●Articles of Incorporation

Articles of Incorporation
(Approved on May 22, 2025)

● Internal Audit

Operation of Internal Audit

  1. Internal auditors shall prepare an Internal Audit Plan detailing the audit period, scope, and items to assess the effectiveness of company operations.
  2. The plan shall be reviewed by the Chairman and approved by the Board. Periodic audits follow the plan; special audits are conducted per Board or Chairman instructions.
  3. Auditors shall analyze findings, communicate with relevant units, report deficiencies and anomalies in the audit report, and inform management, the Board, and supervisors for timely correction.
  4. After approval, auditors shall track the implementation of corrective actions and report progress at least quarterly until issues are resolved.

Statement of Internal Control System

Appointment, Performance Evaluation, and Compensation of Internal Auditors

  1. According to the Company’s Employee Rank and Salary Management Regulations, the performance evaluation and compensation of internal auditors shall be proposed by the Head of Internal Audit and approved by the Chairman.
  2. In 2020, the appointment and removal of the Head of Internal Audit were submitted to the Chairman for approval, with the consent of more than half of the Audit Committee members and the approval of a majority of the Board of Directors.
  3. There were no changes to the Head of Internal Audit in 2021.
  4. In 2021, the performance evaluation and compensation of internal auditors were proposed by the Head of Internal Audit and submitted to the Chairman for approval.
  5. In 2022, the performance evaluation and compensation of internal auditors were proposed by the Head of Internal Audit and submitted to the Chairman for approval.
  6. In 2023, the performance evaluation and compensation of internal auditors were proposed by the Head of Internal Audit and submitted to the Chairman for approval.
  7. In 2024, the appointment and removal of the Head of Internal Audit were submitted to the Chairman for approval, with the consent of more than half of the Audit Committee members and the approval of a majority of the Board of Directors.
  8. In 2024, the performance evaluation and compensation of internal auditors were proposed by the Head of Internal Audit and submitted to the Chairman for approval.
  9. In 2025, the performance evaluation and compensation of internal auditors were proposed by the Head of Internal Audit and submitted to the Chairman for approval.

●Establishment and Duties of the Corporate Governance Officer

I. On August 11, 2020, the Board of Directors approved the appointment of a dedicated Corporate Governance Officer, who is the top executive in charge of corporate governance-related matters . The business implementation included the following :

1. Organize the meetings of the Board of Directors and the Shareholders' meetings in accordance with the law.

2. Prepare the minutes of the meetings of the Board of Directors and the Shareholders' meetings.

3. Assist directors in assuming office and pursuing continuing education.

4. Provide directors with required information for business execution.

5. Assist directors in complying with the laws and regulations.

6. Report to the Board of Directors on the reviewing results of the compliance of the independent directors’ qualifications with the relevant laws and regulations at the time of their nomination, election and during their term of office.

7. Handle matters related to the change of directors.

8. Other matters stipulated in the Articles of Incorporation or contracts.

II.Corporate Governance Officer – Key Responsibilities

1.Assisting Directors in Performing Duties and Providing Resources:

(1).Provide Board members with updates on the latest laws, regulations, and corporate governance developments.

(2).Review information confidentiality levels and provide directors with required company data to ensure smooth internal communication.

(3).Arrange meetings between independent directors and internal audit heads or certified public accountants as needed.

(4).Assist in planning and arranging annual training programs for directors based on industry characteristics and directors’ experience.

2.Assisting the Board of Directors and Shareholders’ Meetings in Procedural and Legal Compliance Matters:

(1).Ensure that the convening of shareholder and board meetings complies with applicable laws and corporate governance guidelines.

(2).Advise and remind directors of regulatory requirements when executing duties or making formal board resolutions.

(3).After meetings, verify the disclosure of important board resolutions to ensure accuracy and legal compliance, safeguarding equal access to information for investors.

3.Prepare board meeting agendas, convene meetings, notify directors and provide meeting materials at least seven days in advance, remind of any potential conflicts of interest, and complete board meeting minutes within twenty days after the meeting.

4.Handle pre-registration for shareholder meetings, and prepare meeting notices, manuals, and minutes within statutory deadlines.

