BIXPO 2026

Privacy Policy

Article 1 (General Provisions)

① "Personal information" means information relating to a living individual that makes it possible to identify the individual by his or her name, Resident Registration Number, etc. included in the information (including information which, if not by itself, makes it possible to identify a specific individual if easily combined with other information).

② Bitgaram International Expo of Electric Power Technology (hereinafter referred to as the “Secretariat”) highly values the protection of customers' personal information and complies with the 『Personal Information Protection Act』 and the 『Standard Guidelines for the Protection of Personal Information』. Through this Privacy Policy, the Secretariat informs customers of the purposes and methods for which the personal information they provide is being used, as well as the measures being taken to protect such personal information.

③ The Secretariat ensures that customers can easily access the Privacy Policy at any time by disclosing it on the front page of the BIXPO website.

④ Through the Secretariat’s Privacy Policy, we provide guidance so that data subjects can verify their personal information.

⑤ The Secretariat has established the necessary procedures for revising the Privacy Policy for its continuous improvement. When revising the Privacy Policy, we assign a version number, etc., so that you can easily recognize the amended changes.

Article 2 (Purpose)

① The BIXPO website collects personal information for the following purposes. The personal information being processed will not be used for purposes other than those specified below. If the purpose of use changes, necessary measures will be taken in accordance with Article 18 of the Personal Information Protection Act, such as obtaining separate consent. In addition, the items listed below are collected through information registered on the BIXPO website.

1) The Secretariat uses customers' personal information only for a limited period during the specified retention period. If a customer withdraws consent to the use of personal information provided, or when the purpose of use is achieved or the retention period expires, the relevant personal information will be destroyed without delay

2) Personal information collected upon membership registration is retained for 3 years from the date of collection. However, in cases falling under any of the following reasons, it will be retained until the relevant reason is resolved:

A. If an investigation or inquiry due to a violation of relevant laws is in progress:
Until the completion of the relevant investigation or inquiry.

B. If a claim/debt relationship remains due to the use of the BIXPO website:
Until the settlement of the relevant claim/debt relationship.

If the business registration certificate contains a Resident Registration Number, please mask the back digits before submitting it.

Personal information files held by Korea Electric Power Corporation (KEPCO) can be searched on the following website:
• Personal Information Protection Portal: http://www.privacy.go.kr/

Article 3 (Provision of Personal Information to Third Parties)

In principle, the Secretariat processes the personal information of data subjects only within the scope specified for the purpose of collection and use, and does not process it beyond the original purpose or provide it to a third party without the prior consent of the data subject, except in any of the following cases; provided, however, that Subparagraphs 4 through 8 shall apply only to public institutions:

1. Where separate consent is obtained from the data subject;
2. Where special provisions exist in other laws;
3. Where the data subject or his/her legal representative is unable to express an intention or prior consent cannot be obtained due to unknown address, etc., and it is deemed explicitly necessary for the urgent life, body, or property interests of the data subject or a third party;
4. Where it is impossible to perform statutory duties prescribed in other laws unless personal information is used for purposes other than intended or provided to a third party, and it has undergone deliberation and resolution by the Personal Information Protection Commission;
5. Where it is necessary to provide personal information to a foreign government or an international organization to implement a treaty or other international agreement;
6. Where it is necessary for the investigation of a crime and the institution and maintenance of prosecution;
7. Where it is necessary for the performance of judicial work of a court;
8. Where it is necessary for the execution of a sentence, custody, or protective order.

② When providing personal information to a third party, the Secretariat obtains the consent of the data subject and provides it as follows:

③ Where the Secretariat uses personal information for purposes other than intended or provides it to a third party pursuant to each subparagraph of Paragraph 1, the Secretariat shall disclose the legal basis, purpose, scope, etc., on the BIXPO website for at least 10 days within 30 days from the date of such use or provision, and shall record and manage the details in the Register of Out-of-Purpose Use and Third-Party Provision.

