Information and cyber security

Information
Security

The Company has established the “Group Information Security Policy,” which is approved by the CEO and serves as the guideline for the Group’s establishment of information security and network security management systems and procedures, as well as information and communication management related to computer system hardware and software. The policy aims to ensure the confidentiality, integrity, and availability of the Company’s important information.
Key elements include: conducting regular evaluations of the information security management system; establishing mechanisms to ensure confidentiality, integrity, and availability of information and prevent unauthorized access; receiving internal and external threat intelligence and performing risk assessments and penetration testing; requiring all employees to comply with the policy and promptly report incidents; and requiring third-party partners to undergo security assessments and include information protection obligations in contracts. The Company also implemented firewalls, threat monitoring and analysis, vulnerability scanning, hacker simulations, drills, and backup operations. In 2025, no violations of customer privacy or legal penalties occurred.

Information security management

The “Information Security Committee of the Group” is the highest guiding organization for the Company’s information security. The Group CEO serves as the highest supervisor, and oversees the implementation of various information security management measures by committee members to demonstrate the full support for the information security management system. The organizational structure of the committee is as follows. The committee is composed of commissioners designated by various departments, including but not limited to the head and division-level executive members. In 2023, the headquarters of the Group further appointed an “Information Security Officer,” with the division-level management unit of the Information Service Division managing information security-related matters, and with a professional security technology team commissioned to assist in providing the necessary information security services.

Two Information Security Committee meetings chaired by the Group’s CEO were held in the year to review the performance of the current security management system, assess operational risks and related response plans, and review the progress of the annual information security projects.

Under the guidance of the Group’s operational strategies and government laws and regulations, the committee is responsible for formulating the overall information security policy, promoting security protection measures, patching system vulnerabilities, monitoring abnormal incidents, and responding to major events. Gamania has fully implemented the PDCA management cycle (Plan – Planning and Assessment, Do – Design and Implementation, Check – Review and Audit, Act – Review and Improvement) to ensure consistency between what is said, documented, and done in the risk management system. With continuous improvement at its core, the cycle enhances the security and resilience of operations and services. Through a comprehensive cyclical framework of risk assessment, rolling policy revisions, protective infrastructure development, monitoring management, and vulnerability patching, we continuously track the latest information security trends. This allows us to flexibly adapt to different information service models, operating environments, and regulatory requirements, thus ensuring that our information systems and network services operate stably within controllable risk tolerances.

To enhance cybersecurity governance and execution effectiveness, the Group has established various functional teams under the Information Security Committee, including the Policy and Information Security Technology Promotion Team, Executive Team, Audit Team, Risk Team, and Emergency Response Team. The “Group Information Security Organization Management Regulations” clearly define the responsibilities and authorities of each team to continuously advance information and communication security matters and provide feedback on security management indicators for information security governance. The teams work together and complement one another. The detailed division of responsibilities is shown in the figure below.

At the same time, the information units also regularly conduct information security assessments, inventories of information assets, reviews of operating systems, determination of business impacts (including MTPD, RTO, and RPO), and information security measurements.

Information security management strategy and specific management measures

The Company’s information security strategy focuses on three key dimensions: people, systems, and management. In compliance with national laws and regulations, the Company manages customer and member data assets through risk-based analysis and controls.

People: Provide training tailored to different groups, including general information and communication security awareness courses for employees and function-specific information security lectures or courses for information personnel.
System: We adhere to the “Guidelines for Cybersecurity Controls for TWSE/TPEx Listed Companies” and reference ISO 27001 standards to revise or introduce new information operation management regulations.
Management: We define clear responsibilities for each team within the Information Security Committee, hold regular meetings, raise awareness of cybersecurity policies and related security control requirements, and promptly review implementation and feedback.

As Gamania continues to advance toward its goal of becoming a “full-ecosystem technology enterprise,” it actively implements the core strategy of “Sustainable Momentum” and introduces external ratings of information security risks and security management performance. Strong ratings can enhance the Company’s brand image, attract potential customers and business partners, and thereby increase overall corporate value. They also enable investors to understand the Company’s information security management performance and the overall health of its information security posture, providing an important reference for investment decisions.

