Personal Data Protection Policy

CHPT places great importance on the protection of personal data and privacy. In compliance with the Personal Data Protection Act and other applicable laws and regulations, the Company has established and publicly disclosed its Personal Data Protection Management Measures and related internal control procedures as the basis for the collection, processing, and use of personal data.

Through the establishment of policy frameworks, management processes, and technical safeguards, the Company seeks to ensure the security, integrity, and availability of personal data throughout its lifecycle.

I. Personal Data Protection Policy and Scope of Application

The Company’s personal data protection system applies to all personnel and activities involving the collection, processing, and use of personal data, including the headquarters, branch offices, subsidiaries, business partners, and outsourced personnel entrusted with processing personal data.

The personal data collected by the Company may include information relating to customers, job applicants, employees, supplier contacts, and other relevant stakeholders. Such data is managed in accordance with the Company’s Personal Data Protection Management Measures and applicable operating procedures.

The Company processes personal data only for lawful and specified purposes and does not disclose such data to third parties without authorization or a lawful basis. Audit and review mechanisms, access controls, and technical safeguards are implemented to reduce the risks of unauthorized access, disclosure, or misuse of personal data.

II. Responsible Departments and Management Responsibilities

The Human Resources Department serves as the primary department responsible for the Company’s personal data protection management system. Its responsibilities include promoting the personal data management framework, enhancing awareness of personal data protection, planning and implementing education and training programs, and formulating policies and operating procedures related to personal data protection and management.

The Human Resources Department is also responsible for cross-departmental coordination and continuous improvement of the management system to ensure that personal data protection requirements are effectively incorporated into relevant business processes.

The Information Technology Department is responsible for supporting the development and implementation of the information systems and technical safeguards required for personal data management. These responsibilities include system development, data access authorization management, information security protection, and other technical control measures to ensure that personal data processing activities are supported by adequate technical security.

The two departments work jointly, within their respective areas of responsibility, to maintain the effective operation of the Company’s personal data protection system.

III. Implementation and Quantitative Results of the Personal Data Protection Policy in 2025

(1) Employee Education, Training, and Awareness

New Employee Training:
Legal knowledge and personal data protection topics are incorporated into digital learning programs for new employees. In 2025, the Company conducted 6 training sessions, with 138 employees completing the training, achieving a 100% completion rate.

Annual Refresher Training for Existing Employees:
The Company conducts three mandatory annual refresher training programs: “Understanding the Personal Data Protection Act,” “Prevention of Insider Trading,” and “Confidentiality, Integrity, and Ethical Conduct.” In 2025, a total of 2,794 training participations were completed. The passing score for the related assessments was set at 100 points, and all participants met the required standard.

Awareness Mechanism:
The Legal Affairs function issues quarterly announcements covering confidentiality, internal controls, integrity, and related topics to continuously strengthen employees’ awareness of personal data protection and confidentiality obligations.

(2) Internal Management and Technical Safeguards

The Company continues to strengthen its internal control procedures and technical safeguards for personal data protection, including:

Periodically reviewing personal data access permissions to ensure that only authorized personnel have access to necessary information.

Implementing appropriate technical safeguards in accordance with the Company’s information security management system, including data encryption, system access controls, redundancy, and backup management, to reduce information security and personal data risks.

Continuously enhancing employees’ cybersecurity awareness through measures such as social engineering awareness programs and security awareness testing.

Periodically conducting reviews and audits related to compliance with the Personal Data Protection Act. A total of 2 reviews and audits were conducted in 2025.

CHPT’s Sustainability Report also discloses related safeguards such as electronic document encryption, tiered user access permissions, off-site data backup mechanisms, and regular social engineering exercises as part of its broader information security and privacy protection framework. 2025 CHPT Sustainability Report.

(3) Incident Response and Risk Management

The Company adopts the principles of “immediate reporting and tiered response” for personal data incidents.

If any suspected personal data breach or unauthorized use is identified, the Human Resources and Information Technology departments will initiate investigation, response, and remedial actions in accordance with the Company’s established incident reporting procedures.

Depending on the nature and severity of the incident, the Legal Affairs function may also be involved to provide legal support and assist with subsequent administrative actions.

Where an investigation confirms a violation of personal data protection requirements or confidentiality obligations, the responsible individual will be subject to disciplinary action in accordance with the Company’s applicable internal rules and regulations.