台新新光金控

To maintain the security of personal information, TS Holdings has not only formulated regulations on the protection and management of personal information, but also reviewed the appropriateness of these regulations in accordance with the law to ensure the legal collection, processing and use of personal information of customers and employees. In addition to regularly checking the current status of personal data security maintenance and evaluating possible risks to personal data, TS Holdings also establishes appropriate management mechanisms based on the results of the risk assessment, and formulate contingency, notification, and prevention mechanisms to implement personal data protection and management measures for security incidents such as theft, alterations, damage, loss, or leakage of personal data.

To enhance the ability to respond to personal data infringement incidents and raise the risk awareness of all employees, Taishin Bank, SKB, SKL and Taishin Securities has formulated the "Personal Data Infringement Incident Management Standards" to effectively implement emergency response and handling. When a personal data infringement incident occurs, the supervisor shall immediately be notified supervisor and the risk assessment and classification of the incident must be completed within the time limit. Depending on the extent of the impact of the incident, an emergency response team shall be set up for the response, coordination, liaison, and investigation of the incident. TS Holdings adopts the principle of zero tolerance for personal privacy infringement. Also, in order to respect the customers' rights to their personal data, TS Holdings' subsidiaries
have formulated "Operating Rules for Exercising the Rights of the Parties" based on their own business requirements, specify customers' personal data's inquiry, viewing, copying, supplement, correction, deletion and the right to stop collection, processing and use.

Personal Information Infringement reporting procedure (Taishin Bank example)

The handling of each level of incident and the reporting level

To strengthen the awareness on personal protection and establish a corporate culture of respect for personal information, Taishin continues to promote education and training on personal information protection so that employees understand the requirements of relevant laws and regulations. Furthermore, allow employees fully understand the scope of responsibilities, mechanisms, procedures, and measures for personal information protection.

Training for Protection of Personal Information in 2025

Internal/External audit defects

TS Holdings and its subsidiaries all conduct personal data management operations and audits in accordance with internal control systems and personal data protection regulations. Internal and external audits as well as third-party
verification completed by each company revealed no material irregularities in 2025. Taishin Bank commissioned an accountant to conduct an audit of the implementation of personal data protection for 2025 in accordance with the agreed procedures, and no major irregularities were found after the implementation of the agreed procedures. In addition, Taishin Bank also obtained the PIMS (personal information management system) certification and ISO27701 (privacy information management standard) certification in 2024. SKB commissioned an accountant to conduct an audit of the implementation of personal data protection for 2025 in accordance with the agreed procedures, and no major irregularities were found after the implementation of the agreed procedures. Since 2019, SKL has commissioned BSI to implement BS 10012:2017 Personal Information Management System (PIMS) certification and once again passed the certification in 2025, showing that its personal information management system continues to meet international standards. Taishin Securities conducts personal information protection security project audits in accordance with the annual audit plan, and there were no major abnormalities in the audit results. Taishin Securities Investment Trust Audit Office conducted personal information protection security audits according to the annual plan, and no major abnormalities were found in the audit results.

Grievance Mechanism of Personal Information

TS Holdings attaches great importance to the protection of personal information, and customers can raise questions or file complaints through different channels. If the results of an investigation confirm a violation of personal information, we will take disciplinary actions (e.g., downgrading of performance evaluation, withholding of bonuses, and internal penalties). We shall also propose specific system and process improvements to address the root cause of the complaint and avoid the recurrence of similar situations. Quarterly reporting will be made to the Treating Customers Fairly Committee for continuous monitoring and improvement.