Alchemy Telco Solutions Taiwan Co., Ltd (Business Account No: 91115092) (“Alchemy”) is based at 16F, No.89, Songren Rd., Xinyi Dist., Taipei City, Taiwan. We are a global services company, specialising in Trade-In and Recycling Services, Problem Solving / Consultancy, Product Sourcing, Accessories and Onsite Managed Services, and other services related thereto (collectively the “Services”).

1. Basic Policy

Alchemy operates conscientiously within the requirements of the laws, regulations and guidelines in Taiwan, including the Personal Data Protection Act ("PDPA"), We work within the principles of fair data processing, namely:

• Using information in a way that people agree.

• Thinking about the impact of our processing.

• Being transparent and ensuring that people agree how we will use their information.

In order to reflect any changes to Services or to comply with changes in our legal and/or regulatory obligations, this policy (“Policy”) which will be updated at regular intervals, sets out the basis on which any data we collect from you, or that you provide to us, will be processed by us.

Please read the following carefully to understand our views and practices regarding your data and how we will treat it.

2. What This Policy Covers

This Policy covers how we treat any Personal Information that we collect and receive either from our website (the “Site”) or as part of our broader operating processes.

We do not sell or pass on any Personal Information and we only use information shared with us for running and improving Services and other purposes provided in this Policy and other applicable laws and terms and conditions to which you have consented. This Policy describes: what information we collect; the steps we take to protect and secure it; how we use and share information; and finally, how you can contact us with questions or concerns.

3. Information We Process

• Personal Information. We collect your personal information (e.g., name, address, email address, phone number, occupation, copy of your Driving License and/or other Government issued identification etc.) (“Personal Information”) when you:

  • Send us an enquiry through the Site.

  • Email us.

  • Work with us as a customer, supplier or employee.

• Your other information. When you access and use Services, we may collect additional contextual information about you, your company as well as your design and aesthetics preferences. We do not link this additional data to any other personal identifiable information we collect about you and do not undertake any profiling activity.

• Billing If you contract us for Services, we will require your billing information in order to process the transaction. Billing information includes your name, address, bank details and other information necessary to process the transaction.

4. Purpose of Collecting Personal Information

• Personal Information is only collected for the purposes of which you have been notified; of which there is a legitimate interest to disclose the information; of which the disclosure of Personal Information is required for the fulfilment of your contract with Alchemy; and of which is otherwise permissible under the PDPA.

• We may use Personal Information collected from you to the extent necessary for process of applications, shipment and provision of our products, after-sales support and other customer support activities, or otherwise operating the Services. We may also make you aware of new and additional products, Services and opportunities available to you. We may use Personal Information to improve our products and Services and better understand your needs. We may also use Personal Information for the background check to determine whether to proceed with a transaction or otherwise to fulfil the requirements under the applicable laws and regulations.

If there are additional purposes for which we propose to use Personal Information which are not specified in this Policy, they will be contained in the terms of any consent we will ask you to agree to when we collect Personal Information, or before we start to use Personal Information for such purpose if your Personal Information has been collected for other purposes of which you have been notified. We will always give you the option to decline to provide Personal Information or to decline to allow us to use Personal Information for the purposes for which we have proposed to use it; provided that we may not be able to provide our products and Services if you decline to provide or to allow us to use the certain Personal Information. How we use your Personal Information:

• Who will use the Personal Information: Alchemy, Alchemy's affiliates, and any third parties engaged by Alchemy to provide Services or to attain the purposes provided in Section 4.

• Region: The location of the parties to use the Personal Information (described above).

• Method: collection, process and utilization in accordance with the applicable laws and regulations.

• Period: We will retain existing customer information for as long as a customer account is active with us or as needed to provide Services – and where required to comply with our legal obligations under the applicable laws and regulations, to resolve disputes, and to enforce our agreements. We will retain all prospective customer data ongoing until you request Alchemy to stop collecting, processing or using your Personal Information or to delete your Personal Information or the purpose of collecting your Personal Information has extinguished.

