Notes on the obligation to notify the Personal Data Protection Act

Creasys Information Co., Ltd. (hereinafter referred to as the Company) collects personal information from the subject in accordance with the Personal Data Protection Act（hereinafter, the “PDPA”）. The Company collects personal information from the subject in accordance with Article 8, Paragraph 1 of the PDPA, and shall clearly inform the subject of the following matters.

The Company shall collect, process and use personal information only for the purpose of carrying out its business or duties, and shall respect the rights and interests of the individual concerned, act in good faith and in a trustworthy manner, and shall not exceed the scope necessary for the purpose of collection.

The Company may collect, process, and utilize the information according to the type and nature of its business and other business needs within the scope of its business registration or articles of incorporation.

Period, area, target and method of use of personal information:

(i) Period: The duration of the specific purpose, the period of time required by the relevant laws and regulations or necessary for the execution of business, or the period of time required by individual activities for the preservation of data. (Whichever is the longest)

(ii) Location: The domestic and foreign locations of the “subject of personal information as”.

(iii) Target: The Company (including external organizations entrusted by the Company to handle affairs), organizations that are required by law to use personal information, other business-related organizations, and those who are authorized by law to do so, and those who are agreed to by customers.

(iv) Method: Automated or other non-automated methods of use in accordance with the relevant laws and regulations of the PDPA.

In accordance with Article 3 of the PDPA, the subject may exercise the following rights with respect to personal information held by the Company, which may not be discarded in advance or restricted by contract:

(i) To make inquiries or requests for access.

(ii) To request a copy.

(iii) To request additions or corrections.

(iv) To cease collection, processing or use.

(v) Request for deletion. 

The parties are free to choose whether to provide the relevant personal information and categories, but the personal information and categories that the parties refuse to provide may not be available to the Company for business audits or operations. The Company may not be able to conduct the necessary business audits or operations if the information is required for business audits or operations. Please note that the Company may not be able to provide the necessary business audits or operations if the information is required for business audits or operations.