Early prevention

Regular review of information security management regulations

Every year, the Company establishes and adjusts the information security policy and related management regulations or procedures in accordance with the current laws and regulations, industry trends, and stakeholders’ requirements. This includes a total of 13 regulations covering the aspects of data protection, operational security, information operation outsourcing, password management, and so on.

Security inspection of information operations

Based on the nature and risk of different information operation services, the Company classifies the information security risk levels of its operations, establishes the necessary protective measures, and regularly conducts various information security management assessments. Security testing is conducted on information and communication service systems, including vulnerability scans of websites and servers and penetration testing. Before a system goes live or undergoes a major change, the corresponding security testing is conducted based on the results of the risk-level assessment, and system vulnerabilities are remediated to reduce the impact of human or natural factors on business operations. These activities also enable the Company to understand and assess the security status of its corporate network environment and systems and verify the security level and effectiveness of its current information security protection settings.

Implementation of Security Operations Center (SOC) Monitoring and Endpoint Detection and Response (EDR)

The Company engages a domestic third-party information security technical consulting team to monitor and keep abreast of information security alerts and threat intelligence, strengthening and accelerating threat detection, defense, and response.

Review of the effectiveness of cybersecurity measures

The Group Information Security Committee regularly convenes two meetings each year to conduct rolling reviews and revisions of information security strategies and mechanisms, while also reviewing the effectiveness of the implementation of relevant requirements and tracking findings from internal audits.

Adoption of International Information Security Management Standards (e.g., ISO 27001)

All the Group’s subsidiaries have obtained international information security certifications (please refer to the Information Security Certifications List for details).
Gama Pay has obtained the “Mobile App Basic Security” certification for consecutive years since 2019, and has been certified by a third-party testing agency.

Cultivating employees’ information security awareness

Simulate hacker attacks and create highly simulated attack emails to send decoy letters to employees to understand the true state of employees’ information security awareness and basic defense capabilities in the face of social engineering, phishing, and other behaviors. Employees who have successfully been deceived are given targeted education programs to arouse employees’ instinctive responses to threats, adjust information security behaviors, and build the ability to stop, see, and listen. In 2025, email-based social engineering exercises were conducted for all employees, with a cumulative total of 3,978 phishing emails sent to test employees’ ability to detect phishing emails.
Information security risk-driven education and training allows proactive defenses to precede attacks. Internal information security trainings are also organized to enhance information security awareness and awareness among information and communication management personnel and general colleagues, understand the importance of information security and various possible security risks, and improve Information security awareness among employees, and thereby change their behavior. In 2025, both the completion rate and pass rate for the Group-wide mandatory course reached 100%.
Through the “Information Security Section” on the information services collaboration platform, the Company compiles information security news and current events each week, provides short articles offering practical security guidance relevant to work and daily life, and distributes information security newsletters on an ad hoc basis together with information security awareness communications. These efforts enhance and reinforce employees’ vigilance regarding information security and cultivate the habit of conducting security checks.
■ Information Security News and Current Events: 388 items
■ Practical Information Security Guides: 11
■ Information Security Newsletters: 3 issues

In-process implementation and review

Operational information self-evaluation

Assessment mechanisms are established for various information security management measures, and the Group’s operating subsidiaries and affiliates are regularly required to conduct self-assessments of their information activities.

Endpoint security management

An endpoint protection mechanism is in place to effectively reduce the information security gaps caused by the improper use of endpoint equipment.

Backup mechanism for important systems, databases, and files

The Group has established a comprehensive business continuity and disaster recovery plan, covering backup mechanisms for critical systems, databases, and files. Disaster recovery drills are conducted regularly (at least once a year). The drills include tabletop simulations and tests of actual scenarios to ensure the effectiveness of restoring access to and the functionality of IT infrastructure. This confirms that access rights and system functions can be promptly restored in the event of an abnormal situation, allowing operations to quickly return to normal or acceptable levels, thereby ensuring the continued operation of core service systems and uninterrupted business operations.

Yearly internal audit on information security

Each year, the headquarters of the Group draws up an information security management audit plan to be implemented. Operating subsidiaries are accordingly interviewed and sampled in terms of the implementation status of various information operations, and the audit results are reported to the Information Security Committee of the Group. The audit findings are listed for follow-up and correction, and serve as the basis for promoting the Group’s information security management. Improvement plans developed following the 2025 reviews include expanding the scope of information security audits in phases in the following year, planning corresponding security management measures for outsourced information operations, gradually enhancing employees’ knowledge of information assets across the organization, and planning the development of lightweight risk assessment methodologies for the Group’s subsidiaries and affiliates.

