This is to provide you data on how KVIC uses and manages visual data processed by visual data processing devices (VDPD) based on the VDPD Policy. 1. Basis and purpose of installation KVIC installed and operates VDPD according to Article 25(1) of the Personal Information Protection Act for the following purposes: 2. Installation status The location of installation of KVIC’s VDPD, number of installed cameras, and the scope of recording are as follows:

Category	Location of server	No. of CCTV cameras	Scope of recording
Korea Venture Investment Corp.	Equipment Room, Disaster Prevention Center, Basement	12	Outdoor parking lot, around the facility
		35	Lobby and hallways of 1F-5F, etc.

3. Chief manager and authorized personnel We designated chief manager and authorized personnel in charge of personal visual data for protecting visual data and handling complaints related to personal visual data.
- Chief manager: Director Choi Cheol-hun, Administration & Planning Division
- Authorized personnel: Team Leader Hong Geun-ho, IT Service Team 4. Recording time, retention period, storage location, and processing method of visual data

Category	Storage location	Scope of recording	Recording time of visual data	Retention period of visual data
Korea Venture Investment Corp.	Disaster Prevention Center, Basement Equipment Room	Basement and outdoor parking lot Around the facility	24 hours	30 days or less

- Processing method: Record/manage matters related to requests on the use of personal visual data other than the original purpose, provision to a third party, destruction, and access; delete permanently (shred or incinerate in case of print-outs) in a method that the data cannot be restored when the retention period expires.
5. Outsourcing operational duties of VDPD KVIC is the direct operator of its VDPD.
6. Viewing location and method of visual data - How to view: Contact the chief manager or the authorized personnel prior to visitation. Submit a viewing/footage confirmation application form to the relevant division when requesting for viewing.
- Where to view: Disaster Prevention Center where the VDPD is installed in KVIC 7. Request of viewing by data subject, etc. 1) Data subjects are entitled to request the VDPD operator whenever the former wishes to view/confirm footage/discard (hereinafter “view, etc.”) personal video data. However, this is limited to personal visual data of which the data subject is filmed, and the request is certainly for the benefit of the life, body, and wealth of the data subject.
2) In the event a data subject wishes to request to view, etc., he or she shall request for personal visual data viewing/footage confirmation in accordance with the [Annex 1] Personal Visual Data Application Form (including electronic documents) to chiefs of different companies.
3) KVIC will take immediate action without delay upon receipt of request for viewing, etc., by a data subject. In this case, the requesting or authorized person for viewing shall present his or her ID, such as resident registration card, driver’s license, or passport.
4) Despite the regulation as stated in paragraph 3, data subjects who fall under the following conditions are subject to denial of viewing of personal visual data. In this case, we will inform the data subject in writing the reason for denial within 10 days.
  a. In case of causing a serious obstacle to criminal investigation, sustainment of a public prosecution, or conduct of a trial
  b. When the personal visual data is destructed after the retention period has expired
  c. When other justifiable reason exists to reject the request for the viewing, etc., by the data subject
5) KVIC will take immediate actions without delay upon receipt of application for viewing, footage confirmation, or deletion of personal visual data. 8. Measures for securing safety of personal visual data To prevent the loss, theft, leak, modulation, or damage of personal visual data, KVIC takes the following measures to secure safety in accordance with Article 29 of the Personal Information Protection Act and Article 30(1) of the Enforcement Decree of the same Act:
1) Establishment and implementation of an internal management plan for safe processing of personal visual data;
2) Measures to control access to personal visual data and restrict access rights;
3) Apply technology that can safely store/transfer personal visual data;
4) Measures to store handling records and prevent forgery/modulation (Recording and managing creation date of personal visual data and viewing purpose, viewer, viewing date/time in case of a viewing);
5) Provision of storage facilities or installation of locking devices for safe physical storage of personal visual data. 9. Information on policy amendments of the operation and management of visual data processing devices This VDPD Operation and Management Policy was established on June 1, 2017. If there are any additions, deletions, or modifications to the contents due to amendments in laws, policies, or security technology, the reason for the change and the contents will be notified through the website of KVIC.