Information Security Policy

1. Policy Purpose

To ensure the confidentiality, integrity, and availability of the information assets owned by James Technology Consulting Co., Ltd. (hereinafter referred to as the "Company"), to comply with applicable regulatory requirements, and to protect such assets from intentional or accidental internal and external threats, the Company hereby establishes this Information Security Policy.

2. Scope of Application

The Company prioritizes the inclusion of information security management related to the design, development, operation, and maintenance of the RACCOON AI intelligent customer service AI Agent platform within the scope of information security management. This includes generative AI conversational services, knowledge base management, and third-party system integration. The Company adopts appropriate organizational, personnel, technical, and physical control measures to address relevant risks.

3. Security Objectives

(1) Maintain the confidentiality, integrity, and availability of information and protect personal data privacy.

(2) Protect business service information from unauthorized access and modification.

(3) Establish an information operations continuity plan to ensure ongoing business operations.

(4) Ensure that business services comply with applicable laws and regulations.

(5) Establish quantitative measurement items each year based on the objectives, and manage them through the objective control and measurement table.

4. Responsibilities and Continual Improvement

The Company has established an Information Security Committee as the management-level decision-making body for information development and security management. The committee is responsible for the planning, establishment, implementation, maintenance, review, and continual improvement of the Information Security Management System (ISMS). All employees, system users, and outsourced personnel shall cooperate with and comply with this policy and related regulations.

5. Policy Review and Disclosure

This policy shall be reviewed once each year. This policy shall be communicated in writing, electronically, or by other means to all employees and shall be made available as appropriate to relevant vendors or stakeholders that provide information services.

This policy shall be implemented upon approval by the Information Security Committee. The same shall apply to any amendments.

James Technology Consulting Co., Ltd.

General Manager

July 1, 2026 (Republic of China Year 115)