Mandatory Consent to Personal(Credit) Information

Letter of consent for Citibank Credit card application Mandatory Consent to Personal(Credit) Information

※Your consent to below is mandatory for card issuance and maintenance. you will be eligible for card application upon providing your consent to this mandatory consent form. ■ Mandatory Collection/Use of Personal(Credit) Information In accordance with Articles 15-2, 32-1, 33 and 34 of "Act on the Use and Protection of Credit Information" and Articles 15-1-1, 17-1-1, 24-1-1 and 24-2 of "Personal Information Protection Act", Citibank Korea Inc.(CKI) must obtain my consent prior to collecting/using my personal(credit) information in regards to(financial) transaction with CKI. I hereby consent to CKI's collection/use of my personal(credit) information as below. ● Purpose of collection/use of personal(credit) information Contract award/maintenance/execution/management(including data analysis, model development, etc.) and improvement, provision of requested services/products, fulfillment of legal obligations, investigation on disorderly credit activities, conflict handling, phone consultation, complaint handling, ID verification, internal reporting/audit/inspection taking place abroad. ● Personal(Credit) information to be collected/used ① Personal identification information: Name, national ID number, date of national ID issuance, contact number(mobile, home, office), address(home, office), email, company name, department, job title, gender, nationality, driver' s license number, passport number, foreign registration ID number, voice data, domestic address registration number, ConnectingInformation(CI). ② Credit transaction information:Information on financial transactions such as loan, guarantee, provision of collateral, credit card, installment payment etc. which are made before/after this transaction with CKI or other financial companies (Type of transaction, period, amount, credit limit.) ③ Credit transaction information: information that can be used to determine credit status such as credit grade or credit score, credit inquiry history, debt readjustment contract, delinquency, default, substitute payment, and amount and occurrence/resolution period of disorderly credit activities ④ Credit capability information:Information that can be used to determine credit capability such as total amount of asset/debt/income, tax payments etc. ⑤ Public institution information:Information held by public institutions which can be used to determine customer ID, credit status and financial capability such as court' s ruling(e.g. individual rehabilitation, bankruptcy, indemnification, registered on the default list), default record, national ID registration related information, social insurance/public utility charges-related information, administrative measures etc. ⑥ Recurring payment information (If customer has applied for recurring payment service):Subscriber's name, national ID, mobile service provider, contact number(mobile, home, office), recurring payment information such as telecommunication/electricity/gas/insurance bill ⑦ Supplementary card information (If customer has applied for a supplementary card): Card name, desired credit line, name, national ID, phone number, address, relationship with the cardholder ⑧ Employment information from National Pension Service (limited to request for online verification of employment information): Company name(region), qualification maintenance period, number of months for unpaid premiums, type of subscriber ⑨ Information collected as per Electronic Financial Transaction Act, e.g., Customer ID, access time, IP address and used telephone number etc (limited to electronic financial transactions) ⑩ Other information provided by the cardholder for contract/service award maintenance implementation management and improvement ※Hereinafter, names for specific information relevant to personal identification information, credit transaction information, credit score information, credit capability information and public institution information will be omitted. ※Personal(credit) information which occurred before the consent shall be included. ● Personal(Credit) information storage/usage period Personal(credit) information shall be stored/used for 5 years after the date of (financial) transaction termination*. It shall bused only for investigating financial accidents, resolving disputes, addressing complaints, fulfilling statutory obligation and managing CKI's risks *The date of (financial) transaction termination refers to a date when all contracts or transaction with CKI (credit·liability, domestic·foreign exchange, card and 3rd party collateral) and services (safety box, safekeeping, designation for FX and electronic financial transactions including internet banking) have been closed

Supplementary Card Applicant name (Signature)

MSA127 ① v11

영문 동의서 (한국씨티은행 신용카드 신청용) ■ Inquiry of Personal(Credit) Informarion I hereby agree to CK's inquiry of my credit information from credit bureaus and centralized credit information collection agencies, and ID verification from public institutions in accordance with Articles 1502, 3201, 33 and 34 of "Act on the Use and Protection of Credit Information" and Articles 15-1-1, 17-1-1, 24-1-1 and 24-2 of "Personal Information Protection Act". This consent shall remain valid for second card issuance, card replacement and renewal. • Personal(Credit) information to be inquired:Personal identification information, credit transaction information, credit capacity information, credit score information, public institution information • Purpose of inquiry:Contract award, maintenance, execution, management (including data analysis, model development, etc.) and improvement • Validity of consent to information inquiry: This consent shall remain valid upon submission of this letter of consent to the date of termination of relevant transaction Note this consent shall lose its validity upon nullification of this contract

