Alltek Technology Corp. (hereinafter referred to as “the Company,” “we,” “us,” or “our”) is committed to safeguarding the personal data of our customers, suppliers, business partners, job applicants, employees, and other relevant individuals. In compliance with the Personal Data Protection Act of the Republic of China (Taiwan) and applicable laws and regulations, the Company has established this Privacy and Personal Data Protection Policy (hereinafter referred to as “this Policy”) to articulate the principles and measures governing the collection, processing, use, and protection of personal data.
Please read this Policy carefully to understand our practices regarding your personal data. When a data subject provides personal data to the Company, we collect, process, and use such data solely for specific purposes and within the scope necessary under the Personal Data Protection Act and relevant laws. Where consent is legally required from the data subject, the Company will obtain such consent in accordance with applicable statutory requirements.
1. Scope of Application
This Policy applies to all activities involving the collection, processing, and use of personal data conducted by the Company in connection with business transactions, human resources management, supplier management, customer support, marketing campaigns, website services, and other operational necessities.
Data subjects covered under this Policy include, but are not limited to, customers and their designated representatives, prospective customers, suppliers and their contact persons, contractors, business partners, distributors, external consultants, investors, employees, job applicants, visitors, website users, and any other relevant individuals who engage in business dealings with or provide personal data to the Company.
2. Responsible Department
The Legal & Document Management Department of the Company is designated to formulate, implement, maintain, and periodically review this Policy. This department oversees and coordinates personal data protection initiatives across all business units, compiles records of personal data protection training, manages data security incident responses, tracks annual operational performance metrics, and handles the consolidation and disclosure of relevant public information.
All operational units across the Company are responsible for the management and security maintenance of the personal data they collect, process, or use within their respective functional areas, strictly adhering to this Policy and relevant regulatory requirements.
3. Categories of Personal Data Collected
Depending on the operational nature and specific business purposes, the Company collects personal data strictly to the extent necessary and appropriate. Such data may include:
3.1 Customers and Prospective Customers
• Name, company name, department, job title, contact telephone number, email address, mailing/correspondence address, customer service logs, and contract and transactional details.
3.2 Suppliers, Business Partners, and Contractors
• Company name, unified business number (tax ID), contact person name, contact telephone number, email address, payment and banking account information, quotation and transaction records, and contractual/collaboration documents.
3.3 Employees and Job Applicants
• Name, national identification number, date of birth, registered domicile and correspondence address, educational background and employment history, contact telephone number, email address, compensation and bank account details, labor insurance, national health insurance, and labor pension records, attendance and performance evaluation records, emergency contact details, and other information necessary for human resources administration.
3.4 Visitors and Website Users
• Depending on visitor management protocols or website functionality, data collected may include name, contact details, IP address, cookie identifiers, browsing history, device specifications, and online behavioral analytics. Specific categories collected vary based on the actual services provided and user engagement.
3.5 Other Relevant Parties
• Personal data reasonably required for business engagements, corporate events, service fulfillment, or operational needs.
The Company collects personal data solely within the specified purpose and necessary scope, and in strict compliance with applicable laws.
4. Purposes of Collection
The Company collects, processes, and uses personal data for specific and legitimate business purposes, including:
4.1 Customers and Prospective Customers
• Customer relationship management, commercial correspondence, product sales and delivery, technical support, customer care, contract fulfillment, billing and account administration, marketing activities, and service enhancements.
4.2 Suppliers, Business Partners, and Contractors
• Vendor and partner relationship management, qualification assessments, procurement management, contract administration, payment processing, performance tracking, commercial correspondence, and related professional services.
4.3 Employees and Job Applicants
• Talent recruitment and screening, human resources administration, employment contract execution, compensation and benefits management, attendance and performance appraisals, professional development and training, statutory filings for labor insurance, national health insurance, and pensions, occupational safety and health compliance, regulatory adherence, and general personnel management.
4.4 Visitors and Website Users
• Visitor access control and facility security, delivery of website functionality, site performance monitoring and analytics, information security management, user experience enhancement, service optimization, and related promotional campaigns.
4.5 Legal Obligations and Operational Requirements
• Compliance with statutory duties, cooperation with lawful investigations or orders from regulatory bodies or judicial authorities, protection of the legitimate rights and interests of the Company and affiliated personnel, and other specific purposes permitted under the Personal Data Protection Act and applicable regulations.
5. Time Period, Territory, Recipients, and Methods of Use
5.1 Time Period
• Personal data will be retained and utilized throughout the duration necessary to fulfill the specific purposes of collection, or for the retention period mandated by applicable laws and regulations.
• Upon the fulfillment of the collection purposes or the expiration of the statutory retention period, the Company will delete, cease processing, or discontinue using such personal data, or apply appropriate de-identification and anonymization measures in accordance with legal and internal procedures.
5.2 Territory
• Personal data will primarily be used within the territory of the Republic of China (Taiwan). Where business needs necessitate cross-border transfers to overseas affiliated entities, partners, service providers, or other necessary parties, the Company will carry out such transfers in full compliance with the Personal Data Protection Act and relevant statutory requirements.
5.3 Recipients
• Within the specific purposes and strictly necessary scope, the Company may disclose or entrust personal data to the following entities:
- The Company and its lawfully established corporate affiliates.
- Third-party service providers retained by the Company to perform operational services.
- Business partners, contractors, and other relevant entities requiring access to personal data for operational purposes.
- Competent regulatory authorities, judicial agencies, or other public authorities vested with lawful investigative powers.
- Other parties as authorized by law or with the prior consent of the data subject.
