Section 23

In collecting the Personal Data, the Data Controller shall

inform the data subject, prior to or at the time of such collection,
of the following details, except the case where the data subject already knows of such details:

(1)the purpose of the collection for use or disclosure of the Personal Data,

including the purpose which is permitted under section 24
for the collection of Personal Data without the data subjects consent

(2)notification of the case where the data subject must provide his or her

Personal Data for compliance with a law, or contract, or where it is necessary to provide
the Personal Data for the purpose of entering into the contract, including notification
of the possible effect where the data subject does not provide such Personal Data;

(3)the Personal Data to be collected and the period for which the Personal

Data will be retained. If it is not possible to specify the retention period,
the expected data retention period according the data retention standard shall be specified;

(4)the categories of Persons or entities to whom the collected Personal Data may be disclosed;

(5)information, address, and the contact channel details of the Data Controller,

where applicable, of the Data Controllers representative or data protection officer

(6)the rights of the data subject under

section 19 paragraph five, section 30 paragraph one, section 31 paragraph one, section 32 paragraph one,
section 33 paragraph one, section 34 paragraph one, section 36 paragraph one, and section 73 paragraph one.