Post-response and recovery

An information security response and reporting mechanism is established to ensure the rapid and thorough handling and recovery in the case of information security incidents. We have also added a information security incident review management mechanism.
In 2025, the Company did not encounter any major network attack or incident, and was not involved in any related case of legal dispute, supervision or investigation.

Note: EDR, or Endpoint Detection and Response, combines continuous real-time monitoring, endpoint data collection, and advanced cross-correlation to detect and respond to suspicious activities involving hosts and endpoint connections. It enables information security teams to make faster assessments and conduct cross-comparisons, while providing clearer information about detected events.

Information security risk management

Gamania actively implements the “Group Business Operations Information Security Management Guidelines” and continues to strengthen the security of key elements of its operational information systems (such as networks, operating systems, databases, and applications), enhance the completeness of its information security management system, ensure the stable operation of information systems, protect information equipment and data files, prevent intrusion and damage from various threats, and thereby reduce operational risks. In addition to sound management measures, potential risks must be continuously monitored, and the Company must ensure that it has the ability to respond promptly and handle incidents effectively when risk events occur. Accordingly, for any factor that may pose a threat to operational information activities, Gamania collects security indicator data and requires relevant information systems and services to undergo regular or ad hoc security testing. These measures enhance protection effectiveness, maintain operating service levels, and safeguard customer rights and interests.

Cybersecurity risk management is a continuous cyclical mechanism. Through our management processes, we analyze cybersecurity risks in operations and assess risk impacts and establish appropriate protection mechanisms, monitor measures, and responses to minimize losses and maximize profit for corporate operations.

Compliance with legislation and standards

On November 11, 2025, amendments to Taiwan’s Personal Data Protection Act were promulgated, granting the Personal Data Protection Commission (PDPC) unified status as the competent authority and enforcement powers and restructuring the oversight framework for government agencies and non-government agencies. The amendments include explicit notification and reporting obligations for personal data incidents, administrative inspections, and related penalties.

Cyberattack

Insecure rule configurations by enterprise information technology personnel or information operation procedures not carried out in accordance with requirements may create opportunities for malicious actors to exploit management vulnerabilities using technical means or methods to intrude into, damage, or steal from target systems and networks, directly impacting business operations.

Viral threats

Viruses can be carried through various vectors, including previously visited websites, attachments or links containing malicious programs in emails, malicious links or executable files from social media websites, portable storage media, unauthenticated documents, files, software or applications.

Operational disruption

The inability of cybersecurity systems to operate continuously would halt external business services, thus impacting brand image, revenue, and customer and shareholder trust and rights.

Insufficient awareness of information security in employees

Employees, due to their job responsibilities, directly interact with the Company’s operational systems and data. Operations not in line with security control requirements, unsafe usage habits or handling methods, or even the accidental loss of IT equipment assigned by the Company without proper necessary measures, could lead to the use of unknown software on the device or malware infection. This could result in the leakage of sensitive operational data, thus impacting internal system security and trade secrets and leading to data breaches and information security incidents.

Supply Chain Security Management

The scale of third-party vendors’ information environments and the maturity of their operating mechanisms fall outside the scope of the Company’s direct management and monitoring. Attackers may exploit these weaker areas to bypass enterprises with otherwise stringent controls and gain access to their internal environments through trusted suppliers or business partners. Vulnerable suppliers therefore pose a significant challenge to ensuring the security of outsourced data.

Information security reporting and handling procedures

Through the “Information Security Incident Reporting and Response Procedures,” Gamania defines information security incident categories, classification standards (including escalation and de-escalation), and reporting and handling levels. For changes from previous practices, briefing sessions are held uniformly for members of the Executive Team under the information and communication security organization. Members are required to communicate relevant changes horizontally across their respective units. At the same time, information on the “24-Hour Information Security Incident Reporting Hotline and Dedicated Reporting Mailbox” is posted on the Company’s electronic bulletin board.

