Data Transfer and Privacy Policy

Crouser & Suh PLLC (the “Firm”) adheres to applicable international data protection legislation concerning the transfer of personal data across borders — in particular between the Republic of Korea and the United States, and from the European Economic Area (the “EEA”) and Switzerland to the United States.

This Data Transfer and Privacy Policy (the “Policy”) outlines the Firm's general practices and procedures in relation to (i) the types of personal data the Firm's offices receive from outside the United States, (ii) how that personal data is used, and (iii) the options available to the individual the data relates to (the “data subject”) in relation to the Firm's use of, and their ability to correct or request deletion of, personal data relating to them.

Scope

This Policy applies to all personal data the Firm receives from outside the United States that pertains to a specific individual, can be linked to that individual, and is recorded in any form.

Notice

Where the Firm obtains personal data directly from individuals, the Firm will inform them about (i) why it is collecting and using their personal data, (ii) the types of third parties to whom it may disclose that data, (iii) their rights regarding the data, and (iv) how to contact the Firm. The Firm will give that notice in clear language when individuals are first asked to provide personal data, or as soon as practicable afterwards, and in any event before the Firm uses or discloses the information for a purpose other than that for which it was originally collected.

Consent for personal data to be collected, used or disclosed in certain ways may be required for an individual to obtain or use the Firm's services. Otherwise we process personal data as necessary for the Firm's legitimate interests in managing its business, delivering legal services to clients and fulfilling its contractual obligations.

Choice

Where acting as a data controller, the Firm will offer individuals the opportunity to choose whether their personal data is (i) disclosed to a non-agent third party, or (ii) used for a purpose other than the one for which it was originally collected. For special categories of personal data, the Firm will give individuals the opportunity to consent affirmatively and explicitly.

In connection with client engagements and at the direction of clients, the Firm may process personal data of data subjects with whom it has no direct relationship. In receiving such personal data from a client, the Firm will obtain confirmation from that client that all personal data transferred to the Firm is transferred in accordance with applicable data protection legislation.

Onward transfer

The Firm will use commercially reasonable efforts to obtain assurances from third parties to whom it transfers personal data that they will safeguard it consistently with this Policy. If the Firm discovers that an agent is using or disclosing personal data contrary to this Policy, the Firm will take commercially reasonable steps to prevent or stop the use or disclosure.

Any transfer of personal data between the Firm's Korean office and its United States offices will be made with adequate levels of protection in place.

Security

The Firm will take commercially reasonable precautions to protect personal data in its possession from loss, misuse and unauthorised access, disclosure, alteration and destruction.

Data integrity

The Firm will use personal data only in ways compatible with the purposes for which it was collected, or in a manner the data subject or client subsequently authorised. To the extent necessary, the Firm will take commercially reasonable steps to ensure personal data is relevant to its intended use, accurate, complete and current.

Access

On request, the Firm will provide individuals with information about the personal data it holds about them in its role as data controller. If you become aware that information the Firm holds about you is inaccurate, or you would like to update, review or erase it, contact the Firm at info@crousersuh.com. You may need to provide sufficient identifying information for the Firm to confirm your identity.

Enforcement

The Firm will periodically review its privacy practices to confirm that it is adhering to this Policy. Any partner or employee the Firm determines is violating or has violated this Policy may be subject to disciplinary action, up to and including termination.

Dispute resolution

Questions or concerns about the use or disclosure of the Firm's human resources data should be directed to the Firm's administration. Questions or concerns about client-related personal data should be directed to info@crousersuh.com. The Firm will investigate and attempt to resolve complaints and disputes about the use and disclosure of personal data by reference to the applicable legislation and this Policy. For unresolved complaints, the Firm will cooperate with the competent supervisory authority.

Limitations

The Firm's adherence to this Policy will be limited as permitted by applicable law: (i) to the extent necessary to meet national security, public interest or law enforcement requirements; (ii) by statute, government regulation or case law that creates conflicting obligations or authorisations, provided that any non-adherence is limited to the extent necessary; or (iii) where applicable data protection legislation allows exceptions or derogations, provided the Firm applies them in comparable contexts.

Further, because the Firm is a law firm providing legal advice, adherence to certain principles — including notice, choice and access — is limited with respect to personal data the Firm processes in establishing a legal claim or defence, or in representing a client's interests and rights in an acquisition, merger, joint venture or other transaction. Personal data may also be subject to ethical duties of confidentiality or privilege.

Internet privacy

The Firm recognises the importance of maintaining the privacy of information collected online. Our Privacy Policy governs the treatment of personal data collected through the website the Firm operates. With respect to personal data transferred into the United States from outside it, the Privacy Policy is subordinate to this Policy, though it may reflect additional legal requirements regarding internet privacy.

Contact

Questions and concerns regarding this Policy should be directed to the Firm at info@crousersuh.com or (305) 372-7776. This Policy may be amended from time to time.

Last updated: August 2026