Privacy and Information Security Policy

Welcome to Taipei 101. To help you use the services and information provided by the Taipei 101 website and app safely, please find below the details of the Privacy Protection and Information Security policies of the Taipei 101 website and app. Please read them carefully to learn how they may affect your rights and interests.

Privacy Protection Policy

I. Applicable Websites: Below websites and app operated by Taipei Financial Center Corporation (hereinafter “Taipei 101”):

1. 1. TAIPEI 101 official website (https://www.taipei-101.com.tw/)
   2. STAGE@TAIPEI 101 official website (https://stage.taipei101mall.com.tw/）
   3. TAIPEI 101 MALL APP

(collectively, the “Taipei 101 Website or App”) and other application services that refer to this Privacy Protection Policy are bound by a single privacy right and information security policy. If you need to refer to any webpage or information on the Taipei 101 Website or App, please contact Taipei 101 to gain consent and please indicate the source. In using any photograph or video from the Taipei 101 Website or App, in addition to the above requirement, please also exercise care about provisions related to the image rights of the persons photographed and personal data protection.

II. Scope of Application: When you use a computer, mobile device or other device to access the Taipei 101 Website or App or any service we provide to you within the scope of business of Taipei 101, such use shall be governed by this policy. Please make sure that you read this policy carefully, as continued use of the services we provide is subject to your consent to this policy. If you do not agree to provide any information that may be used to identify you, you can still view the Taipei 101 Website or App or accept our services. However, the user experience may be impacted, and you will still need to agree to safety terms and conditions that are not related to personally identifiable information.

III. Links to outside websites: This privacy protection policy is not applicable to any website that is not managed or maintained by Taipei 101, nor does it apply to any business place that is not directly managed by Taipei 101. If you are linked to a website of a Taipei 101 partner through the Taipei 101 Website or App, you will have left the scope of application of this policy; Taipei 101 Website or App shall have nothing to do with the content or safety of the other websites and Taipei 101 shall not be held liable for any consequences arising from their use. Please exercise care regarding their privacy policies and safety.

IV. Personal Data Protection Mechanism:

• Purpose of Personal Data Collection

1. To provide you with better quality services, give you notice about events or provide new product services based on your wishes, reply to questions, reach commercial agreements or answer requests, you can freely choose to allow us to collect and process your data and can decide whether or not we can use such data. Taipei 101 only processes and uses personal data for limited and specific purposes. We will perform our obligations of notice and legal basis for data acquisition depending on the type of service.
2. If Taipei 101 wishes to use your personal data for any other purpose, unless otherwise provided by law, to maintain public interest or to prevent harm to any other person’s right, life or property, we will give you further notice before such alternative use and will explain the newly added purpose and processing conditions and seek your consent based on legal processing and use.

• Type of Personal Data Collected

1. To the extent required for legal and specific purposes and subject to the principle of minimal data, with your consent, we need you to provide personal data with justifiable and reasonable links to the purpose of collection.
2. Taipei 101 only provides services to individuals with full legal capacity. Without mandatory requirement under the law, Taipei 101 will not collect, process or use personal data of any person under the age of 16.

• Acquisition of Personal Data

1. When you use the Taipei 101 Website or App to register as a member of Taipei 101, participate in any event organized by Taipei 101, use any specific service provided by Taipei 101 or use any online service of Taipei 101 Website or App (such as online messaging).
2. When you view or download files from the Taipei 101 Website or App, Taipei 101 Website or App will not collect any personally identifiable data, but only data related to the internet protocol (IP) address that links your device to the internet, type of device, device identification code, type and version of browser, viewing record and online journal. Such information will be used to improve your viewing experience and the its use will have no impact on you personally.
3. As required for website internal management, the Taipei 101 Website or App will perform “gross analysis” of website traffic and online behavior surveying based on user viewing and consultation information, as important reference to improve service quality. When you download the Taipei 101 Mall App, Taipei 101 may receive data about your location and mobile phone, including the unique identification code of the device. Taipei 101 may use such data to provide you with localized services, such as advertising, search results and other customized content. You can freely choose whether or not to turn off location services on your device.
4. When you are recorded by surveillance camera inside the Taipei 101 premises, these images will only be used for traffic statistics and research analysis, protection of property and physical safety and prevention of criminal activity. Image data are subject to strict control procedures and will not jeopardize your privacy. Also, it is usually very difficult to identify a specific subject.
5. If Taipei 101 acquires your personal data through other channels, we will give you notice within 1 month about the type of personal data acquired, the purpose of acquisition, the territory and target of use, the channel through which we acquired the personal data, and any other relevant information.

