Supplementary Privacy Policy Statement of Nuvoton under the Personal Information Protection Law of the People’s Republic of China

Scope of Application and Legal Basis

This policy applies to the processing activities of personal information of natural persons within the territory of the People’s Republic of China by Nuvoton Technology Corporation and its affiliated companies. For individuals in Mainland China, we are committed to strictly complying with the Personal Information Protection Law of the People’s Republic of China and other relevant laws and regulations.

1. Definition of Personal Information
   “Personal information” refers to various types of information, recorded electronically or otherwise, that are related to identified or identifiable natural persons, including but not limited to name, date of birth, identification number, contact details, address, online identifiers, and location data. Data that has been de-identified but can be restored is also considered personal information; data that has been anonymized and cannot be restored is not considered personal information.
2. Principles of Legality, Legitimacy, Necessity, Openness, and Transparency
   When processing your personal information, we adhere to the principles of legality, legitimacy, necessity, integrity, openness, and transparency. We process your information only within the scope of clear and reasonable purposes and in a manner that minimizes the impact on your rights and interests.
3. Legal Basis for Processing, Consent, and Withdrawal
   We understand the importance of your personal information. Nuvoton will only process your personal information when there is a legitimate legal basis, including obtaining your consent, fulfilling contractual obligations with you, complying with legal obligations, or protecting your or others’ vital interests. For certain types of information (such as sensitive personal information), or when sharing information with partners, third parties, or transferring information across borders, we will obtain your consent as necessary and explain the purposes and methods of processing. You always have the right to choose and may withdraw your consent at any time. Withdrawal of consent does not affect the validity of personal information processing activities conducted prior to the withdrawal.
4. Notification Obligation
   We value your right to be informed and your right to choose. If there are significant updates to this policy, we will notify you in advance through our website or other appropriate channels in a prominent manner. You may contact us at any time to inquire about, update, or delete your personal information, or to exercise your privacy rights. If you have any questions or need assistance, please feel free to contact us.
5. Minimum Retention Period
   We will retain your personal information only for the minimum period necessary to achieve the processing purposes. Once the purpose is fulfilled or the retention period expires, your personal information will be promptly deleted.
6. Joint Processing, Entrustment, Transfer, and Third Parties
   We may sometimes jointly provide products or services to you with partners or service providers. In such cases, we will share your personal information with third parties only when there is a legitimate legal basis and in accordance with applicable laws. This may include obtaining your consent or fulfilling contractual or legal obligations. When your consent is required, we will explain the purposes and methods of processing and require our partners to comply with strict privacy and security standards to ensure your personal information is properly protected.
7. Automated Decision-Making
   If we use personal information for automated decision-making (such as personalized recommendations or pricing), we will ensure the transparency and fairness of such decisions. You have the right to request an explanation and to refuse decisions made solely by automated means.
8. Sensitive Personal Information
   We understand the importance of sensitive personal information. According to applicable laws, “sensitive personal information” may include biometric data, religious beliefs, specific identities, medical and health information, financial accounts, location data, and information of minors under the age of 14. Nuvoton will only collect and process your sensitive personal information when necessary to provide products or services, with a legitimate legal basis, and after obtaining your consent. When collecting such information, we will explain the relevant purposes and impacts on your rights and take strict protective measures to ensure the security of your information.
9. Information of Minors
   If you are a minor under the age of 14, we will only collect and use your personal information after obtaining explicit consent from your parents or other guardians, and we have established specific rules for processing minors’ personal information.
10. Cross-Border Transfers
    To provide you with better products and services, your personal information may sometimes be transferred outside the territory of the People’s Republic of China. We will strictly comply with Chinese laws and regulations, take necessary compliance measures (such as conducting security assessments, signing standard contracts, or obtaining certifications), and ensure that your personal information receives the same level of protection during cross-border transfers and processing.
11. Personal Rights
    You have the right to access, copy, correct, supplement, and delete your personal information, the right to restrict or refuse our processing of your personal information, the right to request the transfer of your personal information to a designated third party (data portability), and the right to request an explanation of our personal information processing rules. You may exercise these rights by contact us , and we will respond to your request within the statutory period.
12. Personal Information Security Management
    We have established a personal information security management system and continuously improve our security measures to protect your personal information. In the event of, or the risk of, personal information leakage, alteration, or loss, we will take immediate remedial measures and, as required by laws and regulations, promptly notify you and the relevant authorities. The notification will include the nature of the incident, possible impacts, measures taken, preventive actions you can take, and our contact information.