Doc. Ref.
2022-00025
Final revision June 30, 2022
Responsible Security Compliance Team
person
Privacy Policy of Hyundai Motor Company
June 2022
Table of Contents
1. General Provisions ....................................................................................................................................................... 2
2. Purpose, Items, and Period of Retention of Personal Information ................................................................. 2
3. Procedure and Method of Destroying Personal Information .......................................................................... 5
4. Outsourcing of Personal Information Processing ............................................................................................... 5
5. Providing Personal Information to a Third Party ................................................................................................. 6
6. Measures to Secure the Safety of Personal Information .................................................................................. 6
7. Matters About the Installation, Operation and Rejection of Automatic Personal Information
Collection System ............................................................................................................................................................ 8
8. Rights and Obligations of Customers and Their Legal Representatives, and Method of Exercising
the Rights............................................................................................................................................................................ 9
9. Remedy Against Infringement on the Rights of Customers ......................................................................... 10
10. Director, Manager, and Department in Charge of Personal Information Protection .......................... 10
11. Sending Advertising Information ....................................................................................................................... 11
12. Matters Related to Changing Privacy Policy .................................................................................................. 12
1 / 12
1. General Provisions
Hyundai Motor Company (HYUNDAI or We) developed and disclosed following Privacy Policy to protect the
personal information of customers and rapidly and smoothly handle related complaints in accordance with
Article 30 of the Personal Information Protection Act.
1) Scope of Application
This Privacy Policy of Hyundai Motor Company applies to HYUNDAI’s all business sites in and outside of
Korea, subsidiaries, joint ventures, affiliates, personal information processors and their contractor.
2. Purpose, Items, and Period of Retention of Personal Information
1) HYUNDAI processes following personal information for purposes described below.
HYUNDAI processes and retains personal information within the period set by relevant laws and
regulations or the period agreed with customers at the time of collecting their personal information.
Personal information shall not be used for purposes other than those described below.
If the purpose of use or items are changed, we will take necessary measures such as obtaining separate
consent according to the Article 18 of the Personal Information Protection Act.
Service Period of
Purpose of Collection/Use Items Collected
Category Retention
- To provide products and services to fulfill [Mandatory]
the obligations under the car sales Name, residential registration number (alien
contract registration number or passport number), company
- To deliver and register car(s) after (shop) name, business registration number, address,
purchase phone/mobile phone number, email, information of Ten years from
- To verify customers’ identification for the the car purchased issuing a
delivery of billing statement, payment, certificate of
and collection of bills; retain records for manufacturing
dispute settlement; handle complaints; [Optional] after the
deliver notices; and survey customers’ Personal credit information under the Credit purchase of a
Purchase of
satisfaction with services Information Use and Protection Act for installment car
vehicles
- To verify customers’ identification purchase; information related to tax
needed for customer management, exemption/discounts
information of vehicle maintenance,
membership services
To be destroyed
[Sensitive information]
[Optional] after
- To confirm whether a customer is
Information required to purchase a car for the accomplishing
eligible to buy a car for the disabled;
disabled, register the car and declare tax exemption the purpose of
declare tax exemption; and register the
(e.g., disability category and grade) using personal
car on behalf of the customer
information
2 / 12
- To verify customers’ identification for [Mandatory]
Name, contact information (phone/mobile phone Ten years from
Vehicle services, such as vehicle repair,
number), address, information of the car purchased issuing vehicle
maintenance maintenance, service reservation, road-
maintenance
(new vehicles) side assistance service, and recall due to [Optional]
statement
manufacturing defects Email
- To verify customers’ identification for [Mandatory]
Vehicle Name, contact information (phone/mobile phone Ten years from
services, such as vehicle repair,
maintenance number), address, information of the car purchased issuing vehicle
