1. Applicable Data Subject

This policy applies to:

1. (1) Employees of UMC;
2. (2) Employees of UMC’S customers, suppliers, and contractors;
3. (3) Users of UMC's products or services;
4. (4) Visitors to UMC's website or UMC offices or sites;
5. (5) Jobs applicants of UMC.

hereinafter referred to as "you".

2. Collection of Personal Data

UMC may collect your Personal Data from the following sources:

1. (1) Data provided by your initiatives: you contact UMC via e-mail or telephone, or provide your personal data to apply for job vacancies in UMC.
2. (2) UMC obtains in labor relations, business or from business cooperation: UMC obtains your personal data directly from you in labor relations, business contacts or activities. UMC may obtain your personal data because of cooperation in research and development, business interactions, retaining you as a consultant, lecturer of UMC, or you’re the contact windows for the aforementioned business cooperation.
3. (3) Your self-disclosure: UMC may obtain your personal data related to UMC contents in social medias.
4. (4) Personal Data obtained in UMC website: UMC may obtain your personal data from your registrations or browsing of UMC’ website and/or systems wherein.
5. (5) Personal Data provided by Third party: UMC may obtain your personal data from credit reference agencies, law enforcement agencies, or plugins and cookies by a third party.

3. Categories of Personal Data UMC Processes (the following types are collectively referred to as "Personal Data")

1. (1) General Personal Data

• • • • Personal information: name, alias, photo, ID number, passport number, gender, date of birth, age, nationality, ethnic, and financial information.
      • Contact information: contact address, telephone number, fax number, e-mail information, social media accounts etc. If you interact with UMC as an employee of UMC or another company, it may contain your name, job title, photo, company phone number, and company email address.
      • Expertise and social information: educational background, research field, languages, professional skills or expertise, employment records, current occupation, qualifications, certifications, work experience, membership of various trade unions or associations, and relationship with other individuals or institutions.
      • Your consents record: your written consents, the date and time of consents, the consents formats etc.
      • Information related to UMC’s website: device types, operating systems, browser types, browser settings, IP addresses, language settings, dates and times of connecting to a site, user name, password, encryption login, usage data etc.
      • Perspectives and opinions: any views or opinions that you give your feedback to UMC, or your views or opinions regarding UMC posted on social media platforms.
        
        

1. (2) Sensitive Personal Data

UMC will not collect and process your sensitive personal data except in very limited circumstances, and when processing your sensitive personal data is necessary for legitimate purposes. UMC will process your sensitive personal data in accordance with applicable laws. UMC may process physical examination records, criminal records and so on in the following situations:

• • • To comply with applicable laws and regulations;
    • To detect or prevent crimes;
    • To claim, exercise or protect the legal rights of UMC or relevant parties;
    • Based on your consent.

If you provide Sensitive Personal Data to UMC, you must ensure that you are legally entitled to those data.

4. Purposes and legal bases for Processing your Personal Data

UMC may process personal data for the following purposes:

1. (1) For personnel and administrative operations.
2. (2) For provision of products and services.
3. (3) For business and operations.
4. (4) For communication and marketing.
5. (5) For system management.
6. (6) For supplier management.
7. (7) For obtaining your feedback on UMC's products or services.
8. (8) For maintaining the safety and security of UMC’s plants.
9. (9) For investigations and compliance purposes in order to fulfill legal statutory obligations.
10. (10) For asserting, exercising or defending legal rights.
11. (11) For improving or developing UMC's products and services.
12. (12) For manpower recruitment.
13.  

UMC may also process your personal data for other purposes under the following circumstances:

1. (1) Based on the express provisions of the laws.
2. (2) Necessary to advance the public interest.
3. (3) To avoid danger to your life, body, liberty or property.
4. (4) To prevent major harm to the rights and interests of others.
5. (5) Based on your consent.
6. (6) In favor of your rights.
7.  

UMC may process personal data for the following legal bases:

1. 
   (1) Base on your prior consent.
2. (2) Necessary for the contract between UMC and you, or for the purpose to negotiate the contract with you.
3. (3) UMC has legitimate interests, but the legitimate interests do not exceed your interests, fundamental rights and freedoms.
4. (4) UMC fulfills its legal obligations.
5. (5) The processing of personal data is necessary to establish, exercise or defend legal claims.
6. (6) UMC cooperates with the investigation, to investigate fraud and other crimes in accordance with relevant laws and regulations, and prevents behaviors that violate the company's regulations and criminal crimes.

5. UMC may process your personal data

(1) Internal processing:

• • To operate and manage the company's website, systems, products or services.
  • For troubleshooting the company's website, systems, products or services; and for further plans for improvements and developments.
  • To manage, operate, check and monitor various systems of the company.
  • Maintenance of physical and electronic security measures in the company's factory areas.
  • To abide by the company’ legal obligations.
  • For recruitment and interview activities.

