Asiana Airlines collects the following personal information to enable membership services, customer responses and other services for the Users.

1) Personal Information Collected Based on Consent

2) Personal Information Collected Without Consent

Asiana Airlines collects personal information directly from the information subject when using Asiana Airlines’ services (such as membership registration, participating in events, or contacting the Customer Center) through the website, mobile site, social media, or mobile applications, and when using the services of other companies or agencies that perform work on behalf of Asiana Airlines.
Asiana Airlines also indirectly collects personal information about information subjects from other information subject controllers. (For example: reservation system providers, information provided to other airlines to book connecting flights, etc.) The camera feature in the mobile app is only used to recognize passports, baggage barcodes, and to implement augmented reality for customer convenience when using features such as check-in, baggage tracking, and nearby location. It is not stored or used as separate images.

• Records on contracts and withdrawal of subscription (term of maintenance: 5 years) : the Act on Consumer Protection in Electronic Commerce Transactions
• Records on payments and supply of goods (term of maintenance: 5 years) : the Act on Consumer Protection in Electronic Commerce Transactions
• Records on consumer complaints and disputes procedure (retention period: 3 years) : Consumer Protection Act in Electronic Commerce Transactions
• Records on visits to websites (term of maintenance: 3 months) : the protection of Communications Secrets Act
• Records on participation in events (term of maintenance: 1 year) : reasons for maintenance of information in accordance with the corporate policy
• Records on in-flight lost items delivery service (term of maintenance: 1 year) : reasons for maintenance of information in accordance with the corporate policy
• Membership withdrawal, Loss of qualification, Business closure : Disposed of within 1 day
• For the Japan region, ticketing data from Japanese branches/offices(Retention period: 7 years): Based on the standards prescribed by the Electronic Books Preservation Act of Japan.

• Information entered by Users for enrollment or other purposes is disposed of for the protection of information in accordance with the corporate policy and other applicable laws after the purpose of its collection has been fulfilled.
• The above information, unless otherwise required by law, shall not be used for purposes other than the original purpose.

• Personal information printed on paper is shredded or incinerated for disposal.
• Personal information saved in a digital format is deleted by using technology that prevents the recovery of records

① Personal information provided with the data subject's consent is detailed below.

② Personal information provided to relevant authorities without the data subject's consent is detailed below.

▷ Personal Information Transmitted to
- AMADEUS IT GROUP,S.A (Privacy Support Center)
▷ Personal Information Transmitted
- Ticket reservation: membership number, passenger's name, date of birth, gender, phone number, e-mail address.
- Ticket reservation on Americas Routes: passport information (passport number, expiration date, issuing country, nationality)
- Purchasing: card number, expiration date, transaction approval number (credit card payments), transaction number (bank transfer payments)
- Enrollment or Change in Membership Information : Asiana Club membership number, membership status, expiration date of membership status, Korean and/or English name, date of birth, nationality, address, gender, phone number, e-mail address, available Miles, number of boarding and boarding miles within the previous 2years
▷ Country, Date and Method of International Transmission
- Reservation Information : Germany, Transmission upon completion of reservation, Transmission between Asiana Airlines and AMADEUS via a secured network
- Membership Information : Germany, When enrolling or changing information via a dedicated network
▷ Purpose of Personal Information Use and Retention Period
- Reservation Information: Operation and maintenance of Asiana Airlines reservation system, up to 5 years after transmission
- Membership Information: Use of membership services and retention of personal information until the end of the contract term or withdrawal of membership

▷ Personal information transmitted to
- GOOGLE (Privacy Support Center)
▷ Items of personal information to transfer
- When using online services: Cookies, IP information, Access log
▷ Country, Date and Method of International Transmission
- Log information: United States, When using online services, transmission via public network (security protocol processing)
▷ Purpose of Personal Information Use and Retention Period
- Log information: Save log, 26 months after transfer of personal information
- Purpose of use: Homepage usage analysis via Google Analytics

▷ Recipient of transferred personal information
- Microsoft (Privacy Support Center)
▷ Items of personal information to transfer
- Details of chatbot conversations: Reservation information (reservation number, departure date, departure/arrival information)
- Chatbot event collection information: Name, email
▷ Country, Date and Method of International Transmission
- United States/Singapore, transmitted through Microsoft Azure’s dedicated network when using chatbot service
▷ Purpose of use, retention, and usage period of the recipient’s personal information
- Details of chatbot conversations: 3 years
※ Records of consumer complaints or dispute resolution: Legislation regarding consumer protection in electronic commerce
- Chatbot event collection information: 1 month after the end of the event
※ Standards set by our company

▷ Recipient of transferred personal information
- Braze,Inc (Privacy Support Center)
▷ Items of personal information to transfer
- Website and app browsing history, cookies, access information (IP, logs, etc.), operating system version and device model, online platform behavioral information (e.g., recent search history, recent purchase history), personal information of online platform members (e.g., gender, date of birth, family membership status, membership level)
▷ Country, Date and Method of International Transmission
- United States, transmission via public networks when using online services (security protocol processing)
▷ Purpose of use, retention, and usage period of the recipient’s personal information
- Purpose of use: Provision of personalized information, services and promotions
- Service period: Until the end of the contract (※ If there is no access history for one year, it will be deleted immediately)

