Information Security Policy

1. Each department of our company must comply with relevant government regulations (such as the Patent Law, Copyright Law, Personal Data Protection Act, Enforcement Rules of the Personal Data Protection Act, etc.) when conducting business operations.

2. Establish an Information Security Management Committee responsible for the establishment and promotion of the company's information security management system.

3. Establish an organizational panorama evaluation mechanism to define the policy of information security and the scope of implementation of the information security management system, and understand the needs and expectations of the organizational panorama and stakeholders.

4. Establish document control procedures to legally regulate the formulation, modification, encoding, issuance, etc., of documents related to the information security system.

5. Establish a management mechanism for information assets to coordinate the allocation and effective utilization of limited resources to address critical security issues.

6. Establish risk assessment management methods and identify risks associated with various assets to take appropriate risk treatment measures, control, and reduce risks to an acceptable level.

7. Regularly conduct business-related information security education and training to promote information security policies and related implementation regulations.

8. Establish physical and environmental security protection measures for data centers and regularly perform relevant maintenance and upkeep.

9. Clearly define the permissions for the use of information systems, network services, and sensitive information to prevent unauthorized access.

10. Develop and implement internal audits of information security to enforce the information security management system and implement corrective measures for any deficiencies.

11. Develop information security business continuity plans and conduct practical drills to ensure the continuity of business operations in the event of unforeseen incidents.

12. All personnel of our company are responsible for maintaining information security and should understand and comply with relevant information security management regulations, implementing them in their job responsibilities.