Date of confirmation: ■ Mandatory Provision of Personal(Credit) Information In accordance with Articles 15-2, 32-1, 33 and 34 of "Act on the Use and Protection of Credit Information" and Articles 15-1-1, 17-1-1, 22, 24-1-1 and 24-2 of "Personal Information Protection Act", CKI is required to obtain my consent prior to providing my personal(credit) information obtained from me in regards to this contact to a third party as below. I hereby consent to CKI's provision of my personal(credit) information to a third party as below (1)Personal(credit) information provided to centralized credit information collection agencies and credit bureaus ① Recipient of personal(credit) information -Credit information collection agencies: KCIS(Korea Credit information Service) (Articles 25 and 25-2 of "Act on the Use and Protection of Credit information") -Credit bureaus:NICE, KCB (Articles 4 of "Act on the Use and Protection of Credit information) ② Purpose of provision of personal(credit) information -Credit inquiry (credit score evaluation, real-name verification), contract maintenance/follow-up including contracts signed prior to this contract etc./ -Credit information collection operation (management/use of credit information) -Creating the connecting information(CI) for identification. ③ Personal(Credit) information to be provided: Personal identification information, credit transaction information, credit score information, credit capacity information, public institution information ④ Personal(Credit) information storage/usage period -Credit information collection agencies, credit bureaus: As stipulated in "Act on the Use and Protection of Credit Information" and relevant agreements (2) Personal(credit) information provided to Credit Finance Association (Crefia) etc. ① Recipient of personal(credit) information - Crefia - National Tax Service, Korea Customs Service, Ministry of Government Administration and Home Affairs, National Health Insurance Corporation etc. - Monoliners and bank card companies which receive information from Crefia: Lotte Card, BC Card, Samsung Card, Shinhan Card Woori Card Hana Card Hyundai Card KB Card NH bank and CKI ② Purpose of provision of personal(credit) information - Crefia will perform statutory obligations as per applicable laws, e.g., Act on Report and Management of Taxation Data and Specialized Credit Financial Business Act - To set up and maintain credit card contract, provide service requested by information owner and exchange information between card companies ③ Personal(credit) information to be provided -Transaction details, personal identifiable information, credit transaction information, merchant credit information required for verification of transaction details ④ Personal(credit) information storage/usage period -As stipulated in "Act on the Use and Protection of Credit Information", "Personal Information Protection Act" and relevant laws and agreements etc. (3) Personal(Credit) information provided for transaction purpose (Provision to an outsourced vendor etc.) ① Recipient of personal(credit) information -ID authentication service provider, virtual phone number service provider, document(application) management vendor(input, scan, storage, and disposal), vendor of phone verification for credit card initiation, card issuance vendor, card delivery vendor, mail(statement etc.)printing/ delivery/return vendor, due payment withdrawal vendor, ARS verification vendor for online use (registration/payment), ID authentication service provider, payment information processing company for CMS account registration, ATM service provider, merchant operation service

MSA127 ② provider(relay/sales slip management/transaction/storage/e-payment service), TM(recommendation of product/service, use of ARS service included) vendor, system processing/development/maintenance vendor, gift delivery vendor, email/SMS/mobile push message/coupon delivery service provider, collection vendor, judicial scrivener, judicial scrivener corporaton, research firm to conduct customer satisfaction survey, customer service quality management(call monitoring) vendor - Cardholder s employer(company) merchant cardholder ② Purpose of provision of personal(credit) information - ID authentication, virtual phone number service, document(application) management(input, scan, storage, disposal), phone verification, virtual phone number service, document(application) management(input, scan, storage, disposal), phone verification, card issuance, card delivery, mail(statement etc.) printing/delivery/return, due payment withdrawal, ARS verification for online use (registration/payment), ID authentication, payment information processing for CMS account registration, ATM service, merchant operation(relay/sales slip management/transaction/storage/e-payment service), TM(recommendation of product/service, use of ARS service included), system processing/ development/ maintenance, gift delivery, email/SMS/mobile push message/coupon delivery, collection, judicial service, legal counseling, research to conduct customer satisfaction survey, customer service quality management (call monitoring) -Cardholder employment verification merchant conflict resolution notification of supplementary card spending details ③ Personal(Credit) information to be provided: Personal(Credit) information whose collection/use is agreed by the cardholder ④ Personal(Credit) information storage/usage period: Up to the termination of outsourcing contract or completion of outsourced task (Note, different period may apply if stipulated separately) ※ You can refer to the outsourcing details of card due payment withdrawal consent form the outsourced vendor list (4) Personal(Credit) information provided for maintaining services requested by the customer (Applied to customer- requested services only) ① Recipient of personal(credit) information:Customer-requested service providers (Transportation/Hipass, recurring mobile phone/gas/electricity bill payment service(card) provider, mobile card issuance/usage service, point/mileage conversion) ② Purpose of provision of personal(credit) information:Implement and maintain services requested by customers ③Personal(Credit) information to be provided:Card number, Mobile phone number, National ID number, Name, Expiry date, Application date, KEPCO Customer ID number, Contract number(Differs by service. Personal identification information provided for mobile card issuance/usage service) ④ Personal(Credit) information storage/usage period: Up to the point when the service is suspended upon customer's request (In case of mobile card discard within 30 days upon service discontinuation request) (5) Personal(Credit) information provided for internal reporting, audit and inspections abroad ① Recipient of personal(credit) information:Citigroup HQ and CKI affiliates (Check out formore details on CKI affiliates at www.CKI.co.kr) and overseas regulatory institutions (OCC, Fed(US)) ② Purpose of provision of personal(credit) information:Used as internal reporting/audit/inspection materials ③ Personal(Credit) information to be provided:Among information whose collection/use is agreed by the customer, information that is required for audit and inspection purposes ④ Personal(Credit) information storage/usage period: Until the condition is completed

