correction are made to this Policy throughout its official website (www.lescapehotel.com) in the forms of pop-up window and public notice and publications placed inside the hotel, so that customers as information providers are encouraged to review Policy.

L'Escape’s Privacy Policy is as follows:

Article 1. How to agree upon Privacy Policy

Customers can grant their consent to Policy concerning personal information collection and usage and consignment of personal information management in the following ways: (1) Sign the Membership Registration form after being well aware of details of Policy or Personal Information Collection and Usage Agreement form (2) Use customer service and give consent over the phone while fully understanding Policy uploaded on the official website (www.lescapehotel.com) (3) Send the autographed Agreement form via mail or E-mail (4) Fill out the Agreement form online or (5)Use the equivalent way recognized by the relevant laws or regulation.

Article 2. Scope and Purpose of Collecting Personal information and the Consignment of the Personal information Management

• A. Scope, Methods of Collecting Personal Information and Purpose of Collected Information

  L'Escape collects customers’ personal information in order to provide flawless reservation service and customized service. Customers may choose what personal information (if any) they wish to provide to L'Escape. Customers can use limitless service when they refuse to give optional personal information while they cannot enjoy Membership status without giving required personal information.

  • Scope of Collected Personal Information

    Customers’ personal information (such as service use records, access log, cookies, access IP information, payment history, suspension records and more) is collected and processed while they use L'Escape’s service or during service provision process. Please refer to the graph below.

  • Method of Collecting Personal Data
    • 1. Customers’ personal information is collected when they subscribe L'Escape’s membership, participate in on and off-line promotional events, use delivery service, make a payment or use L'Escape’s membership points.
    • 2. Customers’ personal data is collected when they use L'Escape’s official website (www.lescapehotel.com).

    ※ Collected information is as follows:

    Sort		Items	Purpose	Retention Period	Collection Method
    Membership	Required	Personally identifiable information: Name in full, Date of birth, Gender, Website’s ID & Pass word Contact information: Phone number, Email, Home Address Financial information: Card number, Expiration date, Type of the card	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management Financial information: to monitor card payment process and results More : Materials for statistics and new customized service (products) development and provision	5 Years from the Membership Subscription Date	Membership Registration Form(written form), E-mail
    	Optional	More : Name of company, Job title, Family information, Interests in Hotel’s service Registration channel
    On-line Room Reservat	Required	Personally identifiable information: Name in full, Date of birth, Gender, Website’s ID & Pass word Contact information: Phone number, Email, Home Address Financial information: Card number, Expiration date, Type of the card	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management Financial information: to monitor card payment process and results More : Materials for statistics and new customized service (products) development and provision	5 Years from the Latest Check-out	Website
    	Optional	Personally identifiable information : Name in full Contact information : Phone number and Email	Personally identifiable information: to identify customers Contact information: to send the newsletter such as event, promotion of hotel.	3 Years	Website, Room Registration Card
    VOC	Required	Personally identifiable information: Name in full Contact information: Phone number and Email	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management Financial information: to monitor card payment process and results More : Materials for statistics and new customized service (products) development and provision	3 Years	Website
    	Optional	More: Date of birth, Gender
    	Optional	More: Date of birth, Home Address
    Room Reservation	Required	Personally identifiable information: Name in full	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management	5 Years from the Latest Check-out	Room Registration Card (Written form)
    	Optional	Contact information: Phone number, Email, Home Address More : Nationality, SPG number
    Event / banquet Reservation	Required	Personally identifiable information: Name in full, Home Address , Name of company Contact information: Phone number, Email	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management	3 years from the date of event termination	Contract (Written form)
    Event Participation	Required	Personally identifiable information: Name in full, Name of company ( Required information may vary depending on the theme of the event) Contact information: Phone number, Email	Personally identifiable information: to identify customers and manage membership system Contact information: to deliver customer service such as news notification, complaint management	Certain period from the date of event termination (additional conditions on event contents)	Event Coupon

    • L'Escape does not collect delicate personal information that is believed to infringe customers’ basic human rights (race or ethnic origins, ideologies or credos, origin or place of birth, political orientations, criminal records, health conditions, sexual life etc.).
  • Management of False Information Providers
  • The submitted personal information must be guaranteed by customers or information providers. Using false personal data or identify theft (using other’s personal information) can be punished in accordance with the relevant laws and regulations. L'Escape can cancel membership or reservation without prior consents of false information providers and report to law enforcement agencies.
  • The Consignment of the Personal Information Management
• L'Escape consigns personal information management to experienced service providers as shown below for the purpose of ensuring efficient personal information management. In the consignment contract, L'Escape stipulates consignees’ duties to compliance with related regulations and other obligations in the contract for protection of personal information, maintenance of confidentiality of personal information, prohibition of provision to third parties, responsibility in case of mishaps, consignment period, and requirements for return or disposal of personal information upon the fulfillment of consigned tasks. L'Escape ensures consignees comply with such obligations.