• Period, Territory, Target and Manner of Personal Data Use

1. Period: You can terminate your membership with Taipei 101 at any time. The period of use is from the date on which you are invited to become a member of Taipei 101 until the date on which you ask Taipei 101 to stop collecting, processing and using your personal data, or when you request its deletion.
2. Territory: Taipei 101 only uses your personal data collected through the Taipei 101 Website or App inside Taiwan. If offshore data transmission is needed, Taipei 101 will acquire your consent and will only do so in compliance with applicable laws of Taiwan, the EU or the transmitting country.
3. Target: Taipei 101 will not provide any other organization or individual with your personally identifiable information (such as name, email address, or any other information that may be used to contact or identify you) without your prior consent, except where there is a legal basis or contract obligation:

• To perform obligations in any dealing with you.
• In response to a legal requirement (including but not limited to cooperation with legal investigation by the judicial authority, investigation or use based on a competent authority’s powers, or official need.
• To assist the competent authority, judicial authority or the authority designated thereby for use required to perform legal proceedings, where acquiring your consent may jeopardize such proceedings.
• To perform a contract obligation. Before providing your personal data to a third party for processing or use, Taipei 101 will carefully select its partners and will perform proper supervision and management in accordance with the law. Such partnerships may include logistics, marketing, payment processing and information system technical support, and similar; these arrangements are made in order to provide you with improved service experience.
• When the use is required for emergency purpose such as to protect life, prevent physical harm or protect property, and it is difficult to acquire your consent.
• When the use is exceptional and necessary to maintain the public interest, and it is difficult to acquire your consent.
• When your conduct on the Taipei 101 Website or App is in breach of Taipei 101 service terms and conditions, policies or may jeopardize or interfere with Taipei 101’s interests, or cause damage to any person, and Taipei 101’s analysis shows that disclosing your personal data is required for identification, contact or to adopt legal action.

4. Manner: Taipei 101’s manner of collecting and processing your personal data includes automated and non-automated collection, recording, structurization, storage, change, search, etc. Taipei 101 only retains your personal data to the extent necessary for fulfillment of the requirements of the law, performance of contract and provision of services to you.
5. Anonymization or Pseudonymization: In processing personally identifiable data, Taipei 101 will first consider anonymization or pseudonymization technology and will not use your personally identifiable data to execute any fully automated analysis or predict individual behavior without your consent, subject to the performance of obligations under contract between the parties. If we use anonymized data for statistical purposes, such data will be stored separately from the personal data you provide and will be kept strictly confidential.
6. Automatic Decision Making or Dissection: If Taipei 101 decides to use your data to carry out any automated decision making or dissection, we will give you prior notice about how the data will be processed and acquire your written consent. Taipei 101 will adopt proper measures before such processing, to protect your rights and data security.

• Exercise of Personal Data Rights:

1. Depending on the applicable laws, Taipei 101 provides you with the right to seek copies of the data, including the purposes and scope of our processing of personal data. If you need a copy, we will tell you the fee schedule and will charge a reasonable fee to cover our costs. If you have any concerns about the correctness of the data provided, we also provide you with the right to make corrections or revisions.
2. You can ask Taipei 101 to delete your personal data, in accordance with the requirements of individual laws. If you revoke your consent for the processing of personal data, if the purpose of use ceases to exist, if we processes data illegally or if we no longer have legal grounds to keep the data, you can also reject our marketing, or ask us to limit data processing, stop processing and use, ask for the data to be transferred or object to the continued processing of personal data, we will strictly comply with the law in processing these requests. If you want to exercise your personal data rights granted to you by the law, or if you have any questions about the legality of our personal data processing, you are welcome to contact the customer service desk or leave a message via the hotline, mailbox or the Taipei 101 Website or App. We will assign a dedicated person to contact you and will do our best to reply within the legally required deadline. If you have any concerns regarding Taipei 101’s handling of personal data, you can file a complaint with the competent authority.
3. Taipei 101 does not force you to provide any personally identifiable data. However, in the course of providing services or performing our contract obligations with you, relevant personally identifiable data may need to be processed. If such data are not provided, we may not be able to provide you with all services, perform our contract obligations or contact you pursuant to your request. You can provide personal data based on your free will and we will contact you with your prior consent. If you provide any incorrect or false data, Taipei 101 has the right to decline your request or the provision of services.

