Company: RETO
Filing Date: 2025-07-31
Form Type: F-3
Source: 0001213900-25-070052
Chunk: 28

Company: ReTo Eco-Solutions, Inc.
Filing Date: 2025-07-31
Form: F-3
Chunk 28
---
 that any “online
platform operators” controlling personal information of more than one million users which seeks to list in a foreign stock exchange
should also be subject to cybersecurity review. The Measures for Cybersecurity Review (2021 Version), further elaborates the factors to
be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data,
important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and
(ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected,
controlled, or maliciously used by foreign governments after listing abroad. We have relied on the opinion of our PRC counsel, Yuan Tai
Law Offices, that as a result of: (i) we do not hold personal information on more than one million users in our business operations; and
(ii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data
by the authorities, we are not required to apply for a cybersecurity review under the Measures for Cybersecurity Review (2021 Version).

As advised by our PRC legal
counsel, Yuan Tai Law Offices, the PRC governmental authorities may have wide discretion in the interpretation and enforcement of these
laws, including the interpretation of the scope of “critical information infrastructure operators.” In anticipation of the
strengthened implementation of cybersecurity laws and regulations and the continued expansion of our business, we may face challenges
in addressing its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of
this prospectus, we have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we have not
received any inquiry, notice, warning, or sanctions in such respect.

On August 20, 2021, the SCNPC
promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights
and privacy protection and took effect on November 1, 2021. Personal information refers to information related to identified or identifiable
natural persons which is recorded by electronic or other means and excluding anonymized information. The Personal Information Protection
Law provides that a personal information processor could process personal information only under prescribed circumstances such as with
the consent of the individual concerned and where it is necessary for the conclusion or performance of a contract to which such individual
is a party to