III. The continuing education of the Corporate Governance Officer is as follows: 

Training period

Professional training institutes

Training courses

Course Hours

Total Training Hours in 2025

From

To

114/08/18 114/08/18 The Institute of Internal Auditors Legal Liability Analysis of Greenwashing and Misleading Sustainability Reports 6

12

114/11/21 114/11/21 The Institute of Internal Auditors Case Studies of Violations by Audit/Accounting Personnel and Countermeasures 6 12

IV. The Corporate Governance Report as follows :

Organization
Chart

●Implementation of prevention of insider trading

I. The Company has stipulated the prohibition of insider trading in Article 8 of the "Code of Ethical Conduct for Directors and Mangers", Article 15 of the "Procedures for Ethical Management and Guidelines for Conduct", and the "Procedures for Handling Material Inside Information". Besides, it has stipulated the prevention of improper disclosure of information in the "Procedures for Handling Material Internal Information".

II.The Company has stipulated the prohibition of insider trading in Article 16-1 of the ''Procedures for Handling Material Inside Information'' :

The directors ,managers and employees not to trade their shares before the news was made public or during the closed periods
1.Upon actually knowing any company financial report that will have a material impact on the price of the securities of persons specified, after the information is made definite, and prior to the public disclosure of such information, or within 18 hours after its public disclosure, such persons shall not purchase or sell, in the person's own name or in the name of another, non-equity corporate bonds that are listed on an exchange or an over-the-counter market.
2.Not to trade their shares before the news was made public or during the closed periods of 30 days before the annual financial report announcement and 15 days before the quarterly financial report announcement

III. The Company electronically informed the directors of the date of the meeting of the Board of Directors and the date of the financial report announcement . Additionally, it reminded the directors and insiders not to trade their shares before the news was made public or during the closed periods of 30 days before the annual financial report announcement and 15 days before the quarterly financial report announcement to comply with the laws and regulations.

IV. The Company’s Implementation of Insider Trading Education and Training in 2025 is as follows:

本公司已建立內部人股權交易管理及宣導機制。新任董事於上任後一個月內,由公司進行內部人股權交易相關規範之宣導,亦會安排相關董事進修課程,協助其充分瞭解並遵循內部人交易相關法令與公司治理規範;新任經理人則於職前訓練階段由人事完成相關宣導。另,本公司每季對董事及經理人辦理內部人股權變動申報常見違規態樣之宣導,以提升法令遵循與資訊透明度。

相關宣導及進修課程內容如下:

Trainee

Date

Topics

Hours

Attendance

Director

114/05/22

Internal training:

內部人股權交易相關規範之宣導

Directors and managerial officers

114/02/2605/0708/0511/04

Internal training:

Promotion of Non-compliance Patterns in Declaration of Insider Equity Changes

0.5hours

62Participants

Director 

114/05/23、09/26

External Training:

2025 Insider Trading Prevention Seminar

3hours

V.Related specifications as follows :

Directors and Managers Morality
code of conduct

Integrity management procedures and Code
Conduct

Internal procedures for handling major
information

Human Rights Policy andHuman Rights Concerns and Operations

I. The Company complies with the laws and regulations of its location and follows the spirit and basic principles of human rights protection enshrined in the Universal Declaration of Human Rights, the Global Covenant, the International Labor Organization Convention and various international human rights conventions, and actively implements various policies to protect human rights in the formulation of various regulations, treats and values all employees, and fully realizes its responsibility to respect and protect human rights.

II. The details of the Company's ''Huaman Rights Policy'' and ''Human Rights Concerns and Operations'' as follows :

Human Rights Policy Statement

Human Rights Concerns and Operations

●Employee Benefits

I. The Company provides labor insurance, employer's compensation contract liability insurance, retirement benefits, annual health checkups, gifts for weddings, funerals, or births, working uniforms, bonuses or gifts for the three major holidays, employee remuneration, discounts for employees to purchase the Company’s construction projects, specific hotel accommodation discounts, employee travels, Long Service Award, and employee clubs.

II. The Company has formulated the "Measures for Employee Travals''domestic and international tourism was organized,and holds regular or irregular seminars on education and training for employees.

III. Employee benefits and implementation,Work environment and employee safety protection measures as follows :

Employee benefits and
implementation

●Risk Management Policies and Procedures

I. On November 11, 2020, the Board of Directors resolved to formulate the "Risk Management Policies" to strengthen the Company's governance and establish sound risk management to control the risks that may arise from various businesses within a tolerable range, so as to reasonably ensure the achievement of the Company's objectives.

II. The Company's risk management policies cover organization authority and responsibility, risk analysis, risk types, risk management process, information and communication.

