Company: WCT
Filing Date: 2025-12-05
Form Type: 424B3
Source: 0001213900-25-118563
Chunk: 43

Company: Wellchange Holdings Co Ltd
Filing Date: 2025-12-05
Form: 424B3
Chunk 43
---
 personal information
of natural persons within the territory of China that is carried out outside of China where (1) such processing is for the purpose
of providing products or services for natural persons within China, (2) such processing is to analyze or evaluate the behavior of
natural persons within China, or (3) there are any other circumstances stipulated by related laws and administrative regulations.
Pursuant to the PIPL, personal data processors (“data processors”) shall meet one of the conditions in order to transmit personal
information overseas for their business operations: (i) passing the security evaluation organized by the Cyberspace Administration
of China (the “CAC”); (ii) acquiring personal information protection certification from the professional organizations
regulated by the CAC; (iii) adopting the standard contract forms stipulated by the CAC when entering into contracts with overseas
information receivers, setting forth the rights and obligations of the parties; and (iv) other conditions regulated by laws, regulations
and the CAC. Prior to the cross-border provision of personal information of the natural persons, personal information processors
shall obtain the approval of the corresponding natural persons and advise them of the overseas receiver’s name, contact information,
processing purpose and methods, classification of personal information and information reception procedures, etc.

On December 28, 2021, the CAC, jointly with
the relevant authorities, formally published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022
and replaced the former Measures for Cybersecurity Review (2020) issued on July 10, 2021. Measures for Cybersecurity Review
(2021) stipulates that in addition to “operator of critical information infrastructure,” any “data processor”
carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and
further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among
others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and
illegally used or transferred outside the country; and (ii) the risk of critical information infrastructure, core data, important
data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad.
CAC has said that under the proposed rules, companies holding data on more than one million users must apply for cybersecurity approval
when seeking listings in other nations because of