Company: KPEA
Filing Date: 2025-01-14
Form Type: 10-K
Source: 0001493152-25-002124
Chunk: 467

Company: Kun Peng International Ltd.
Filing Date: 2025-01-14
Form: 10-K
Item: Item 1
Chunk 467
---
 be an operator or a data processor and we
do not control more than one million users’ personal information, we would not be required to apply for a cybersecurity review
by the CAC. However, if the CSRC, CAC, or other regulatory agency later promulgates new rules or explanations requiring that we obtain
their approvals for a follow-on offering, we may be unable to obtain such approvals which could significantly limit or completely hinder
our ability to offer additional securities to investors and our securities may substantially decline in value or be worthless.

We
currently have less than one million registered users on our digital platform and only require and obtain user information after
users register with it. Given that we sell and service products through our digital platform, we may constitute a “data
processor,” but as the number of our online registered users is far less than one million, we do not believe that we are
required to apply for a cybersecurity review under the Cybersecurity Review Measures or the Regulations on Network Data Security.
Although we believe we currently are not required to obtain clearance from the CAC under the Cybersecurity Review Measures, the
Regulations on Network Data Security, or the Opinions on Strictly Cracking Down on Illegal Securities
Activities, we face uncertainties as to the interpretation or implementation of such regulations or rules and we may in the future
be required to perform a data security assessment annually either by ourselves or by retaining a third party data security service
provider and submitting such data security assessment report to the local agency every year under the Regulations on Network
Data Security.

Personal
Information Protection Law. On August 20, 2021, the Standing Committee of the National People’s Congress of China promulgated
the Personal Information Protection Law (the “PIPL”), which took effect on November 1, 2021. In addition to other rules and
principles of personal information processing, the Personal Information Protection Law specifically provides rules for processing sensitive
personal information. Sensitive personal information refers to personal information that, once leaked or illegally used, could easily
lead to the infringement of human dignity or harm to the personal or property safety of an individual, including biometric recognition,
religious belief, specific identity, medical and health, financial account, personal whereabouts, and other information of an individual,
as well as any personal information of a minor under the age of 14. Only where there is a specific purpose and sufficient necessity,
and under circumstances where strict protection measures are taken, may personal information processors process sensitive personal information.