Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 32

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 3
Chunk 32
---
 data, identity card numbers and their foreign equivalents, bank account numbers,
tax information and other sensitive personal and business information. We also collect significant amounts of funds from the accounts
of our clients and transmit them to their employees, taxing authorities and others.

We are focused on ensuring
that we safeguard and protect personal and business information and client funds, and we devote significant resources to maintain and
regularly update our systems and processes. Nonetheless, the global environment continues to grow increasingly hostile as attacks on information
technology systems continue to grow in frequency, complexity and sophistication, and we are regularly targeted by unauthorized parties
using malicious tactics, code and viruses. Certain of these malicious parties may be state-sponsored and supported by significant financial
and technological resources. Although this is a global problem, it may affect our businesses more than other businesses because malevolent
parties (including our personnel) may focus on the amount and type of personal and business information that our businesses collect, host,
store, transfer, process, disclose, use, secure and retain and dispose of, and the client funds that we collect and transmit.

We have programs and processes
in place to prevent, detect and respond to data or cyber security incidents. However, because the techniques used to obtain unauthorized
access, disable or degrade service, or sabotage systems change frequently, are increasingly more complex and sophisticated and may be
difficult to detect for long periods of time, we may be unable or fail to anticipate these techniques or implement adequate or timely
preventive or responsive measures. Our ability to address cyber security incidents may also depend on the timing and nature of assistance
that may be provided from relevant governmental or law enforcement agencies. Hardware, software, applications or services that we
develop or procure from third parties, or are required by third parties such as foreign governments to install on our systems, may contain
defects in design or manufacture or other problems that could (or, in respect of third-party software, may be designed to) compromise
the confidentiality, integrity or availability of data or our systems. Unauthorized parties also attempt to gain access to our systems
or facilities, or those of third parties with whom we do business, through fraud, trickery, or other methods of deceiving these third
parties or our personnel, including phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute
computer viruses and malware into our systems or otherwise compromise the confidentiality, integrity or availability of data on our systems.
As these threats continue to evolve and increase, we continue to invest