5. Cookies

• When you access the Site a small text file is saved to your web browser— a cookie. A “cookie” assigns you a unique identifier so that we can recognise you each time you re-enter the Site. We use cookies to help us to improve the Site and to provide us with information about usage of the Site. Certain third parties also place cookies on your device when you browse the Site. Cookies help us deliver an enhanced personalised experience to you. You also have choices with respect to cookies. By modifying your browser preferences, you have the choice to accept all cookies, to be notified when a cookie is set, or to reject all cookies. If you choose to reject all cookies you will be unable to use those Services or engage in activities that require the placement of cookies. Certain aspects of the Site may not function properly if you set your browser to reject all cookies.

• If you require further information, please see Section 12 ‘Contacting Alchemy’.

6. Disclosure and Sharing of Personal Information

Alchemy does not share, sell, rent or trade Personal Information with any third parties for marketing or promotional purposes or for any purpose not provided in Section 4. Where necessary Alchemy will share with its trading partners Personal Information required for the provision of the goods and services you have engaged us for.

Alchemy reserves the right to share data with relevant authorities if compelled to do so to comply with legal obligations under applicable laws and regulations. We will use third party payment processors for card transactions to pay for goods and Services but these third parties are authorised to use the data only as necessary to provide these Services to us and are prohibited from using Personal Information for promotional purposes. We may share Personal Information amongst other Alchemy businesses. Where information is shared, that other Alchemy business is bound by the original Primary Purpose for which the information was collected.

Alchemy may disclose Personal Information under the following circumstances:

• to respond to lawful requests by public authorities, including but not limited to national security or law enforcement requests.

• to be required by law, such as to respond to court orders, or similar legal processes, to establish or exercise our legal rights or, defend against legal claims, or if in our judgment in such circumstances disclosure is required or appropriate.

• to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our various terms of use, or as otherwise required by law

7. International Transfer of Your Personal Data

Information that we collect may, from time to time, be stored, processed in or transferred between parties located in countries outside of Taiwan for purposes described in the Section 4 above, including for the purpose of data processing or storage on behalf of and under the control of Alchemy. We have hosting facilities in UK and European Economic Area (EEA). We adhere to the provisions in the PDPA, during the transfer of your Personal Information by ensuring appropriate safeguards are deployed and ensure that when required, these are part of Service contracts. Alchemy operations across EEA adhere to the EU General Data Protection Regulations 2018 to ensure data security. Your Personal Information may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. These countries include but are not limited to the United States of America (USA). Transfers to the USA will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission, a copy of which can be obtained from https://www.privacyshield.gov/. This arrangement imposes strong data protection obligations on companies receiving Personal Information from the EU, safeguards on US government data, effective protection and redress for individuals, and is subject to annual joint review by EU and USA.

8. Confidentiality and Security of Personal Information

We use physical, electronic, and procedural safeguards to protect Personal Information. We instruct our management and employees concerning legal requirements and company regulations related to privacy protection as part of our continuing efforts to manage Personal Information appropriately.

Our IT arrangements aspire to “Data Protection by Design” and should be able to detect a significant data breach. Where such a breach could result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage we will notify the relevant authority if required under the applicable laws. Where a breach is likely to result in a high risk to the rights and freedoms of individual data subjects, we will also notify those concerned directly and at the earliest practical opportunity. We shall then fully investigate any data breach and implement corrective actions to prevent recurrence.

By using Services or providing Personal Information to us, you are consenting to Alchemy communicating with you electronically regarding security, privacy, and administrative issues related to your use of Services. We may post a notice on the Site if a security breach occurs. In these circumstances, we may also send an email to you at the email address you have provided. Notwithstanding the foregoing, if your Personal Information is stolen, leaked, or altered or your interests may otherwise be compromised because of our failure to comply with the PDPA, we will notify you of the incident and the remedies that we have adopted as soon as we have carried out an investigation of the incident.

Data transmissions over the Internet are not 100% secure. Consequently, we cannot guarantee or warrant the security of any information you transmit to us and you do so at your own risk. Once we receive your transmission, we use reasonable efforts to ensure security on our systems.

9. Access to Personal Information

You may request details of Personal Information that we hold about you in accordance with the provisions of the PDPA. If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, or if you would like to request us to stop collecting, processing or using; or request to delete your above Personal Information, please email privacy@alchemyglobalsolutions.com

Disclosures will be made only of the Personal Information about the individual submitting the request. Where there is a controversy with respect to inaccuracy of the Personal Data, any process or use of such Personal Data will be stopped immediately.