Article 4 (Outsourcing of Personal Information Processing)

① The Secretariat outsources personal information processing tasks as follows to ensure the smooth handling of personal information:

② When entering into an outsourcing contract, the Secretariat specifies matters in documents such as contracts, pursuant to Article 26 of the Personal Information Protection Act, concerning responsibilities including the prohibition of processing personal information for purposes other than performing the outsourced tasks, technical and administrative protective measures, restrictions on re-outsourcing, management and supervision of the outsourcee, and liability for damages, and supervises whether the outsourcee processes personal information safely.

③ If the details of the outsourced work or the outsourcee change, it will be disclosed through this Privacy Policy without delay.

Article 5 (Rights and Obligations of Data Subjects and Legal Representatives and Method of Exercise)

① Customers may access or correct their registered personal information at any time. If a customer using membership services wishes to access or correct their personal information, they may directly access or correct it by clicking "Edit Member Information," or contact the Personal Information Protection Officer or manager in writing, by phone, or by email, and necessary measures will be taken without delay.

② If customers wish to request access, correction, deletion, or suspension of processing of their own personal information, they must submit a Request for Access, Correction/Deletion, or Suspension of Processing of Personal Information in accordance with Form No. 8 of the Enforcement Rule of the Personal Information Protection Act to Korea Electric Power Corporation (KEPCO).

③ If a customer requests the correction of an error in their personal information, the relevant personal information will not be used or provided until the correction, deletion, or suspension of processing is completed.

④ When collecting personal information of children under 14 years of age, the Secretariat obtains the consent of their legal representative and collects the minimum personal information necessary to perform the relevant service.

• Items collected: Name, date of birth, and contact information of the legal representative

⑤ When collecting personal information of children under 14 years of age, the Secretariat may request minimum information from the child, such as the legal representative's name and contact information, and confirms whether the legitimate legal representative has consented through one of the following methods:

1. Requiring the legal representative to indicate whether they consent on an internet site where the details of consent are posted, and notifying the legal representative via mobile phone text message that the personal information controller has confirmed the indication of consent;
2. Requiring the legal representative to indicate whether they consent on an internet site where the details of consent are posted, and receiving card information such as credit card or debit card details of the legal representative;
3. Requiring the legal representative to indicate whether they consent on an internet site where the details of consent are posted, and verifying identity through mobile phone identity verification of the legal representative, etc.;
4. Delivering a document containing the details of consent directly to the legal representative or sending it via mail or fax, and having the legal representative submit it after signing or sealing;
5. Sending an email containing the details of consent, and receiving an email from the legal representative expressing intention of consent;
6. Informing the legal representative of the details of consent over the phone and obtaining consent, or guiding them to a method such as an internet address to check the consent details, and obtaining consent through a follow-up phone call;
7. Other methods equivalent to Subparagraphs 1 through 6 that inform the legal representative of the details of consent and confirm the expression of consent.

⑥ Upon receiving a request for access, correction, deletion, or suspension of processing of personal information, the Secretariat verifies whether the requester is the person concerned or a legitimate representative.

⑦ If incorrect personal information has already been provided to a third party, the Secretariat will notify the third party of the results of correction, deletion, or suspension of processing without delay so that appropriate measures can be taken for correction.

Article 6 (Destruction of Personal Information)

In principle, the Secretariat destroys the relevant personal information without delay after the purpose of collecting and using personal information has been achieved.

① Destruction Procedure

A. Information entered by customers is transferred to a separate database (DB) after the purpose is achieved, stored for a certain period in accordance with internal policies and other relevant laws (refer to the Retention and Use Period), or destroyed immediately. At this time, personal information transferred to the DB will not be used for any other purpose unless required by law.

② Destruction Method

A. Personal information printed on paper is destroyed by shredding with a shredder or through incineration.
B. Personal information stored in electronic file format is deleted using technical methods that render the records unrecoverable.

