Company: SISI
Filing Date: 2025-03-13
Form Type: S-1/A
Source: 0001493152-25-010206
Chunk: 50

Company: SHINECO, INC.
Filing Date: 2025-03-13
Form: S-1/A
Chunk 50
---
 use of networks to carry out data processing activities and the supervision and administration of network data security in mainland China and apply to activities outside mainland China to process personal information of any natural persons in mainland China under any of the following circumstances: (i) for the purpose of providing products or services to natural persons in mainland China; (ii) analyze and evaluate the behavior of natural persons in mainland China; and (iii) other circumstances stipulated by laws and administrative regulations. The Security Administration further stipulates that where it is indeed necessary to transfer “important data” collected and generated by a network data processor during its operation within the territory of mainland China to overseas parties, it shall pass the security assessment for cross-border data transfer organized by the CAC. Network data processors should identify and declare “important data” in accordance with the relevant provisions, but they are not required to conduct security assessment for outbound data transfer for data that has not been notified or published as “important data” by relevant departments or regions. In addition, the Security Administration provides that data processors that process “important data” must conduct an annual data security assessment with regard to the data process activities, and submit the assessment report to relevant competent authorities at or above the provincial level. Since the Security Administration is newly promulgated, there remains uncertainty as to how it will be implemented and interpreted by the competent authorities and whether the PRC regulatory agencies, including the CAC, will adopt new laws, regulations, rules, or detailed implementation and interpretation related to security assessment. We cannot predict the impact of the Security Administration on us, if any, at this stage, and we will closely monitor and assess any development in the implementation and interpretation of the Security Administration.

As of the date of this prospectus, we have not received any notice from any authorities identifying our PRC subsidiaries as CIIOs or requiring us to go through cybersecurity review or network data security review by the CAC. As confirmed by our PRC counsel, Beijing Yingke Law Firm, the operations of our PRC subsidiaries are not expected to be affected, and that we will not be subject to cybersecurity review by the CAC under the Cybersecurity Review Measures, nor will any such entity be subject to the Security Administration, given that our PRC subsidiaries possess personal data of fewer than one million individual clients and do not collect data that affects or may affect national security in their business operations as of the date of this prospectus and do not anticipate that they will be collecting over one million users’ personal information or data that affects or may affect