Company: RETO
Filing Date: 2025-10-24
Form Type: 424B5
Source: 0001213900-25-102262
Chunk: 89

Company: ReTo Eco-Solutions, Inc.
Filing Date: 2025-10-24
Form: 424B5
Chunk 89
---
 U.S. -listedChinese companies and prohibiting these apps from registering new users during the review periods. We do not believe that we constitute a critical information infrastructure operator under the Cybersecurity Review Measures. On July 10, 2021, the CAC issued the Cybersecurity Review Measures (revised draft for public comments), which proposed to authorize the relevant government authorities to conduct cybersecurity review on a range of activities that affect or may affect national security. The PRC National Security Law covers various types of national security, including technology security and information security. The Cybersecurity Review Measures (2021 Version) took effect on February 15, 2022. The Cybersecurity Review Measures (2021 Version) expand the cybersecurity review to data processing operators in possession of personal information of over 1 million users if the operators intend to list their securities in a foreign country. Under the Cybersecurity Review Measures (2021 Version), the scope of entities required to undergo cybersecurity review to assess national security risks that arise from data processing activities would be expanded to include all critical information infrastructure operators who purchase network products and services and all data processors carrying out data processing activities that affect or may affect national security. In addition, such reviews would focus on the potential risk of core data, important data, or a large amount of personal information being stolen, leaked, destroyed, illegally used or exported out of China, or critical information infrastructure being affected, controlled or maliciously used by foreign governments after such a listing. An operator that violates these measures shall be dealt with in accordance with the provisions of the PRC Cybersecurity Law and the PRC Data Security Law. According to the Cybersecurity Review Measures (2021 Version), cybersecurity review will be required when (i) operators of critical information infrastructure purchasing network products and services or online platform operators carry out data processing activities which do or may affect national security; and (ii) any online platform operator controlling personal information of more than one million users which seeks to list in a foreign stock exchange. 27 The factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad. The CAC has said that under the new rules companies holding data of more