Current version dated January 01, 2023

WPG Holdings, a Taiwan corporation, and its affiliates (collectively, “WPG”, “we”, “our” or “us”) values your privacy. We commit to protect your privacy with the highest level of security. To understand how we process your personal information, please read this Privacy Statement (hereinafter this “Statement”) carefully:

A. What is personal information?

Personal information means data that can be used to identify, or can reasonably be linked directly or indirectly to, an individual. Identification can be by the data alone or in conjunction with any other data in our possession. Examples of personal information include your name, birth date, location, country of residence, photographs, email address.

B. Personal information we collect and the purposes of collection

We will use automatic or non-automatic methods permitted by the laws and regulations to process your personal information. The chart below outlines, by the business process involved, the types of personal information we collect under such process, the purpose of collection and processing, and how we process the personal information. We also describe how you can manage your personal information with us.

Where you have authorized sharing of account information of your account with third parties (such as WeChat, Weibo, QQ, Line, Facebook) to your WPG website account, we may obtain from such third parties your account information after you agree to this Statement, so that you can directly access our WPG website through your third party accounts. We will use your personal information in accordance with our agreement with such third parties, after verifying the legitimacy of the source of the personal information, and subject to the relevant laws and regulations.

If we seek to use your personal information for other purposes not described in this Statement, or if we seek to use personal information collected for a specific purpose for other purposes, we will always seek your prior consent.

C. Retention and deletion

We retain your personal information within the following time periods, whichever is longer:

1. within the minimum duration necessary for fulfilling the above purposes and conducting relevant business;
2. within the period if we are required by applicable laws or regulations to retain the information; or
3. as long as necessary to assist with any governmental and judicial investigations, to initiate or defend legal claims or for the purpose of civil, criminal, or administrative proceedings.

After the above periods have expired, we will delete or anonymize your personal information in accordance with applicable legal requirements.

Please note that all personal information provided by you when using our products and/or services will continue to be used by us for the duration of your use of our products and/or services, unless you delete the personal information or refuse to allow us to collect your personal information by adjusting system settings.

If you request to delete personal information in the course of using our products and/or services, some products and/or services may no longer be available to you.

When you cancel your account, we will stop using your personal information, and will delete or block and anonymize your personal information.

D. Data transfers

Your personal information will be treated as strictly confidential and will be shared only in the following circumstances:

1. With your prior consent.
2. To our affiliated entities within our global group of companies and branches worldwide to provide you our services, for internal administration purposes, to detect and deal with data breaches, illegal activities, and fraud, and to maintain the integrity of our information technology systems.
3. To third party service providers whom we sub-contract to work on our behalf or for us and therefore may have access to your information only for the purposes of performing services on our behalf and under obligations similar to those in this Statement. The services provided by these service providers are categorized as follows:
   1. Information analysis services and information testing services: In order to better optimize our website and services, we will share or provide the information we collect to third party service providers that provide such optimization services. We will de-identify your personal information before sharing or providing it to such third party service providers. If some information cannot be de-identified, we will obtain your individual consent before sharing or providing it.
   2. Personal information audit and information management: In order to obtain professional audit and information management services, we may share or provide the information we collect to third party service providers that provide such audit services.

• Personalized services: In order to better personalize and improve our services to you, we may share or provide your personal information to third party service providers who provide such personalization services and business partners who assist us to provide you our services, including but not limited to credit card services and payment services.

1. As necessary to comply with applicable laws and regulations, the requirements of legal process, or mandatory administrative or judicial requirements, including detecting and dealing with data breaches, illegal activities, and fraud, we may share or provide your personal information to third party service providers who provide such relevant services and/or to parties as required by laws and regulations, legal process or administrative or judicial requirements.

In all instances of data transfers, we will inform you in advance of the name of the recipient, the contact details, the purpose of processing, the manner of processing, and the type of personal information involved. We will ask the data recipient to fulfill their data protection responsibilities and obligations as stipulated by the relevant laws and regulations and our data transfer agreements with them.