  Consigned Business

  Consigned Business	Consigned tasks
  Bluewaves Consulting Co., Ltd.	Official Website Development and Maintenance
  SanhaiT Corp.	Room System Operation and Maintenance
  KCP Co.,Ltd, KIS Van Co.,Ltd	Credit Card Payment System

Article 3. Provision and Sharing of Collected Personal Information to or with Third Parties

L'Escape provides detailed information of how it handles personal information such as the identities of the third parties with which it share its customers’ personal information and the purpose, the scope and the retention period of the personal information to provide quality customer service. L'Escape recognizes provision and sharing of personal information to third parties is prohibited, and only permitted if the grounds are applicable to Policy and relevant regulations as listed below.

• A. When L'Escape acquires the prior consent of customers or personal information providers.
• B. When L'Escape is requested by law-enforcement authorities to provide customer’s personal information under pertinent laws and regulations such as the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Personal Information Protection Act, the Protection of Communications Secrets Act and the Telecommunications Business Act for an investigation. (Any government agency seeking customers’ personal information from L'Escape shall obtain a search warrant issued upon a showing of probable cause)
• C. L'Escape provides or shares personal information with allied partners. However, it will always undergo a procedure of seeking agreement by informing the individual customers in writing, over the phone or through an e-mail as to who the third parties or the alliance partners are, what personal information items are provided or shared, and how their information will be protected or managed. If the customer does not give his or her consent, L'Escape will not provide or share their personal information to or with allied partners.

Article 4. Retention and Retention Periods of Collected Personal Information

L'Escape immediately discards personal information upon the fulfillment of objectives of collecting personal information, the withdrawal of membership and the expiry of the retention period. Also, the third party with which L'Escape share customers’ personal information is required to discard the collected personal information immediately upon the expiry of the retention period. L'Escape uses customers’ personal information for lawful

purpose and retains for given periods as follows:

• A. Records concerning the contracting or withdrawal of subscription: Five years Legal ground: Act on the Consumer Protection in the Electronic Commerce
• B. Records concerning payment or financial contractions: Five years Legal ground: Act on the Consumer Protection in the Electronic Commerce
• C. Records concerning the handling of consumer complaints or dispute settlement: Two years Legal ground: Act on the Consumer Protection in the Electronic Commerce
• D. Personal information can be retained for a longer period whenever the customers give prior consents.

Article 5.Personal Information Disposal Procedure and Method

L'Escape immediately discards personal information upon the fulfillment of objectives of collecting personal information,and the procedure and methods are following:

• A. Disposal Procedure
  • Customers’ personal information is collected for a specified period of time pursuant to Policy and other related legislation, and is destroyed immediately upon the fulfillment of objectives of collecting personal information.
  • The collected personal information is retained only for lawful purposes.
• B. Disposal Methods
  • Personal information printed on paper: Shredded or incinerated
  • Personal information stored on digital media: Deletion using technical methods disabling regeneration or retrieval

Article 6. Methods of Viewing and Correcting Personal Information, Canceling Membership, and Withdrawing Consent

• Customers may, at any time, request the viewing, correction, deletion or suspension of their registered personal information or for the withdrawal of their agreement. Customers can make the requests in the following ways:
  • Directly Visit to L’Escape: customers may review and correct their personal data or cancel their membership after verifying their identification
  • Log into the L'Escape Official Website: customers may review and correct their personal data or cancel their membership in the L'Escape’s Official Website.
  • Contact with L'Escape’s associates by phone (+82.2-2233-3131) or submit a request to the person in charge of personal information protection in writing, by phone or e-mail. L'Escape will address customers’ concerns immediately.
• When customers request for a correction of errors in their personal information, L'Escape will not use or provide the personal information before the correction is done. L'Escape will also ensure the correction is made by speedily informing third parties of the correction details if incorrect personal information has already been provided to any allied partners.
• Customers may, at any time, request the viewing, correction, after authentication, deletion or suspension of their registered personal information or for the withdrawal of their agreement in the official website.
• L'Escape ensures that customers’ personal information whose deletion has been requested is treated in accordance with Policy concerning retention or retention period of the collected personal information or is not used for purposes other than those stated. However, when there is a high possibility of a crime or hurting others’ human rights and financial rights, L'Escape may provide to or share with law-enforcement agencies. L'Escape ensures information providers will be informed of the cooperation with law-enforcement of giving their personal information immediately.

