APG Audit Website

Anti-corruption Policy
Anti-corruption Policy
Anti-Corruption Management Systems(ISO 37001)Certification

Anti-corruption Policy of Amorepacific

Amorepacific pursues its mission to 'Make people beautiful, and make the world beautiful' with all its members joining the journey towards beauty.
Based on this cornerstone, the Company desires to carry out proper business activities by fulfilling its social roles and responsibilities and create a sound business ecosystem that is shared with all stakeholders. Accordingly, the Company has established its anti-corruption policy, which is set forth in the following:

1. Amorepacific and its employees will comply with the applicable statutes and Company regulations related to corruption .

2. Amorepacific employees will not give or receive any money, valuables, entertainment, conveniences, or bribes to/from interested parties, nor will they be involved in any corrupt acts.

3. Amorepacific will improve and further develop its anti-corruption management system through continuous monitoring .

4. The Representative Director will grant independent responsibilities and authority relating to the prevention of corruption to the Anti-corruption Officer, and the Anti-corruption Officer will supervise the process of development, operation, and improvement of the anti-corruption management system.

Amorepacific employees shall promptly report any violation of the statutes or Company regulations related to corruption if he/she becomes aware of such violation. The Anti-corruption Officer will keep the personal information of the reporter in confidence, protect from disclosure the identity of the reporter to prevent any disadvantage due to such reporting, and establish countermeasures to prevent recurrence thereof.
the date of enactment: February 14, 2023

Seung-hwan Kim
Amorepacific President

Purpose

The executives and staff members of Amorepacific must work honestly and transparently according to the Code of Ethics to avoid ethical conflicts and not seek personal gain while performing their duties. Amorepacific's anti-corruption policy aims to solidify trust with stakeholders and continuously grow the company by practicing the value of 'Integrity,' which the company has maintained since its foundation.

Scope

This policy is equally applied to executives and staff members of all companies affiliated with the Amorepacific Group. In this policy, The terms' Amorepacific,’ 'company,' ‘our company,' or 'executives and staff members' refer to all these companies or their employees.

Implementation Guideline

No Bribery
Amorepacific executives and staff members must comply with domestic laws and regulations, including the Anti-Graft Act and the OECE Anti-Bribery Convention, and must not provide or promise money, valuables, or entertainment in return for obtaining illegitimate business profits.
- ① Bribes, money, valuables, treats, entertainment, or non-monetary benefits should not be given to or taken from interested parties to obtain business or personal gain. In particular, you must not make improper solicitations or offer or provide money or valuables that are prohibited from being provided to public officials following the laws of the Republic of Korea.
- ② Legitimate and customary gifts or entertainment may be provided to interested parties for smooth business performance. However, in such cases, you must carefully check whether they violate laws and the company's policies and regulations and whether they exceed the other party's standards for accepting such gifts or entertainment before offering or providing them.
- ③ If executives and staff members are forced or requested by stakeholders to provide unfair or fraudulent money and valuables, gifts, or entertainment for business or in business relationships, they must report it to the Ethics Office of the company.
- ④ We do not offer bribes or illegitimate benefits to foreign public officials for business or business purposes. We do not provide illegal bribes to government offices or public officials in other countries. A foreign official, etc., refers to a person in the following;
  · A person who lives in a country or territory outside the Republic of Korea and holds a legislative, administrative, or judicial position through election or appointment;
  · A person who performs the duties of a public official or agent for an international public organization
Acceptance of Gifts and Entertainment
Amorepacific executives and staff members must properly and carefully determine the giving and taking of gifts or entertainment in transactions with stakeholders.
- ① Employees must not give or take illegitimate gifts or entertainment in transactions with all stakeholders for business, such as clients and suppliers. In particular, taking money, valuables, entertainment, monetary or non-monetary benefits from clients, suppliers, and internal employees is more strictly prohibited.
- ② Legitimate and ordinary gifts or entertainment may be received for smooth business performance, but you must check whether limited gifts and entertainment do not violate laws and company policies and regulations. You must report your superior or the Ethics Office in case you receive gifts or entertainment.
- ③ Clients, suppliers, partners, and business agents who have an interest in the company should be notified of Amorepacific's ethics-related regulations and requested to observe the company's ethical standards and that, if they become aware of unethical or corrupt acts committed by other executives and staff members, they must report it to the Ethics Office.
- ④ Customs regarding gifts or entertainment may differ from country to country or culture. You must comply with local laws and customs and be careful not to violate the company's policies.
Bribes

