This Privacy Policy is provided by Taiwan Semiconductor Manufacturing Company Limited (hereinafter referred to as the “Company” or “we”). This Policy applies to individuals outside the Company, including registered users and visitors of the website (hereinafter referred to as “you”) who use and browse the website of the Semiconductor Cloud Academy (hereinafter referred to as the “Academy”). The Company is committed to protecting privacy, personal data and information security.

The Company shall amend the Policy whenever necessary due to changes in the methods for processing your personal data and changes in laws. We advise you to carefully read the Policy and visit this webpage regularly to obtain more information on the amendments to the terms in this Policy.

Collection of Personal Data: We may collect your personal data from the following channels:

• Information provided to the Company: The Company uses the information provided to us by you or others to obtain your personal data (e.g., when you contact us by e-mail or telephone, and provide us with your name and contact information).
• Information obtained through direct contact with you: The Company may obtain your personal data by participating in a conference, exhibition, seminar, event or other meetings, et cetera.
• Information obtained based on a legal relationship between the Company and you: Your personal data obtained by the Company based on a legal relationship between the Company and you (e.g., when we provide services to you).
• Information you make public: The Company may obtain your personal data by the information you make public, including information on social media (e.g., when you publish text regarding us online, we may obtain your personal data on the platform through social media).
• Website information: The Company obtains your personal data when you visit our website or use functions or resources on our website.
• Registration information: The Company obtains your personal data when you register to use our website (e.g., the Academy) or services.
• Third-party contents and ad information: When you interact with contents or ads provided by a third party on the website (including plug-in or cookies provided by a third party), the third party will provide related information to the Company.
• Information provided by third parties: The Company may collect or obtain your personal data from information provided by third parties. (E.g., law enforcement agencies.)

Under specific conditions, the Company may create files about your personal data such as records of interactions between you and us, or records of past interactions. The Company may combine the personal data obtained from websites, products, or services, including data obtained from different devices and record the data for use.

The Company may process the following types of personal data:

• Personal information: Name, aliases, and photos.
• Demographic information: Gender, date of birth/age, nationality, title, honorific title, and preferred language.
• Contact information: Contact address, mailing address, telephone number, e-mail address, instant messaging app information, online real-time communication information, and social media website information.
• Academic records and event participation records: Information of your academic records and participation in seminars, events, and exhibitions.
• Consent records: Records of your consent obtained along with the time and date of consent, method of providing consent, and any related information (e.g., recipient of the consent).
• Information related to the Company’s website: The type of device used, operating system of the device, type of browser, browser settings, IP address, language settings, date and time of connection to the website, user name, password, encrypted login information, usage data, and consolidated statistics.
• Website contents and ad information: Records of your interactions with the contents and ads on our website, records of ads and contents shown to you, records of your interactions with the aforementioned contents (e.g., cursor tracking, mouse clicks, or other activities) and any records of interactions involving touching the screen.
• Opinions and feedback: Any opinion or feedback provided by you to the Company or any opinion or feedback regarding the Company you publish on social media websites.

In the course of our normal operations, the Company does not take initiative to collect or process special categories of personal data, such as data pertaining to medical records, healthcare, genetics, sex life, physical examination and criminal records. If we are required to collect or process special categories of personal data for legal reasons, we shall collect and process such data within the scope of the following purposes:

• For compliance with laws and regulations: We may process your special categories of personal data within the scope required or permissible by law (e.g., to fulfill our statutory reporting obligations);
• Investigation or prevention of crimes: We may process your special categories of personal data if it is necessary for the investigation or prevention of crimes (e.g., avoidance of scams);
• Claim, exercise, or protection of legal rights: We may process your special categories of personal data if it is necessary to claim, exercise, or protect legal rights;
• Based on your consent: We may process your special personal data in accordance with related laws or with your prior express consent (this only applies when you voluntarily grant consent and does not apply to cases where we are required to process special categories of personal data based on legal requirements or for fulfilling statutory duties).

