Privacy Protection

EN Laundry Information Security Policy

Version: 1.0
Release date: October 14, 2025

1. General Provisions

To ensure the confidentiality, integrity and availability of the information assets of EN Laundry (hereinafter "the Company"), including customer data, operational information and core systems, and to protect the rights and interests of customers, partners and employees, the Company has established this Information Security Policy (hereinafter "this Policy"). This Policy aims to create a safe and reliable operating environment and to guard against malicious or unexpected threats, both internal and external.

All employees of the Company, outsourced service providers and partners are responsible for complying with this Policy and its related procedures, and for jointly maintaining the Company's information security.

2. Information Security Vision and Objectives

  • Vision: To build a fine dry-cleaning brand that customers trust, ensuring that customers' personal data and transaction records are protected to strict security standards.
  • Objectives:
    • Data protection: Ensure the confidentiality and integrity of customers' personal data and transaction information during processing, transmission and storage, and prevent unauthorized access, disclosure or tampering.
    • System stability: Maintain the stable operation of the online booking system, the membership management system and internal operating systems, so that service is not interrupted.
    • Legal compliance: Comply with the requirements of the Personal Data Protection Act and other relevant laws and regulations.
    • Security awareness: Raise information security awareness among all employees and build security responsibilities into daily operations.

3. Scope of Information Security Management

This Policy applies to all business activities of the Company, including:

  • Personnel: All employees of the Company (full-time and part-time), interns, outsourced service personnel and consultants.
  • Information assets:
    • Hardware: Servers, personal computers, point-of-sale (POS) terminals, network equipment, etc.
    • Software systems: The membership management system, order processing system, official website, internal office software, etc.
    • Data: Customer personal data, transaction records, operational reports, employee data and other sensitive business data.
  • Operating sites: The headquarters office, all physical stores and data processing sites.

4. Policy Guidelines

To achieve the above objectives, the Company has established the following information security guidelines:

  1. Information security organization and responsibilities:
    • An information security team is responsible for promoting, coordinating and reviewing information security matters.
    • Information security rights and responsibilities are clearly assigned to each department and staff member.
  2. Human resources security management:
    • Conduct necessary security background checks on new employees, and have them sign a confidentiality agreement when they start.
    • Hold regular information security training to strengthen employees' ability to guard against threats such as phishing emails and social engineering.
    • When employees leave or change roles, access rights shall be changed and assets returned accordingly.
  3. Asset management:
    • Maintain an inventory of information assets, and classify and manage them by level of importance.
    • Set rules for the proper use of information assets to prevent misuse or physical damage.
  4. Access control:
    • Follow the "principle of least privilege," granting employees only the minimum system access they need to perform their work.
    • Establish standard procedures for requesting, reviewing and changing system access.
    • Strengthen password complexity requirements and remind users regularly to change passwords.
  5. Physical and environmental security:
    • Key server rooms and office areas shall have access control to prevent entry by unauthorized persons.
    • Ensure that operating sites have appropriate fire protection, water protection and uninterruptible power systems to deal with environmental risks.
  6. Operations and communications security:
    • Perform regular system vulnerability scans and risk assessments, and patch vulnerabilities promptly.
    • Establish malware protection, ensuring that all computers have antivirus software installed and kept up to date.
    • Back up important data regularly and carry out backup restoration drills to make sure data can be recovered.
  7. Outsourcing management:
    • Select outsourced service providers carefully, and clearly specify information security responsibilities and confidentiality clauses in contracts.
    • Regularly review the service quality and security capabilities of outsourced providers.
  8. Information security incident response:
    • Establish information security incident reporting and response procedures, so that the Company can respond quickly and reduce damage when an incident occurs.
    • After an incident has been handled, carry out a root cause analysis and take corrective measures to prevent it from happening again.

5. Policy Review and Revision

This Policy shall be reviewed at least once a year, or reassessed when there are significant changes to the Company's organization, business, applicable regulations or technology, to ensure that it remains suitable and effective. This Policy is implemented once approved by management and announced; the same applies to any revision.

This English version is provided for convenience. If there is any difference, the Traditional Chinese version prevails.