Amorepacific executives and staff members will eradicate bribes given directly or indirectly to government officials in the name of smooth business handling. Even when government officials illegally request a bribe, executives and staff members must refuse and report it to their superiors or the Ethics Office.
Avoiding Conflicts of Interest
Amorepacific executives and staff members must avoid any action or relationship involving conflicts between personal interests and the company's interests. When there is a conflict of interest, they shall act in the manner of giving priority to the company's interests.
- ① All executives and staff members should make job decisions by prioritizing the interests of the company and must avoid situations where personal interests or personal financial interests conflict with the interests of the company.
- ② Conflicts of interest may occur in various situations as follows; When there is a conflict of interest, it must be reported to the immediate supervisor or disclosed to the Ethics Department within the company.
  · When a family member or relative works for, or has business interests in, a competitor, client, or supplier;
  · When you, your family, or your relative has a financial interest in a competitor, client, supplier, or potential supplier;
  · When you are in a relationship with your family members or relatives where one reports to the other regarding business or one can exercise influence on the other;
  · When the conflict of interest situation above occurs between you and a person you have a personal relationship with (friend, acquaintance, romantic relationship, etc.).
- ③ You cannot run your own business or engage in the business of another person or another company without obtaining prior approval from the company.
- ④ Executives and staff members must not exchange cash or gift certificates or have financial transactions with officials of clients or suppliers.

Anti-Corruption Management Systems (ISO 37001)* ISO 37001(反贿赂管理系统)认证仅适用于韩国(总部)。

ISO 37001 is a management system standard published by the International Organization for Standardization (ISO) to provide effective Anti-Corruption measures and sets forth guidance on fair and balanced policies, procedures, and Anti-Corruption management systems for risks that can arise during corporate operations.

AMOREPACIFIC acquired ISO 37001 certification in May 2023 to carry out proper business activities and create a sound business ecosystem that is shared with all stakeholders.

Through the certification of Anti-Corruption Management Systems, AMOREPACIFIC’s own anti-corruption management system is compliant with ISO 37001 standards. Based on our anti-corruption management system and operation guidelines, we have built a work system to examine, prevent, and control corruption risks across the board of corporate operations.

Additionally, all AMOREPACIFIC members, through regular training and active encouragement of reporting, recognize corruption as a sensitive matter and put into practice management ethics in their day-to-day operations.

AMOREPACIFIC is committed to prioritizing management ethics throughout its business decision-making and establishing a corporate culture where mutually beneficial relationships with various stakeholders are cultivated.

AMOREPACIFIC Anti-Corruption Management Systems(ISO 37001)

Establishment of anti-corruption policies and regulations to implement them
Analysis of the organization's situation
Identification, analysis, and assessment of corruption risks
Establishment of anti-corruption goals

Anti-corruption education and training
Communicate with stakeholders
Due diligence on risk areas
Investigation and handling of corruption

Corrective actions for non-conformance
Improvement measures to prevent recurrences
Continuous improvement

Monitoring and internal audits
Management review by the board of directors

Certifications

AMOREPACIFIC Co. Ltd. (hereafter "Company") considers the private information of the user using Service provided by Company very important. Therefore, Company makes its best efforts to protect the user's private information.

