Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 42

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 3
Chunk 42
---
 in turn may adversely affect our results of operations. 
 We face regulatory risks related to our air ticketing business. 
 The Civil Aviation Administration of China and the NDRC regulate pricing of air tickets. The Civil Aviation Administration also supervises commissions payable to air-ticketing agencies together with the China Air Transport Association. If restrictive policies are adopted by the Civil Aviation Administration, the NDRC, or the China Air Transport Association, or any of their regional branches, our air-ticketing revenue may be adversely affected. 
 Our failure to comply with privacy and data protection laws and regulations in various jurisdictions could subject us to sanctions, damages, and litigation, and could harm our reputation and business. 
 We collect and process certain personal data of our users, including email addresses, usage data, identification information, and additional information. We also collect and process billing information and phone numbers of our users. As such, we are subject to the privacy and data protection laws and regulations in various jurisdictions. Privacy laws provide restrictions and guidance in connection with our storage, use, processing, disclosure, transfer, and protection of personal information. We strive to comply with all applicable laws, regulations, and policies relating to privacy and data protection. We are also subject to privacy and data security-related obligations deriving from our privacy policy and terms of use with our users, and we may be liable to third parties in the event we are deemed to have wrongfully processed, used, stored, disclosed, or otherwise disposed of personal data. 
 Data security and protection has become one of the policy focuses of many jurisdictions in which operate. Substantial uncertainties remain with respect to the interpretation and enforcement of the data security and privacy protection regulations of some jurisdictions and their impact to us, which makes it difficult to determine what actions or inactions may be deemed to be in violation of the applicable laws and regulations in certain circumstances. The relevant government authorities may have wide discretion in the interpretation and enforcement of these laws. For example, in China as a major internet platform, we are exposed to risks of being deemed to be a critical information infrastructure operator or a network platform operator. If we are identified as a critical information infrastructure operator, we would be required to fulfill various obligations that are currently not applicable to us. Moreover, we may need to follow cybersecurity review procedure and apply with Cybersecurity Review Office before making certain purchases of network products and services. During cybersecurity review, we may be required to undertake certain business adjustments, which may cause disruptions to our business and operations. The cybersecurity review could lead to a diversion of time and attention