▷ Recipient of transferred personal information
- AWS(Privacy Support Center)
▷ Items of personal information to transfer
- Information of Passengers Requiring Medical Assistance: Passenger Name, Date of Birth, Gender, Contact Information
▷ Country, Date and Method of International Transmission
- United States, "In the event of a passenger requiring medical assistance, data is transmitted via a dedicated network
▷ Purpose of use, retention, and usage period of the recipient’s personal information
- In the event that the AWS Seoul Region becomes unavailable, the disaster recovery system will be activated in the US East Region data center.
- Personal Data Retention Period: 3 years

▷ Recipient of transferred personal information
- RTB House (Privacy Support Center)
▷ Items of personal information to transfer
- Cookies,, IP Information, Access Logs
▷ Country, Date and Method of International Transmission
- Singapore, When a user visits the website/app or interacts with advertisements, tracking pixels or SDKs installed within the website/app enable encrypted network t transmission
▷ Purpose of use, retention, and usage period of the recipient’s personal information
- Personalized and Targeted Advertising
- Personal Data Retention Period: Up to 1 year from the date of collection

Asiana Airlines in South Korea (aadpo@flyasiana.com)

▷ Enrollment in Asiana Club
- Required: Name (Korean and/or English spellings), Gender, Telephone number(Mobile Phone Number), E-mail address, Place of residence, ID authentication number, ID and Password
- Optional: Name of company, Department, Position, Home Phone Number, Address, ZIP code
▷ Reservation of Flight Tickets
- Required: Name of passenger, Date of birth, Telephone number, E-mail address, Gender, Credit card payment information (credit card number and transaction authentication number), Account transfer information (name of bank and account number)
- Optional: Membership number, Passport information (passport number, date of expiry, place of issuance and nationality) – US (including Saipan and Guam), Some Europe routes required
▷ Use of Customer Center
- Required: Name, Contact information, E-mail address
- Optional: Membership number, Boarding information, Date of birth
▷ Order of Duty-Free Goods
- Required: ID, Password, Membership number, English and Korean name of a person who places the order, English and Korean name of passenger, Date of birth, Contact information, E-mail address, Credit card number, Credit card authentication information, Passport information of passenger.
- Optional: In-flight duty free points information, Address to which the points reward and promotion gift will be delivered, Mileage information.
▷ Registering fellow workers in Asiana Corporate Plus membership
- Required: Name, Membership number, E-mail address, Certificate of employment, Boarding information
- Optional: Department, Positon

South Korea (Service Use): Transmission via public networks (Processed with secure protocols)

Records required to be preserved under relevant laws and regulations, such as the Act on Consumer Protection in Electronic Commerce, will be retained for a specified period and then destroyed.

• Records related to contracts or withdrawal of subscription (Retention Period: 5 years): Act on Consumer Protection in Electronic Commerce
• Records related to payment and supply of goods (Retention Period: 5 years): Act on Consumer Protection in Electronic Commerce
• Records related to consumer complaints or dispute resolution (Retention Period: 3 years): Act on Consumer Protection in Electronic Commerce
• Records related to website visits (Retention Period: 3 months): Protection of Communications Secrets Act
• Member Information: Until member withdrawal (account deletion)

• The information subject may exercise the right to request Asiana Airlines to access, correct, delete, or suspend processing of personal information at any time. If such a request is made, Asiana Airlines will take the necessary measures without delay, after verifying whether it is the same person.
• Information subjects and their legal representatives may view or modify their registered personal information at any time, and may request cancellation of their membership.
• To view and modify your personal information, you can change or withdraw from the online platform MY ASIANA menu, or you can request it through the Asiana Club Center at 1588-8180.
• The right to view personal information and request suspension of processing may be restricted in accordance with Article 35, Paragraph 4, and Article 37, Paragraph 2, of the Personal Information Protection Act. In addition, requests for correction or deletion of personal information cannot be made if other laws state that such personal information is subject to collection.
• If a data subject or their legal representative requests the correction of errors in personal information, the relevant personal information will not be used or provided until the correction is completed.

• Asiana Airlines shall obtain the consent of guardians when it collects the personal information of a child under age 14, discloses the collected information to a third party or uses the personal information for purposes other than the original purpose. Accordingly, a child under age 14 may register only when his or her guardian agrees with the terms of collection of the personal information of the child.
• The guardian of a child under age 14 may request to view, correct, terminate or withdraw from the agreement in relation to the personal information of the child. Asiana Airlines, upon receiving such a request, shall immediately take the necessary measures after authenticating the ID of the guardian.
• The User or guardian may view or edit their own personal information or the personal information of the registered child under age 14. The User or guardian may also request the termination of membership.
• The User or the child under age 14 may view or edit personal information via the My Asiana menu on the websites, or request to view or edit the personal information by calling Asiana Club Center (1588-8180).
• When a User has requested the correction of an error in personal information, the personal information shall not be used or disclosed until the correction is completed.