Company complies with 『Private Information Protection Law』, 『Law regarding Information Network Use Promotion and Information Protection and etc. 』 and all regulations relevant to the private information protection. Company establishes its own private information handling policy additionally and follows the policy to provide better protection of the private information of users. Also, Company opens the private information handling policy to public all the time in the front page of Company's website as a part of its measure for users' convenience in reading the policy.

Company's Private Information Policy is subjected to change according to any revision of relevant law or notification or any change of the internal operation policy. In case of any revision of Company's Private Information Policy, the revised items is announced though the website.

Company's Private Information Policy contains the following items.

Article 1 The Collected Item of Private Information and the Purpose of Collection and Use
Article 2 The Provision of Private Information
Article 3 The Handling Consignment of Private Information
Article 4 The Holding, the Use Period, the Deistruction, the Destruction Procedure and Method of Private Information
Article 5 The Protection Work for Private Information and the Problem Handling Department
Article 6 The Private Information Collection with Automatic Private Information Collection Device
Article 7 The Reading, the Correction and others of the Private Information
Article 8 The Cancellation of Consent regarding Collection, Use and Provision of Private Information
Article 9 Administrative, Technical and Physical Measures for the Private Information Protection
Article 10 The Right of User and Its Exercise Method
Article 11 The Announcement Obligation for Protection Policy Change

Article 1 (The Collected Item of Private Information and the Purpose of Collection and Use)

① Company collects the minimum private information required to provide service if a user uses reporting service. However, to provide customized services with higher quality, the user is requested to enter additional private information on his/her choice.
② Company does not collect any sensitive private information concerning any violation of human right including the ideology, the belief, the participation in labor union or political party, the political opinion, the health, the sexual life, the past disease history, the religion, the place of birth and the criminal record without out the user's explicit and additional agreement.
③ The main purposes for the collection and the use of private information items when collected by Company are as under:

1. Internal Audit (ethics.amorepacific.com)

Service Classification	Collected Items	The Purpose of Collection and Use	The Periods of Use and Holding
Report	Name(anonymous), Mobile Phone No, E-mail Address, Contents of Report	To communicate the processing of the collected information To manage information submitted	Until one year from report

④ The user may deny to agree regarding the collection and the use of private information. And in case of denial, the user may be restricted for use of the service provided by a third party.

Article 2 (The Provision of Private Information)

① Company shall not use any user's private information or provide the information to a third party beyond limit specified in Article 2 except if Company has the relevant user's consent or if the case is acceptable according to regulations of the relevant law.
② However, in case of one of followings, the provision is allowed without additional agreements of users.
1. If necessary for the fee balance following a service provision.
2. If the information is processed into a form hiding any specific individual and provided to a research organization, a survey or research institution and others for a statistics work, an academic research or a market research.
3. In case of any special regulation established in the private information law, the law regarding the information network use promotion and the information protection, the communication secret protection law, The basic tax law, the law regarding the real name financial transaction and secret guarantee, the law regarding the use and the protection of credit information, the telecommunications law, the telecommunication business law, the local tax law, the consumer protection law and the criminal procedure law.
③ Company shall inform and request the agreement from the user in case of providing the private information to any third party in overseas.

Article 3 (The Handling Consignment of Private Information)

① Company may consign the management of private information to an external professional company to improve the service or the smooth computer process.
② When Company consigns the process of private information, Company shall manage and supervise to protect users' private information for the service provider's strict adherence of guides related to private information protection, confidentiality of private information, prohibition of private information provision to any third party without users' agreements through the consignment contract.
③ The consignee of the private information handling and its responsibility are as under:

2. Internal Audit

Consignee	The Consigned Responsibility
GROVESOFT Co. Ltd.	Site’s Management and Computer Process

Article 4 (The Holding, the Use Period, the Destruction, the Destruction Procedure and Method of Private Information)

