1. Personal information processing policy

• 1) At the time of JMB enrollment
   - Mandatory items: name (in English), date of birth, gender, mailing address (home), telephone number, email address, password, company name, company address, company telephone number, preferred language
   - Optional items: Company department, title, fax number, mobile phone number
   - In case of a new member under the age of 14 : name of legal representative, relationship with the new member
• 2) At the time of tax payment/refund for award ticket issuance:
   - In case of credit card payment: card number, date of expiry, cardholder name, security code (CVV number)
   - In case of account transfer: bank name, name of the remitter
   - In case of cash refund: bank name, account number, name of account holder
• 3) Other information
   - In case of JAL Family Club enrollment : name (in English), relationship with the primary member, JMB membership number, email address
   - In case of post-flight credit
   ・For JL Japan domestic flights: flight date, flight number, seat number
   ・For JL International flights/Partner Airlines : flight date, flight number, ticket number/booking class (for Partner Airline flights), flight sector additions
   - In case of JMB Proxy Registration:
   ・Mandatory items: name, date of birth, phone number of proxy, relationship with the JMB member
   ・Optional items: JMB membership number, ID number of the proxy
   - In case of presentation of letter of attorney: name of representative, date of birth, telephone number, relationship with the JMB member
   - In case of inquiry via email (for inquiries in Korean only): name (in English), email address, telephone number, JMB membership number, date of birth (when JMB membership number is not provided)
   - Personal information which is created during service use: service record data, access log, cookies, IP information, payment record, etc.

(2) How personal information is collected
JAL collects personal information as below.

• - Collection through online tools such as JMB enrollment through the JAL website, online inquiry board, and email
• - Collection through offline tools such as JMB enrollment using the paper application form telephone, fax, and postal mail
• - Provision from JMB mileage partner companies
• - Collection through generated information collection tools

2. Purpose of collecting and using personal information

JAL may use personal information submitted by members for the purpose of:

• (1) Member management
  - Issuance of JMB membership card, mileage credits, management of award usage, provision of air transportation service, provision of services relating to air travel such as tours and hotels, fare payment, etc.
  - Identification during service use
  - Confirmation of consent by the legal representative concerning collection of personal information of children under the age of 14
  
• (2) Marketing and advertisement
  Personal information collected from members is used for announcements relating to JAL products, services, fares, JMB program services, events, and new services for JMB members, as well as for product development and associated activities
  
• (3) Other purposes
  - For confirmation of various inquiries and requests, notification about expiration of miles and flight operation, etc.

3. Personal information retention and use period

JAL shall retain and use the personal information based on the consent of the member during the period in which a member maintains his/her membership.
However, JAL may retain and use personal information when necessary during a specified retention period, based on reasons in accordance with applicable laws:

• - Records about contract and application withdrawals, records about payment and supply of goods
  Reason for retention: Act on Consumer Protection in Electronic Commerce Transactions
  Retention period: Five years
• - Records of consumer complaints and processing of disputes
  Reason for retention: Act on Consumer Protection in Electronic Commerce Transactions
  Retention period: Three years
• - Records of visits to the JAL website
  Reason for retention: Protection of Communications Secrets Act
  Retention period: Three months

4. Transfer of personal information outside Korea

JAL will not transfer personal information to countries/areas outside Korea, with the exception of cases permitted by the Act on the Protection of Personal Information.
Currently, JAL transfers personal information to the following countries/areas outside Japan:

(1) JAL headquarters

• - Transferred personal information: Personal information listed in section 1.1) above (except the following information collected upon presentation of letter of attorney: name of representative, date of birth, telephone number, relationship with the JMB member)
• - Country/area to which personal information is transferred: Japan
• - Timing and method of personal information transfer: Personal information will be transferred to the Japan Airlines server in Japan via the information and communications network every time new information is collected
• - Recipient of personal information transfer: Japan Airlines Co., Ltd.
• - Purpose of use by the recipient of personal information transfer: Storage of personal information for the purposes listed in section 2 above
• - Personal information retention and use period by the recipient of personal information transfer: Retention and use period listed in section 3 above

