Notification for the Collection, Processing, and Utilization of Personal Data

I. With respect to the collection, processing, use and international transmission of your personal data, we, KGI Futures Co. Ltd. (hereinafter “the Company”) hereby inform you of the followings according to Paragraph 1 of Article 8 of Personal Data Protection Act and if applicable, Article 13 of the EU General Data Protection Regulation:

No.	Notification Item	Notification Content
1	Purpose ofCollction	To operate the businesses approved by the competent authorities and in accordance with the Company’s business registration or articles of incorporation, including but not limited to futures, futures advisory enterprise, managed futures enterprise, securities introducing broker, securities investment consulting enterprise, Leverage transaction merchant, , as well as any other financial services the Company may be permitted to operate in the future (based on the latest scope of business announced by the Company). To perform matters and operations arising from contractual relationships, quasi-contractual relationships, or other legal relationships between you and the Company, and to provide services and operations related to your status as a customer or shareholder. These include credit investigation, marketing (including cross-selling and cooperative promotions), customer management and services, certificate management, e-commerce services, consulting and advisory services, statistical surveys and research analysis, information and database management, information and communications security management, internal audit and internal control system, risk management. To perform legal obligations, such as anti-money laundering and counter-terrorism financing operations, risk management, internal control and audit, whistleblowing systems, information security and management, and compliance with domestic and international financial regulations (including but not limited to the U.S. Foreign Account Tax Compliance Act (FATCA), Common Reporting Standard (CRS), and the EU Shareholders’ Rights Directive II (SRD II)). To comply with orders, investigations, and inspections by financial supervisory, judicial, tax authorities, and other authorities with judicial, prosecutorial, or administrative investigative authority, and to handle litigation, non-litigation, arbitration, or other financial disputes.
2	Types of Personal Data	Personal data collected within the necessary scope for the aforementioned specific purposes includes basic information (such as name, national identification number, passport number, date of birth, residential/work/email address, telephone/mobile/fax number, education, occupation, employer’s name, family status, etc.), account information, credit information, income information, asset or financial information, credit extension information, investment information, location data, online identifiers, data recorded by cookies and similar technologies, and any other information contained in relevant business application forms or contracts that can directly or indirectly identify an individual.
3	Duration of Use	Within the duration of the Company’s business operations as permitted by the competent authority, and within any of the following periods (whichever is the longest): The duration of the aforementioned specific purposes. The retention period as required by applicable laws or as stipulated in contracts (or similar agreements). The retention period necessary for the execution of business operations. The period consented by you.
4	Areas of Use	The relevant areas where the Company is authorized by the competent authority to operate and where its registered business activities or those stipulated in its articles of incorporation are conducted, as well as areas necessary for achieving the purposes of personal data collection, processing, and use, include: the Company (including its headquarters and all branches), parent companies, subsidiaries, or affiliates under the Company’s control or subordinate relationship, and their respective branches; areas where institutions or consultants that have contractual or business relationships with the Company or the aforementioned companies are located; areas where financial supervisory, judicial, tax authorities, or other domestic or foreign government agencies or third-party institutions to which data must be provided by law are located; and areas where recipients designated by you are located (in the case of international transmission of personal data, limited to jurisdictions not restricted by the central competent authority).
5	Entities Using Personal Data	The Company (including its headquarters and all branches), parent companies, subsidiaries, or affiliates under the Company’s control or subordinate relationship, and their respective branches (including but not limited to those engaged in cross-selling or sharing customer data with the Company); institutions or consultants (such as lawyers or accountants) that have contractual or business relationships with the Company or the aforementioned companies due to business needs (including but not limited to companies cooperating with the Company in promotional activities or entities entrusted in accordance with the “Directions for Operations Outsourcing by Futures Commission Merchants ”); and assignees of all or part of the Company’s business. Financial supervisory, judicial, tax authorities, or other authorities with investigative authority, or dispute resolution and credit agencies, including but not limited to the stock exchange, futures exchange, over-the-counter trading center, central securities depository, securities or futures industry associations (or other relevant trade associations), the Securities and Futures Investors Protection Center, the Financial Ombudsman Institution, This also includes other institutions designated by the competent authority related to business operations, supervision, issuance, trading, credit investigation, settlement, and financial supervisory authorities with jurisdiction over the recipients listed in Item 1, or other domestic or foreign government agencies or third-party institutions to which data must be provided by law. Recipients designated by you.
6	Method of Use	By means of automated machines or other non-automated methods (including but not limited to written, electronic, or international transmission), personal data will be used within the scope of the aforementioned specific purposes in a reasonable and lawful manner. If the EU General Data Protection Regulation (GDPR) is applicable, the Company will ensure that international data transfers are subject to an appropriate level of security protection as required by law. If the Company transfers your personal data to a country or jurisdiction that cannot guarantee a level of personal data protection equivalent to that of the Republic of China (Taiwan), the Company will require the recipient to enhance its data protection measures to a level equivalent to that of the Company, in order to ensure that your personal data remains protected despite the international transfer.
7	Your Rights and How to Exercise	You may exercise the following rights regarding your personal data held by the Company: To inquire about, request access to, or request a copy of your personal data (the Company may charge necessary fees to cover costs). To request supplementation or correction of your personal data (you must provide an appropriate explanation). To request the cessation of collection, processing, use, international transmission or to request deletion of your personal data (however, the Company may refuse such requests if it is necessary for the Company to comply with relevant laws, regulations, and contracts, or to carry out its business.). To request restriction of processing. To request data portability. To object to automated profiling. To object to the processing of personal data for direct marketing purposes. If you wish to exercise any of the above rights, you may submit a request through the following contact methods or any other means by which you can reach the Company. If you believe the Company has collected, processed, international transported, or used your personal data in violation of applicable regulations, you may also file a complaint with the Company or the competent authority. Contact Numbers: (02) 2361-9889. Official Website of KGI Futures
8	Impact on your rights if you refuse to provide your personal data	You have the right to freely decide whether to provide your personal data. However, if you choose not to provide such data, the Company may be unable to carry out the necessary reviews, processing operations, and other related services required for business purposes. As a result, the Company may refuse to engage in business transactions with you or process related matters and applications. For example, if you do not fully provide the personal data required for the Company to comply with the U.S. Foreign Account Tax Compliance Act (FATCA) in conducting U.S. account investigations, or if you do not consent to the Company reporting your U.S. account information to the U.S. federal government or the government of the Republic of China (Taiwan), the Company may, in accordance with the provisions of FATCA, be required to withhold taxes on certain payments and may further be required to close your account.