① Company holds and uses a user's private information while the user uses service provided by the company for the purpose to provide the service. The private information registered in the computer is not allowed to print out as a document to anyone except employees and staffs responsible for the private information management or a person authorized by the private information management personnel.
② Company shall take actions immediately without any delay in case of requests made by a user to delete his/her private information or to cancel his/her membership. The deleted information should be completely deleted from the disk according to a method preventing any recovery or replay in the state impossible for the future reading or use.
③ Company shall delete the information following Company's internal destruction process upon the occurrence of a reason for destruction of the collection purpose or the provision purpose of private information as stated under. In case of the information printed out, Company should destruct the user's private information immediately without any delay by shredding using a shredder.
④ Even in case of accomplishment of purpose for the collection or the provision, the user's private information may be held for certain period of time if it is necessary to hold according to regulations of the law regarding the consumer protection, the private information protection law, the commerce law and the basic national tax law applied to the electronic commerce.

Article 5 (The Protection Work for Private Information and the Problem Handling Department)

① To protect users' private information and handle complains related to the private information, Company assigns a department to handle the private information protection and related problems. Also, a private information manger and a private information management staff are assigned to process users' inquiries and complains regarding the private information as soon as possible.

[Private Information Manager]

Name: Lee Sang Ho Vice President

Department: AMOREPACIFIC Internal Audit

Telephone No.: 82-2-879-3274(Mon.~Fri. : 09:00~18:00 Except Holidays)

[The Department Responsible for Private Information Management]

Responsible Department	Internal Audit Team
Telephone No	82-2-879-4111
E-mail	ethics@amorepacific.com

② The user may make inquires not only to Paragraph 1's Private Information Protection Department of Company, but also to following institutions when consultation is required due to an occurrence of intrusion to own private information or its concern.

- Private Information Violation Report Center, Korea Internet and Security Agency (privacy.kisa.or.kr/82-2-405-5118)

- Information Protection Mart Certification Committee (www.eprivacy.or.kr/82-2-580-0533~4)

- Online Complaint Office, Supreme Prosecutor's Office (www.spo.go.kr/minwon/82-2-3480-2000)

- Cyber Terror Response Center, The National Policy Agency (www.ctrc.go.kr/1566-0112)

Article 6 (The Private Information Collection with Automatic Private Information Collection Device)

① Company may use 'cookie (Automatic Internet Access Information and other Private Information Collection Device)' that saves and frequently searches information regarding users. Cookie is a small information sent to a user's browser (Netscape, Internet Explorer and etc.) by the server used to operate Company's website and often saved in the hard disk of user's computer. When a user access the website, Company's computer reads the content of cookie in the user's browser and searches the user's additional information in the user's computer so that the service can be provided without no additional input. Cookie identifies the user's computer, but not the user personally.
② Company may use cookie for support or renewal of the service required for the site operation including the analysis of user's access frequency and visit hour and finding of the number of the user's visit.
③ Company uses cookie to find a user's participation level in various events conducted by Company and the number of visits to give differentiated entrance opportunities and to use the data to provide differentiated information according to the user's interested area.
④ The user has the right to choose regarding the cookie installation. Therefore, the user can make a selection for cookie's all acceptance, partial acceptance or complete rejection.
1. How to Select Acceptance of Cookie Installation (in case of using Internet Explorer 6.0): After clicking [Tool] in the internet window's task bar, select [Internet Option] then select [Private Information Tap], make a selection for cookie acceptance in {Private Information Protection Level}.
2. How to Read the Received Cookie (in case of using Internet Explorer 6.0 After clicking [Tool] in the internet window's task bar, select [Internet Option], the select [Configure] of the temporary internet file in the general tap (basic tap), then select [View File].

