[Optional] (For App Push) Consent to Collection/Use of Personal (Credit) Information

[Provision of Information on Products/Services, etc.]

https://iags.kcredit.or.kr:3446/guide.do?wrtcnsNo=BAA00006-2021-00003

To Korea Inc.

My consent shall be required pursuant to 15-2, 32-1, 33 and 34 of the 「Credit Information Use and Protection Act」 and 15-1-1 and 22-3 「Personal Information Protection Act」 if CKI intends to collect and use my personal(credit) information in order to provide product or service information via App Push.

* (Financial) transaction below refers to transactions related to banking business (loan, deposit, foreign exchange), concurrent business (trust, fund, bancassurance, credit card) or add-on business (guarantee, factoring, safety box, safekeeping)

* Consent is limited to provision of information on products/services via App Push.

Safe Quite Safe Average Cautious Alert Items reg. Collection/Use

※ The above rating is assigned to the subject of consent taking into account everything from privacy violation

risk to benefits and to clarity, etc. Please refer to QR code.

(For details, please refer to QR code.)

- Citibank Korea's product/service communication and solicitation Purpose of - Market research, promotion for customers

collection/use - Product/Service development and research - Provision of free gifts

▶ Members with financial transactions Period of - Retained/used until the end date of (financial) transaction or the

retention/use point of consent withdrawal

In the above retention period, the end date of (financial) transaction refers to the "date when all

existing contracts with the bank (loan/deposit, domestic/foreign exchange, card and third-party guarantee, etc.) are terminated and services (safe deposit box, safe deposit of securities certificates, FX bank designation, electronic financial transactions incl. internet banking, etc.) end, or when any dispute involving credit/debt is settled.” ▶ Members without financial transaction

- Retained/used until 1 year after sign-up,

or membership or consent are withdrawn.

You may refuse to give consent to the above collection and use of personal (credit) information. Right to reject and As such consent is optional for "the Bank’s product/service communication and solicitation, market research, promotion for customers, product/service development and research, and provision disadvantages in the of free gifts", there will be no limitations for you in entering into and executing (financial) transaction agreements even if you do not give consent. However, if you do not give consent, case of rejection you may not be able to enjoy benefits such as "product/service communication and solicitation, and free gifts."

Info. Collected/Used

Personal (Credit)

Information

General Personal Name, date of birth, email, home address, office address, home phone, office phone,

Information mobile, CI, family information, residence information, job information, Normal identifiable information, other personal information

Credit Terms of transaction, date/time of transaction, product/service type, information on Transaction commercial transactions, loan transactions, financial investments, insurance

Information transactions, other financial transactions

Credit

Worthiness Delinquency information, disorderly credit activities information

Information

Credit Capability Job information, income information, asset information, debt information, tax

Information payment information

Public Personal credit score, delinquency information, debt restructuring information, utility

Information, etc. bills payment information, public ledger information

Do you agree to CKI's collection/use of Personal

Quite Safe □ Disagree □ Agree (credit) information?

Product/Service Do you agree to receive advertising

messages on our products/services using Communication □ Disagree □ Agree the below means of communication?

□ App Push

※ Consent is limited to provision of products/services via App Push.

※ You can withdraw your consent using Smart Alert on Citi mobile app.

※ The Bank can contact you using the above means of communication you agreed to in order to accomplish the intended purposes of collection and use such as product/service communication.

※ The scope of collection and use also covers personal (credit) information that has come into existence before you give consent.

※ You may be compensated for any losses incurred from personal information leak, which is attributable to the Bank's willful misconduct or gross negligence, according to relevant laws.

Customer’s Rights on Collection, Utilization and Provision of Personal (Credit)

Information

1. Scope of financial service availability

Customer’s personal (credit) information will be collected, utilized, and provided only for the purposes agreed by the customer. The collection, utilization and provision of mandatory information are essential for the execution and fulfillment of the contract and therefore you are able to establish and maintain the (financial) transaction relationship only after agreeing to the above. As per optional information, you may reject the collection, utilization and provision of such information, in which case you might experience some disadvantages on the conditions of (financial) transactions.