All the Group’s employees are responsible for reporting incidents and must promptly notify the IT contact point of their respective unit in the first place. The contact point will conduct a preliminary assessment based on the type and severity of the incident and complete the “Information Security Incident Reporting Record Form”. Subsequently, the IT Department, in collaboration with relevant units, will follow up on the information security incident. The IT unit must resolve and fix incidents within the predefined timeframe. After resolution, it needs to provide an incident analysis report and improvement suggestions to prevent similar events from recurring. The handling results and reports for all information security incidents are regularly consolidated and submitted to the Information Security Committee for review at its meetings and retention on record.

Supplier information security management

Building on its existing security requirements for outsourced information system development, Gamania has added supplier security management requirements (including the scope and responsibilities of subcontracting). For activities involving development, implementation, maintenance, processing, and management by third parties, corresponding information security testing requirements (including requirements concerning the privacy of important data) must be established based on the severity of the information security risks that may arise from their functions. The core members assigned to the engagement must also be assessed and required to sign separate confidentiality agreements. Outsourcing security requirements must be incorporated into contracts (including the requirement that, in the event of abnormalities in outsourced information systems or environments or the occurrence of an information security incident, the relevant procedures must be handled in accordance with the organization’s “Information Security Incident Reporting and Response Procedures”). Contracts must also stipulate data retention and deletion requirements upon termination of services and reserve the right to audit suppliers, ensuring that every supplier commits to applying sufficient technical and organizational measures to protect the information it processes.

Information security testing vendors must possess professional information security certifications, or the testing tools they use must meet standards equivalent to those of international testing tools, thereby ensuring that systems outsourced for development by the Group’s subsidiaries and affiliates meet a consistent security baseline before they are introduced or go live. The “Group Operational Business Information Security Management Guidelines” also specify security testing requirements for systems or services before they go live.

In addition, at the end of 2025, Gamania reviewed and revised the “Personal Data Protection Policy,” the “Personal Data File Security Maintenance Plan,” and other related documents to strengthen protection requirements for the organization’s teams when processing data and conducting organizational data exchanges (including personal data and cross-border transfers). This ensures that all supplier agreements include appropriate representations and protection obligations. The Company also plans to conduct sample audits of suppliers to verify the actual standard of outsourced suppliers’ information environments.

Protection of network security

【 Consumer protection measures 】

The Group not only values the health and safety of consumers for the products or services provided, but also provides detailed instructions to consumers on the use of the products or services provided for online services, in order to maintain transaction fairness. Pre-drafted contractual terms are established for the network services provided for the sufficient and accurate information to customers, and other necessary consumer protection measures are implemented to maintain the quality and safety of products or services, and prevent services from damaging consumers’ physical or mental health, property or other rights and interests. We comply with laws and regulations on the labeling and fair trading of products or services, and provide complete consumption information for consumers to adopt correct and reasonable consumer behaviors to safeguard their safety and rights.

【 Crime prevention 】

With the rapid growth of online information, fraud and game account theft have become prevalent as new societal challenges. Gamania is committed to prioritizing customer service and players’ rights and actively engages in digital crime prevention to stand with consumers. For all relevant complaints received, provided
that there is sufficient supporting evidence, Gamania’s team proactively cooperates to help consumers cope with criminal behavior so as to prevent unlawful opportunists from endangering the platform’s security.

Since 2022, Gamania has partnered with the Anti-fraud Hotline 165 by establishing an online inquiry mechanism that allows police to submit case inquiry requests in real-time, significantly boosting investigation efficiency. Additionally, recognizing the high technicality and difficulty in identifying digital game terminology, the Group has formed an independently operating “Joint Defense Team.” This team dispatches dedicated personnel for 24-hour shift support, to provide real-time information and answer questions for police and investigative agencies, thus ensuring uninterrupted anti-fraud operations.

【 Implementation of industry laws 】

To enhance our industry competitiveness, Gamania actively participates in assisting the government in formulating regulations that are fair, just, and in line with industry development needs. With the employees responsible for legal affairs serving as the members of the Cultural-Creative and Sport-Entertainment Law Committee, Taiwan Bar Association, Gamania consistently provides legislative amendment suggestions
to the government through various associations and personally attends relevant institutions to present opinions and share insights. Additionally, Gamania receives visits from lawyers, judicial officer groups, and law school students is also, and shares with them the common dispute scenarios in the fast-changing digital entertainment industry, thus fostering a deeper understanding and exchange regarding the industry’s legal frameworks.

