Company: GRAN
Filing Date: 2025-07-31
Form Type: 20-F
Source: 0001213900-25-069627
Chunk: 7

Company: Grande Group Ltd/HK
Filing Date: 2025-07-31
Form: 20-F
Item: Item 3
Chunk 7
---
 any other circumstances stipulated by related laws and administrative regulations.
Pursuant to the PIPL, personal data processors (“data processors”) shall meet one of the conditions in order to transmit personal
information overseas for their business operations: (i) passing the security evaluation organized by the Cyberspace Administration
of China (the “ CAC”); (ii) acquiring personal information protection certification from the professional organizations
regulated by the CAC; (iii) adopting the standard contract forms stipulated by the CAC when entering into contracts with overseas
information receivers, setting forth the rights and obligations of the parties; and (iv) other conditions regulated by laws, regulations
and the CAC. Prior to the cross-border provision of personal information of the natural persons, personal information processors
shall obtain the approval of the corresponding natural persons and advise them of the overseas receiver’s name, contact information,
processing purpose and methods, classification of personal information and information reception procedures, etc.

On December 28, 2021, the CAC, jointly with
the relevant authorities, formally published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022
and replace the former Measures for Cybersecurity Review (2020) issued on July 10, 2021. Measures for Cybersecurity Review (2021) stipulates
that in addition to “operator of critical information infrastructure,” any “data processor” carrying out data
processing activities that affect or may affect national security should also be subject to cybersecurity review, and further elaborated
the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the
risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or transferred
outside the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal
information being affected, controlled, or maliciously used by foreign governments after listing abroad. CAC has said that under the proposed
rules companies holding data on more than one million users must apply for cybersecurity approval when seeking listings in other nations
because of the risk that such data and personal information could be “affected, controlled, and maliciously exploited by foreign
governments.”

Our Operating Subsidiary in Hong Kong may
collect and store certain data (including certain personal information) from our clients, some of whom may be individuals in Mainland
China, in connection