2. Right to request for discontinuance of customer’s personal (credit) information handling

A. Customer may request the bank to discontinue the provision of customer’s personal (credit) information or the usage for business purposes such as referral of the bank’s financial products (services), whether on a case by case basis or a blanket basis, that were agreed at the time of subscription (Article 37 of the Act on Protection of Personal Information, Article 37 of the Act on Use and Protection of Credit Information). However, the request to discontinue the information handling may be rejected if ① it is specifically provided by law or it is inevitable to conform to the obligations under laws/regulations, ② it is concerned to possibly harm the life or body of other person or unduly infringe the property and/or other interest of other person, or ③ it is difficult to perform the contract including the provision of service contracted with the information owner without handling the personal (credit) information and the information owner hasn’t clearly expressed the intention to terminate the contract.

*The consent to the provision of credit information granted for the purpose of providing to credit bureau or public credit registry for the evaluation of personal credit worthiness may not be withdrawn (Article 37-1 of the Act on Use and Protection of Credit Information).

B. If you want to discontinue the handling of your personal (credit) information, please submit the request via the channel described below. - Subscription method: Internet: www.citibank.co.kr Phone: 1588-7000 Document: Citibank branch

C. If you experience any inconveniences or difficulties in relation to the above request, please contact Citibank’s Credit Information Officer/Personal Information Officer, Korea Credit Information Services (Complaint Service Team), or Financial Supervisory Service (Financial Complaint Office).

Contact point Citibank Credit Information Officer / Personal Information Officer: (02) 2004-1447, 1420 Citi Corp. Center, Saemunan-Ro 50, Jongro-gu, Seoul Korea Credit Information Services (Complaint Service Team): 1544-1040, 11 Gil 19, Myung-dong, Jung-gu, Seoul FSS (Financial Complaint Office): 1332, Yoidae-ro 38, Youngdeungpo-gu, Seoul

3. Right to request for reading/correction/deletion of customer’s personal (credit) information

A. Customer has the rights described below pursuant to the Act on Protection of Personal Information, the Act on Use and Protection of Credit Information, and the Regulation on Supervision of Credit Information Business. Details of such rights are posted in the Citibank homepage (www.citibank.co.kr) and FSS homepage (www.fss.or.kr). If you want to exercise such rights, please make a request via the Do-Not-Call homepage or Citibank internet page/branch for Do-not-call or other requests respectively.

- Right to request for inquiry of use/provision of personal credit information (Article 35 of the Act on Use and Protection of Personal Information): . Customer has the right to check use and provision of personal credit information except for the cases when financial company uses information for internal business purposes or repetitive outsourcing.

-Right to request for Do-Not-Call (Article 37-2 of the Act on Use and Protection of Credit Information): . Customer has the right to reject unwanted marketing contacts (mobile phone call or SMS)

- Right to request for reading and correction/deletion of personal(credit) information (Article 35 and 36 of the Act on Protection of Personal Information and Article 38 of Act on Use and Protection of Credit Information): . Customer has the right to request for reading of customer’s personal (credit) information and to request for correction or deletion of personal (credit) information after reading that is different from the fact or unverifiable.

- Right to request for notification of use/provision of credit information (Article 35 of the Act on Use and Protection of Credit Information): . Customer has the right to request for notification of use and provision of credit information via [requested notification channel] once a year if credit bureaus uses or provides customer’s credit information. . Fees may incur if notification on use/provision of credit information is provided.

- Right to request for deletion of personal credit information (Article 38-3 of the Act on Use and Protection of Credit Information) . If a specific period as per the relevant law passes after financial transaction with CKI is terminated, customer has the right to request for deletion of his/her information owned by CKI.

B. Customers can check the customer’s personal (credit) information from or through personal credit evaluation agencies (Nice, Siren24, Allcredit, etc.) for the year. For details, please contact respective personal credit evaluation agency. - Nice (Nice Credit Information Service Co.): 02) 1588 – 2486 / www.credit.co.kr - Siren24 (Seoul : 02) 1577-1006 - Allcredit (Korea Credit Bureau) : 02) 708 – 1000 / www.allcredit.co.kr

4. Compensation for leakage of personal(credit) information

Customers shall be compensated for any damages or losses due to leakage of personal information intentionally or negligently by the Bank.