Article 7 (Measures to Ensure the Security of Personal Information)

① Establishment and implementation of an internal management plan for the safe processing of personal information

A. Korea Electric Power Corporation (KEPCO) has established and implements an internal management plan for personal information protection to process personal information safely.
B. Regular internal and external training sessions are provided to employees handling personal information regarding the acquisition of new security technologies and personal information protection obligations.
C. Security pledges are required from all employees upon joining the company to prevent information leakage caused by human factors in advance, and internal procedures are established to audit the implementation of and compliance with the Privacy Policy.
D. The handover of duties among personal information handlers is thoroughly conducted in a secure state, and responsibilities for personal information incidents before and after joining or leaving the company are clearly defined.

② Access control and limitation of access rights to personal information

A. In handling customers' personal information, the Secretariat takes the following technical measures to ensure safety and prevent loss, theft, leakage, alteration, or damage.
B. To prepare for external intrusions such as hacking, intrusion prevention systems and vulnerability analysis systems are utilized for each server to ensure maximum security.
C. The Secretariat limits access rights to customers' personal information to the minimum number of personnel. Such minimal personnel include the following:

• - Personnel directly involved in marketing tasks for users
• - Personnel performing personal information management tasks, such as the Personal Information Protection Officer and managers
• Other personnel who unavoidably handle personal information for business purposes

③ Application of encryption technology or equivalent measures to securely store and transmit personal information

A. Customers' personal information is protected by passwords, and important data is protected through separate security functions, such as encrypting files and transmitted data or using a lock function.
B. The Secretariat adopts a security mechanism (SSL) that safely transmits personal information over the network using encryption algorithms.

④ Storage of access records and measures to prevent forgery or alteration against personal information breach incidents

A. Personal information and general data are not stored together but are stored separately on distinct servers.

⑤ Installation and update of security programs for personal information

A. The Secretariat takes measures to prevent damage from computer viruses by using antivirus programs.
B. Antivirus programs are updated periodically, and when a sudden virus emerges, vaccines are deployed immediately upon release to prevent personal information infringement.

⑥ Physical measures such as providing storage facilities or installing locking devices for safe storage of personal information

A. Computer rooms, document archives, and CCTV control rooms are designated as special protected areas to control access.

⑦ Notification and reporting in the event of personal information leakage

When becoming aware of the loss, theft, or leakage of personal information, the Secretariat promptly notifies the data subject without delay, pursuant to Article 34 of the Personal Information Protection Act, of the items of personal information leaked, the timing and circumstances of leakage, methods the data subject can take to minimize damage, the Secretariat's response measures and damage relief procedures, and the department and contact information to receive damage reports. In addition, if statutory conditions are met, the Secretariat reports to the Personal Information Protection Commission or the Korea Internet & Security Agency and takes necessary measures to prevent the spread of damage and identify the cause.

Article 8 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

① During the operation of the BIXPO website, the Secretariat utilizes 'cookies' to retrieve and store customers' information as necessary. A cookie is a very small text file sent to the customer's browser by the server used to operate the website and stored on the customer's computer hard disk. Customers may choose whether to allow or refuse the collection of text information in cookies through their web browser's security settings.

▶ Allowing/Blocking Cookies in Web Browsers

• Chrome: Web browser settings > Privacy and security > Clear browsing data
• Edge: Web browser settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allowing/Blocking Cookies in Mobile Browsers

• Chrome: Mobile browser settings > Privacy and security > Clear browsing data
• Safari : Mobile device settings > Safari > Advanced > Block All Cookies
• Samsung Internet: Mobile browser settings > Browsing history > Clear browsing data

② The information collected by cookies and the purposes of use are as follows:

A. Information collected: Service usage information such as ID, connection IP, member classification, and content used

B. Purposes of use:

• Providing differentiated information according to individual fields of interest.
• Analyzing the access frequency or visit time of members and non-members to understand users' tastes and fields of interest, and utilizing this for promotion and as a benchmark for service reorganization.