V. Social Media:

Taipei 101 Website or App may be linked to official accounts operated by Taipei 101 on social media platforms (including but not limited to Facebook, Instagram, X, Threads, Line, etc.) or social media accounts not operated by Taipei 101. When you use the share button and function provided by such social media, the social media will receive the relevant webpage information you provide.

If you have logged into a social media platform account, the platform will access information in your personal account or online viewing data through the browser. If you do not agree with such access, please make sure that you delete the data from your social media platform page. We suggest that you read carefully the terms of use and privacy policies of social media platforms.

VI. Use of Cookies:

• A cookie is a small-size text file for the purpose of storing information for the web browser. Cookies can store and receive identification codes and other information on computers, mobile phones and other device. Other technologies, including data that Taipei 101 stores on your webpage browser or device, as well as the identification codes and other software linked to your device, are for similar purposes. These technologies are referred to collectively as “cookies” in this policy.
• The Taipei 101 website will read the cookies saved in your computer based on the functions and purposes of the cookies. To memorize the operations and data inputs when you switch from webpage to webpage or to maintain the security of data transmission, the use of such type of cookies is not subject to your consent.
• The Taipei 101 website will use cookies to improve your user experience, such as your location and language. However, your true identity cannot be identified. If you choose to use cookies to save your account name and passcode, it will provide you with the convenience of logging into the Taipei 101 Website or App without having to input them again. This type of data is only used for statistical analysis by the Taipei 101 Website or App. Unless you log in as a member or complete shopping at the Taipei 101 Website or App, this type of information will not be linked to or matched with your member data or other personal data. Taipei 101 will not use cookies to send you advertisements.
• To improve the performance of the Taipei 101 Website or App, such as error messages, user feedback or webpage click rate statistics, Taipei 101 will collect statistics data from the website, including but not limited to the type of device, IP address and webpage viewing records, etc., solely for the purposes of improving the service process flow of the Taipei 101 Website or App and analysis of website traffic. Your true identity will not be identified, and these data will be kept continuously.
• If you do not wish for cookies to be used, your browser or device allows you to configure and delete browser cookies. We encourage you to set the privacy configuration in your browser function to the highest level so that your viewing will not be traced and cookies will be rejected. For detailed information about the control options, please refer to the instructions for use of each browser or device. However, turning off cookies may make it unable for you to use certain functions of the Taipei 101 Website or App or may lower the service quality of the Taipei 101 Website or App.

Information Security Policy

• Management:
  1. Taipei 101 has set up an Information Security and Personal Data Protection Steering Committee to review and make resolutions on the management of personal data. It also has a Personal Data Protection Management Team to carry out management tasks, revise personal data management governance documents, convene personal data management meetings and assist with the compilation of personal data protection results and records.
  2. Taipei 101 follows the safety maintenance procedures required by the Personal Data Protection Act, and has established the Personal Data Management Regulations, the Taipei 101 Personal Data File Security Maintenance Program, and Personal Data Handling Procedures after Termination of Business, and regularly performs risk assessment on personal data, including proper security measures related to the performance of its responsibilities regarding personal data protection.
  3. In granting authority to access personal data, Taipei 101 only grants the minimum authority required by business need and implements segregation of power and reviews of such authority.
  4. When the specific purpose for collection of personal data ceases to exist or when the retention period expires, Taipei 101 will, on its own initiative or pursuant to the subjects’ request, delete and stop processing or using relevant personal data, except where the data is required for performance of legal duties or the subject gives their consent for its further retention.
  5. In case of a personal data incident in breach of the Personal Data Protection Act relevant rule, Taipei 101 will immediately activate the emergency report and response procedure and will handle subsequent matters in accordance with applicable laws.

