Regulations Governing Cross-selling Activities Among Subsidiaries of a Financial Holding Company Article 11

When subsidiaries of a financial holding company share their customer data and collect personal data for marketing purposes, such data shall not be used for purposes other than marketing, and shall be handled strictly in accordance with the following regulations:1. When disclosing, referring, or sharing customer data, unless otherwise provided by laws and regulations, or explicitly consented to by the customer in a signed contract or in writing, the data disclosed, referred, or shared shall not contain any data other than the customer's name or address.2. In transaction contracts with customers, the terms regarding the use of customer data shall provide fields for customers to choose whether they agree to provide data other than their names or addresses for marketing database creation, disclosure, referral, or sharing. This shall be confirmed by the customer by signing or other methods that can identify the customer's identity and expression of intent, and the names of the subsidiaries utilizing the data shall be clearly listed. Where subsidiaries increase or decrease due to organizational changes of the financial holding company, an announcement shall be made on the websites of the financial holding company and its subsidiaries.3. Terms and conditions in transaction contracts with customers regarding the sharing of customer data shall be presented in a conspicuous font to remind customers, and the names of the subsidiaries utilizing the customer data shall be disclosed. Furthermore, a simple method (such as telephone notification) by which customers may request to stop the sharing of their relevant information at any time shall be clearly communicated or agreed upon. Upon receiving a notification from a customer to stop using their data, a subsidiary of a financial holding company shall immediately stop the use of the data by the financial holding company and all its subsidiaries. However, if the customer explicitly instructs that the scope of subsidiaries stopped from utilizing data does not extend to all subsidiaries, it may be handled in accordance with the intent of the customer's notification.4. Information regarding a subsidiary's customer who disagrees to the company's continued use of their data shall be communicated to marketing personnel of each subsidiary, department, product line, and outsourced unit, and the computer control systems shall be modified accordingly.For operations involving the use of customer data, sound confidentiality measures shall be established, and a dedicated unit or personnel shall be designated to take charge of such use. A customer database shall be established to properly store, safeguard, and manage customer-related data, and security measures for the customer database shall be established to ensure that only authorized employees may use customer data.