The fee for processing the request is NT$ 40. The fee must be borne by the applicant. We will aim to supply the information within 30 days.

We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the PDPA.

10. Changes to the Privacy Statement

Alchemy reserves the right to revise, modify, or update this statement at any time in order to reflect any changes to Services or to comply with changes in our legal and/or regulatory obligations. We will notify you via email about material changes in the way we treat Personal Information, or by placing a prominent notice on the Site.

11. Contacting Alchemy for Complaints or Privacy Concerns

We have established an office in order to receive and respond to any inquiries and complaints concerning our handling of Personal Information efficiently and appropriately. Please note that any such communications must be in writing (which may include e-mail). The primary point of contact for all issues arising from this Policy, including requests to exercise data subject rights, is our Data Protection Officer. The Data Protection Officer can be contacted in the following way:

Address: 16F, No.89, Songren Rd., Xinyi Dist., Taipei City, Taiwan

Email: privacy@alchemyglobalsolutions.com.

We take complaints very seriously and will respond shortly after receiving written notice of your complaint. Alchemy is the data controller for the purposes of the Personal Information processed under this Policy. We do ask that you please attempt to resolve any issues with us first, although you have a right to contact the supervisory authority at any time.

Enacted 05/31/2021

台灣煉金通訊股份有限公司（統一編號：91115092）（下稱「台灣煉金」）位於台灣台北市信義區松仁路 89 號 16 樓。我們是一家全球服務公司，專營換購和回收服務、疑難排解 / 諮詢、產品採購、配件及現場管理服務，以及其他隨附之相關服務（合稱「服務」）。

1. 基本政策

台灣煉金 之營運嚴格遵守台灣法律、法規和指引之規定，包括個人資料保護法（下稱「PDPA」）， 我方依照公平資料處理之原則運作，即

• 以人們同意之方式使用資訊。

• 考量我方之處理會造成之影響。

• 透明並確保人們同意我方處理其資訊之方式。

為能反映服務之任何變更，或遵循法律和/或法規義務之變更，本政策（下稱「政策」）將定期更新，闡明我方據以處理向您收集或由您提供之任何資料之依據。 請詳細閱讀以下內容，以瞭解我方對於您的資料之觀點和作法，以及我方對其處理方式。

2. 本政策涵蓋範圍

本政策涵蓋我方如何處理由我方網站（下稱「本站」），或在更廣泛作業程序中，所收集和收到之任何個人資訊。我方不會販售或轉讓任何個人資訊，且僅將分享予我方之資訊用於管理和改善服務，和其他本政策及其他適用法律以及您同意之條款與條件所提供之目的。本政策說明：我方收集何種資訊；採取之保護和保全步驟；使用和分享資訊方式；以及最後，您能如何就問題或疑慮聯絡我方。

3. 我方處理之資訊

• 個人資訊：我方在以下情況收集您的個人資訊（例如：姓名、地址、電子郵件位址、電話號碼、職業、駕照和/或其他政府核發之身份證件影本等。）（下稱「個人資訊」），當您：

• 透過本站向我方詢問時。

• 向我方發送電子郵件時。

• 以客戶、供應商或員工身份與我方合作時。

• 您的其他資訊：您進入和使用服務時，我們可能會收集關於您、貴公司，以及您的設計和美學偏好之額外內容資訊。我們不會將此額外資料連結至我們所收集關於您的任何其他個人可識別資訊，且不會進行任何剖析活動。

• 付款 ：若您簽約購買我方服務，我方將需要您的付款資訊以辦理交易。付款資訊包括您的姓名、地址、銀行詳細資訊和其他辦理交易所需資訊。

4. 收集個人資訊之目的

• 個人資訊僅基於您已獲通知；有揭露資訊之合法利益；揭露資訊乃履行您與 台灣煉金合約之所需；及其他 PDPA 允許之目的來進行收集。

• 我方可能就申請處理、我方產品之運送和供應、售後服務支援和其他客戶支援活動，或其他運作服務等所需範圍內，使用向您收集之個人資訊。我方亦可能告知您可取得之新的和增加的產品、服務和機會。我方可能利用個人資訊來改善產品和服務，以及更加瞭解您的需求。我方亦可能利用個人資訊來進行背景調查，以判定是要繼續交易，亦或履行適用法律和法規之規定。