maintenance, service reservation, road-
(secondhand maintenance
side assistance service, and recall due to
vehicles) [Optional] statement
manufacturing defects
- To provide information about new
[Mandatory]
services (including products) and events
- To provide latest company information
Marketing and online magazine Two years from
and - To deliver direct messages (DM), texting collecting
[Optional]
advertisement (SMS), mail, free gifts, and event information
Name, address, phone/mobile phone number, email
information
- To conduct statistical analysis of
customers and market survey
- To provide test-drive services and [Mandatory]
handle accidents during test drive with
insurance Name, mobile phone number, date of birth, gender,
- To respond to accidents, prevent theft of test drive information (car model, car plate number,
Two years from
Test drive test drive cars, manage their operation date of test drive), and information of drive routes and
test-driving
and customer complaints real-time location
- To handle complaints, respond to
[Optional]
disputes, survey consumer opinions, and
provide customer management services
[Mandatory]
[Optional]
To provide customer counseling related to
Address, model of the car currently owned, car model
purchasing vehicles; provide various Two years from
that the customer wants to purchase, name, date of
Prospects information (including advertising collecting
birth, gender, mobile phone number, email, the name
information), and help customers join information
of mobile carrier, CI (only for users who completed
events
identification verification services of NICE Information
Service), whether the customer has a Korean
nationality
[Mandatory]
During the
To allow customers to sign up for the
Price service period
service and use it Name, address, contact information, business
guarantee (three years
- Buy/sell used cars, inquire about registration status, mobile phone number, email,
service for after delivering
business license number, and provide information about the vehicle purchased,
used cars the car to the
information about the service maintenance history
customer)
[Optional]
Advantage [Mandatory] Until the
To provide products/services for vehicle
service purpose of the
exchange to a new model or a new car of
- vehicle Name of the applicant written on the car registration, vehicle
the same model (sell used cars or check
exchange to a resident registration number, information about the exchange
whether customers have a business
new model or car purchased, contact information, mobile phone program (to
license)
a new car of number, email exchange to a
3 / 12
the same new model or a
model new car of the
[Optional]
same model) is
achieved
[Mandatory] Until the
Advantage Name of the applicant written on the deed of sale of purpose of the
To provide products and services to the motor vehicle, address, contact information,
service worry-free
implement the worry-free installment mobile phone number, email, information about the
- worry-free installment
program car purchased, and bank account number
installment program is
[Optional] achieved
[Mandatory] Until customer
History of services and
services from handling
Customer service history
the customer [Optional] customer
service center requests are
completed
- To verify customers’ identification to [Mandatory]
provide remote consultations/actions, Vehicle model, VIN number, contact information
vehicle repair, vehicle checking and (phone number or mobile phone number), diagnostic Three years
Smart remote
maintenance services, service information, information about vehicle condition, from gathering
diagnostics
reservation, road-side assistance consumables management information information
services, and correction of manufacturing
[Optional]
defects
2) HYUNDAI stores customers’ personal information if such retention is mandatory as per related laws and
regulations, including the Commercial Act.
In this case, HYUNDAI will use the retained information only for the purpose of such retention, and the
period of retention is as follows:
① Important documents related to HYUNDAI’s commercial books and sales, and information about
statements: 10 years – important documents/5 years – statements (Commercial Law)
② Information related to ledgers and documentary evidence about all transactions: 5 years (Framework
Act on National Taxes, Corporate Tax Act)
③ Records about contracts or withdrawing subscriptions, or records about payment and provision of
goods, etc. : 5 years (Guidelines for Consumer Protection in Electronic Commerce, etc.)
④ Records about handling consumer complaints or disputes: 3 years (Guidelines for Consumer Protection
in Electronic Commerce, etc.)
⑤ Ledgers, tax invoices issued, or receipts: 5 years (Value-added Tax Act)
⑥ Service use history, access logs, access IP information as required by Protection of Communications
Secrets Act: 3 months
4 / 12
※ According to the policy about the term of the validity of personal information, personal information of
members who have not used the service for one year is stored separately.
3. Procedure and Method of Destroying Personal Information
1) HYUNDAI immediately destroys personal information if it becomes unnecessary due to the expiry of the
period of retaining personal information or by achieving the purpose of processing the personal
information unless it should be preserved according to laws and regulations.