II.If the dealings between you and the Company call for collection of your personal data from TAIFEX’s information reporting system , the Company hereby informs you of the followings in accordance with Paragraph 1 of Article 9 of Personal data Protection Act and if applicable, Article 13 of the EU General Data Protection Regulation:

Your personal data, and breach records related to futures transactions is obtained by the Company from TAIFEX’s information reporting system for credit checking purpose. For other matters please refer to the above.

The Company will continue to collect, process, international transport and use your personal data in accordance with the content of this notification. The Company will not provide separate or repeated notifications for such collection, processing, and use within the scope of this notification.

You agree that the Company has the right to amend the content of this notification and that, upon such amendment, the Company may notify you by posting on its website or through verbal, written, telephone, SMS, email, fax, electronic documents, or any other means sufficient to inform or make the content accessible to you (including, but not limited to, providing a website link containing the full content of this notification via the aforementioned methods).

If the data you provide to the Company includes personal data of third parties other than yourself, you declare that you have properly informed such third parties that their personal data will be provided to the Company and will be collected, processed, international transported, and used within the scope of this notification. You shall also ensure that such third parties have consented to the aforementioned collection, processing, use, and international transfer of their personal data, and that they understand all legally required notifications and their rights. Therefore, the Company is not required to provide separate notification to such third parties.

III.Taiwan Futures Exchange (“TAIFEX”) Personal Information Protection Notification
The Company hereby provides on behalf of TAIFEX the following notification made in accordance with Paragraph 1, Article 9 of the Personal Information Protection Act and if applicable, Article 14 of the EU General Data Protection Regulation:

(1)Notifying party: TAIFEX.

(2)Purpose for collection: trading, settlement, supervision, audit of futures market.

(3)Type of personal information: name, date of birth, ID number (or FINI number), occupation, contact information, bank accounts, futures trading accounts, name, ID number of authorized persons, telephone number, name and telephone number of contact person, order placing and execution records, default records in domestic or foreign markets, settlement records, as well as other relevant information.

(4)Period: during the period TAIFEX is permitted by the Financial Supervisory Commission (“FSC”) to conduct its business.

(5)Parties to use: TAIFEX, Taiwan Stock Exchange, Taipei Exchange, TDCC, Futures Association, Securities and Futures Investors Protection Center, Financial Ombudsman Institution, tax or judicial authorities, FSC and its designated entities, as well as other institutions that may obtain your personal information under the laws.

(6)Location: Taiwan.

(7)Method: in writing or electronic files

(8)Others:

(a)TAIFEX is not able to cease collecting, processing, using, or deleting your personal information per your request, for carrying out its market supervisory duties.

(b)Make inquiries, request to view or request a duplicate copy:

i.you may do so during TAIFEX’s office hours with regard to your account opening information, futures trading and execution records, settlement records, and default records in domestic or foreign markets.

ii.please approach your futures broker for other information.

(C)Supplement or revise personal information: please approach your futures broker for such request.

You are free to provide your personal information. However, if you refuse to provide, the Company nor the TAIFEX will not be able to carry out the necessary review and process and provide other related services. Therefore, the Company may reject your request or application for conducting business or other related matters with the Company.

The Company will collect, process, use and internationally transmit your personal information in accordance with this Statement. The Company will not inform you again if the collection, process, use and international transmission of your personal information is within the scope of this Statement.

You agree that the Company may amend the contents herein and may inform you of the updated version by any method that enables you to be aware of the amendment, including but not limited to, posting the same on company website(s) or providing links to such website(s), disclosing the same verbally or in writing, via telephone, messages, e-mails, fax, or electronic documents.

If the information you provide include personal information of a third party, you should and you represent you have, inform such third party that his/her personal information will be provided to the Company. You should ensure the third party agrees the Company may collect, process, use and internationally transmit his/her personal information and that he/she understands the contents he/she should be notified and his/her rights; thus the Company does not need to inform the third party again.