Article 9 (Installation and Operation of Mobile Visual Information Processing Devices)

The Secretariat may install and operate mobile visual information processing devices for safety management of event facilities and participants, accident prevention, smooth event operation, and event promotion/introduction.
In addition, photos and videos may be taken within the event venue for event operation and promotion/introduction, and visitors may be filmed during this process. Filmed photos and videos may be utilized for purposes such as introducing and promoting BIXPO events.

① Purpose and Legal Basis of Operating Mobile Visual Information Processing Devices

Pursuant to Article 25-2 (1) of the Personal Information Protection Act, the Secretariat operates mobile visual information processing devices for the following purposes:

② Number of Mobile Visual Information Processing Devices Operated

* Subject to change depending on event conditions

③ Person in Charge of Management and Person Authorized to Access Visual Information

The Secretariat designates and manages a person in charge of management and authorized persons to protect personal visual information filmed through mobile visual information processing devices and to handle related complaints.

- Personal Information Protection Department: Personal Information Protection Division, Information Security Department

- Contact: +82-61-345-4922

④ Filming Time, Retention Period, Storage Location, and Processing Method of Visual Information

• Filming time: Within event operating hours
• Retention period: Until the end of business usage purpose and up to a maximum of 3 years
• Storage location: 55 Jeollyeok-ro, Naju-si, Jeonnam-Gwangju Special Metropolitan City
• Processing method: Matters regarding requests for out-of-purpose use, third-party provision, destruction, and access to personal visual information are recorded and managed, and upon expiration of the retention period, it is permanently deleted in an unrecoverable manner.

⑤ Consignment of Mobile Visual Information Processing Devices

The Secretariat may consign business if necessary for the installation and management of mobile visual information processing devices, and stipulates necessary matters in accordance with relevant laws and regulations to ensure that personal information is safely managed during consignment contracts.

⑥ Method and Location for Verification of Mobile Visual Information

If verification of the existence of visual information is required, it can be checked through the department in charge below. If assistance is not provided or a problem occurs, guidance can be received through the department in charge.

⑦ Actions on Data Subject's Request for Access, etc. to Visual Information

If you wish to request access, confirmation of existence, or deletion of personal visual information filmed through mobile visual information processing devices, you may submit a request to the person in charge specified in the above clause using the designated form, and the Secretariat will take necessary measures without delay.
However, this is limited to personal visual information in which the data subject oneself is filmed through mobile visual information processing devices or where it is explicitly necessary for the urgent life, body, or property interests of the data subject, and the data subject's request may be restricted or refused in any of the following cases:

1. Where access is prohibited or restricted by law;
2. Where there is a concern of harming another person's life or body or unjustly infringing upon another person's property and other interests;
3. Where a public institution causes severe disruption in performing any of the following tasks:

• Tasks regarding the assessment, collection, or refund of taxes;
• Tasks regarding grade evaluation or admission selection in schools of each level under the 『Elementary and Secondary Education Act』 and the 『Higher Education Act』, lifelong education facilities under the 『Lifelong Education Act』, and other higher education institutions established under other laws;
• Tasks regarding examinations of academic background, skills, and employment, and qualification reviews;
• Tasks regarding ongoing evaluations or judgments regarding the calculation of compensation, benefits, etc.;
• Tasks regarding ongoing audits and investigations under other laws.

⑧ Technical, Administrative, and Physical Measures for Protection of Visual Information

The Secretariat safely manages personal visual information filmed through mobile visual information processing devices through encryption measures, etc. In addition, as administrative measures for personal visual information protection, access rights to personal information are assigned on a differential basis, and to prevent forgery and alteration of personal visual information, the creation date and time of personal visual information, purpose of access, viewer, date and time of access, etc., are recorded and managed. In addition, locking devices are installed for the safe physical storage of personal visual information.

Article 10 (Personal Information Protection Officer and Responsible Department)

① Korea Electric Power Corporation (KEPCO) takes overall responsibility for business concerning personal information processing, and has designated the Personal Information Protection Officer and responsible departments as follows to handle complaints and provide remedies for damages to data subjects related to personal information processing.