2) In cases where personal information should be preserved due to laws and regulations, internal policy, or
for protection of information (refer to the period of retaining and using personal information) even after
the period of retaining personal information expires or the purpose of processing personal information is
achieved, HYUNDAI moves the said personal information to a separate database or store it at a different
location (a separate filing cabinet in the case of paper). The personal information moved to a separate
database will not be used for purposes other than the purpose of retaining the information.
3) Followings are the procedures and methods to dispose of personal information.
① Procedures of disposal
HYUNDAI selects personal information that should be disposed of, receives approval by the person in
charge of personal information protection, and then dispose of the personal information.
② Method of disposal
In the case of personal information recorded and stored in an electronic file format, HYUNDAI disposes of
the information in an irreversible way so that it cannot be reproduced. Printed copies of personal
information should be incinerated or shredded by a paper shredder.
4. Outsourcing of Personal Information Processing
1) HYUNDAI outsources part of activities related to personal information processing for smooth personal
information processing.
2) When signing an outsourcing contract, HYUNDAI specifies matters related to responsibilities, such as
prevention of personal information processing for purposes other than the purpose of outsourcing,
technical and managerial safeguards of personal information, prohibition of sub-outsourcing,
management and supervision of the entity who provides outsourcing services, and damage
5 / 12
compensations, etc., to supervise whether the outsourcing service provider safely processes personal
information, According to Article 26 of Personal Information Protection Act.
3) When the details of outsourcing services or the entity that provides the outsourcing services is changed,
related details will be disclosed in accordance with this Privacy Policy.
5. Providing Personal Information to a Third Party
1) HYUNDAI processes personal information of data subject only within the scope defined by Article 1
(Purpose of Processing Personal Information) and provide personal information to a third party only in the
cases that fall under Article 17 and Article 18 of the Personal Information Protection Act, including the
cases where additional consent is obtained from the data subject and special provisions exist in other
laws.
2) HYUNDAI does not use personal information outside of the scope described above or does not provide
customers’ personal information to other organizations, including other companies.
6. Measures to Secure the Safety of Personal Information
※ Technical and Management Measures to Protect Personal Information
For the safety of customers’ personal information processed, HYUNDAI applies the following technical and
management measures to prevent loss, theft, leakage, falsification, or damage to the information.
1) Technical measures
① Encryption of customer information
Personal information of customers is encrypted and stored in a database so that it cannot be used by
outsiders, even in the case of leakage by the intrusion.
② Networking Encryption
When customers sign up or log in on the website, the personal information they enter is safely transmitted
through SSL.
③ Installation of security solutions
Vaccine programs are installed on the personal information processing system, and the programs are
updated and maintained on a regular basis for the safe management of services and customer
6 / 12
information. In addition, database encryption solutions and screen capture prevention solutions are also
in place. Intrusion blocking/detecting systems were installed, and the integrated security control center
provides ongoing monitoring to prevent hacking and intrusion.
2) Management Measures
① Development of personal information management system
HYUNDAI internally developed and operates a personal information management system to manage
personal information safely.
② Operation of the personal information protection committee
HYUNDAI organized a personal information protection committee and holds a committee meeting twice
or more a year to resolve issues related to personal information protection and the operation of the
personal information management system.
③ Management of personal information controller
HYUNDAI requires personal information controllers to sign and submit a privacy pledge and provides
them with privacy protection training twice or more a year to raise their awareness of the importance of
customer information as well as to manage customer information. In addition, HYUNDAI controls the
authority level of personal information controllers to minimize unnecessary access to and exposure of the
personal information of customers.
※ Internal Control of Personal Information Protection Tasks
To HYUNDAI, protection of personal information is part of corporate-wide compliance management and is
one of the major risk areas for which HYUNDAI conducts self-compliance check twice a year to diagnose
and prevent risks.
3) Corporate-wide Risk Management
HYUNDAI leads and complies with the privacy policy of Hyundai Motor Group. Based on this, HYUNDAI
established its own privacy rules for HYUNDAI’s business activities and stakeholders, including customers
and affiliated companies.
