Information Security and Customer Privacy Management
Information Security Management Policy
To effectively manage information security, GIS follows ISO 27001 “Information technology – Security techniques – Information security management systems – Requirements” and “Information technology – Security techniques – Code of practice for information security management”. Based on these standards, GIS developed its “Information Security Manual” and related rules and regulations, which were officially implemented since June 2021. In accordance with these regulations, all departments regularly conduct information security risk self-assessments to ensure the continued suitability, effectiveness, and adequacy of GIS's information security management system.
In addition, in accordance with the internal document “Information Security Organizational Operating System,” the Company has established an “Information Security Management Committee,” which serves as the primary responsible unit for information security. The Chairperson of the Information Security Management Committee is the General Manager (decision-making level), and the Vice Chairperson is the Director of the Information Technology Division (decision-making level). The organizational structure includes the Information Security Standing Committee (planning level), Information Security Team (planning level), and Information Security Coordinator (execution level).
Information Security Incident Reporting and Response
In accordance with the Information Security Incident Management Operating Procedures, GIS reports information security incidents through internal reporting system. The Information Security Team is responsible for incident handling and for collecting relevant information on security breaches. Each reported incident is classified and addressed to minimize potential damage, and the team determines whether the event is an actual information security incident or merely a false alarm. No major information security incidents were reported in 2025.
Information Security and Personal Data Protection
GIS values customer interests and privacy, and upholds them through a sound management framework and protective measures to prevent leakage of personal data. The Company has established the New Product Safety Control and General Administration Management Operating System to ensure comprehensive enforcement of customer privacy management, encompassing personnel security, asset security, physical security, and information security. In 2025, GIS received no complaints from customers regarding privacy violations.
Information Security and Personal Data Management
GIS regularly conducts information asset risk assessments in accordance with its Information Asset Risk Assessment Form, including assessments of risks arising from unauthorized access and modification. Where the information involved contains personal data, such risk assessments are considered part of the privacy impact assessment process. In addition, pursuant to GIS′s "Information Security Organization Operating Procedures", the Information Security Management Committee regularly reports information security performance, including privacy management, to the Board of Directors.
Information Security Education and Training
GIS places great importance on internal information security and has built five technical defense lines with services including firewalls, external network protection, and vulnerability scanning. To enhance employees' awareness of information security management, GIS includes information security courses and product information security control in new employee training, and conducts information security awareness training and system disaster recovery drills for existing employees from time to time. The 2025 education and training content includes "Information Security Fundamentals," "Personnel Security Control," "Product Security Protection," and "Information Security Promotion," as well as the protection of privacy information and common phishing techniques, with a 100% pass rate for all employees (meeting the 2025 Targets).
In 2025, during routine
information security audits, a total of 6 violations were found. Corrective actions have been taken to enhance employee
awareness of information security, and no impact or financial losses were incurred for the Company.
Social Engineering Drills
To enhance employees' awareness of email-based social engineering, GIS began implementing regular simulations of hackers sending phishing emails in 2024, designed to test employees' response abilities to malicious emails. In 2025, the number of participants in the drill was 3,655, with 3,541 assessed as low risk, resulting in a pass rate of 96.9%. A tracking mechanism is in place for employees who did not pass, and they are provided with corresponding education and training based on the failure circumstances.
Artificial Intelligence Policy
GIS recognizes that artificial intelligence (AI) can enhance operational efficiency, innovation, and decision-making capabilities, while also potentially creating risks related to privacy, information security, fairness, transparency, human rights, and environmental impacts. Therefore, GIS is committed to developing and using AI in a responsible, ethical, secure, and human-centered manner.
Scope
This Policy applies to the directors, management, employees, and relevant business personnel of GIS and its operating sites. It covers all types of AI systems and tools developed, procured, implemented, or used by the Company, including generative AI, machine learning, automated decision-making, and other AI applications.
Suppliers and business partners involved with GIS data, systems, products, or services are also expected to comply with applicable responsible AI principles in accordance with relevant contractual and management requirements.
Eight Core Principles
Human-Centered Approach:
AI applications should be designed to enhance human capabilities. For matters involving significant rights and interests or critical decisions, appropriate mechanisms for human oversight and intervention should be maintained.Fairness and Non-Discrimination:
Potential biases, discrimination, or unfair outcomes arising from AI models, data, or applications should be identified and mitigated.Privacy and Data Protection:
The development and use of AI should comply with personal data protection requirements and the Company’s data governance policies. Confidential, sensitive, or unauthorized data must not be entered, processed, or disclosed without authorization.Safety and Reliability:
AI systems should implement appropriate information security, access controls, testing, and risk management measures to reduce the risks of misuse, cyberattacks, errors, or abnormal operation.Transparency and Explainability:
The use of AI should be appropriately disclosed according to the application context, and important AI-driven decisions or outcomes should have a reasonable degree of comprehensibility and explainability.Accountability:
Clear responsible functions or units should be designated for AI systems and applications. AI-generated results must not replace the ultimate responsibility that should be assumed by human personnel.Responsible Use and Prohibited Uses:
AI must not be used for illegal, deceptive, discriminatory, or inappropriate surveillance activities, violations of human rights, manipulation of vulnerable groups, or any other conduct that violates the Company’s ethical standards.Environmental Responsibility:
Where practicable, consideration should be given to the energy and resource efficiency of AI systems, models, and related information infrastructure. The adoption of technologies and services with greater environmental benefits is encouraged.
Customer Relations
In 2025, in response to the Company's transformation and increasing product diversification, GIS redefined the targets and presentation method of its customer satisfaction survey to further optimize product quality, strengthen internal quality control, and reduce customer complaints. Instead of using numerical scores and percentages, the survey results for customer satisfaction and customer rejection rates were presented using a grading system, enabling stakeholders to intuitively understand GIS's product quality performance. The 2024 customer satisfaction survey results remained consistently high across all dimensions. Customers were especially satisfied with on-time delivery, prompt response to issues, rapid implementation of countermeasures, and early identification and resolution of potential risks. GIS is committed to maintaining this high level of customer service in the future
Grading System for Customer Satisfaction and Customer Rejection Rate
2025 Customer Satisfaction Outcomes
