Information Security Measures

Information Security Organization

In response to the digital trend, the importance of the network, IT system, and data security is becoming increasingly important, while the demand and expectations of the competent authorities and stakeholders for the Company’s information security are also on the rise. If the quality of the Company’s system is not up to standard, information leaks or service interruptions will result in expensive costs and damage the Company’s reputation. In light of this, RichWave has formed an interdepartmental information security management team with the President as the convener, while the Information Technology Department and Administrative Management Department are in charge of offering directions and planning, with support and cooperation from various business units. The Information Security Management Team convenes regular meetings to review the Company’s information security system operations, and it must report information security- related implementation status to the Board of Directors at least annually to obtain advice and guidance from the highest level of the Company. This is to ensure the operational effectiveness of RichWave’s information security management. On December 19, 2025, the information security team briefed the Board of Directors on the company’s information security operational status, receiving guidance and confirmation from the Board of Directors.

Information Security Policy

Board-approved "Information Security Risk Management Policy and Procedures" have been established by the Company in order to protect the confidentiality, integrity, and availability of information assets related to employees, suppliers, and customers, and to ensure the reliability of the Company's information services. This policy governs the Company's actions regarding information asset inventory, information security awareness, Company data confidentiality, information equipment maintenance and backup, personal computer security system maintenance, and the reporting of information security incidents. With these measures, we hope to ensure the continued viability of the company's information business.

By implementing information security management procedures, the company ensures the security and veracity of electronic data in various systems and meets the policy objectives of sustaining the company's normal business operations. The policy applies to all of RichWave’s system data and information equipment, regulating the company’s information security control operation (including authorization control, file management, and anti-virus measures), data processing operation, information equipment management and maintenance, form filling operation and form storage period, thereby guaranteeing that the company’s system can engage in effective hierarchical control, important data can be kept, reviewed adequately, and the information system can be comprehensively protected and backed up. Additionally, the company regularly establishes a data backup system to conduct disaster recovery drills and engender an effective data security protection environment in conjunction with the information security system for the sake of ensuring the company’s sustainable operation. In 2025, the Company invested resources in information security management, performing one information system security update, 12 application system security updates, one mail server system security update, and four firewall upgrades. Through multi-layered system updates and upgrades, as well as system and information security health checks, we ensure the security of the Company's information systems.

Regarding the Personal Data Protection Policy, the policy covers all personal data collected by the Company in its global operations, as follows:

RichWave's information security management measures

Information Security Training and Education

To instill information security awareness in our colleagues and make every employee an integral part of the Company’s information security protection network, RichWave provides information security education and training to all new employees and irregularly promotes information security awareness through email communications. The new employee information security orientation includes an introduction to the Company’s information system, document management system, electronic form operations, computer and network regulations, and USB regulations. RichWave’s information security supervisor provides a briefing to new employees to ensure their understanding and compliance with the Company’s information security policies and regulations.

The Company continues to monitor current information security trends and launches awareness campaigns targeting high-risk issues, which are communicated through the internal announcement system. These campaigns address issues such as account security management and phishing emails, aiming to enhance employees’ information security awareness, promote vigilance in email usage, and enforce regular updates of system login passwords. In June and October 2025, we held two information security education and training sessions to share insights on domestic and international security incidents and their associated losses. The sessions covered topics such as common information security risks, hacker attack techniques, social engineering, and password management. A total of 291 and 299 employees attended the sessions, respectively, resulting in a combined total of 590 training hours. The course recordings are stored in the Company’s document management system, allowing our colleagues to learn and review the materials online at any time.

Customer Privacy

RichWave values the trust between the Company and its customers and is committed to ensuring the security and confidentiality of all information involved in business transactions. Although our business does not involve collecting personal data from end customers, we maintain the confidentiality of any personal data and business secrets that may be encountered during commercial transactions. We strive to protect all privacy and data in accordance with industry standards throughout the cooperation process and to use all business data solely for the purpose of fulfilling our mutual agreement. To ensure data security, we have implemented strict confidentiality measures and established a dedicated unit to handle relevant matters. As of 2025, RichWave has not received any complaints regarding data protection or confidentiality.