(2) External processing:

• • Providing your personal data to third parties operating UMC’s website, systems, and the obtaining of communications, opinions regarding our products or services.
  • Providing your personal data to a third party for maintaining and updating your contact information.
  • UMC cooperates with law enforcement in the investigation and prevention of criminal activities.
  • Submitting, collecting, reviewing documents, or gathering facts , evidence, and witness statements that may include your personal data in legal proceedings.
  • Sharing your personal data with a third party after obtaining prior consents as outlined in “Article 8. The parties UMC may share your personal data” in the policy.

6.Cross-border transfer of Personal Data

Due to the transnational nature of the company's business and services, UMC may transmit your personal data amongst UMC group companies including Taiwan, the United States, Japan, South Korea, Netherlands, Singapore or other places where the company has business operation, in light of the content of Article 4 of this policy. These countries may have different legal regulations and requirements for personal data protection.

If UMC transmits your personal data from the European Economic Area (hereinafter referred to as “EEA”) to a country outside of EEA, in which the country has not obtained the EU adequacy decision, UMC will sign an EU standard contractual clause with the recipient. You may request UMC to provide standard contractual clause for your reference in accordance with the contact information listed in Article 17 of this policy.

Please note that when you directly transfer your personal data to our affiliated companies outside the EEA, we cannot be held responsible for the transfer thereof.

7.  Protection of minors

UMC’s services and products are aimed at adults who meet the legal requirements, not minors. If you are a minor under the laws of your country, you can only use the company's services or products under the supervision of a parent or guardian. The company does not knowingly collect personal data from children under the age of 13. If the Company discovers that the Company has inadvertently collected personal data from children under the age of 13, the Company will delete such information as required by law.

8. The parties UMC may share your personal data

(1)  UMC may share your personal data with:

• • You and the agent appointed by you.
  • The judiciary authorities, UMC shares your personal data in accordance with legal requirements, or to report any illegal or suspected illegal behavior.
  • Accountants, auditors, consultants, lawyers and other professionals who have confidentiality agreements with UMC and provide consulting service to UMC.
  • In accordance with the provisions of this policy, UMC may provide your personal data to payment service agencies, freight companies and other global service providers.
  • When necessary to assert, exercise or defend legal rights, or to prevent, investigate, prosecute, or enforce criminal penalties, UMC may provide your personal data to relevant parties, competent authorities, government units, and law enforcement agencies or court.
  • If UMC sells or transfers all or part of its business or assets, or undergoes reorganization, dissolution or liquidation, it may provide your personal data to the buyer or transferee of the transaction.

(2) If UMC entrusts an information service provider to process your personal data, UMC will require a contract to meet the following:

• • The information service provider shall process within the purpose’s scope.
  • The information service provider shall comply with legal requirements and have sufficient mechanisms to protect the security of personal data.

9. Data Analysis and Automated Decision Making

UMC may process your personal data to analyze and to be used in automated decision making:
In order to avoid information leakage and protect intellectual property rights, for example to process your data and to analyze potential risks in Information Technology systems. Therefore, it is recommended that you avoid disclosing your sensitive personal data, or other confidential information.

10. Information Security

UMC has employed properly technical and organizational security measures (e.g. setting access permission) in accordance with the applicable laws to prevent your personal data from being accidentally or intentionally damaged, lost, tampered with, unauthorized disclosure, unauthorized access, and other illegal or unauthorized processing.

Because of the public nature of the internet, information transmitted over the internet is not completely secure. Although UMC has taken all reasonable steps to protect your personal data, it cannot guarantee that the transmission of your personal data over the internet will be completely secure. You will bear the possible risks of this transmission process, and please confirm that there are no security issues in the process of transmitting your personal data to UMC.

11. The accuracy of your Personal Data

UMC endeavors to take reasonable steps to ensure that the personal data processed by the company is accurate and correct. If there is any inaccurate in your personal data, the company will correct or erase it immediately. In order to ensure the accuracy of your personal data, the company may confirm the accuracy with you if necessary.

12. The principle of minimizing the Processing of Personal Data

UMC endeavors to take reasonable steps to ensure that the scope of the company's processing of your personal data is reasonably related to the purposes set out in this policy, and only within that scope.

13.Personal Data retention period

UMC endeavors to take reasonable measures to ensure that the processing of your Personal Data is for necessary time period and to fulfill agreed purposes. UMC will keep your Personal Data in accordance with the following principles:

1. (1) During the period of business relationship from the time you approached UMC for business, until you notify UMC of your succession of business communication.
2. (2) During the period of statute of limitation prescribed by the applicable laws or regulations. For example, when a third party exercises the legal right to request for your Personal Data from UMC, UMC may continue to facilitate your Personal Data for the period necessary for fulfilling such request. The processing of your Personal Data will be limited to the storage and maintenance.
3. (3) After the expiration of the retention period, UMC will permanently delete or destroy your Personal Data, or make your Personal Data to be anonymous.
4. (4) The mandatory time period for fulfilling legal purposes under the policy.

