Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 137

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 4
Chunk 137
---
, the Ministry of Industry and Information Technology and certain other government authorities on March 12, 2021 and became effective on May 1, 2021, “necessary personal information” refers to the personal information necessary for ensuring the normal operation of an app’s basic functional services, without which the app cannot achieve its basic functional services. For learning and education App, the basic functional services are “online tutoring, online classes, etc.” and the necessary personal information is mobile phone numbers of registered users.
Further, the State Administration for Market Regulation amended the Measures for the Supervision and Administration of Online Transactions, which became effective from May 1, 2021 and amended on March 18, 2025, with amended version becoming effective on May 1, 2025. The measures requires that online transaction operators shall not force customers, whether or not in a disguised manner, to consent to the collection and use of information not directly related to their business activities by means of one-off general authorization, default authorization, bundling with other authorizations, or the suspension of installation and use. Otherwise, such online transaction operator may be subject to fines and consequences under related laws and regulations, including without limitation suspension of business for rectification and revocation of permits and licenses.
On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which came into effect on September 1, 2021. The PRC Data Security Law provides for data security and privacy obligations on entities and individuals carrying out data activities. The PRC Data Security Law also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The appropriate level of protection measures is required to be taken for each respective category of data. For example, a processor of important data shall designate the personnel and the management body responsible for data security, carry out risk assessments for its data processing activities and file the risk assessment reports with the competent authorities. In addition, the PRC Data Security Law provides a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data and information. No entity or individual within the territory of the PRC may provide foreign judicial or law enforcement authorities with the data stored within the territory of the mainland