5.4 Methods of Use
• Personal data may be collected, processed, stored, analyzed, and used through automated or non-automated means, including physical hard-copy documents, electronic databases, information systems, and other lawful media.
6. Security and Protection Measures
In proportion to the nature, volume, and associated risks of the personal data handled, the Company implements reasonable and adequate administrative and technical measures to safeguard personal data against unauthorized access, theft, leakage, alteration, destruction, or loss.
These measures include, but are not limited to:
- Role-based access control and regular privilege audits.
- User account authentication, credential security, and permission controls.
- Network security controls, including enterprise firewalls, anti-virus defenses, and intrusion safeguards.
- Data encryption and robust data protection protocols for stored and transmitted data.
- Regular data backup procedures and disaster recovery mechanisms.
- Employee education, training programs, and awareness campaigns on data privacy and information security.
- Incident reporting, emergency response, containment, and continuous remediation protocols for data security breaches.
- Vendor risk management and oversight of outsourced service providers handling personal data.
- Other appropriate security safeguards implemented in accordance with statutory mandates or risk assessment findings.
7. Rights of the Data Subject
In accordance with Article 3 of the Personal Data Protection Act, data subjects are entitled to exercise the following statutory rights regarding their personal data:
- The right to make an inquiry and request to review their personal data.
- The right to request a copy of their personal data.
- The right to request supplementation or correction of their personal data.
- The right to demand the cessation of collection, processing, or use of their personal data.
- The right to demand the erasure/deletion of their personal data.
To exercise any of the aforementioned rights, data subjects may submit a request through the contact channel specified in this Policy. The Company will process such requests in compliance with applicable laws and established internal procedures.
Where permitted by law, the Company reserves the right to refuse requests that do not satisfy statutory requirements, and may charge reasonable processing fees to cover necessary administrative costs where permitted by applicable regulations.
8. Cookies and Website Tracking Technologies
The Company’s website may utilize cookies and similar tracking technologies to ensure essential web functionality, improve user experience, analyze site traffic patterns, and maintain cybersecurity.
Users may manage, restrict, or disable cookies via their browser settings; however, please note that disabling cookies may impair certain features or prevent optimal functionality of the website.
Where third-party analytics or external tracking tools are deployed on our website, appropriate disclosures and notices will be provided in compliance with applicable regulations and service terms.
9. Provision, Sharing, and Outsourced Processing of Personal Data
As a general principle, the Company does not disclose or transfer personal data to unrelated third parties.
The Company may only share or utilize personal data within specific purposes and necessary scopes under the following circumstances:
- With the explicit consent of the data subject.
- Where expressly required or authorized by applicable law.
- Pursuant to lawful requests from judicial or competent regulatory authorities.
- Where necessary for the execution or performance of a contract, or the provision of requested services.
- To protect the vital and legitimate rights and interests of the Company or the data subject, provided such actions comply with relevant legal provisions.
- Where necessary for engaging third-party service providers to handle or process personal data on the Company’s behalf.
When entrusting third-party vendors with personal data processing, the Company establishes contractual covenants and supervisory mechanisms commensurate with the operational nature and risk profile, requiring full compliance with privacy and data protection standards and the implementation of robust safeguards.
10. Management of Employee and Job Applicant Data
The Company collects, processes, and uses personal data of employees and job applicants for recruitment, talent acquisition, human resources administration, employment contract fulfillment, and statutory compliance.
Such personal data is utilized strictly within the scope required by operational needs and applicable regulations, encompassing:
- Recruitment, candidate assessment, and selection.
- Personnel records and administration.
- Compensation, payroll, and benefits management.
- Attendance tracking and performance appraisals.
- Corporate training and professional development.
- Statutory filings and operations for Labor Insurance and National Health Insurance.
- Labor pension contribution and related management.
- Compliance with statutory mandates and general HR operations.
The Company maintains and safeguards employee and candidate records in strict compliance with relevant labor legislation and internal administrative controls.
11. Data Management for Suppliers, Partners, and External Contractors
The Company mandates that suppliers, business partners, contractors, and external vendors adhere to applicable personal data protection laws, information security standards, and the Company’s contractual requirements whenever they access or process personal data on our behalf.
Third parties processing Company-controlled personal data must:
- Process personal data strictly within the authorized scope and specific business purposes defined by the Company.
- Implement robust technical and organizational security measures to protect personal data.
- Refrain from disclosing, distributing, transferring, or utilizing personal data without prior written authorization from the Company.
- Cooperate with data protection audits, security evaluations, and corrective actions as required by contract or requested by the Company.
- Promptly return, delete, or securely destroy all relevant personal data upon termination of the business engagement or completion of the contracted services.
12. Incident Response and Management of Personal Data Breaches
In the event of an actual or suspected security incident involving unauthorized access, disclosure, alteration, loss, or destruction of personal data, the Company will promptly trigger internal incident response procedures to implement necessary containment, forensic investigation, remediation, and corrective actions.
Where mandated by law, the Company will notify affected data subjects and report the incident to the competent regulatory authorities in accordance with statutory procedures and timeframes.
13. Amendments to this Policy
The Company reserves the right to amend this Policy periodically to reflect changes in regulatory requirements, operational conditions, organizational structure, cybersecurity standards, or data protection practices.
Material amendments to this Policy will be announced on the Company’s official website or communicated through other appropriate and accessible channels.
14. Contact Information
If you have any questions, comments, or inquiries regarding this Policy, or if you wish to exercise your statutory rights under the Personal Data Protection Act, please contact us through the following channel:
- Contact Department: Legal & Document Management Department, Alltek Technology Corp.
- Email Address: esg@alltek.com
Upon receiving your request, the Company will review and handle it in accordance with applicable laws and internal operating procedures.