Information Security and Privacy Protection Policy

I. Purpose

Concord New Energy Group Limited (“the Group”) strictly follows all laws and regulations on information security and privacy protection in the jurisdictions where it operates. The purpose of this policy is to clarify the Group’s responsibilities and obligations in respect of information security and privacy protection, and to ensure that the Group values and safeguards information security and customer privacy while pursuing business development.

II. Applicability

The Policy is applicable to all employees of the Group (including regular employees, part-time employees, temporary workers, Senior Management and Directors of the Group and its affiliates). The Group encourages suppliers and business partners to jointly adhere to this Policy.

The Policy shall be read together with all other Group policies relevant to the topics specified herein, including the “Code of Ethics & Conduct”, etc.

III. Policy Statement

1. Management Method

• The Group attaches great importance to information security and privacy protection matters and has established a comprehensive information management process, including but not limited to information storage, transmission, use and destruction, to strictly abide by the red line of information security and guard the rights and interests of customers.

• The Group closely monitors changes in laws and regulations and continuously assesses possible information security and privacy protection risks in business segments. The Group incorporates information security and privacy protection risk management into the Group’s risk management system, prioritizes them annually according to their impact level, and formulates targeted risk mitigation measures.

• The Group clearly identifies the person responsible for information security and privacy protection. IT professional departments at all levels are responsible for the overall security of the information system and ensure the implementation of the management system related to information security and privacy protection. The Chair of the ESG Committee assumes the highest management responsibility for the Group’s information security and privacy protection matters.

• The Group maintains a zero-tolerance attitude towards incidents of information leakage and infringement of customers’ privacy. Individuals who intentionally leak important, sensitive or other information of the Group that is subject to the information security protection requirements, as well as those who steal or maliciously infringe upon the privacy of customers and other information that will cause an actual impact on the Group will be punished in accordance with the severity of the incident, including, but not limited to, interviews, performance deduction, termination of employment contracts, and report to the authorities.

• The Group requires its suppliers to comply with all applicable information security and privacy protection laws and regulations in the countries and regions where they operate.

2. Requirements on Information Security Management

• Implement technical measures to enhance the security protection of networks and information systems, and continuously improve the information security management system to guard against security risks such as hacker attacks and virus intrusions.

• Deploy access control mechanisms to ensure that data is strictly accessible to authorized personnel only. Centralize the management of computing resources in both public and private clouds, clearly define personnel permissions during IT operations, and promptly revoke relevant access upon completion of maintenance tasks.

• External audits of the information security management system are conducted regularly, and immediate steps are taken to repair and remediate if any information security vulnerabilities and risks are identified.

• Establish information security emergency handling process promptly respond to threats such as system vulnerabilities and cyber attacks. Conduct annual testing of the information security emergency mechanisms and incident response procedures to verify their security and effectiveness.

3. Requirements on Privacy Protection Management

The Group shall follow the principles of lawfulness, legitimacy, necessity and minimisation in the collection and retention of personal information, limiting the scope of collection to information that is necessary for the conduct of its business. Personal information collected by the Group shall be confined to the categories necessary to fulfill the relevant business purposes, including contact details such as names and means of contact. With respect to the contact information of customers, business partners’ contacts, or other personal information subjects, the scope of collection and use shall be restricted to what is necessitated by the business purpose; where sensitive personal identity information such as identity card numbers or biometric information is involved, stricter requirements on assessment, notification, authorisation and protection shall be fulfilled in accordance with the law.

In respect of the personal information collected, the Group shall strictly adhere to the principle that use must be both compliant and necessary, together with the requirements of its relevant policies, and shall use such information solely for the business purposes that have been notified or agreed. It shall not be used for marketing, profiling or automated decision-making that is unrelated to the business purpose. The Group’s policies expressly require that the creation and collection of data comply with legal and regulatory requirements, and that the use and sharing of data be conducted on the premise that data security is ensured and in accordance with the principle of least privilege; no relevant data may be shared without authorisation.

For businesses that have access to customers’ personal data, the Group will clearly inform customers of the types of information that will be collected and used, how the Group will use such information, how long the information will be retained by the Group, and how the Group will protect such data prior to data collection.

• When customers use the products/services provided by the Group, the Group also provides customers with convenient data management options so that they can make appropriate choices and manage their personal data effectively. The data management options we provide to our customers include:

1. Before using our products and services, the Group will ask customers whether they allow us to collect their personal data and obtain their authorized consent.
2. Customers can choose to change the scope of their authorization or withdraw their authorization, as well as to cancel their account and related information.
3. Save where exceptions are provided for by law, customers may request access to the personal information they have provided.
4. Customers may submit a request to the Group to have their personal data transferred to another service provider, corrected, or deleted.

• In order to fulfil the purposes for which customers’ personal information is collected and used, the Group will retain such personal information for as long as is necessary, and will take reasonable measures to ensure that the information is retained only for so long as is required for the purpose of collection, unless a longer retention period is required or permitted by law. All business data, including customers’ personal data, is retained by the Group in strict accordance with the explicit requirements of business management, contract management, audit trail and relevant laws and regulations. Data storage and maintenance follow the Group’s policy requirements: data is managed by classification according to its importance and sensitivity; regular backups and operational monitoring are carried out to safeguard the security and integrity of data; and for data that has reached the end of its retention period and is no longer required, archiving or destruction is completed in a timely manner strictly in accordance with the Group’s data lifecycle management requirements. The destruction process strictly follows the principle of irrecoverability in order to guard against the risk of data leakage.

• In principle, the Group does not disclose customers’ personal data to unrelated third parties. Where disclosure is genuinely required for business operations, contract performance, system operation and maintenance, audit inspection, or regulatory or judicial requirements, it shall be strictly limited to the extent necessary and shall be implemented in accordance with authorisation rules, contractual stipulations and the Group’s requirements on information security and data management. In the day-to-day use and sharing of data, the principle of least privilege is strictly observed, and no data may be shared without authorisation. Where suppliers or external service organisations have access to system data, end-to-end management is carried out in conjunction with procurement, contractual, confidentiality and information security requirements, strictly preventing data from being used for purposes other than those agreed.

• The Group handles customers data in a prudent manner in accordance with the principles of necessity and data minimization when cooperating with third parties and restricts third parties’ involvement in processing user data.

• When responding to requests from regulatory and law enforcement authorities to access customers’ personal data, The Group will ensure compliance with all applicable laws and regulations of the jurisdictions in which the products or services are offered.

• Internal audit on privacy protection is conducted annually to confirm the effectiveness of privacy policy and management system. Where necessary, the Group will engage an external third party to conduct an independent audit on the privacy management system.

4. Employee Engagement

• Promoting information security-related training continuously to improve employees’ awareness of information security.

• Employees should follow “Network and Information System Security Incident Response Plan”, once they notice suspicious activities.

• For specific positions (including but not limited to information technology-related positions), the Group includes information security and privacy protection as part of performance evaluation.

IV. Compliance with the Code

• This policy shall take effect from the date of publication and shall be strictly observed by the relevant departments of the Group.

• The Group shall set up a supervision department on information security to supervise and inspect the implementation of the policy.

V. Policy Review

• The Group will conduct necessary reviews of the Code at regular intervals.