III. The Company has established a risk management organization to distinguish risk management authorities and responsibilities. Each department must analyze and identify risks in order to effectively identify, measure, and control each of the Company's risks and keep them within acceptable range.

●Risk management scope and organizational structure

I. The risk management of the Company includes the management of "market risk", "investment risk", "credit risk", "hazard risk", "operational risk", "legal risk" and "other risks", as described below :

1. Market risk: Including the impact on the Company's finance and business due to domestic and foreign economic as well as technological and industrial changes, and the risk of financial loss resulting from changes in the value of financial assets and liabilities (including assets and liabilities on- and off-the statement of financial position) due to fluctuations in market risk factors (interest rates, exchange rates, stock prices and commodity prices).

2. Investment risk: Including fluctuations in the market price of short-term investments such as derivative transactions and financial wealth management; the operation and management of long-term investee companies.

3.Credit risk: refers to risks that customers, suppliers and counter-parties may fail to fulfill their contracts or obligations, resulting in losses.

4.Hazard risk: Safety protection and emergency response, referring to the risk of occurrence of major hazard events and losses.

5.Operational risk: refers to losses to the Company due to internal control negligence, human management and information system improprieties or failures.

Legal risk: refers to potential risks of financial or goodwill losses due to failure to comply with relevant regulations or the contract itself has no legal effect, ultra vires behavior, inadequate regulations, omissions in terms, or other factors, resulting in failure to bind the counterparty to perform its obligations in accordance with the contract.

7.Other risks: refer to risks that are not one of the above, but that would cause the Company to incur a material loss.

II. The Company's risk management organization structure, descriptions and appendices are as follows :

1. Board of Directors

The Board of Directors is the highest governance unit of the Company to establish effective risk management. It determines the overall risk management policy, supervises the operation mechanism related to risk management, and assumes the responsibility of risk management in accordance with the overall operation strategy and business environment.

2. Risk management promotion and implementation unit

The Company assigns the Senior Management to be the promotion and implementation unit for risk management, in charge of planning, executing and supervising risk management related matters.

3. Senior Management (President, Vice Presidents)

Coordinate cross-departmental risk management and communication.

4. Executives of all the Company's divisions

(1) Perform daily risk management activities.

(2) Responsible for analyzing and monitoring the risks associated with their units.

(3) After the risk is resolved, what shall be done to avoid or reduce the risk in the future?

5. Auditing Office

Supervise the risk management of each department of the Company.

Risk Management Policies

●Risk management operations

The Company's risk management operations were reported as follows:

Responsible Unit

Date

Audit Committee

2025/11/04

Board of Directors

2025/02/26
2025/05/07
2025/08/05
2025/11/04

1. Operational risks: The Company reviews the operational risks arising from the internal and external environment from time to time, and responds to them early to reduce risks and losses.

2.Interest Rate Risk: Since 2022, the central bank has been continuously raising interest rates, resulting in increased funding cost pressure. Therefore, in September 2023, secured corporate bonds were issued, followed by the issuance of unsecured convertible bonds in August 2024 and March 2025, to reduce funding pressure and mitigate risk.

3.Human Resource Risk: Due to the reluctance of younger generations to work on construction sites, resulting in severe labor shortages, the Company has employed foreign workers to maintain a stable workforce supply.

●Cyber Security Management:

(I) Cyber security risk management framework

In order to enhance the cyber security management, the executive of Information Department and colleagues are currently performing the duties related to "cyber security management unit" to regularly evaluate cyber security risks, review cyber security policies and implement the promotion. Besides, the results of cyber security implementation are regularly reported to the Board of Directors every year.

(II) Cyber security policy

1. The Company follows the laws and regulations to establish relevant information security management regulations and provides appropriate protection for our information assets to ensure their confidentiality, integrity, availability and legal compliance.
2. Regularly evaluate the impact of various man-made and natural disasters on our information assets, and formulate disaster prevention and recovery plans for important information assets and critical businesses to ensure the continuity of our business operations.
3. Supervise our colleagues to implement cyber security protection, to establish the concept of "information security, everyone's responsibility", and to raise the awareness of cyber security among all divisions and employees

(III) Specific Cyber Security Management schemes

Category

Management scheme

1.Legal compliance

In addition to conforming to international cyber security standards, cyber related operations must also comply with relevant domestic cyber security laws and regulations.