如有我方提議使用個人資訊之額外目的而尚未列於本政策者，它們將會於個人資訊收集時，或若個人資訊已基於其他您已獲通知之目的收集，則在開始使用個人資訊於該目的前，包含在任何我方徵求您同意之知情同意條款內。我方一定會給予您拒絕提供個人資訊或拒絕允許個人資訊使用於我方所提議之目的之選項；前提是若您拒絕提供或允許我方使用特定個人資訊，我方可能無法提供產品和服務。我方如何使用您的個人資訊：

• 誰將使用個人資訊：台灣煉金、台灣煉金之分公司，以及台灣煉金聘用以提供服務或達成

• 節所述目的之任何第三方。

• 地區：使用個人資訊各方（如上所述）之所在地。

• 方法：依據適用法律和法規來收集、處理和使用。

• 期間：我們將於客戶帳戶有效期間，或基於提供服務之需要──以及需於適用法律和法規下遵循法律義務以解決爭端和執行協議時，保留現有客戶資訊。我們將持續收集所有未來客戶之資料，直到您要求台灣煉金停止收集、處理或使用您的個人資訊或刪除您的個人資訊亦或收集您的個人資訊之目的已消失時。

5. Cookies

• 您進入本站時，會有一個小文字檔儲存在您的網路瀏覽器中，那就是 cookie。「cookie」會分配一個獨特的識別碼給您，如此每次您重新進入本站時，我方就能辨識您。我方使用 cookies 來幫助改善本站，並提供我方有關使用本站之資訊。特定第三方亦會於您瀏覽本站時在您的裝置放置 cookies。Cookies 幫助我方為您提供更個人化的體驗。就 cookies 方面您亦有選擇權。您可藉由修改您的瀏覽器偏好，選擇接受所有 cookies、於 cookies 設定時接收通知，或拒絕所有 cookies。若您選擇拒絕所有 cookies，您將無法使用那些服務，或參與需要放置 cookies 的活動。若您將瀏覽器設定為拒絕所有 cookies，本站之特定功能可能無法正常運作。

• 若您需要進一步資訊，請參閱第 12 節「聯絡台灣煉金」。

6. 揭露和分享個人資訊

台灣煉金不會基於行銷或促銷或任何未列於第 4 節之目的向第三方分享、販售、出租或交易個人資訊。必要時，台灣煉金會向其交易夥伴分享所需之個人資訊，以提供您向我方購買之商品和服務。

台灣煉金保留其被強制時向相關主管機關分享資料之權利，以於適用法律和法規下遵循法律義務。我方將使用第三方付款處理器來辦理商品和服務付款之卡片交易，但這些第三方僅獲授權於提供我方該服務需要時使用資料，並且禁止將個人資訊用於促銷目的。 我方可能在其他台灣煉金事業間分享個人資訊。資訊分享所及，其他 台灣煉金事業亦受資訊收集之原始主要目的約束。