- Responsible Department and Person in Charge by Field

- Personal Information Controller and Person in Charge

② Data subjects may inquire with the Personal Information Protection Officer and the responsible department regarding inquiries, complaint handling, damage remedies, etc., related to personal information protection that occur while using the BIXPO 2026 services. KEPCO will respond to and process inquiries from data subjects without delay.

Article 11 (Request for Access to Personal Information and Handling of Complaints)

① The Secretariat values customers' opinions, and customers have the right to receive sincere answers to their inquiries at any time.

② Contact information for smooth communication between the Secretariat and customers is as follows:

A. Department in charge of BIXPO

- Tel: +82-61-345-7782~7785, 7787

B. Personal Information Protection Department

- Department: Personal Information Protection Division, Information Security Department

- Email: biz-privacy@kepco.co.kr

- Tel: +82-61-345-4922

- Address: Information Security Department, KEPCO, 55 Jeollyeok-ro (120, Bitgaram-dong), Naju-si, Jeonnam-Gwangju Special Metropolitan City, 58322, Republic of Korea

③ Telephone consultations are available on weekdays from 09:00 to 18:00.

④ For consultations via email, fax, or mail, we will provide a sincere response within 12 hours of receipt. However, as a general rule, inquiries submitted after working hours, on weekends, or on public holidays will be processed on the next business day.

Article 12 (Remedies for Infringement of Rights and Interests of Data Subjects)

① Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Reporting Center of the Korea Internet & Security Agency (KISA), etc., to receive relief for personal information infringement. For other reports and consultations on personal information infringement, please contact the following organizations:
[Note: The following organizations are independent of the BIXPO Secretariat. If you are not satisfied with the Secretariat's internal handling of personal information complaints or damage relief outcomes, or if you require further detailed assistance, please contact them.]

▶ Personal Information Infringement Reporting Center (Operated by KISA)

• Responsibilities: Reporting personal information infringement, requesting consultation
• Website: privacy.kisa.or.kr
• Tel: +82-118 (without area code in Korea: 118)
• Address: Personal Information Infringement Reporting Center, KISA, 9 Jinheung-gil, Naju-si, Jeonnam-Gwangju Special Metropolitan City, 58342, Republic of Korea

▶ Personal Information Dispute Mediation Committee

• Responsibilities: Application for personal information dispute mediation, collective dispute mediation (civil resolution)
• Website: www.kopico.go.kr
• Tel: +82-1833-6972 (without area code in Korea: 1833-6972)
• Address: Personal Information Dispute Mediation Committee, 12th Floor, Seoul Government Complex, 209 Sejong-daero, Jongno-gu, Seoul, 03171, Republic of Korea

▶ National Police Agency (Electronic Cybercrime Report & Management System - ECRM)

• Responsibilities: Inquiry and reporting of criminal cases related to personal information infringement
• Website: ecrm.police.go.kr
• Tel: +82-182 (Civil complaints hotline, without area code in Korea: 182)
• Address: 97 Tongil-ro, Seodaemun-gu, Seoul, 03739, Republic of Korea

▶ Supreme Prosecutors' Office Cyber Investigation Division

• Website : www.spo.go.kr
• Tel: +82-1301 (Main hotline, without area code in Korea: 1301)
• Address: 157 Banpo-daero, Seocho-gu, Seoul, 06590, Republic of Korea

② Any person whose rights or interests have been infringed due to a disposition or omission made by the BIXPO website in response to a request for access, correction, deletion, suspension of processing, or objection regarding personal information may file an administrative appeal in accordance with the Administrative Appeals Act:

- Central Administrative Appeals Commission: +82-110 (without area code in Korea: 110) [www.simpan.go.kr]
- Address: Central Administrative Appeals Commission, Building 7-2, Government Complex Sejong, 20 Doum 5-ro, Sejong Special Self-Governing City, 30102, Republic of Korea

Article 13 (Amendments to Privacy Policy)

This Privacy Policy takes effect on September 7, 2026. Any additions, deletions, or modifications to the content resulting from changes in government policies or security technologies will be announced through the BIXPO website.