2.Software and hardware protection

If the software system requires external connection for maintenance, it must pass the firewall rule and dynamically establish connection information for connection. For hardware equipment, access to the information room must be controlled by the access control system to reduce theft or vandalism.

3.Backup and restoration

The system backups are automatically executed in batches, and are included in the daily inspection checklist, and are verified by information personnel one by one, so that the system can be restored within a short period of time in response to various unexpected situations that cause system damage, and so that colleagues can resume normal operations as soon as possible.

4.Prevention and drills

The Company regularly reviews the information security mechanism and performs routine security tests. In addition, it irregularly educates our employees about cyber security in order to prevent in advance, effectively detect incidents, and prevent the spread.

5.New knowledge of cyber security

In recent years, the prevalent attack methods include DDoS, ransomware viruses, social engineering, and even fake websites (password modification, lottery notification, etc.). The Company keeps in touch and communicates with domestic cyber securityrelated vendors to understand the new cyber security threats and contingency measures of the current Internet generation through existing network resources.

Continuous response to the Covid-19

Establish a secure and reliable cloud office operating environment, including: VPN connection, cloud switchboard and import cloud enterprise resources tools (including online meeting), to meet the needs of employees to continue to work from home in response to the epidemic and to ensure that the Company's business can maintain normal operations.

(IV) Invest resources in the cyber security management

In recent years, the Company has gradually invested in following equipment, services and policies to strengthen the internal cyber security:

Invested resources

Relevant description

 1.Build a secure communication network

In order to enhance the security of the Company's network, the Information Department has gradually upgraded related network security equipment in recent years, such as FireWall, Thin AP, and other hardware to divide the wired and wireless network applications into public and private parts, and the VPN connection mechanism is used to provide external locations or employees who need to work in different locations to ensure that employees can complete their work remotely and synchronously in a secure way.

 2.Provide complete data storage mechanism

By using NAS devices to build local and off-site synchronous backup mechanism, information personnel can assist in restoring the operation in a short time when the relevant system equipment or computers are damaged; or in case of any natural, technical or human-generated hazardous events, the risk of data loss and irreversibility can be greatly reduced.

 3.Import cloudbased enterprise resource management tools

In terms of hardware equipment, a large amount of system construction, management and maintenance costs can be eliminated, allowing information teams to focus on providing more secure system services and applications; and in terms of software services, the combination of complete, professional and reliable tool services from system service providers not only allows employees to greatly reduce the risk of exposure to advertising mail, spam and mail viruses when sending and receiving emails, but also enables employees to use online collaboration tools more quickly and securely to complete tasks in this fast-changing information generation through occasional education and promotion by information personnel. In addition, through regular education and promotion by information personnel, employees can make good use of online collaborative operation tools to complete tasks more quickly and safely in this fast-changing information generation, thus enhancing team work efficiency

 4. Employee operation certification mechanism

Based on human resources management, the Company has gradually established a complete and consistent operation certification method, which can integrate access control and related business equipment usage to ensure the safety of equipment, personnel, and data, and to maintain the confidentiality of each employee's work within their responsibilities

 5. Legal asset use management

The Company uses asset management tools to take inventory of related information equipment and software resources within the enterprise. It ensures the legality and security of resource usage authorization through daily inspections and regular auditing operations to avoid the use of resources from unknown sources that may create unintended cyber security loopholes and cause unnecessary losses to the Company.

 6. Enhance employees’ cyber security awareness

In response to the ever-changing cyber security attack techniques and risks, the information team conducts cyber security promotion and audits irregularly, such as information bulletins, case sharing, education and training, and system audits, to enhance employees' information literacy and cyber security awareness.

 7.Information Security Personnel Allocation

At present, the Company has set up a cyber security supervisor and a cyber security officer to discuss domain security at work review meetings at least once a week, and from time to time to discuss case studies on cyber security related news.

(V) Risk management operations of cyber security

In 2025, the Company reported the status of its information security operations to the Board of Directors as follows:

1.Avoid the use of resources from unauthorized sources that may create unintended cyber security loopholes.

2.Reminding colleagues to change passwords from time to time to reduce the risk of hacker attacks.

3. The Company reviews the operational risks arising from the internal and external environment from time to time, and responds to them early to reduce risks and losses.

(VI) The losses, possible impacts and countermeasures of major cyber security incidents in the most recent year and up to the date of publication of the annual report : None