Responsibility for digital content

Digital entertainment and multimedia content are Gamania’s primary products and services. Gamania is committed to providing players and consumers with innovative, high-quality digital experiences, and all content made available on its platforms strictly complies with the applicable laws and regulations of the jurisdictions in which it operates. In the open internet environment of a democratic society, freedom of expression may lead to the risk of exposure to inappropriate content. As a platform operator, Gamania advocates for the establishment of clear responsibility guidelines to demonstrate our commitment to and practice of sustainable business principles.

Advertising ethics

In 2023, we officially launched the “Gamania Group Advertising Ethics Policy,” becoming the first in the domestic industry to establish advertising-related regulations specifically for advertisers. By incorporating feedback from the Group’s diverse digital entertainment business units, this policy aims to enhance its applicability and serve as a model for the industry. This policy not only keeps in line with the regulations, but also covers different control conditions for product categories such as adult content, controlled products, entertainment, and health. Meanwhile, violent, hateful, harassing or deceptive words to solicit or mislead consumers are prohibited; Gamania reserves the right to suspend the publication of any advertisements that are against this rule. In 2024, Gamania’s e-commerce business entity, Gamania Shopping, fully adhered to this policy and further implement actions related to digital privacy protection, warnings for high-risk content identification, and requirements for legitimate material usage rights to ensure the integrity and honesty of all advertising content.

In the course of providing digital advertising and marketing services, Gamania places great importance on the truthfulness, appropriateness, and social responsibility of advertising content. It avoids exaggerated or false claims, misleading statements, and content that may give rise to controversy, and reviews such content in accordance with the requirements of each platform and its internal review principles. All materials and copy provided by customers are reviewed and confirmed before being published to ensure that they do not involve infringement, false statements, violations of public order or good morals, or other circumstances that fail to comply with operating requirements, thereby reducing risks associated with collaboration and advertising placement. At the same time, Gamania also places great importance on personal data protection and information security management throughout the service process. Data is handled prudently in accordance with applicable requirements at each stage of access, transmission, and use to reduce the risk of data leakage and misuse.

Responsible content

For games and platforms published by the Company, the registration pages prominently state that users must comply with the Company’s operating rules and management rules, as well as relevant international conventions and etiquette governing Internet use. Any conduct that violates public order or good morals is strictly prohibited. Users are prohibited from uploading or publishing generated content involving, including but not limited to, violence, sexual suggestiveness, hate speech, terrorist or extremist ideologies, misinformation, online harassment, self-harm, or discrimination. In serious cases, the Company has the right to terminate any digital services.

At the same time, Gamania places great importance on the lawful use of materials. During project execution, attention is paid to the authorization and scope of use of images, text, audiovisual materials, and design elements to avoid infringing third-party intellectual property rights and protect the rights and interests of both parties to the collaboration. For the publication and review mechanisms of different digital platforms, Gamania adjusts content and submits it for review in accordance with platform policies during project execution. Sensitive visual elements, wording, and presentation methods are revised to ensure that content complies with applicable requirements and is successfully published. When faced with content reviews, customer complaints, controversial materials, or platform rejections, Gamania also strengthens its risk response capabilities through cross-departmental communication, content revisions, and repeated confirmation mechanisms, embedding digital content responsibility into its day-to-day operating processes.

Child protection

The Company ensures that all digital content is designed to promote the balanced physical and mental development of children and adolescents, and encourages use only by individuals aged 12 and above. In accordance with the “Protection of Children and Youths Welfare and Rights Act” and “Game Software Rating Management Regulations“, we have established clear protection policies, including age-appropriate content, rating labels, and warning messages to prevent underage exposure to unsuitable material.
To safeguard privacy, our games and platforms explicitly state in the user terms that the collection of personal or sensitive information from minors requires the consent of a legal guardian. Parents or guardians are further supported with online parental control mechanisms, such as consumption reminders and abnormal login alerts, which enable them to monitor usage. If any irregularities are identified, parents or guardians can contact customer service, and the Company will take appropriate measures to protect the safety and privacy of children and adolescents.
In the future, should new regulation arise, our company will actively support and promote their implementation, continuing to lead the Taiwanese gaming industry in emphasizing child protection.