SK reits

The Company shall process personal information for the following purposes. Personal information being processed shall not be used for purposes other than the following. Should the purpose of using personal information change, the Company shall take necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.

1. 1. Customer consultation, rendering of services, dispute resolution, etc.

① For the following personal information, the Company shall retain and use personal information based on the consent of the information subject or relevant laws, and shall destroy it without delay once the purpose of processing has been achieved. However, if the Company is required by law to retain the information, it shall do so for the period stipulated under the relevant law.

② The following personal information items may be automatically generated and collected in the course of using Internet services. The Company shall retain and use such information for a period of one year.

1. 1. IP address, cookies, service usage records, access records, records of improper use

In principle, the Company shall process the personal information of the information subject only within the scope defined in Article 1 (Purpose of Processing Personal Information), and shall not process it beyond that scope or provide it to a third party without the prior consent of the information subject. However, personal information may be provided to a third party in the following cases:

1. Where there are special provisions in law, or providing the information is unavoidable to comply with a legal obligation;
2. Where the information subject or the information subject's legal representative is unable to express intent, or prior consent cannot be obtained due to an unknown address, etc., and provision is clearly necessary to respond to an imminent threat to the life, body, or property of the information subject or a third party;
3. Where necessary for statistical compilation, academic research, or market research, and the information is processed and provided in a form in which no specific individual can be identified;
4. Where necessary to settle fees or charges for rendered services.

① The Company consigns the processing of personal information to the following parties to ensure seamless handling of such information. The consigned party shall destroy the personal information upon completion of the relevant task, provided that where retention is required by law, it shall be retained for the period stipulated under the relevant law.

② Should the content of consigned tasks or the consigned party change, the Company shall disclose this without delay through this Privacy Policy.

③ In consignment agreements, the Company clearly stipulates prohibition of processing personal information beyond the purpose of the consigned task, prohibition of providing personal information to third parties, restrictions on re-consignment, and allocation of responsibility, and retains the relevant contract in both written and electronic form.

① The information subject (or the legal representative, in the case of a person under 14 years of age) may exercise the following personal information protection rights at any time:

1. Request to access personal information
2. Request to correct errors, if any
3. Request to delete
4. Request to suspend processing
5. Request to withdraw consent to the collection, use, or provision of personal information

② The rights under Paragraph 1 may be exercised toward the Company in writing, by telephone, e-mail, or facsimile (FAX), and the Company shall take action without delay.

③ Where the information subject requests correction or deletion of erroneous personal information, the Company shall not use or provide such personal information until the correction or deletion has been completed.

④ The rights under Paragraph 1 may be exercised through the information subject's legal representative or an authorized agent, in which case a power of attorney in the form prescribed under Annexed Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤ A request to access personal information or to suspend processing may be denied where it falls under Article 35(4) or Article 37(2) of the Personal Information Protection Act.

The Company uses "cookies" that store and periodically retrieve users’ usage information in order to provide customized services.

* A cookie is a small piece of information sent from a website server (HTTP) to a user's browser and may be stored on the user's computer hard disk.

1. Request to access personal information
2. Request to correct errors, if any
3. Request to delete
4. Request to suspend processing
5. Request to withdraw consent to the collection, use, or provision of personal information

① Purpose of using cookies — Cookies are used to provide services optimized to the user by identifying browsing patterns, popular search terms, secure connection status, and the like.

② Installation, operation, and refusal of cookies — Users have the right to choose whether to allow cookies. Users may set their web browser options to allow or block all cookies, or to be prompted each time a cookie is saved.

The Company shall destroy personal information without delay once the purpose of processing has been achieved. The procedures and methods of destruction are as follows.

① Destruction procedure — The Company selects personal information subject to destruction and destroys it upon approval of the Company's Personal Information Protection Officer.

② Destruction method — Personal information recorded or stored in paper documents shall be destroyed by shredding or incineration; personal information recorded or stored in electronic file form shall be permanently deleted using technical methods that prevent reproduction of the record.

The Company implements the following technical, administrative, and physical measures to ensure that users' personal information is not lost, stolen, leaked, altered, or damaged.

1. Technical measures

   ● Access rights to personal information are restricted.

   ● Security programs are installed and regularly inspected and updated to prevent leakage and damage of personal information caused by hacking, malicious code, or malicious insiders.

   ● Unique identification information, etc. is processed on an encrypted basis.

2. Administrative measures

   ● The number of staff handling personal information is minimized, and such staff receive personal information protection training.

   ● Regular internal audits are conducted to ensure the security of personal information handling.

3. Physical measures

   ● Documents and auxiliary storage media containing personal information are kept in secure locations with locking devices, and access control procedures are established and operated.

The Company designates a Personal Information Protection Officer as follows, who bears overall responsibility for personal information processing and handles information subjects' complaints and grievance relief related to personal information processing.

1. Personal Information Protection Officer

   ● Corporate Director: SK REIT Management Co., Ltd.

   ● Contact: Tel. 02-6353-7070, E-mail: inkyoo.joo@sk.com

Information subjects may file a request to access personal information under Article 35 of the Personal Information Protection Act with the Company's Personal Information Protection Officer, and the Company shall endeavor to process such requests promptly.

Information subjects may apply to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, or similar bodies for dispute resolution or consultation regarding infringement of personal information.

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (no area code required) (privacy.kisa.or.kr)

This Privacy Policy shall be effective from August 24, 2026. Previous versions of this Privacy Policy can be