E. International data transfers

As noted above, WPG may transfer your personal information to the above-mentioned recipients who may be in countries other than the country in which you reside. Although these countries may have data protection laws that are different to the laws of the country you reside in, we ensure appropriate safeguards in place so that your personal information will remain protected in accordance with this Statement.

F. Data from Minors

WPG’s products and services are not designed nor intended to be used by children under 16 years of age. If children under the minimum age of the relevant jurisdiction must use WPG’s products and services, explicit parental consent must be provided and verified. If WPG is notified or discovers that data collected is from a child under the minimum age, WPG will take procedures to delete the information as soon as possible.

G. Your rights over your data

In accordance with applicable data protection laws, you may exercise the following rights over your personal information upon our satisfactory verification of your identity:

1. You may request to access your personal information that we collect about you or request a copy of your personal information, provided that your request will not adversely impacYot WPG or others’ interests and rights and except as otherwise required by law and regulations. If you wish to exercise your right of access, you can view your personal information, linked accounts, order history and other information by logging into your account on our website. If you are not able to access to your personal information through our website, you may contact us at any time through the means set forth in the “Contact Us” section below, and we will respond to your request for access within 30 days (or within the period required by applicable law).
2. You may request WPG to supplement or correct your personal information, provided that you are able to provide a reasonable explanation. You may contact us through the methods listed in the “Contact Us” section below to request that we supplement or correct your personal information.
3. You may request WPG to cease processing or erase your personal information, provided that WPG has no legal grounds to keep processing your personal information. Where we act on your deletion request, we will also notify the entities from which we received your personal information to request its timely deletion, unless otherwise required by law or regulation or unless these entities have your independent authorization. When you delete information from our Services, we may not immediately delete the corresponding information from our backup system, but we will delete the information when the backup is updated.
4. You may notify us to change the scope of your consent:
   1. Each of our business functions requires some basic personal information in order to complete its tasks. You may provide or withdraw your consent to the collection and use of additional personal information collected at any time.
   2. You may change the extent to which you authorize us to continue collecting personal information, or withdraw your authorization by deleting information, turning off device features, making privacy settings on web pages, etc. You may also withdraw your authorization for us to continue to collect your personal information for a particular session by logging out of your account. When you withdraw your consent, we will no longer process the corresponding personal information. However, your decision to withdraw your consent will not affect the processing of personal information that was collected based on your prior authorization.

• If you do not want to receive promotions and advertisements from us, you can unsubscribe at any time by using the unsubscribe form we provide.

1. You may cancel your previously registered account at any time by contacting us as set forth in the “Contact Us” section below to request a cancellation or for additional advice. Upon cancellation of your account, we will cease providing you with products or services and, at your request, delete your personal information, except as otherwise required by laws or regulations.
2. For some business functions, we may make decisions based solely on non-manual automated decision- making mechanisms, including information systems, algorithms, etc. If these decisions significantly affect your legal rights, you have the right to request an explanation and to refuse to allow us to make decisions based solely on automated decision-making mechanisms. If these decisions significantly affect your legal rights, you have the right to request an explanation and the right to refuse to allow us to make decisions that significantly affect your personal rights through automated decision-making only, and we will provide appropriate remedies to protect your personal rights.

For security purposes, in making the above rights requests, you may be required to provide a written request. We may also ask you to verify your identity before we process your request. We will respond to your written request and verification of identity as soon as possible after we receive your information.

In principle, we do not charge a fee for reasonable requests, but we reserve a right to charge a fee for repeated requests that exceed reasonable limits, as appropriate. We may deny requests that are unreasonably repetitive, require excessive technical means (for example, requiring the development of new systems or a fundamental change in current practices), pose a risk to the legal rights of others, or are highly impractical (for example, involving the backup of information stored on tapes).

We may not be able to respond to your request in the following circumstances:

1. for compliance with a legal obligation which requires processing by a law or regulation to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
2. for reasons of public interest in the area of public health;
3. for the establishment, exercise or defense of legal claims.

H. Security

We have used industry-standard security measures to protect the personal information you provide to us in order to prevent your personal information from unauthorized access, public disclosure, use, modification, damage or loss. We take all reasonably practicable measures to protect your personal information, including but not limited to appropriate encryption, de-tagging, and other security technology measures.

