This Korea Privacy Schedule supplements our General Privacy Notice and applies where the Personal Information Protection Act of Korea applies to our processing of personal information.

For the purposes of this Privacy Schedule, “personal information”, “processing”, “data subject” and related terms have the meanings given under Korean law.

Otherwise, unless defined herein, capitalised terms in this Privacy Schedule shall be as defined in our General Privacy Notice.  In particular, “Agency” and “Agency Group” refer to the specific agency, legal entity or group of entities responsible for the relevant processing, as described in the General Privacy Notice.

1. Controller and privacy contact

The controller responsible for your personal information will usually be the Agency Group entity with which you or your organisation has a relationship.

You may contact our privacy team at: DPO@the-independents.com

Where required, we will identify a local privacy officer or responsible contact separately.

1. Personal information processed, purposes and retention periods

We process the following personal information for the following purposes:

Categories of personal information	Purposes of processing	Retention period
Name, employer, job title, business address, email address, telephone number	Business relationship management, communications, providing or receiving services, event invitations and administration	For the duration of the business relationship and thereafter as necessary for legal, regulatory, accounting, dispute or legitimate business purposes
Emails, messages, meeting notes, call notes and business correspondence	Project administration, relationship management, responding to requests, record keeping	As necessary for the relevant business purpose and in accordance with our Data Retention Policy
Preferences, event attendance, interests, marketing preferences	Event management, marketing, business development and relationship management	Until opt-out/withdrawal or as otherwise required by law or our Data Retention Policy
IP address, browser type, device identifiers, cookie and website usage data	Website operation, analytics, security and improvement	As described in our Cookies Policy or Data Retention Policy
Compliance, sanctions, anti-bribery, KYC or onboarding information	Legal and regulatory compliance, risk management and screening	As required for compliance purposes and applicable limitation periods
Invoicing, payment, purchase order and transaction information	Accounts, payments, procurement, financial administration and tax/accounting compliance	As required by tax, accounting and legal obligations

We do not usually collect sensitive information or unique identification information from business contacts. Where we are required to process such information, we will obtain consent where required by Korean law.

1. Third-party provision of personal information

We may provide personal information to third parties where necessary for the purposes described in our General Privacy Notice, where permitted by law or where you have consented.

Where required by Korean law, we will provide specific details of third-party provision, including the recipient, purpose, items provided, retention period and whether consent is required.

Current third-party provision arrangements may include:

Recipient	Purpose	Items provided	Retention/use period
Agency Group / The Independents Group entities	Group administration, business relationship management, reporting, service delivery and internal operations	Identity, Contact, Business Communications, Profile, Compliance and Transaction Data as relevant	As necessary for the relevant purpose and in accordance with our Data Retention Policy
Professional advisers, regulators or transaction counterparties	Legal, audit, insurance, regulatory, compliance or corporate transaction purposes	Relevant personal information necessary for the relevant legal, audit, insurance, regulatory, compliance or transaction purpose	As necessary for the relevant purpose or as required by law

1. Outsourcing of personal information processing

We may outsource processing of personal information to service providers who process personal information on our behalf.

Outsourced processing may include:

Outsourced processor / category	Outsourced function
IT, hosting and cloud service providers	Hosting, storage, security, infrastructure and system support
CRM and business systems providers	Contact management, relationship management and business administration
Email and communications providers	Email, messaging, communications and collaboration tools
Marketing and event platforms	Event invitations, event administration, marketing communications and preference management
Analytics and cookie providers	Website analytics, performance measurement, cookie management, usage reporting and service improvement
Professional advisers	Legal, audit, insurance, accounting and consultancy support
Compliance screening providers	Sanctions, anti-bribery, KYC and onboarding checks

We supervise outsourced processors in accordance with Korean law and require appropriate contractual and security controls.

Where Korean law requires publication of named processors, the names and details of relevant processors will be made available on request or in a separate Korean local notice, on the Agency’s website, or otherwise as required by applicable law.  Please see our General Privacy Notice for further details.

1. Overseas transfers

Your personal information may be transferred outside Korea to The Independents Group entities and service providers in other jurisdictions, including the UK, EEA, United States, Hong Kong, Singapore, Japan, Switzerland, UAE and other jurisdictions in which we or our service providers operate.

Where required by Korean law, we will provide further details and obtain consent or rely on another lawful basis for overseas transfer.

Recipient / category	Country / region	Date and method of transfer	Purpose of transfer	Items transferred	Retention / use period
The Independents Group entities	UK, EEA, United States, Hong Kong, Singapore, Japan, Switzerland, UAE and other relevant jurisdictions	Ongoing / secure electronic transfer, remote access or system access	Group administration, business relationship management, reporting, service delivery, finance, legal, compliance, IT support and internal operations	Identity and contact information, business communications, profile and relationship information, compliance information, financial and transaction information and other relevant business information	As necessary for the relevant purpose and in accordance with our Data Retention Policy
IT, hosting, cloud, CRM, email and collaboration providers	Various jurisdictions depending on the provider	Ongoing / secure electronic transfer, hosting or remote access	Hosting, storage, CRM, communications, IT support, system administration, cybersecurity and business continuity	Identity and contact information, business communications, technical and usage information and other information stored in relevant systems	For the duration of the relevant service and thereafter as required by contract, law or our Data Retention Policy
Marketing, event and analytics platforms	Various jurisdictions depending on the provider	Ongoing / secure electronic transfer, platform access or cookie/analytics collection	Event invitations, event administration, marketing communications, preference management, analytics and service improvement	Identity and contact information, marketing preferences, event information, technical and usage information and engagement information	As necessary for the relevant purpose and in accordance with our Data Retention Policy
Finance, payment, accounting and professional service providers	Various jurisdictions depending on the provider	As needed / secure electronic transfer or remote access	Payments, invoicing, accounting, audit, tax, legal, insurance, compliance and professional advisory services	Identity and contact information, financial and transaction information, invoices, payment details, purchase order information and relevant business communications	As required for payment, accounting, tax, audit, legal, regulatory and dispute purposes
Compliance screening providers	Various jurisdictions depending on the provider	As needed / secure electronic transfer or platform access	Sanctions, anti-bribery, KYC, onboarding, supplier/client screening and risk management	Identity and contact information, employer/company information, role/title, due diligence information, screening results and relevant compliance information	As long as necessary for compliance, legal, audit, regulatory, risk management and dispute purposes

1. Destruction of personal information

When personal information is no longer required, we will destroy it without undue delay unless retention is required by law or necessary for legitimate business purposes.

Electronic records will be deleted or anonymised using appropriate technical measures. Paper records, where any exist, will be shredded, securely destroyed or otherwise disposed of securely.

1. Security measures

We maintain appropriate technical, organisational and administrative safeguards to protect personal information, including access controls, system security, confidentiality obligations, internal policies, training, monitoring and incident response procedures.

1. Your rights

Subject to applicable law, you may request:

• access to your personal information;
• correction of inaccurate personal information;
• deletion of personal information;
• suspension of processing;
• withdrawal of consent; and
• information about processing, third-party provision, outsourcing and overseas transfers.

To exercise your rights, please contact: DPO@the-independents.com

We may need to verify your identity before responding.

1. Complaints and remedies

If you have concerns about our processing of your personal information, please contact us first at: DPO@the-independents.com

You may also contact the Korean Personal Information Protection Commission or other relevant Korean authorities.

Updated: April 2026