4) Disciplinary Measures in the Case of Violation
Any accidents that violate laws and regulations related to personal information protection and this Policy
are reported in public, and HYUNDAI takes disciplinary measures regarding responsible employees and
organizations pursuant to company regulations. HYUNDAI determines the degree of discipline such as
7 / 12
dismissal or suspension of the relevant contract in the worst case, depending on the type of violations, the
gravity of the issue and other matters.
5) Internal Audit
HYUNDAI implements regular internal investigations to check compliance with this Policy; carries out due
diligence on major business sites (regional HQ, branch offices, service centers, delivery centers, test drive
centers); and manages/checks the personal information processor through on-site due diligence in the
second half of each year. HYUNDAI identifies areas that require improvement through regular
investigations to improve business and confirm whether improvements were made.
7. Matters About the Installation, Operation and Rejection of Automatic Personal
Information Collection System
1) HYUNDAI uses cookies, which contain data and enable websites to retrieve information, in order to
provide users with personalized services.
2) Cookies are small text files containing information sent by servers (http) that are used to run websites.
Cookies can be stored in the hard disk of users’ personal computers.
① Purpose of using cookies: Cookies are used to analyze website login frequency and when users visit the
website, understand, and analyze customers’ areas of interest, and identify the number of events
participated and the number of visits to the website. With this, HYUNDAI can provide target marketing or
customized services. Customers can choose whether cookies are to be installed. Therefore, customers
can allow all cookies, or check whenever cookies are stored or even reject storing cookies, by setting web
browser options.
② Installing, operating, and rejecting cookies: Customers can change setting on the web browser to allow
all cookies, or check whenever cookies are stored or even reject storing cookies.
※ Example of setting (for Internet Explorer): Click Tools on the menu bar > Internet Options > Privacy >
Advanced > Choose option you want
③ However, in the case of rejecting storing cookies, users may have difficulty in using part of the services
that require membership login.
8 / 12
8. Rights and Obligations of Customers and Their Legal Representatives, and
Method of Exercising the Rights
1) Customers or their legal representatives (for children under 14) can withdraw their consent (cancel their
membership) on the collection, use and provision of personal information to HYUNDAI. They can exercise
their rights to access, correct, delete, and stop processing their personal information.
2) Customers can exercise the above said rights either online or offline: they can visit the company website,
verify their identification, and click the personal information setting menu; or they can contact HYUNDAI’s
customer center or the head or the responsible employee in the personal information protection team by
mail, phone, or email. HYUNDAI will take immediate actions regarding such requests.
3) Customers can exercise their rights described in above paragraphs 1 and 2 via their legal representative
or a delegated person, etc. In this case, a letter of delegation should be submitted using the form no. 11 of
the “Announcement of the Methods of Processing Personal Information (No. 2020-7).”
4) According to Paragraph 4 of Article 35 and Paragraph 2 of Article 37 of the Personal information
Protection Act, customer’s rights to request access to personal information or suspending personal
information. processing can be limited.
5) Regarding the request to correct and delete personal information, customers cannot request deleting
their personal information if collecting the information is legally required by other laws and regulations.
6) In the case of receiving requests to access, correct, delete, or suspend processing personal information as
per the rights of information subjects, HYUNDAI will verify whether such requests were made by the
information subject or a legitimate representative.
7) When requested by customers to correct errors with their personal information, HYUNDAI does not use or
provide the said personal information until correction is completed. In cases where the personal
information was already provided to a third party, HYUNDAI will immediately send a notice to the third
party to correct the error.
8) If customers or their legal representatives withdraw consent (cancel membership), HYUNDAI should
destroy the information without delay in principle. However, if it is mandatory to retain such information
according to related laws and regulations, HYUNDAI should process the information as per the ‘Period of
Retention of Personal Information under the Privacy Policy and allow access to or use of the personal
information only when such access or use is really needed.
