Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 30

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 3
Chunk 30
---
 information of 10,000 people to overseas since
January 1 of the previous year, provide personal information to overseas parties; or (4) other scenarios required by the CAC to apply
for security assessments occur. In addition, these measures require data processors to carry out self-assessments of risks of providing
data overseas before applying to the CAC for security assessments.

According to Article 10 of Regulations on the
Security Protection of Critical Information Infrastructure, the security protection departments of critical information infrastructure
will timely notify the identification results to the operators. As of the date of this annual report, we had not received such notification.
In addition, as advised by our PRC legal counsel, Beijing Kingdom Law Firm, we believe we are compliant with the regulations or policies
that have been issued by the CAC to date since we have not received any notice from any authorities identifying our PRC subsidiaries or
the PRC operating entities as CIIOs or requiring us to go through cybersecurity review or network data security review by the CAC. In
addition, we should not be deemed as CIIO on the basis that we had not received such notification from the security protection departments
of critical information infrastructure. Moreover, we have not been subject to any material administrative penalties or other sanctions
by any competent regulatory authorities in relation to cybersecurity, data and personal information protection. Our business does not
involve the cross-border transfer of personal information and important data, and if it does in the future, we will take necessary technical
and organizational measures to protect the security of the data, including using data encryption to secure personal information when it
is in transit. As of the date of this annual report, there had not been a significant cybersecurity or data protection incident regarding
theft, leakage, damage or loss of data or personal information. According to the Revised CAC Measures and the Cyber Data Security Regulations,
which came into effect on January 1, 2025, we do not expect ourselves to become subject to cybersecurity review by the CAC at this moment,
given that: (i) data we handle in our business operations, either by its nature or in scale, do not normally trigger significant concerns
over national security of China; and (ii) we have not processed, and do not anticipate to process in the foreseeable future, personal
information for more than one million users or persons. Based on the above and the information currently available, we believe the impact
of the CAC’s increasing oversight over data security on our business