Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 117

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 117
---
 Office of the MOHRSS on September 21, 2018, before the reform of the social insurance
collection authorities being in place, the relevant levying policies, including the base and rate of the social insurance premiums, shall
remain unchanged. The Urgent Notice also clarified that it is strictly prohibited for the local authorities themselves to organize and
conduct centralized collection of enterprises historical social insurance arrears.

Regulations Relating to Personal Information
Protection

In accordance with the Civil
Code, the personal information of a natural person is protected by law. Any organization or individual needing to obtain the personal
information of other persons shall legally obtain and ensure the security of such information, and shall not illegally collect, use, process,
or transmit the personal information of other persons, nor illegally buy, sell, provide, or publish the personal information of other
persons. In case of infringement upon civil rights and interests, the victim shall have the right to request that the tortfeasor assume
tort liability. The Civil Code stipulates that the limitation of action regarding applications to a people’s court for protection
of civil rights shall be three years. Where the laws provide otherwise, such provisions shall prevail.

On August 20, 2021,
the National People’s Congress passed the Personal Information Protection Law, which took effect on November 1, 2021. The law
creates a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands
data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in
China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing
products and services to, or analyzing and evaluating the behavior of, persons in China. The law also proposes that critical information
infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to-be-set
by Chinese cyberspace regulators are also required to store in China personal information generated or collected in China, and to pass
a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Lastly, the Personal
Information Protection Law stipulates significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the
prior year.

Regulations Relating to Information Security

In November 2016, the Standing
Committee of the National People’s Congress promulgated the Cyber Security Law of the PRC, or the Cyber Security Law, which took