I hereby consent to CKI's use of personal identification information as below. I agree. I disagree. - Personal Identification Information: National ID number, Driver's License number, Passport number, Foreigner Registration ID number ※if CKI is to provide personal(credit) information to an outsourced vendor, it will provide minimum information required for fulfilling outsourced tasks. Details on such vendors, purpose of using personal(credit) information, personal(credit) information to be provided shall be available on CKI's homepage (www.citicard.co.kr). ※Any changes made to above will be notified via internet homepage etc., Note, this consent shall lose its validity upon nullification of this contract. ※while you have the right to refuse to provide your consent, transaction may not be established or maintained without your consent to above information

Card Applicant name (Signature)

Supplementary Card Applicant name (Signature)

MSA127 ③

영문 동의서 (한국씨티은행 신용카드 신청용) ■ Mandatory Provision of Personal(Credit) Information (Provision of Co-brand Card Services)

Provision of personal (credit) information to offer co-brand card services I agree. I disagree.

Target card: KAL/Asiana co-brand Card Target card: Debec co-brand Card ① Recipient of personal(credit) information : Korean Air/Asiana Airlines ① Recipient of personal(credit) information: Daegu Department Store Co. ② Purpose of provision personal(credit) information : Each Airlines ② Purpose of provision personal(credit) information: instant discount membership subscription and mileage accumulation at Daegu Dept Store and Debec points & membership subscription ③ Personal(credit) information to be provided: name, date of birth, gender, and accumulation address(home,office), contact number(mobile,home,office), e-mail, Airlines ③ Personal(credit) information to be provided : Name: date of birth, gender, card membership number, CI(Alternative of National ID) number, address (home, office), contact number (home, office, mobile), email, CI ④ Personal(credit) information storage/usage period :Until attrition from (alternative of National ID) KAL / Asiana co-brand card. (Note: Airlines membership is maintained) ④ Personal(credit) information storage/usage period :Until attrition from Debec co-brand card. (Note: Debec points membership is maintained)

Target card: SSG/SSG Asiana co-brand Card Target card: Galleria co-brand Card ① Recipient of personal(credit) information: shinsegae, Gwangju ① Recipient of personal(credit) information : Hanwha Galleria Shinsegae, Emart, Shinsegae Dongdaegu CTC, *Asiana Airlines ② Purpose of provision personal(credit) information : Instant ② Purpose of provision personal(credit) information: Instant discount discount at Galleria Department Stores and affiliates, Galleria at SSG Department Stores and affiliates, SSG Point / *AsianaAirlines Mileage membership/ subscription and accumulation Mileage membership/ subscription and accumulation ③ Personal(credit) information to be provided : name, date of birth, gender card ③ Personal(credit) information to be provided : name, date of birth, gender card number, address (home, office), contact number (home, office, mobile), e-mail, number, address (home, office), contact number (home, office, mobile), e-mail, *Airlines *Airlines membership number, CI(Alternative of National ID) membership number, CI(Alternative of National ID) ④ Personal(credit) information storage/usage period : Until ④ Personal(credit) information storage/usage period : Until attrition attrition from Galleria co-brand Card. (Note : Galleria from SSG/SSG Asiana co-brand Card. (Note : SSG point and asiana membership is maintained) membership is maintained)

Target card: KAKAO Bank Citi card ① Recipient of personal(credit) information: Kakao Bank Corp. ④ Personal(credit) information retention and usage period: The provided ② Purpose of provision of personal(credit) information: Conclusion, information shall be destructed upon the termination of service or maintenance, and management of co-brand card contract, user within 6 months from the membership attrition. (If there is a specific experience improvement, fee settlement, complaint handling, term stipulated in the governing laws/regulations, the term will be performance of statutory obligations, etc. applied.) ③ Personal(credit) information to be provided: CIF, payment account, due amount, card * This item is additionally provided in relation to Kakao Bank Citi Card. closure information, due date, card account status, co-brand card issuance status, credit card holding status, eligibility for promotion * If you hold other card(s) in the same *card group with the card you are applying for, the due amount information of such card(s) will be included in the provided information. (* card group: Citi charge card/revolving)