台灣煉金可能在以下狀況揭露個人資訊：

• 回應公家主管機關之法律要求時，包括但不限於國家安全或執法要求。

• 受法律要求時，例如回應法院命令，或類似之法律程序，以建立或行使我方法定權利，或對法律申訴做出抗辯，或若我方判定當下狀況揭露為必要或合適時。

• 針對非法活動、疑似詐騙、涉及任何人身安全之潛在威脅的狀況、違反我方各種使用條款，亦或因應法律要求而進行調查、預防或採取行動時。

7. 您個人資訊之國際傳輸

我方收集之資訊可能有時會基於以上第 4 節所述，包括代表台灣煉金 或在台灣煉金控制下處理或儲存資料之目的，在位於台灣以外之國家儲存、處理或多方傳輸。我方在英國和歐洲經濟區域 (EEA) 皆有主機機房設施。傳輸您的個人資訊期間，我們會遵守 PDPA 條款，確保防護措施妥善佈署，並確保必要時這些皆為服務合約之一部份。台灣煉金在 EEA 之營運，遵守 2018年開始施行之《歐盟通用資料保護規則》，以確保資料安全。您的個人資訊亦可能由我方或我方供應商任用之在 EEA 以外地區作業的員工所處理。這些國家包括但不限於美國 (USA)。對美國之傳輸將受到妥善防護措施之保護，即，使用歐盟執行委員會採用或核准之標準資料保護條款，其副本可於 https://www.privacyshield.gov/ 取得。這項協議將重大之資料保護義務加諸從歐盟接收個人資訊之公司，防護美國政府資料，有效保護和補償個人，並每年由歐盟和美國聯合檢視。

8. 個人資訊之保密和安全

我方使用實體、電子和程序防護措施以保護個人資訊。 我方就隱私保護相關之法律規定和公司規則來訓練管理階層和員工，作為我方持續投入妥善管理個人資訊的一部份。

我方 IT 佈局力求「納資料保護於設計中」，且應可偵測到顯著的資料外洩。當此種外洩會導致歧視、聲譽受損、財務損失、保密性喪失，或任何其他顯著之經濟或社會損害時，我方將於適用法律規定為必要時通知相關主管機關。當外洩可能對個別資料主體之權利或自由造成高度風險時，我方亦將儘早於可行時機直接通知有關人士。我方應接著全面調查任何資料外洩，並實行矯正措施以預防再度發生。

經使用服務或向我方提供個人資訊，您即同意台灣煉金以電子通訊方式與您溝通有關使用服務之安全、隱私和行政管理事宜。我們亦可能於發生安全漏洞時，在本站張貼通知。在這些狀況下，我方亦可能發送電子郵件至您提供之電子郵件位址。縱有上述事項，若您的個人資訊遭竊取、洩露或竄改，或您的利益可能因我方未能遵守 PDPA 而受損，我方一旦完成事件調查，便將通知您事件經過及我方採取之補償措施。

網路上之資料傳輸並非 100% 安全。因此，我方無法擔保或保證任何您傳輸給我方之資訊安全，而您如此作時需自負風險。一旦我方收到您的傳輸，會盡合理努力確保我方系統之安全。

9. 個人資訊之存取

你可以索取我方依照 PDPA 條款所持有之您的個人資訊詳情。若您想要我方持有之您的個人資訊副本，或認為我方持有之您的任何資訊不正確、過時、不完整、不相關或有誤導之嫌，或您想要求我方停止收集、處理或使用；或要求刪除您的上述個人資訊，請來信 privacy@alchemyglobalsolutions.com 僅會揭露與提出要求之本人相關的個人資訊。當出現個人資訊不正確之爭議時，該筆個人資訊之任何處理或使用將立即停止。 處理該要求之費用為新台幣 (NT$) 40 元。該項費用必須由申請者負擔。 我方將於 30 天內提供該資訊。

在 PDPA 闡明之特定狀況下，我方保留拒絕提供我方所持有之您的資訊之權利。

10. 隱私權聲明之變更

台灣煉金保留隨時修訂、修改或更新本聲明之權利，以反映服務之任何變更，或遵循法律和/或法規義務之變更。我方將以電子郵件，或於本站放置明顯之公告，通知您有關我方處理個人資訊方式之實質變更。

11. 就客訴事件或隱私疑慮聯絡台灣煉金

我方已設立一間辦公室，以便能有效和妥善地接收和回應有關我方處置個人資訊之任何詢問和客訴。請注意，任何此類通訊皆應以書面進行（包括電子郵件）。 所有因本政策而起之問題（包括行使資料主體權利之要求）的主要聯絡窗口為我方之資料保護長。可經由以下方式聯絡資料保護長： 地址：台灣台北市信義區松仁路 89 號 16 樓 電子郵件：privacy@alchemyglobalsolutions.com。

對於客訴我方會嚴謹以對，並將於收到您客訴之書面通知後儘速回覆。台灣煉金係旨在本政策下處理個人資訊的資料控制者。 儘管您有權隨時聯絡主管機關，我方仍希望您能先嘗試與我方解決任何問題。 2021 年 5 月 31 日制定