Company: MASK
Filing Date: 2025-12-02
Form Type: POS AM
Source: 0001185185-25-001899
Chunk: 175

Company: 3 E Network Technology Group Ltd
Filing Date: 2025-12-02
Form: POS AM
Chunk 175
---
 PRC, or the Data Security Law, which became effective on September 1, 2021. The Data Security Law is formulated for data security and data protection, and sets forth the requirements for enterprises to serve as the first responsibility bearer for safeguarding data security. The Data Security Law introduces a data classification and hierarchical protection system based on the materiality of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of persons or entities when such data is tampered with, destroyed, divulged, or illegally acquired or used. It also provides for a security review procedure for the data activities which may affect national security. We may be subject to such requirements as we operate website and apps, and provide certain internet services mainly through our website and apps. The Data Security Law further requires the entities conducting data handling activities by using the internet shall, based on the graded cybersecurity protection system, establish a data security management system across the entire workflow, organize and conduct data security education and training, and adopt the corresponding technical measures and other necessary measures to ensure data security.

The Cybersecurity Review Measures, or the Review Measures, which were promulgated on April 13, 2020, and amended December 28, 2021, became effective on February 15, 2022. The Review Measures provide that online platform operator holding more than one million users/users’ individual information shall be subject to cybersecurity review before listing abroad. The Regulations on the Administration of Cyber Data Security were promulgated on September 24, 2024, and came into effect on January 1, 2025. The Regulations provide as follows: Where network data processors need to provide important data collected and generated during their operations within the territory of the People’s Republic of China to overseas parties, they shall undergo a data export security assessment organized by the national cybersecurity and informatization authority.If the network data processor identifies and declares important data in accordance with relevant state regulations, but such data has not been designated or publicly disclosed as important data by the relevant region or authority, it is not required to be treated as important data for the purpose of declaring a data export security assessment. Data processor means an individual or organization that independently make decisions on the purpose and manner of processing in data processing activities.

<div align='center'>97</div>

The Review Measures also provide that if a critical information infrastructure operator, or CIIO, purchases internet products and services that affect or may affect national security, it should