Company: RETO
Filing Date: 2025-10-24
Form Type: 424B5
Source: 0001213900-25-102262
Chunk: 56

Company: ReTo Eco-Solutions, Inc.
Filing Date: 2025-10-24
Form: 424B5
Chunk 56
---
. On July 10, 2021, the CAC published the Measures for Cybersecurity Review (Revised Draft for Comments), or the Measures, for public comments, which propose to authorize the relevant government authorities to conduct cybersecurity review on a range of activities that affect or may affect national security, including listings in foreign countries by companies that possess the personal data of more than one million users. On December 28, 2021, the Measures for Cybersecurity Review (2021 Version) was promulgated and became effective on February 15, 2022, which iterates that any “online platform operators” controlling personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review. The Measures for Cybersecurity Review (2021 Version), further elaborates the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad. We have relied on the opinion of our PRC counsel, Yuan Tai Law Offices, that as a result of: (i) we do not hold personal information on more than one million users in our business operations; and (ii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities, we are not required to apply for a cybersecurity review under the Measures for Cybersecurity Review (2021 Version). As advised by our PRC legal counsel, Yuan Tai Law Offices, the PRC governmental authorities may have wide discretion in the interpretation and enforcement of these laws, including the interpretation of the scope of “critical information infrastructure operators”. In anticipation of the strengthened implementation of cybersecurity laws and regulations and the continued expansion of our business, we may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of this prospectus, we have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we have not received any inquiry, notice, warning, or sanctions in such respect. On December 24, 2021, the CSRC released the Administrative Provisions of the State Council Regarding the Overse