Personal Data Collection Notice for Local Network Services

Taiwan Fixed Network Co., Ltd. (hereinafter referred to as "the Company") hereby explicitly informs you of the following matters in accordance with Paragraph 1, Article 8 and Paragraph 1, Article 9 (where applicable) of the Personal Data Protection Act (hereinafter referred to as "the PDPA"):

I. Specific purposes for collecting your personal data to provide local network services (hereinafter referred to as "the Service") are as follows:

II. Categories of Personal Data Collected for the Provision of the Service

1. Information Provided by You: Includes your name, National ID number, date of birth, contact information, and any other details provided in the service application form or contract, as well as information required to be retained by law.
2. Subscriber Number: The unique identification number(s) assigned to you by the Company.
3. Location Information: Refers to the location data generated through your use of the Service.
4. Billing Information: Includes communication logs, billing records, and payment methods (such as bank account details, credit card numbers, etc.) generated by your use of the Service; service history logs; and other personal data related to your account (including project contract data combined from non-Service sources, such as third-party project fees bundled with telecommunications billing).
5. Other Service Information: To optimize the Service and assist you in selecting the most suitable products/services, the Company may analyze your personal data and use the results to improve and develop our products and services.

III. Period for Processing and Utilization of Personal Data

1. Duration of Specific Purposes: The Company will process or utilize your personal data during the period in which you use the Service.
2. Post-Contract Termination or Rescission: After this Contract is terminated or rescinded (i.e., you no longer use the Service), the Company will retain your personal data for a minimum period of one year, in accordance with the Telecommunications Management Act and other relevant laws and regulations.

IV. Regions for Processing and Utilization of Personal Data

The domestic locations of the recipients listed in the following section, "Recipients of Personal Data Processing and Utilization."

V. Recipients of Personal Data Processing and Utilization

1. The Company: Including any third-party outsourced agencies delegated by the Company to process relevant matters.
2. Agencies/Organizations Authorized by Law: Agencies or organizations authorized to collect, process, and utilize personal data in accordance with laws and regulations (e.g., Number Portability, or database-assisted verification agencies designated by central competent authorities, such as the National Immigration Agency or the National Police Agency of the Ministry of the Interior).
3. Parties Consented to by You: Specific third parties to whom you have provided explicit consent (e.g., parties specified under the "Individual Negotiation Terms for Third-Party Marketing").

VI. Methods of Personal Data Processing and Utilization

1. Account Management and Service Provision: Establishment of customer profiles to facilitate account management and the provision of services.
2. Billing and Invoicing Operations: Execution of billing, invoicing, and payment processing based on your network usage data and billing information.
3. Business Communication and Notifications: Contacting you for business purposes or notifying you of information related to the Service via various contact methods. This includes sending bills and payment reminders to your address or email, or contacting you/the actual user of the Service via telephone or SMS regarding payment status and debt collection.
4. Service Optimization and Development: Analyzing your personal data to optimize the Service, and utilizing the results to improve or develop features, as well as providing recommendations for tariff plans suitable for your needs.

VII. Rights and Methods for Exercising Your Personal Data Rights (In Accordance with Article 3 of the PDPA)

1. Right to Access and Copy: You may inquire about or request to review your personal data held by the Company, or request a copy thereof. In accordance with Article 14 of the PDPA, the Company may charge a reasonable fee to cover necessary administrative costs.
2. Right to Supplement or Correct: Pursuant to Paragraph 1, Article 11 of the PDPA, the Company shall, either voluntarily or upon your request, supplement or correct your personal data. However, in accordance with Article 19 of the Enforcement Rules of the Personal Data Protection Act, you shall provide an appropriate explanation of the reasons and facts.
3. Right to Cease Processing or Utilization (Accuracy Disputes): Pursuant to Paragraph 2, Article 11 of the PDPA, if the accuracy of your personal data is in dispute, the Company will voluntarily, or upon your request, cease processing or utilizing said data. This does not apply if the processing is necessary for the performance of business operations, or if you have provided written consent with the dispute specifically noted.
4. Right to Deletion or Cease Collection (Unlawful Processing): If you believe the Company has collected, processed, or utilized your personal data in violation of the law, you may, pursuant to Paragraph 4, Article 11 of the PDPA, request the deletion of your data or a cessation of its collection, processing, or utilization. The Company will investigate the alleged violation and notify you of the outcome.
5. Right to Deletion or Cease Utilization (Post-Contract/Purpose Completion): Upon termination or rescission of this Contract, or if you believe the Company no longer requires your personal data, you may, pursuant to Paragraph 3, Article 11 of the PDPA, request the deletion of your data or a cessation of its processing or utilization. However, the Company may continue to retain, process, or utilize your data if it is necessary for business operations (e.g., as required by statutory retention periods) or if your separate written consent has been obtained.
6. Response to Requests: The Company shall respond to your requests to access, review, or provide copies of your collected personal data, except under circumstances specified in the provisos of Article 10 of the PDPA.