※Any Changes made to above will be notified via internet homepage etc., Note, this consent shall lose its validity upon nullification of this contract. ※While you have the right to refuse to provide your consent, transaction may not be established or maintained without your consent to above information. ※Additional separate consent is not required after this consent if personal(credit) information is provided to ensure accuracy and updation within the same objective or use. ※Any loss caused by leakage of personal information due to bank’s willful act, mistake or reasons attributable to the bank shall be compensated for as per relevant laws etc. Card Applicant name (Signature)

Supplementary Card Applicant name (Signature)

MSA127 ④

영문 동의서 (한국씨티은행 신용카드 신청용) Optional Consent to Personal(Credit) Information

In accordance with Articles 15-2, 32-1m 33 and 34 of “ Act on the Use and protection of credit Information” and Articles 15-1-1, 17-1-1, 22-3 of “Personal Information Protection Act”, Citibank Korea Inc.(CKI) needs to obtain my consent prior to collecting/ using my personal(credit) information in regards to (financial) transaction with CKI. While you have the right to refuse to give your consent to collection, use and provision of persona I (credit) information, certain benefits may be limited according to the purpose of usage such as communication on benefits(gifts, discount coupons etc.) new products(services), promotions(discount, point accumulation, free EPP etc.), insurance products etc. Note that there will be no disadvantage in regards to other financial transactions.

■ Optional Consent to collection/Use of personal(Credit) Information Collection/ Use for communication and recommendation of product/service I agree. I disagree.

① Purpose of collection/ use of personal(credit) Information: Introduction and recommendation of Citi bank and alliance products/ services, market survey, product/ service development ② Personal(Credit) Information to be collected/ used: Personal(Credit) Information about which the cardholder has agreed to its mandatory collection/use. ③ Personal(Credit) Information storage/usage period: Until date of (financial) transaction termination* or until the consent is withdrawn * The date of (financial) transaction termination refers to a date when all contracts or transactions with CKI (credit/liability, domestic & foreign exchange, card and 3rd party collateral) and services (safety box, safekeeping, designation for FX and electronic financial transactions including Internet banking) have been closed.

I agree to send marketing information using the product service guide channel below. I agree. I disagree.

You may receive information on useful services, alliance benefits, marketing events etc. via SMS, phone, email or mail(written) I agree to all. Marketing ※ As per “Act on the Use and Protection of Credit Information”, you may always ask for SMS Phone discontinuation of marketing communication even after providing your consent to it. communication Email Paper (Homepage: www.citicard.co.kr) channel ※ Mandatory communication such as renewal, product/service change etc. are I do not agree. excluded from above consent. ※ This optional consent is not applicable to introduce and recommend via App-Push and you can agree/withdraw optional consent of App-Push in the mobile App.

MSA127 ⑤ ■ Optional Provision of personal(Credit) Information Provision to alliance insurance company I agree. I disagree. ① Recipient of personal(credit) information : AIA Life insurance, TONGYANG Life Insurance, Allianz Life Insurance, PCA Life Insurance, ACE Indemnity insurance, IBK Insurance, Hyundai Life Insurance, LIG Indemnity Insurance, Samsung Fire & Marine Insurance, Dongbu Insurance, AEC Insurance, Hyundai Marin & Fire Insurance, etc. ② Purpose of use of personal(credit) information Promotion and recommendation of alliance products and services, provision of customer benefits etc.. ③ Personal(Credit) information to be used: Name, address(home, office), contact number(mobile, home, office), date of birth, card number, card expiry date, e-mail, company name ④ Personal(Credit) information storage/usage period: Up to 6 months upon provision of information

Provision of persona(credit) information to prevent fraud usage I agree. I disagree. upon third party’s illegal acquisition of card(information)

① Recipient of personal(credit) information: Immigration office, The Credit Finance Association ② Purpose of use of personal(credit) information: Overseas fraud prevention ③ Personal(Credit) information to be used: name, national ID number ④ Personal(Credit) information storage/usage period: Until confirmation of entry/exit data

I hereby consent to CKI's use of personal identification information as below. I agree. I disagree. - Personal Identification Information: National ID number, Driver's License number, Passport number, Foreigner Registration ID number * Additional separate consent is not required after consent if personal(credit) information is provided to ensure accuracy and updation within the same objective or use. *Any changes will be communicated via internet home page. This consent will become invalid from moment when the agreement is not fulfilled.

Card Applicant name (Signature)

MSA127 ⑥