• Change of Website Account Name, Password and Security Protection:
  1. Taipei 101 undertakes proper security protection measures to protect data and prevent unanticipated interruption of business operations or data breach events. All account details of registered members in the Taipei 101 Website or App are password protected. Taipei 101 adopts reasonable measures to protect personal data from loss, improper use, and unauthorized access, use, alteration or sabotage. Data transmission is done using appropriate encryption technology. The security protection measures in place include the overall data lifecycle and regular inspection and updating of each security mechanism to provide effective protection and comply with the law. Any hacking that may impact Taipei 101’s operation will be reported to the competent authority.
  2. Online users who are registered members can log in at any time to revise their data and preference settings in the Taipei 101 Website or App, including whether to accept Taipei 101’s notifications regarding special events, new products and new services.
  3. The above data are required to (1) correctly transmit the contents in the Taipei 101 Website or App, (2) improve content and advertisements on the Taipei 101 Website or App, (3) ensure the long-term feasibility of Taipei 101’s information technology systems and website technology and (4) provide the competent authority with information required for investigation or litigation in the event of hacking.

• Data Storage and Management:
  1. We provide you with functions to view, revise and delete personal data. For more information, please visit the configuration page of the Taipei 101 Website or App.
  2. Taipei 101 will continue to retain the data until you no longer need us to provide the services or until you delete the personal data (whichever is earlier). Such a decision will have different results in different cases, depending on the nature of the data, the reason for data collection and processing, relevant laws and the need to keep the data for procedures.
  3. If you delete your personal data, it will not be possible to recover the data that you provided in the past.

• Security Measures: Any attempted sabotage to Taipei 101 Website or App’s confidentiality, integrity or availability without authorization shall constitute a breach of the law and will be pursued by Taipei 101 in accordance with the law.

Responding to Legal Requests

• When Taipei 101 encounters the below situations, it may access and keep your data or extend the period to acquire and keep such data:
  1. When you raise a concern about the correctness and manner of handling the data, object to Taipei 101’s continued processing, suspect illegal processing by Taipei 101, cease of existence of specific purpose of personal data protection or expiry of retention period. If Taipei 101 needs to continue keeping personal data due to litigation, pending clarification on the application of the law or verification, you may ask Taipei 101 to limit the processing of the data. If Taipei 101 processes your data based on legitimate interest or public interest, you also have the right of rejection (objection).
  2. A legal requirement or performance of obligation in cooperation with a competent authority’s investigation or use, based on its authority or required by its duty or legal investigation by the judicial authority.
  3. Taipei 101 is convinced that it should cooperate with an investigation or respond to the competent authority’s enquiry or instruction in order to prevent or resolve fraud, breach of Taipei 101’s terms and conditions or policies, or other damage to users’ rights or to protect the legal interests of you and Taipei 101 (including rights, assets, products or services).

• Governing Law and Jurisdiction

Any litigation arising from the Taipei 101 Website or App shall be governed by the laws of the Republic of China and the Taiwan Taipei District Court shall be the first-instance court of jurisdiction.

• Amendments to Privacy Rights and Information Security Policies

In response to the evaluation of the social environment, legislation and the advance of technology, and to protect user privacy and intellectual property rights of website contents, Taipei 101 may on occasion revise and republish this policy. If you have any suggestions or questions regarding this policy, please contact us.

• Privacy and Information Security Consultation

If you have any questions about Taipei 101’s processing of personally identifiable data, please address them to the customer service desk, hotline, mailbox or the Taipei 101 Website or App.  You can also consult the relevant competent authority.

Taipei 101 Contact Window and Contact Details:

Telephone (02) 8101-8800, email mallservice@tfc101.com.tw

Contact Taipei 101’s Privacy Protection Officer: dpo@tfc101.com.tw

Taipei 101’s Business Address: No. 7, Section 5, Xinyi Road, No. 45, Shifu Road, Xinyi District, Taipei City

 （Privacy and Information Security Policy, revised June 2024）