VIII. Methods for Exercising Your Rights If you wish to exercise any of the rights stipulated under Article 3 of the PDPA as mentioned above, please contact our local service centers or use the following channels for inquiries and assistance: 24-hour Toll-free Customer Service: From Taiwan Mobile lines: Dial 809 (Direct dial) From Landlines: Dial 0809-000-809 Official Website (Online Support): https://www.twmsolution.com/service/

IX. Voluntariness and Impact of Non-Provision of Personal Data You may freely choose whether or not to provide your personal data and the categories thereof. However, the personal data required during the application process for the Service are mandatory fields necessary for identity verification and notifications. If the information provided is incorrect or incomplete, the Company may be unable to process your application, or you may not receive essential information related to the Service in a timely manner. Other personal data is automatically generated and recorded during your use of the Service. If you are unwilling to allow the Company to process or utilize such data, please follow the methods for exercising your rights as described in Section VIII above.

X. Utilization Beyond the Specific Purposes of Collection

1. Exceptions for Utilization Beyond Specific Purposes: The Company will only utilize your personal data within the necessary scope of the specific purposes (as detailed in Section I). However, under the following circumstances as stipulated in Article 20 of the PDPA, the Company may utilize your personal data beyond the original purposes:
Explicit Legal Requirements: e.g., providing personal data to judicial police agencies in accordance with the Communication Security and Surveillance Act.
Necessity for Public Interest or Prevention of Grave Harm: e.g., preventing, stopping, or reporting fraudulent or cybercriminal activities in accordance with the Fraud Crime Hazard Prevention Act.
Protection of Life, Body, Liberty, or Property: e.g., providing your location information to authorized third parties when your whereabouts are unknown.
Public Interest for Statistical or Academic Research: Providing data to government agencies or academic institutions in an unidentifiable form (as detailed in Section XI) at their request for necessary research or statistics.
With Your Consent: e.g., parties specified under the "Individual Negotiation Terms for Third-Party Marketing."
2. Period of Utilization Beyond Specific Purposes: Based on the statutory retention periods required by law, or the specific retention years agreed upon through individual project negotiations, whichever is longer.
3. Processing and Utilization of Irretrievable and Unidentifiable Data:
De-identification Techniques: The Company will process your personal data using de-identification or other data minimization techniques (detailed in Section XI) such that individuals cannot be objectively re-identified. Results in the form of statistics, trend analysis, or other non-identifiable formats may be provided to enterprise clients, content providers, or innovative research units authorized by competent authorities to serve as a basis for business decisions or technological development (e.g., helping content providers understand consumer click-through rates or demographic distributions).
Right to Opt-Out: If you wish to stop the Company from processing and utilizing your personal data using the aforementioned irretrievable methods, you may notify us through the contact channels listed in Section VIII. This does not apply to data already utilized/processed before your request or where otherwise stipulated by law.

XI. Descriptions of Our Irretrievable De-identification Methods

The methods employed by the Company to ensure data is irretrievable and unidentifiable include, but are not limited to, the following:
1. Pseudonymization: The process of replacing personal identifiable information with codes or aliases to prevent direct identification.
2. Masking: The partial replacement of data with special characters, such as "〇" or "※," to conceal sensitive portions.
3. Hashing: Applying a cryptographic function to sensitive information to produce a fixed-length hash value (e.g., SHA-256) which replaces the original data.
4. Suppression/Redaction: The removal of identification data from a dataset or its replacement with labels (e.g., retaining only the last 6 digits of a National ID number or deleting the National ID field entirely).
For more information, please visit: Taiwan Mobile \ Sustainability (ESG) \ Ethical Management \ Personal Data Security and Privacy Protection
https://corp.taiwanmobile.com/esg/ourVision.html

Individual Negotiation Terms for Third-Party Marketing

1. Marketing Communications:
▢ I Agree ▢ I Disagree to the Company sending or providing commercial information, promotional offers, and marketing materials regarding services other than the Local Network Service and/or services provided by third parties (such as affiliates, joint marketing partners, or co-branding partners). If no option is selected, it shall be deemed as "I Disagree." Your disagreement will not affect your access to or use of the Service.

2. Data Sharing with Third Parties:
▢ I Agree ▢ I Disagree to the Company providing your personal data (categories and content as detailed in Section II of this Notice) to third parties (affiliates, joint marketing partners, or co-branding partners) for the purpose of marketing products, providing service information, or promoting special offers. If no option is selected, it shall be deemed as "I Disagree." Your disagreement will not affect your access to or use of the Service.

3. Right to Withdraw Consent:
You may, at any time, request to cease the aforementioned consented activities through our business locations, telephone, website, or other service channels disclosed in Section VIII of this Notice. However, this does not apply to data already processed or utilized prior to your request, or where otherwise stipulated by law.

I hereby acknowledge that I have fully understood the contents of the aforementioned statements and terms, and affix my signature as evidence hereof.

Signature of Applicant:
Signature of Agent/Representative: