(version 4, 2021 May)

1. With respect to the collection, processing, use and international transmission of your personal information, we, KGI Securities Co. Ltd. (hereinafter “the Company”) hereby inform you of the followings according to Paragraph 1 of Article 8 of Personal Information Protection Act and if applicable, Article 13 of the EU General Data Protection Regulation:

1. Your personal information is collected, processed, used, and internationally transmitted by the Company for the following purposes: (1)conducting securities, futures, and other related business permitted by applicable laws or within the scope of business registration, bylaws or article of incorporation of the Company, including relevant acts carried out for the administrative operations or business management of the Company or its parent company(ies), such as registration of securities and holders of securities, investment management, internal management of shareholder list, trust business, property management, financial advisory services, information technology security and management, relevant e-commerce services, information and database management, investigation statistics and research analysis, certification business management, client management and services, internal control, audit and risk management. (2)performing contract/quasi-contract obligations, providing you with various client services, such as credit checking, marketing, relevant advisory and consultation services. (3)performing legal obligations such as implementation of anti-money laundering and counter-terrorism measures, and internal whistleblower system, compliance with financial regulations of various jurisdictions (including but not limited to FATCA, CRS, SRD II). (4)complying orders, investigations, exanimations of financial supervisory, judicial, tax regulators and other similar organizations, and handling litigations, non-litigating matters, arbitrations, or resolving financial disputes.
2. Type of personal information to be collected, period, parties, areas and method of using personal information: (1)Type: the type of personal information to be collected for the above purposes or due to business necessity includes your basic information (e.g., name, I.D. number, passport number, date of birth, residence/company/e-mail address, telephone/mobile phone/fax number, education, occupation, name of employer, family situation), information regarding billing, credit, income, assets or finance, facility, investments, location data, online identifier, and other information which may be directly or indirectly identify a person, as provided in the related business application forms or contracts. (2)Period: during the term the above specific purposes exist, the Company is licensed to conduct business, required by business, during the retention period as set forth by law/regulations or contract/quasi-contracts, or the period you agree (whichever is longer). (3)Parties: including:
   (3.1)The Company and each of the Company’s branches, the Company’s financial holding parent company and its subsidiaries (including but not limited to those with whom the Company conducts co-marketing or client data sharing), the entities with which the Company cooperates for business promotion), the receiver not restricted by competent authority for international transmission, the financial institutions you designate, consultants (such as lawyers) or organizations having a contractual or business relationship with the Company due to business needs, the transferees of all or part of the business of a securities firm. (3.2)Financial supervisory, judicial, or tax authorities or organizations with legal investigation authority or in connection with dispute resolution and credit checking, including without limitation to, TWSE, Futures Exchange, Taipei Exchange, TDCC, Taiwan Securities Association, Futures Association (or other related commerce association), Securities and Futures Investors Protection Center, Financial Ombudsman Institution, the share issuing company, settlement banks, custodians, Taiwan Clearing House (for dividend payment), and other organizations involved in the business in connection with supervision, issuance, transaction, credit checking, trading, and settlement, and those domestic or foreign financial supervisory organizations and judicial organizations competent and applicable to the parties listed in the above paragraph. (4)Area: to the extent permitted by laws and regulations or necessary to carry out business, the Company and the aforementioned parties may, within the area of its business, and relevant areas necessary for collecting, processing, using and internationally transmitting (including but not limited to the area where the Company, offshore institutions, banks, international transmission receivers are located), collect, process, use and internationally transmit your personal information. (5)Method: via automated machines or other non-automated methods (including but not limited to written, electronic method or international transmission) and with reasonable and legal method within the above specific purposes. If the EU General Data Protection Regulation is applicable, in transmitting personal information internationally, the Company shall ensure such transmission enjoys adequate level of protection required by law. If the Company transmits your personal information to countries or jurisdictions where same level of protection as provided by the Republic of China cannot be guaranteed, the Company will request the receiver to increase the protection to such level provided by the Company, so as to ensure the protection to your personal information is not be undermined.
3. Your Rights
   You may exercise the following rights with respect to your personal information retained by the Company: 1) make an inquiry, request to view or request a duplicate copy (the Company may charge necessary fees in accordance with relevant laws); 2) request to supplement or revise personal information, if a reasonable explanation is provided; 3) request to stop the collection, processing, use, and international transmission or request to delete personal information; ; 4) request to restriction of processing,5) right to data portability; 6) right to object automated individual decision-making; and 7) right to object to processing of personal information for direct marketing purposes; provided, however, the Company may reject your request if it is necessary for the Company to comply with relevant laws, regulations, and contracts, or to carry out its business. Where you wish to exercise said rights, you may access the Company’s telephone number, email address or business place address on the Company’s official website or in the information sent by the Company to you. You may also lodge a complaint with the Company or regulator if you think the Company does not comply with regulations in collecting, processing, using, and internationally transmitting your personal information.
4. Effect if you refuse to provide personal information
   You are free to provide your personal information. However, if you refuse to provide, the Company will not be able to carry out the necessary review and process and provide other related services. Therefore, the Company may reject your request or application for conducting business or other related matters with the Company.

2. If the dealings between you and the Company call for collection of your personal information from TWSE’s securities firms credit checking system, the Company hereby informs you of the followings in accordance with Paragraph 1 of Article 9 of Personal Information Protection Act and if applicable, Article 13 of the EU General Data Protection Regulation: Your personal information (including personal data, credit or investment information, breach or criminal records related to securities transactions) is obtained by the Company from TWSE’s securities firms credit checking system for credit checking purpose. For other matters please refer to the above.

The Company will collect, process, use and internationally transmit your personal information in accordance with this Statement. The Company will not inform you again if the collection, process, use and international transmission of your personal information is within the scope of this Statement.

You agree that the Company may amend the contents herein and may inform you of the updated version by any method that enables you to be aware of the amendment, including but not limited to, posting the same on company website(s) or providing links to such website(s), disclosing the same verbally or in writing, via telephone, messages, e-mails, fax, or electronic documents.

If the information you provide include personal information of a third party, you should and you represent you have, inform such third party that his/her personal information will be provided to the Company. You should ensure the third party agrees the Company may collect, process, use and internationally transmit his/her personal information and that he/she understands the contents he/she should be notified and his/her rights; thus the Company does not need to inform the third party again.