(2) Outsourced company

• - Transferred personal information: Personal information listed in section 1.1) above (except the following information collected upon presentation of letter of attorney: name of representative, date of birth, telephone number, relationship with the JMB member)
• - Country/area to which personal information is transferred: Japan
• - Timing and method of personal information transfer: Personal information will be transferred to the Toppan Forms Card Technology server in Japan via the information and communications network every time new information is collected
• - Recipient of personal information transfer: Toppan Forms Card Technology Ltd.
• - Purpose of use by the recipient of personal information transfer: Issuance and shipment of JMB membership cards
• - Personal information retention and use period by the recipient of personal information transfer: Retention and use period listed in section 3 above

(3) Outsourced company

• - Transferred personal information: Personal information listed in section 1.1) above (except the following information collected upon presentation of letter of attorney: name of representative, date of birth, telephone number, relationship with the JMB member)
• - Country/area to which personal information is transferred: Japan
• - Timing and method of personal information transfer: Personal information will be transferred to the DMS server in Japan via the information and communications network every time new information is collected
• - Recipient of personal information transfer: DMS Co., Ltd.
• - Purpose of use by the recipient of personal information transfer: Issuance and shipment of FLY ON status cards and coupons
• - Personal information retention and use period by the recipient of personal information transfer: Retention and use period listed in section 3 above

5. Provision of personal information to third parties

JAL will not provide personal information to third parties without prior consent of the member unless the provision is stipulated in applicable laws or regulations, such as provision permitted by the Act on the Protection of Personal Information.
Currently, the following personal information is being provided to third parties:

6. Outsourcing of personal information management

JAL outsources the management of personal information as follows. If changes arise in the outsourced companies or outsourced tasks, those changes will be disclosed via this Privacy Policy.

7. Disposal of personal information

JAL disposes of all personal information without delay using a method that renders it unrecoverable after the purpose of its collection and use has been fulfilled and the personal information retention and use period has ended.

• - Paper enrollment application forms and personal information printed on paper will be put through a shredder or incinerated.
• - Personal information stored in the form of an electronic file shall be deleted using a method that will not be able to reproduce its record.

8. Rights of member and legal representatives and the method of exercising these rights

• (1) Members and legal representatives can request access to and correct inaccuracies in their personal information collected and stored by JAL as well as the personal information of children under the age of 14 at any time. Members and legal representatives are also able to withdraw membership and withdraw their consent to the collection, use, and provision of personal information at any time.
• (2) Members and legal representatives are able to access and change their personal information and the personal information of children under the age of 14 by visiting the JAL website and clicking "会員情報変更" or by contacting the JMB Center by phone. To withdraw from JMB, the JMB withdrawal form should be completed and submitted by email, fax, or postal mail. The JMB withdrawal form can be obtained by contacting the JMB Center to be sent the form by postal mail. JAL will perform the necessary steps after verifying the identity of the member making the request.

9. Measures to secure personal information

JAL takes physical and procedural safeguards as listed below to protect personal information.

• (1) Encryption of passwords
  - ID and passwords are encrypted to ensure safe storage on our servers.
• (2) Protection from hacking
  - JAL exerts its utmost effort to safeguard personal information from hacking and viruses.
  - JAL uses anti-virus software and other safeguards to prevent unauthorized access.
• (3) Education and training for employees.
  - JAL limits access to personal information to a minimal number of employees.
  - Employees use separate passwords and update these passwords regularly.
  - JAL implements frequent education to comply with the personal information policy.

10. Inquiries about personal information, chief privacy officer in Korea

JAL shall assign the following chief privacy officer and relevant office in Korea to protect information and respond to opinions about the handling of personal information.

Chief privacy officer: KIM KYUNGLYNN (President, Korea Regional Office)
For inquiries and feedback about JMB personal information:
Division: JMB Center
Phone number: 02-757-1711
email: JAL website online inquiry board

To otherwise report or consult about infringements of personal information, please contact the organizations below:
- Personal Information Infringement Report Center (privacy.kisa.or.kr / (no area code) 118)
- Supreme Prosecutors' Office Cybercrime Investigation Department (www.spo.go.kr / (no area code) 1301)
- National Police Agency Cyber Bureau（cyberbureau.police.go.kr / (no area code) 182)

11. Change to the personal information handling policy

JAL complies with the Korean Act on the Protection of Personal Information and other applicable laws relating to personal information protection. Accordingly, this Privacy Policy is subject to change in accordance with amendments to the applicable laws of Korea. In the event of additions, changes, and/or deletions to this Privacy Policy, JAL will post a notice on the JAL website at least seven days prior to the amendment.