Article 7 (The Reading, the Correction and others of the Private Information)

① A user may sign-in Company's website and clicking [Reservation Check and Revision] for reading or correcting directly or request to the consignee for the private information handling or to Company's private information protection department via a phone call, in writing or through an E-mail to request to read, correct, delete or stop processing anytime. In any of such case, Company will take an action regarding the user's request without any delay.
② If a user requests the correction on an error in the private information, Company does not use or provide the relevant private information until the completion of the correction. Also, in case of the wrong private information is already processed, Company will take an action to reflect the corrected outcome without any delay.
③ In case of any of the following situation, the reading, the correction and others of the Private Information can be restricted.
1. In case of any concern to damage a third party's right or benefit significantly.
2. In case of any concern to cause severe interference to the relevant service provider's performance.
3. In case of any legal violation.

Article 8 (The Cancellation of Consent regarding Collection, Use and Provision of Private Information)

① A user may cancel his/her agreement on the collection and the provision of private information at any time. The cancellation can be performed by requesting to the consignee of private information handling or to the private information management department in writing, phone call or E-mail. Regarding the user's request, Company will conduct necessary measures such as the user's reservation cancellation process or destruction of the private information without any delay.
② Company shall make efforts to take necessary actions to make the agreement cancellation on the private information collection that the method to collect the private information.

Article 9 (Administrative, Technical and Physical Measures for the Private Information Protection)

① Company shall establish and conduct the internal management plan for safe process of the private information and perform trainings.
② Company is seeking for technical measure to secure the safety to prevent loss, theft, leak, alternation or damage on the private while handling users' private information.
③ Users' private information is managed by utilizing the internal network impossible for any access or intrusion from an external network. And, by encrypting files and transmission data or using the file lock feature, important data is thoroughly protected through additional security features.
④ To confront hackings and other external intrusion, Company makes its best efforts in its corporate network security using firewalls and intrusion detection system for each server and is reinforcing the security by installing access control systems.
⑤ Any invasion to the private information is prevented by installing vaccine programs for all time check and process of the intrusion of malware such as computer viruses and spywares to the information system used to process the private information by the private information process system and the private information handling personnel.
⑥ Company restrict the access right to users' private information to the minimum personnel. To secure the safety of the private information, the internal procedure required for access and management on the private information is prepared while the entrance control and lock devices are installed. The department employees are guided to understand and follow the international procedure.
⑦ The handover of the responsibility of the personnel related to the private information is strictly conducted in the state with the security is maintained. The responsibility in any private information accident occurred after entrance or resignation from Company is clearly defined.
⑧ The user shall maintain the accurate information through own confirmation and management regarding own private information. In case of using other person's private information without any authority or disturbing other person's right during a process of using the internet site, the user may be subjected to not only Company's sanction, but civil or criminal responsibility.
⑨ Company shall be completely free from any responsibility on any problem caused by private information leakage due to the user's carelessness or an internet problem. Therefore, each individual user should manage own private information properly to protect own private information and be responsible for such matter. However, in case of loss, leak, alternation or damage of the user's information because of Company's internal manager's mistake or a technical management accident, Company shall inform the fact immediately to the user and seek for proper measures and compensation.

Article 10 (The Right of User and Its Exercise Method)

① A user may exercise the right related to the read, the correction and the revision of the private information provided to Company and the cancellation of membership by him/herself or the legal representative.
② A user may exercise the right regarding private information by contacting Company using the internet, the telephone and/or a written format. And Company takes proper actions for the contact.

Article 11 (The Announcement Obligation for Protection Policy Change)

This policy's content may change according to any change in the law & policy and Company's internal operation policy or the security technology. In case of a change, Company will announce the cause and content of change on the front page of Company's website at least seven days (if the change is disadvantageous users, 30 days) prior to the changed policy enforcement.

