Company: GRAN
Filing Date: 2025-07-31
Form Type: 20-F
Source: 0001213900-25-069627
Chunk: 8

Company: Grande Group Ltd/HK
Filing Date: 2025-07-31
Form: 20-F
Item: Item 3
Chunk 8
---
 with our business and operations for “ Know Your Customers” purpose. However, as confirmed by our legal
advisors, we believe that we and our Operating Subsidiary will not be deemed to be an “operator of critical information infrastructure,”
any “data processor” carrying out data processing activities, and we are not subject to cybersecurity review by the CAC or
required to obtain regulatory approval from the CAC nor any other PRC authorities for our and our subsidiaries’ operations Hong Kong
and for our public offerings on a foreign stock exchange, since (i) our Operating Subsidiary
is incorporated and operating in Hong Kong only without any subsidiary or variable interest entity structure in Mainland China, and
it is unclear whether the Measures for Cybersecurity Review (2021) shall be applied to a Hong Kong company; (ii) as of
date of this annual report, our Operating Subsidiary has in aggregate collected and stored the personal information of less than one thousand
individuals in Mainland China only and we have acquired the clients’ separate consents for collecting and storing of their personal
information and data; (iii) we and our subsidiaries do not place any reliance on collection and processing of any personal information
to maintain our business operation; (iv) data processed in our business should not have a bearing on national security nor affect
or may affect national security; (v) all of the data our Operating Subsidiary have collected is stored in servers located in Hong Kong;
and (vi) as of the date of this annual report, neither we nor our subsidiaries have received
any formal notice from any PRC cybersecurity regulator identifying us or our subsidiaries as a “critical information infrastructure
operator” or requiring any ex-ante security assessment and evaluation of cross-border data transfer and our subsidiaries have processed
far less than one million users’ personal information.

However, given the recent
issuance of the above PRC laws and regulations related to cybersecurity and data privacy, the interpretation and implementation of these
laws and regulations may be subject to revisions and we cannot rule out the possibility that any PRC governmental authorities may subject
us and our subsidiaries to such laws and regulations in the future. If they are deemed to be applicable to us and our subsidiaries, we
cannot assure you that we and our subsidiaries will be compliant with such new regulations in all respects, and we and our subsidiaries
may be ordered to rectify and terminate any actions that are deemed illegal by the PRC governmental authorities and become