When you provide special categories of personal data to the Company, please make sure that you have the legal right to disclose the information to us.

The purpose and legal basis for the Company’s processing of personal data in full compliance with related laws are as follows:

The Company shall disclose your personal data to other members of the Group in full compliance with the law to meet legal business objectives, maintain the operations of the website, and provide services. In addition, we may also share your personal data with the following entities:

• You and, where necessary, your designated agent;
• Competent authorities of legal affairs to which disclosure is required based on legal requirements for reporting any illegal or allegedly illegal activities;
• Accountants, auditors, consultants, attorneys, and other professionals that provide consulting services to the Company, with whom the Company has signed confidentiality agreements;
• The Company may provide your data to our service providers across the world in accordance with the terms of this Privacy Policy (e.g., O&M contractors of the website of the Academy and contractors for organizing or assisting in related activities of the Academy);
• Where the disclosure of your personal data is necessary for the claim, exercise, or defense of legal rights, the Company may provide your personal data to related parties, the competent authorities, government agencies, law enforcement agencies, or courts;
• The Company may provide your data to related parties, the competent authorities, government agencies, law enforcement agencies, or courts to prevent, investigate, probe, or prosecute illegal activities or implement criminal penalties;
• The Company may provide your data to the buyer or transferee when we sell or transfer businesses or assets (including reorganization, dissolution, or liquidation), in whole or in part;
• Third parties that provide ads, plug-ins, and content services on the Company’s website. If you choose to interact with the ads and contents when you browse our website, we advise you to carefully read the third-party privacy policy before you interact with third-party ads and contents.

If we appoint an information service provider to process your personal data, we shall enter into a contract with the service provider and request them to meet the following requirements: (i) process your personal data in accordance with the purposes and scope specified in our prior written instructions; and (ii) comply with regulations and requirements in laws and establish mechanisms for ensuring personal information security and confidentiality.

The Company shall use your personal data for the following purposes when processing your personal data for data analysis and automated decision-making:

Method of analysis	Purpose of analysis	Influence on you
Influence on you	To prevent information leaks and protect our intellectual property rights, we shall process and use the information in the correspondence between you and any of the Company’s employees. Potential usage includes the establishment of a behavioral model for threats, or analysis of potential threat to our information system.	Such analyses may affect the privacy of the correspondence between you and the Company’s employees. We advise you not to disclose your special categories of personal data or highly sensitive or confidential information in correspondence with the Company’s employees.

As the Company operates multinational businesses, we may transmit your personal data to other companies of the Company’s Group in accordance with Section (G) of this Privacy Policy in compliance with the scope of purposes specified herein. Based on the aforementioned reasons, we shall transmit your personal data to Taiwan, the United States, and other places where we set up operations. These countries may have different regulations and requirements for personal data protection compared with the country of your residence.

If the applicable laws for the aforementioned conditions are revoked or if exceptions in regulations apply, we shall abide by the related exceptions where appropriate. For instance, the cross-border transmission of personal data shall be based on the necessity for the claim, exercise, or defense of legal rights. If we transmit your personal data from the EU to territories outside the EEA and the country of the recipient has not received an adequacy decision from the EU, we shall sign an agreement that contains standard EU clauses with the recipient.

Please note that when you transfer any personal data directly to an affiliate of the Company outside the EEA, we shall bear no liability for the transmission of the personal data.

As the Internet is open by nature, information transmitted via the Internet is not completely secure. Notwithstanding the reasonable measures we adopted to protect your personal data, we cannot guarantee the complete security of information you transmit via the Internet. You shall bear the potential risks of the transmission process. Please ensure that there are no security issues in the process of your transmission of information to us.

We shall take reasonable measures to ensure the following:

• The accuracy and timeliness of your personal data we process; and
• We shall immediately correct or remove your personal data if there is any error regarding the purpose of data processing.

We may verify the accuracy of your personal data from time to time.

The Company endeavors to take all reasonable measures to ensure reasonable connection between the scope of your personal data we process and the purposes specified in this Privacy Policy, and that data processing shall be confined to the reasonable scope.