14. Data Subject Rights

According to applicable Personal Data protection laws, you may request the following rights to UMC:

1. (1) Review your Personal Data.
2. (2) Request UMC to provide duplicates of your Personal Data.
3. (3) Request to supplement or correct your Personal Data.
4. (4) Transfer your Personal Data to other Personal Data controllers under reasonable and feasible measures.
5. (5) In light of the compliance of applicable laws, you have the right to object to third party who processing of your Personal Data on behalf of UMC.
6. (6) Request to opt-out, including the following rights:

• • • Withdrawing your consent for UMC to process your Personal Data. However, please note that the withdrawal of your consent will not affect the legality of UMC's processing of your Personal Data based on your prior consent. If the processing of your Personal Data has other legal standings, UMC may continue to process your Personal Data.
    • Refusing to provide your Personal Data. However, please note that if you refuse to provide your Personal Data, UMC may not be able to provide you our products or services in complete.
    • Stopping the collection of your Personal Data.
    • Restricting the processing of your Personal Data.
    • Requesting the deletion of your Personal Data.

If you intend to exercise the above rights or have any questions about this privacy policy, please contact UMC using the contact information provided in Article 17.

For security purposes, when exercising your privacy rights, UMC may request additional information to verify your identity to reasonably confirm that you are the owner or a legally authorized agent of your Personal Data.

15. Cookies and other similar technologies

When you visit our website or log in systems, we may set cookies on your device or read the cookies which are on your device based on legal requirements or your clear consent. We may use cookies to record certain information or record your preferences and browsing intents. We will use cookies and other similar technologies to process your Personal Data in accordance with Cookie Policy. For any details, please refer to our Cookie Policy。

16. Direct marketing

UMC may use your e-mail and other Personal Data to provide you information that may be of interest to you, including but not limited to business sustainability and corporate social responsibility. When UMC provides you with the foregoing information, UMC may use the contact information provided by you. You can unsubscribe at any time via the emails sent to UMC. After canceling the subscription, UMC will no longer send unsubscribed information to you.

17. Contact information

If you have any questions about this privacy policy, please contact UMC at:

United Microelectronics Corporation

Company address: No. 3, Li-Hsin Rd. 2, Hsin-Chu Science Park, Hsin-Chu City, Taiwan, R.O.C.

Telephone: 03-5782258

Email: [email protected]

Data Subject Access Right(DASR) Form

18. For California Residents

Since 2018, the California Consumer Privacy Act (hereinafter referred to as “CCPA”), the California Privacy Rights Act (hereinafter referred to as "CPRA"), and California Civil Code Sections 1798.100 et seq have strengthened the protection of California residents and consumers privacy rights.

The aforementioned laws and regulations apply to Personal Data collected from California residents and consumers (hereinafter referred to as "you"). Personal Data, as defined under the aforementioned laws and regulations is limited to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident, consumer or household. You may refer to the provisions of the CCPA and CPRA to identify the category of Personal Data, as well as the explanations provided in Article 3 of this policy. However, Personal Data does not include:

1. (1) Publicly available information that is lawfully made available from federal, state or local government records.
2. (2) California residents and consumers information that is de-identified or aggregate.
3. (3) Other information excluded from the scope of CCPA and CPRA.

According to CCPA and CPRA, you are entitled to the following rights:

1. (1) Request UMC to delete your Personal Data. However, UMC may retain Personal Data under the CCPA, CPRA or other applicable laws if it is necessary, such as:

• • • To provide our services or to perform a contract between you and UMC.
    • To protect our business and systems from fraudulent or illegal activity.
    • To debug, identify and repair errors that impair existing intended functionality.
    • For UMC or others to exercise free speech or other rights.
    • For scientific, historical or statistic research in public interest aspect.
    • For our internal sole use that are reasonable based on your relationship with us.
    • To comply with legal obligation.

1. (2) Request to correct your Personal Data.
2. (3) Request UMC to disclose the categories and specific pieces of personal Data that UMC have collected, used, or sold. Furthermore, you have the right to request UMC provide duplicates of your Personal Data.
3. (4) Choose not to sell or share your Personal Data, and the aforementioned share includes cross-context behavioral advertising. However, UMC does not "sell" nor "share" your Personal Data as UMC understands that term to be defined by the CCPA, CPRA and its implementing regulations.
4. (5) Choose to limit your sensitive Personal Data.
5. (6) Choose to access information from automated decision-making technology or opt-out from it.
6. (7) UMC will not “discriminate” against you for exercising your rights under CCPA and CPRA as UMC understands that term to be defined by the CCPA, CPRA and its implementing regulations.

If you intend to exercise the above rights or have any questions about this privacy policy, please contact UMC using the contact information provided in Article 17. UMC may provide Personal Date to you at any time, but shall not be required to provide Personal Data to you more than twice in a 12-month period.

The information disclosed by UMC will only cover the time range of 12 months from the time UMC receives your request to be verified; if UMC cannot meet your request, UMC will also reply and explain why.

For security purposes, when exercising your California privacy rights, UMC may request additional information to verify your identity to reasonably confirm that you are the owner or a legally authorized agent of your Personal Data.