Information Security and Privacy Management Policy

Purpose

BlockChain Security (hereinafter referred to as "the Company") is committed to strengthening its information security and privacy management and ensuring the confidentiality, integrity, and availability of its information assets. This policy is established to provide a secure information environment that supports the continuous operation of the Company's business activities and complies with applicable legal and regulatory requirements. It is designed to protect the Company's information assets from both intentional and accidental internal and external threats.

Scope

This policy applies to all employees, contractors, temporary personnel, and supplier personnel of the Company.

Definitions

1. Information Assets: Hardware, software, services, documentation, and personnel required to support the normal operation of the Company's information systems and business activities.

2. Information Environment for Business Continuity: The computing and information technology environment necessary to ensure the uninterrupted operation of the Company's business functions.

Objectives

The Company is committed to maintaining the confidentiality, integrity, and availability of its information assets while safeguarding user privacy. Through the collective efforts of all personnel, the Company aims to achieve the following objectives:

1. Protect business information from unauthorized access, disclosure, alteration, or destruction, ensuring its accuracy and completeness.

2. Establish a cross-functional information security and privacy management organization responsible for developing, implementing, promoting, and continuously improving information security and privacy management practices to support business continuity.

3. Conduct information security and privacy awareness and training programs to strengthen employees' understanding of their information security and privacy responsibilities and best practices.

4. Implement information security and privacy risk assessment mechanisms to enhance the effectiveness and timeliness of information security and privacy management.

5. Establish and maintain an internal information security and privacy audit program to ensure compliance with information security and privacy requirements and controls.

6. Ensure that all business operations comply with applicable laws, regulations, and contractual obligations relating to information security.

Responsibilities and Commitment

1. The Company's management is responsible for establishing, approving, and reviewing this policy.

2. The Information Security and Privacy Management Committee is responsible for implementing this policy through appropriate standards, procedures, and controls.

3. All employees and outsourced service providers must comply with relevant security and privacy management procedures to uphold this policy.

4. All personnel are responsible for promptly reporting information security and privacy incidents and any identified vulnerabilities or weaknesses.

5. Any actions that compromise information security or personal data privacy may result in disciplinary measures and, where applicable, civil, criminal, or administrative liability in accordance with relevant laws and Company regulations.

Review

This policy shall be reviewed at least annually to reflect changes in applicable laws, regulations, technologies, and business requirements, ensuring the Company's continued operational resilience and the effectiveness of its information security and privacy practices.

Continual Improvement

The Company adopts the PDCA (Plan-Do-Check-Act) continual improvement framework to establish a structured and documented management system. Through ongoing monitoring, periodic audits, and regular management reviews, the Company continually improves the suitability, adequacy, and effectiveness of its information security and privacy management system.

Implementation

This policy shall become effective upon review and approval by the Chairperson of the Information Security and Privacy Management Committee and subsequent publication. Any revisions to this policy shall follow the same approval process.