9 / 12
9. Remedy Against Infringement on the Rights of Customers
Customers can contact the following institutes and inquire damage relief or get consultations about
infringement on personal information. Customers can contact these organizations, which are not related to
HYUNDAI, if they are not satisfied with the results of HYUNDAI’s internal handling of complaints related to
personal information or damage relief, or if they need additional support.
▶ Personal Information Infringement Report Center Korea (run by Korea Internet & Security Agency)
- Tasks: to receive reports of personal information infringement, and application for consultations
- Website: privacy.kisa.or.kr
- Phone: (without area code) 118
- Address: (58324) 3rd floor, 9, Jinheung-gil, Naju-si, Jeollanam-do, Republic of Korea
▶ Personal Information Dispute Mediation Committee
- Tasks: to receive applications for dispute conciliation regarding personal information and arbitrate
collective disputes (civil case settlement)
- Website: www.kopico.go.kr
- Phone: (without area code) 1833-6972
- Address: (03171) 12th floor, 209, Central Government Complex, Sejong-daero, Jongno-gu, Seoul,
Republic of Korea
▶ Internet Crime Investigation Center: 02-3480-3573 (www.spo.go.kr)
▶ Cyber Bureau of the National Police Agency: 182 (https://cyberbureau.police.go.kr)
10. Director, Manager, and Department in Charge of Personal Information
Protection
1) HYUNDAI designated following Personal Information Protection Director to be responsible for the
supervision of personal information processing, as well as related customer complaints and damage
relief.
10 / 12
Director and Manager in Charge of Personal Information Protection
- Personal Information Protection Manager
- Personal Information Protection Director : Jun-ho Kim Senior Manager
: Sang-hong Lee Managing Director - Department: Security Compliance Team
- Department: Hyundai Security Center - Phone: 080-600-6000
- Email: [email protected]
2) For all inquiries, complaints, and damage relief related to personal information protection that may arise
while using HYUNDAI’s services (or business), customers can contact the above personal information
protection director or responsible department.
HYUNDAI will respond to and handle customer inquiries without delay.
11. Sending Advertising Information
1) HYUNDAI does not send for-profit advertising information to customers without their prior consent.
2) In the case of sending for-profit advertising information, such as marketing and promotion (e.g.,
information about launching new cars or events), HYUNDAI sends such information only to customers
who agreed to receiving it.
3) In the case of sending advertising information using electronic communication, following actions are
taken before sending the information in accordance with Article 50 to Article 50-8 of the Act on
Promotion of Information and Communications Network Utilization and Information Protection, Etc.
- Means of electronic communication: text, email, fax, and others
① Insert “[Advertising]” in the beginning of title
② Add the name and contact information of the sender
③ Indicate a toll-free number for those who don’t want to be put on HYUNDAI’s do-not-call list.
4) Once obtaining a customer’s consent to receive advertising information, HYUNDAI checks with the
customer’s consent every two years from the day of receiving the consent. If customers do not express
their intention after receiving the notification, their consent will be considered as valid.
5) HYUNDAI does not send advertising information using electronic communication means from 21:00 to
08:00 the next day.
6) However, sending following information via electronic communication means will be an exception.
11 / 12
- Information about the fulfillment of the contact signed between HYUNDAI and the customer
- Information requested by customers (e.g., estimates, automobile catalogue, newsletters, etc.)
- Matters that must be notified by HYUNDAI to customers, including matters related to vehicle safety and
quality as per related laws and regulations
※ Customers can withdraw their consent to receiving advertising information as follows:
- Visit My Page menu on the website and opt out of receiving advertising information.
- 080-656-6000: automatic response system (ARS) number (toll-free), 080-600-6000: via customer
service representatives (toll-free)
12. Matters Related to Changing Privacy Policy
In the case of changing this Privacy Policy, HYUNDAI will notify the reason and details of the change in
advance, either via the notice menu on the first page of the website or via a separate window, before
changing and adopting the policy change.
This Policy will take effect starting on June 30, 2022.
12 / 12
