Policy Ping An regards cybersecurity and privacy protection as the top priority for our information and data governance. We state clear commitments and principles in ourPolicy Statement on Privacy ProtectionandPolicy Statement on Information Security. Both polices govern all operations of Ping An.Governance structure Information security risk is well managed and embedded in the Groups comprehensive risk management organizational structure where the Board of Directors is the highest decisionmaking authority.Monitoring To ensure policies are followed and the system is effective we conduct internal information security audits every six months and external audits at least every two years. By the first half of 2022 over 85 of Ping Ans operations were certified to ISOIEC 27001 or equivalent standards certified by regulators. We are working towards a broader range of certifications.Incident response Ping An has proactive and reactive measures to minimize the probability of cybersecurity incidents and potential impacts. In terms of reactive measures if Ping An and its subsidiaries identify a cyberattack or malware the Information Security Emergency Handling Mechanism is launched and relevant departments handle the situation collaboratively. In terms of proactive measures every year Ping An organizes several penetration testing events simulating a hacker attack. Various technical methods including connection management access right testing and authorization escalation and removal are used to analyze potential vulnerabilities and scenarios that may be exploited by hackers. The testing results enable Ping An to make improvements for any highrisk items and to take appropriate reinforcement measures for enhanced information security. Ping An also accepts reports of vulnerability via the Groups publicSecurity Response Center Chinese onlyand rewards are considered for valuable reports.Data collection and use Ping An collects information under the principles of lawfulness legitimacy and necessity. Personal information authorized by customers and the information generated by the service will only be used for the designated purposes permitted by the agreement and consent of the customer. Ping An only collects personal information from third parties with appropriate legal compliance including having third parties commitments of user consent. Ping An ensures that personal data is kept only during necessary periods for its designated purposes and as required by relevant laws and regulations. Beyond the necessary periods Ping An commits to delete or anonymize personal data except when required otherwise by laws or regulators. Ping An keeps customer information strictly confidential and does not share or transfer personal information to any third parties and the use and transfer of data must not contravene laws or administrative regulations.Rights of customers In terms of rights in data privacy customers have the right to access their collected data to correct any inaccurate personal data and to delete hisher personal information in compliance with the Personal Information Protection Law and other relevant laws and regulations.Product and service development Ping An integrates information security and privacy protection considerations and safeguards into its design and development processes of new products and services. Information security and privacy protection experts join discussions on innovative products and business models in the design and development stages designing relevant safeguard measures. This collaborative effort enables development teams to understand issues that information experts are concerned about. Privacy experts from Ping Ans legal department perform dedicated assessments before the launch of products and services which ensure compliance issues of privacy protection are well managed.Customer notification Privacy notices for each Ping An Group application are designed to popup onscreen and must be acknowledged by users when they launch our applications for the first time. This is to ensure that customers are informed of Ping Ans policies and reminded of privacy protection measures.TrainingPing An organizes staff training sessions and online courses on cybersecurity and privacy protection to ensure employees understand the relevant principles procedures requirements and emergency plans. Training resources are provided to all permanent employees as well as contractors who have access to information systems.Supply chain Suppliers are required to abide by Ping Ans policies of information security and privacy protection by agreeing to cybersecurity articles in supplier contracts. Ping An conducts regular evaluations to verify suppliers compliance of information security and privacy protection as an important part of routine supplier assessments.Initiatives Ping An leads and engages the industry on issues of information security and privacy protection. For example in June 2022 Ping An Trust published a White Paper on Information Security Chinese only which introduces the Groups experience on plans mechanisms and practices of cybersecurity and shares helpful references for the trust industry.