• The information subject may exercise the right not to be subject to automated decision-making, including information provision, access, correction, deletion(right to be forgotten), restriction of processing, transfer of personal information, objection, profiling, etc.

• Measures to protect user rights regarding the generation and processing of Connecting Information (CI)
  - Data subjects may exercise their rights (access, correction, suspension of processing, deletion, etc.) related to the generation and processing of connecting information in accordance with relevant laws.
  - For detailed procedures related to the exercise of rights, please refer to the contents of Article 9 A, B, and C of this Privacy Policy.
• Procedures for receiving and handling user complaints and infringement incidents
  - Data subjects may inquire with the department in charge about all matters related to the generation and processing of connecting information, complaints, and damages that occur while using the company's services, and the company will respond and process the data subject's inquiries without delay.
  - We operate a customer center to promptly handle user complaints regarding the generation and processing of connecting information, and the contact information is as follows.

  * Asiana Club Center 1588-8180 (Phone consultation is available from 09:00 to 18:00 on weekdays.)

• Measures to prevent user damage and secure safety
  - Asiana Airlines applies the following administrative/physical/technical measures to prevent loss, theft, leakage, external attacks, hacking, etc., and to secure safety in processing users' connecting information.

  * Establishment and implementation of internal management plan: We establish and operate an internal management plan for personal information, including connecting information.
  * Minimization and training of employees processing connecting information: We limit the number of employees in charge of processing connecting information to a minimum and conduct personal information protection training once a year.
  * Security inspection and vulnerability diagnosis: We inspect and take action on vulnerabilities in the connecting information processing system, and inspect and improve the actual state of connecting information processing at least once a year.
  * Access control for unauthorized persons: Computer rooms, etc. are designated and protected as restricted areas, and access control procedures are established and operated.
  * Encryption of personal information: We apply encrypted communication when transmitting and receiving connecting information, and encrypt and process it with a safe algorithm when storing it.
  * Measures against hacking, etc.: We maintain periodic updates and the latest versions of vaccine programs.
  * Intrusion monitoring: We use security devices that block external intrusions, and monitor intrusions 24 hours a day through intrusion detection systems and external specialized companies.

- We establish and operate an internal management plan to securely manage users' personal information.

- We limit the number of personnel handling users' personal information to a strict minimum, and conduct personal information protection training at least once a year t to ensure safe management.

- Through a dedicated personal information protection organization, we verify the implementation status of privacy measures and staff compliance, and take immediate corrective actions upon discovering any issues.

- Server rooms and other critical facilities are designated as controlled zones, and we establish and operate strict access control procedures for these areas.

- When storing personal information such as unique identification information and card numbers, we use secure encryption methods. Furthermore, sensitive data transmitted via the website—including member profiles and billing information—is securely transmitted using SSL encryption.
- We ensure safe document management by applying file encryption and secure print solutions to all business terminal devices.

- To prevent unauthorized access to our personal information processing systems, we implement server and database (DB) access control solutions and manage access rights on an individual user basis.

- We retain access logs of our personal information processing systems and periodically review them to monitor for any abnormal or unauthorized activities.

- Asiana Airlines utilizes antivirus programs to prevent damage caused by computer viruses and ensures they are regularly updated and kept up to date.
- Asiana Airlines employs security devices to block external intrusions and prevent the leakage of users' personal information from hacking. Furthermore, the airline monitors for intrusions 24 hours a day through intrusion detection systems (IDS) and external specialized firms.

• Collected items of behavioral information: History of web/app service visits, searches, clicks, etc.
• Method of collecting behavioral information: Automatically collected through log analysis tools when users use the service.
• Purpose of collecting behavioral information: User analysis, including customer analysis, and provision of customized services and advertisements based on user behavioral information
• Retention/use period and subsequent information processing methods: Retained and used until membership withdrawal, and after the retention period has elapsed, information is de-identified and then retained or used only for statistical purposes

※ Menus and methods may vary depending on the mobile OS version.

[Web browser]
- Edge: Settings > Site Permissions > Cookies and Site Data
- Chrome: Menu > Settings > Privacy & Security > Cookies
- Safari: Settings > Privacy > Cookies and Website Data

[Smartphone]
- Android: Settings > Google > Advertisements > Delete Advertisement ID
- iOS: Settings > Privacy & Security > Tracking > Allow Apps to Request Tracking OFF

• Customer Service Headquarters: Customer Relations Team(asianacs@flyasiana.com) ☞ Click.
• Asiana Club Service Center: +82-2-2669-8180
• Online Duty-Free Shop: +82-2-2669-3434
• Privacy Policy Division: Information Security Team(aadpo@flyasiana.com)

• National Police Agency Cyber Investigation Bureau (ecrm.cyber.go.kr / call 182)
• Supreme Prosecutor's Office Republic of Korea(http://www.spo.go.kr/eng/index.jsp / call 1301)
• Korea Internet & Security Agency(privacy.kisa.or.kr / call 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972 )