The Company endeavors to take reasonable measures to ensure that we process the data for the duration necessary for the purposes specified in this Privacy Policy, and only retain the data for the shortest necessary duration. Our criteria for determining the retention period of your personal data are as follows:

1. We shall only retain your personal data in identifiable formats in the following periods:
   • (a) The duration of continuous transactions between you and us;
   • (b) The duration necessary for processing your personal data for meeting the legal objectives specified in this Privacy Policy for which the Company has legal interests.

In addition,

2. We shall also retain your personal data in the following periods:
   • (a) The period before the extinctive prescription set in related laws (i.e., the period in which any individual may file a legal claim against us with regard to your personal data);
   • (b) Within two months after the expiry of the aforementioned periods (therefore, if an individual claims legal rights prior to the expiry of the aforementioned extinctive prescription, we shall have reasonable time to verify the personal data related to the claim).

Finally,

3. in addition to the aforementioned periods, if an individual has filed a claim for legal rights related to your personal data, we shall be permitted to continue to process your personal data within the period necessary for processing the claim.

During the retention period specified in Paragraph (2)(a) and Paragraph (2)(b), except for accessing your personal data for legal claims and performance of legal obligations, we shall process your personal data solely for the storage and maintenance of the security of the information.

Upon the expiry of the retention period specified in Paragraphs (1), (2), and (3), we shall adopt one of the following methods for processing your data:

• Permanent deletion or destruction of related personal data;
• Anonymization of related personal data.

When you visit our website, we will usually set cookies on your device or access the cookies stored on your device in accordance with regulatory regulations or with your prior approval. We use cookies to record information about your devices or browser or record your preferences and browsing habits. We use cookies and other similar technologies to process your personal data in accordance with the contents of the Cookie Policy.

We use your personal data and provide you with information on websites that may be of interest to you and the events or services of the Academy through e-mail, telephone, promotional mail, or other methods. We will also use your personal data to provide related contents based on your preferences when using the website or services. When we provide website access or services to you, we may transmit or show information about our website or services, events, and other information that may be of interest to you. The information shall be provided using the contact information you provide to the Company or other legal means.

You may cancel your subscription to the promotion/event notification e-mails we send by clicking on the link provided in the e-mail or notifying us of your cancellation. After receiving your cancellation request, we need approximately two weeks to process the request. You may continue to receive promotion/event notification e-mails in the two-week period. After canceling your subscription, we will no longer send promotional/event notification e-mails to you. However, we shall contact you, where necessary, regarding the information on our website or services in which you requested from us before canceling your subscription.

The Company is committed to protecting user privacy and therefore does not use the user information it collects for purposes other than those specified in this Privacy Policy.

If you have any questions regarding this Privacy Policy, please contact the operator of the website of the 3dblox:

Manager	Contact information
DIGITIMES Inc.	Jack jack.shih@digitimes.com

You retain the following rights to your personal data, provided that such rights comply with laws and regulations:

• The right to refuse to provide personal data; however, if you choose not to provide personal data, we may not be able to provide you with complete functions and services on our website. For instance, the videos and education materials in the Academy can only be accessed by registered users.
• The right to review your personal data, the right to request a copy of the information, and the right to provide information on the nature of the data processing;;
• The right to correct inaccurate personal data;
• You may exercise the following rights based on legitimate reasons:
  • Delete your personal data;
  • Limit the processing of your personal data;
• Transfer of your personal data in a structured format generally usable and readable by machines to another manager within the scope of possibility;
• When we process your personal data based on your consent, you have the right to withdraw the consent (however, the withdrawal of your consent shall not affect the legality and legitimacy of our processing of such information before we receive your withdrawal notification, and shall not affect the legality of our processing of your personal data according to other legal basis);;
• You have the right to file a complaint regarding the processing of your personal data to the competent authority of information protection, particularly to the information protection authority of your residence, place of work, or place of the personal data infringement within the EU.