We have implemented technical and organizational security measures to protect and store your personal information. Such measures include, for example, limiting the permissions of those who process personal information to only those employees and authorized service providers who need to know such information pursuant to the purpose of this Statement, and other security technology measures, and implementing other administrative, technical and physical safeguards.

We will take all reasonably practicable steps to ensure that no irrelevant personal information is collected and that the personal information that is collected is managed in a categorical manner. We will retain your personal information only for the period of time explained in this Statement, unless an extended retention period is required or permitted by law. After the retention period, we will delete your personal information or anonymize it as required by applicable law.

We have established internal management systems and operating procedures to ensure that your personal information is processed and protected in a lawful manner.

Because of the inherent risks associated with the Internet as an open global communications system, we will use our best efforts to protect our systems, websites, operations and information from unauthorized access, use, modification and disclosure, but we cannot guarantee that any information transmitted or stored on our systems will be free from intrusion by others (e.g., hackers).

I. How to contact us

If you have any questions about this Statement or intend to exercise any of the above rights, please send your request to this email: [wpgh_privacy@wpgholdings.com].

J. Changes to Statement

We may make amendments to this Statement when needed to reflect changes in our privacy practice. We will notify you of such amendment through our website or send the amendment to your email address. We encourage you to regularly review this Statement to understand how your data is handled.

K. Additional Information for Residents in other Jurisdictions

WPG is a multinational group with companies and operations all over the world. Some of our businesses primarily operate in Taiwan and Mainland China. By using our services and providing us with your information, you acknowledge and understand that the transfer, storage and processing of your personal information may be performed in countries other than the country in which you reside. WPG may be required to supplement the Statement under the laws of other countries. If you are a resident of such other countries, you may find out more information about your privacy rights in the following parts.

a. Additional information for EU residents

When you are in the European Union, the European Regulation (EU) 2016/679, also referred to as the “General Data Protection Regulation” or “GDPR”, applies to the collection and processing of your personal information by WPG.

If WPG is not able to obtain a valid consent to process your personal information from you, WPG may still collect and process your personal information based on the following legitimate interests of WPG or a third party:

1. Implementation and operation of a group-wide organizational structure and group-wide information sharing;
2. Right to freedom of expression or information, including in the media and the arts;
3. Prevention of fraud, misuse of company IT systems, or money laundering;
4. Direct marketing to WPG’s existing clients;
5. Operation of a whistleblowing scheme;
6. Physical security, IT and network security;
7. Internal Investigations;
8. Proposed mergers and acquisitions

In the above circumstances, you may object to such processing based on the legitimate interests of WPG or a third party (except direct marketing), unless WPG has compelling legitimate grounds for the processing which override your interests, right and freedoms. You may also choose to opt out of direct marketing from WPG at any time; in such case, WPG will stop sending you marketing materials or personalized content without undue delay.

In addition to the right of objection and the rights described in the section “Your rights over your data” of this Statement, you also have the right to withdraw your consent to WPG’s processing of your data at any time, provided that the processing is based on your consent, and the right to transmit your personal information provided by you to another entity designated by you in a structured, commonly used and machine-readable format. However, WPG will refuse your request to transmit your personal information if the processing of such personal information is not based on your consent or a contract with you or is not carried out by automated means.

If WPG transfers your personal information from EU to non-EU region, we will adopt appropriate measures such as the standard contractual clauses to safeguard your personal information and your privacy rights where the recipients are not located in countries subject deemed to have an adequate level of data protections by the European Commission.

WPG’s representative for GDPR purposes in the European Union is [WPG EMEA B.V.], with registered address in [Zekeringstraat 42, 1014BT Amsterdam]. If you have any concerns or any questions about your privacy rights, you may contact us by using the methods described in the section “How to Contact us” of this Statement or by communicating with our DPO email address (DPO@wpgholdings.com). If you are not satisfied with our response, you may contact the competent supervisory authority of your place of residence. In this link you can find the contact details of the supervisory authority in EU.

b. Additional information for Singapore residents

When you are in Singapore, the Singapore Personal Data Protection Act 2012 shall also apply to the collection, processing and use of your personal information by WPG. If the processing of your personal information is based on your consent, including your agreement to provide your personal information due to the contract between you and WPG, you may have a right to withdraw your consent at any time by giving a reasonable notice to [wpgh_privacy@wpgholdings.com].

c. Additional information for South Korea residents

When you are in South Korea, the South Korea Personal Information Protection Act shall also apply to the collection, processing and use of your personal information by WPG.

