Privacy Statement

Introduction

Panda Origin Co., Ltd. ("we", "our", or "the Company") maintains high standards in the processing of personal information. This Privacy Statement describes the scope of the personal data we process and your rights as our user and data subject.

This Statement applies to your use of the nps.tw platform and all features and services provided by the Company (collectively, "Services"). We also maintain a separate Cookie Policy for website cookie usage.

This Privacy Statement applies to all services provided by Panda Origin Co., Ltd. through its official website (nps.tw), branded applications, and digital services. Where a specific plan, product, or service has its own privacy policy, that policy will take precedence over or supplement this Statement.

Your Personal Data

"Personal data" means any information that directly or indirectly identifies a specific individual or household. We only collect data necessary to provide our services and continuously improve user experience.

If you choose not to provide the requested information, we may be unable to provide certain services. If you no longer need a service or wish to delete personal data, please contact us.

We collect personal data through your use of our services and may use cookies and similar technologies. Data categories collected in the past 12 months include but are not limited to:

• Contact Information：Email address (used as account identifier and primary communication method), name, phone number, and other contact details for account services, identity verification, and customer communications.
• Commercial Information：Payment methods and financial data (credit cards, bank accounts, etc.) for payment transactions and billing management.
• Technical Information：IP address, device identifiers, referral URL, browser type and version, operating system, connection data, and network activity logs for security, fraud detection, and service improvement.
• Account Information：Account name, login records, activity logs, transaction data, and content generated during service use.
• Communication History：Inquiries and customer service interactions with us, and any other information you voluntarily provide.
• Other Information：Other information provided digitally or physically, stored on a case-by-case basis based on the reason provided.

Legal Basis and Other Purposes

The legal bases for our processing of your personal data include:

• Based on your consent;
• Necessary for the performance of a contract with you (including terms of service);
• Based on our legitimate interests, provided those interests do not override your fundamental rights.

"Legitimate interests" include: protecting users and the company from security threats, complying with legal obligations, preventing fraud and abuse, conducting reasonable business integration and internal audits.

Purposes for which we collect and use personal data include but are not limited to:

• Building and operating the nps.tw platform for you to browse and use services;
• Managing accounts and responding to inquiries and requests;
• Personalizing service experience and continuously improving platform features;
• Providing newsletters, event notifications, and other marketing information (you may unsubscribe at any time);
• Sharing necessary information with partners (such as payment processors, logistics providers, and technical service providers) to deliver services;
• Ensuring network security and preventing fraud;
• Enforcing our policies or contracts with you;
• Maintaining the integrity and security of information systems that store and process personal data.

We do not sell your personal information to any third party, nor do we provide your information to third parties for direct marketing purposes.

Retention Period

We retain personal data no longer than reasonably necessary for the specific processing purpose. If you have provided consent, we will process your data for the duration of the consent.

Where required by applicable law or regulation, to assist government or judicial investigations, or in connection with legal claims, we may retain necessary data as required. Data not meeting any retention criteria will be deleted or destroyed securely.

Data Controller and Data Transfers

Panda Origin Co., Ltd. (registered in Taiwan) is the data controller for your personal data. Your use of our services is subject to the relevant terms of service.

To provide complete services, we may need to transfer your personal data to service providers outside Taiwan (such as cloud infrastructure, payment processing, and email delivery services). We take appropriate contractual safeguards to ensure these recipients protect your data to standards equivalent to this Statement.

We may also disclose personal data to competent authorities as required by law or in response to lawful government investigations.

Your Rights Regarding Personal Data

Unless subject to legal exemption, you have the following rights regarding personal data we hold:

• Right of Access：You may request a copy or specific portion of personal data we have collected about you.
• Right to Know：You may request information about the categories of personal data collected, sources, purposes of use, and which third parties receive it.
• Right to Portability：Under certain conditions, you may request that we transfer your personal data in a machine-readable format to another data controller.
• Right to Deletion：You may request that we delete personal data we no longer need (subject to applicable law).
• Right to Correction：You may modify your contact information through account settings or request that we correct inaccurate data you cannot change yourself.
• Right to Object：You may object to the use of some or all of your personal data based on our legitimate interests.
• Right to Restrict Use：You may request that we stop or limit use of personal data that is no longer necessary.
• Right Against Discrimination：You will not be subject to discriminatory treatment by us for exercising any of the above rights.

To exercise any of the above rights, please contact us via the "Contact Information" section below. We will respond within 30 business days of receipt. Note that exercising deletion, restriction, or objection rights may affect our ability to continue providing certain services.

Security

We employ multiple data protection measures to minimize the risk of misuse, unauthorized access, disclosure, and data loss. These include data encryption (in transit and at rest), hashing, access control, and other technical and administrative measures.

Our employees may only directly access personal data in a secure network environment with strict access controls. Data you provide is encrypted and stored in managed cloud and server systems.

We only log user IP addresses for security purposes and periodically clear these logs. If there is clear evidence that certain IP addresses or accounts may be intentionally harming our services, we may suspend service and report to relevant authorities.

Changes to This Statement

We may revise this Statement as needed to reflect regulatory updates, user feedback, and new service launches. If changes affect how we process your data or your rights, we will notify you directly or, if we cannot reach you directly, through a website notice.

We recommend reviewing this Privacy Statement periodically to stay informed about how your data is processed.

Children's Data

The nps.tw platform is designed for adults with legal capacity and commercial users, and is not designed or intended for children under 16. We do not typically collect data from children.

If a child under 16 must use our services, explicit parental consent must be obtained and verified. If we learn or discover that collected data comes from children below the minimum age, we will immediately take steps to delete the information.

Notice to End Users

Some nps.tw services may be managed by enterprise or organizational administrators. Your use of these managed services will also be subject to the terms or policies set by those administrators. For questions, please contact the service administrator directly.

Panda Origin Co., Ltd. is not responsible for privacy or security practices independently configured or managed by our customers.

Contact Information

If you have any questions, concerns about this Privacy Statement, or wish to exercise your personal data rights, please contact us via:

We will respond within 30 business days of receipt. If we cannot process your request within this timeframe, we will notify you and provide an explanation.