Article. 7 Usage and Operation of Cookie

• L'Escape uses software cookies that frequently store and search customers’ personal information. Cookies are a small data file that L'Escape’s website (hereinafter referred to as the “Site”) transmits to the customer's browsers (Internet Explorer, Chrome etc.) or mobile device and are stored at customers’ Hardware.
• L'Escape uses cookies as the following reasons:
  • Analyze frequency and recurrence of visits, time of visit and fields of interests of customers or visitors and use them as grounds for improving service quality and providing bespoke service and building marketing strategies.
  • Analyze frequency of visit to the Site and the participation of L'Escape’s on-line events to provide equal chance to enjoy the promotional prizes and customized information.
  • Customers have the right to decide whether to accept or reject cookies. They can set or adjust their web browser controls to accept and reject all cookies or check every time when cookies are stored.
    • 1. Open [Internet Option] tab
    • 2. Click [Privacy] tab
    • 3. Select a setting for the internet zone. If customers choose to block all cookies, some functionality and areas of our Site may be restricted.

Article 8. Handling complaints about Privacy Policy

• L'Escape appoints the department and personnel to protect customers’ personal information and to collect their comments and handle their complaints as follows:
  • Person responsible for personal information protection: Lim Yeongjun, Assistant Manager
  • Person in charge of personal information protection: Park Suhwan, Manager
  • Contact: +82.2-317-0034
  • E-mail: soo2000@chosunhotel.co.kr
• Customers may contact the below-listed agencies for reporting or counseling on the infringement of personal information:
  • Private Information Interference Report Center (www.118.or.kr / 118)
  • Information Protection Mark Certification Committee (www.eprivacy.or.kr / +82.2-550-9531~2)
  • Internet Crime Investment Center, Supreme Prosecutors' Office (www.spo.go.kr / +82.2-3480-3571)
  • Cyber Terror Response Center of National Police Agency (www.ctrc.go.kr / +82.2-393-9112)

Article 9. Technical and Managerial Measures to Protect Personal Information

• L'Escape takes the below-listed technical, administrative and physical measures to protect customers’ personal information from loss, theft, leakage, forgery or tampering:
  • L'Escape has Customers’ personal information encrypted before storing or management of it. All files and transmitted data are also encrypted and important data are protected using additional security functions such as ‘Lock’ function.
  • L'Escape uses dual fire walls to prevent personal data from being leaked or misused by unauthorized 3rd parties. Each server is under close watch with anti-intervention software in real time.
• L'Escape appoints a minimum number of personnel who are allowed to handle personal information and conducts education on a regular basis. When an issue concerning customers’ personal information management arises, employees in charge of the issues are required to identify the root cause and implement the resolutions and corrective measures.
  • L'Escape holds no liability for the problems caused by customers themselves and the fundamental risky characteristic of the Internet. Customers have a duty to manage and protect their personal information by changing password on a regularly.
  • If customers’ personal information is lost, leaked, amended and damaged due to mistakes and mismanagement of L'Escape’s associates, L'Escape will immediately report the issue to the information providers and make appropriate measures and indemnity.

Article 10. Protection of personal information of customers less than 14 years old

L'Escape does not collect personal information of customers less than 14 years old. When personal information of customers less than 14 years old, however, is needed, L'Escape will be pursuant to Policy and relevant regulations.

Article 11. Collection and Protection of Non-member Customers’ Personal Information

Every customer may use L'Escape's services irrespective of membership status. L'Escape requests only necessary personal information from non-member customers and make the same effort to protect their personal information. L'Escape will not use the personal information for purposes other than for payment of service bills and shipment of goods.

Article 12. Transmission of advertising information or messages

• L'Escape does not transmit any advertising information for commercial purposes against the customer's outright refusal.
• L'Escape ensures that the followings are indicated in the title and body of its e-mail messages for readability of those who receive the mails when it send advertising information as below:
  • E-mail title: [Advertisement] is indicated in the title before the main title.
  • E-mail body: Name in full, E-mail Address, Contact information such as phone number and Address of the sender are written so that customers or receivers may easily express their refusal. Specific methods to express refusal are indicated both in English and Korean respectively.
• When information which may infer adult content is indicated in the forms of text, symbols and video, L'Escape indicates the E-mail includes ‘Content for Adult Included’ in the title of the E-mail. And the definition of the ‘Content for Adult’ are following:
  • Content stimulates sexual desire of the underage (referring to customers less than 19 years old)
  • Content encourages the underage to commit a crime
  • Content provokes the underage to engage in violence and drug abuse.
  • Content which is recognized as harmful information against to the underage
• When L'Escape sends E-mail including content for adult or advertisement of specific sites which may infer sexual content for product information or other online marketing purposes, it marks ‘Content for Adult Included’ in the title of the E-mail.

13. Obligation to notify

• When any changes, including amendment, addition, deletion or correction to are made in Privacy Policy in accordance with internal policy changes and government policies, L'Escape will notify or publish details through its official website before it apply the amendment to Policy.
• This policy takes effect from January 1th, 2022