The deletion procedures and methods are as follows:

1. Deletion Procedure: WPG will delete personal information after the retention period is expired. The retention period is decided in accordance with the purpose of the collection and use or the legal requirements to retain personal information.
2. Deletion Methods: WPG will dispose of the personal information contained in documents or in paper form by way of physical destruction, such as shredding, of all such documents containing personal information. If the personal information is in electronic form, WPG will use appropriate tools or techniques to complete their deletion or exclude from further processing permanently and irreversibly.

You are entitled to exercise all the rights described in the Section “Your rights over your data” in this Statement. However, please note that WPG may charge a reasonable fee within the scope of the actual cost if you request for right of access.

d. Additional information for California residents

If you reside in California, the California Consumer Privacy Act will apply to the collection, processing and use of your personal information by WPG. If you are a California resident, you have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we retain. You also have the right to request WPG to delete your personal information, subject to legal exceptions.

Please make your requests through the designated email address specified in the Section “How to contact us” in this Statement, or by the toll-free number: [888-WPG-8881]. If you authorize an agent to make requests on your behalf, please provide your agent a signed permission for him/her to make requests. Before responding to your requests, we may need to verify your identity or the identity of your authorized agent. We may contact you through the contact details you provide in your member account to confirm the authenticity of the requests. Therefore, please make sure your contact details are up-to-date. If WPG fails to verify your identity, we may refuse the requests you make. You also have a right not to receive discriminatory treatment by WPG for the exercise of your privacy rights.

For the personal information we have collected in the preceding 12 months, the source of the personal information and the purposes of collection, please refer to the section “Personal information we collect and the purpose of collection” in this Statement.

WPG does not sell your personal information.

e. Additional information for residents of the Mainland China

If you reside in the Mainland China, the Personal Information Protection Law of the People’s Republic of China (hereinafter “PRC PIPL”) will apply to the collection, processing and use of your personal information by WPG.

Please note that pursuant to the PRC PIPL, WPG is not required to obtain your consent before collecting and processing your personal information under the following circumstances:

1. a) Collecting and processing your personal information is in relation with national security and/or national defence security.
2. b) We process your personal information which has been disclosed to the public by you or, if you are a minor, by your parent or guardian to the extent that the processing will not cause major influence on your rights and interests.
3. c) We collect your personal information which has been lawfully disclosed; for example, collecting through lawful news reports or through government information.

Please note that pursuant to the PRC PIPL, WPG may disclose your personal information to the public under the following circumstances:

1. a) Obtaining your explicit consents.
2. b) Disclosing your personal information as required by laws, legal process, litigation process, or requested by the authority.

Please note that pursuant to the PRC PIPL, WPG may transfer, share, provide, disclose your personal information to the public without your consents under the following circumstances:

1. a) Processing your personal information to the public is in relation with national security and/or national defence security.
2. b) Processing your personal information as required by laws, legal process, litigation process, or requested by the authority.
3. c) We process your personal information which has been disclosed to the public by you or, if you are a minor, by your parent or guardian to the extent that the processing will not cause major influence on your rights and interests.
4. d) We collect your personal information which has been lawfully disclosed; for example, collecting through lawful news reports or through government information to the extent that the collecting will not cause major influence on your rights and interests.

Please make your requests through the designated email address specified in the Section “How to contact us” in this Statement. Please note that in addition to the circumstances described in the section “Your rights over your data” of this Statement, pursuant to the PRC PIPL, WPG may not be able to respond to your request in the following circumstances:

1. a) The request is in relation with national security and/or national defense security.

2. b) There is sufficient evidence showing that you make the request without faithful intention or showing that you are abusing your right.