<Addendum>January 2, 2014

Article 1 (Effective Date) This policy is implemented from January 2, 2014

<Addendum>March 25, 2014

Article 1 (Effective Date) This policy is implemented from April 2, 2014

Anti-Corruption Management System

Anti-corruption Policy of Amorepacific

Purpose

Scope

Implementation Guideline

Anti-Corruption Management Systems (ISO 37001)* ISO 37001(反贿赂管理系统)认证仅适用于韩国(总部)。

AMOREPACIFIC Anti-Corruption Management Systems(ISO 37001)

Certifications

홈페이지 이용약관

제1조 (목적)

제2조 (약관의 효력)

제3조 (약관 외 준칙)

제4조 (용어의 정의)

제5조 (서비스의 제공 및 변경)

제6조 (이용자에 대한 통지)

제7조 (이용자의 개인정보보호)

제8조 (감사실의 의무)

제9조 (서비스 전반에 관한 이용자의 의무)

제 10 조 (이용자의 게시물)

제 11 조 (게시물에 대한 권리 및 책임)

제12조 (서비스 이용시간)

제13조 (이용제한)

제14조 (면책조항)

제15조 (관할 법원)

AMOREPACIFIC Private Information Handling Policy

Article 1 (The Collected Item of Private Information and the Purpose of Collection and Use)

Article 2 (The Provision of Private Information)

Article 3 (The Handling Consignment of Private Information)

Article 4 (The Holding, the Use Period, the Destruction, the Destruction Procedure and Method of Private Information)

Article 5 (The Protection Work for Private Information and the Problem Handling Department)

Article 6 (The Private Information Collection with Automatic Private Information Collection Device)

Article 7 (The Reading, the Correction and others of the Private Information)

Article 8 (The Cancellation of Consent regarding Collection, Use and Provision of Private Information)

Article 9 (Administrative, Technical and Physical Measures for the Private Information Protection)

Article 10 (The Right of User and Its Exercise Method)

Article 11 (The Announcement Obligation for Protection Policy Change)

<Addendum>January 2, 2014

<Addendum>March 25, 2014

AMOREPACIFIC Private Information Handling Policy

Article 1 (The Collected Item of Private Information and the Purpose of Collection and Use)

Article 2 (The Provision of Private Information)

Article 3 (The Handling Consignment of Private Information)

Article 4 (The Holding, the Use Period, the Destruction, the Destruction Procedure and Method of Private Information)

Article 5 (The Protection Work for Private Information and the Problem Handling Department)

Article 6 (The Private Information Collection with Automatic Private Information Collection Device)

Article 7 (The Reading, the Correction and others of the Private Information)

Article 8 (The Cancellation of Consent regarding Collection, Use and Provision of Private Information)

Article 9 (Administrative, Technical and Physical Measures for the Private Information Protection)

Article 10 (The Right of User and Its Exercise Method)

Article 11 (The Announcement Obligation for Protection Policy Change)

<Addendum>January 2, 2014

<Addendum>March 25, 2014

AMOREPACIFIC Private Information Handling Policy

Article 1 - Purpose of Processing Personal Information

Article 2 - Processing and Retention Period of Personal Information

Article 3 - Providing Personal Information to Third Parties

Article 4 - Entrusting Personal Information Processing

Article 5 - Rights, Duties, and Exercise Methods of the Information Subject and Legal Representatives

Article 6 - Items of Personal Information to Process

Article 7 - Destroying Personal Information

Article 8 - Measures to Secure the Safety of Personal Information

Article 9 - Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

Article 10 - Matters Concerning Personal Information Security Officer

Article 11 - Changing the Privacy Policy

<Addendum>

AMOREPACIFIC Private Information Handling Policy

Article 1 - Purpose of Processing Personal Information

Article 2 - Processing and Retention Period of Personal Information

Article 3 - Providing Personal Information to Third Parties

Article 4 - Entrusting Personal Information Processing

Article 5 - Rights, Duties, and Exercise Methods of the Information Subject and Legal Representatives

Article 6 - Items of Personal Information to Process

Article 7 - Destroying Personal Information

Article 8 - Measures to Secure the Safety of Personal Information

Article 9 - Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

Article 10 - Matters Concerning Personal Information Security Officer

Article 11 - Changing the Privacy Policy

<Addendum>

AMOREPACIFIC Private Information Handling Policy

Article 1 - Purpose of Processing Personal Information