Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 138

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 138
---
 with the labor related rules and regulations and the collective contracts formulated or concluded in accordance with laws; (iii) it is necessary to perform statutory duties or statutory obligations; (iv) it is necessary to respond to public health emergencies, or to protect the life, health and property safety of individuals in emergencies; (v) carrying out news reports, public opinion supervision and other acts for the public interest, and processing personal information within a reasonable scope; (vi) processing personal information disclosed by individuals or other legally disclosed personal information within a reasonable scope in accordance with this law; or (vii) other circumstances stipulated by laws and administrative regulations. In addition, this law emphasizes that individuals have the right to withdraw their consent to process their personal information, and the processors must not refuse to provide products or services on the grounds that the individuals do not agree to the processing of their personal information or withdraw their consent, unless processing of personal information is necessary for the provision of products or services. Before processing the personal information, the processors should truthfully, accurately and completely inform individuals of the following matters in a conspicuous manner and in clear and easy-to-understand language: (i) the name and contact information of the personal information processor; (ii) the purpose of processing personal information, processing method, type of personal information processed, and the retention period; (iii) methods and procedures for individuals to exercise their rights under this law; (iv) other matters that should be notified according to laws and administrative regulations. Furthermore, the law provides that personal information processors who use personal information to make automated decisions should ensure the transparency of decision-making and the fairness and impartiality of the results, and must not impose unreasonable differential treatment on individuals in terms of transaction prices and other transaction conditions.
In addition to the aforementioned general rules, the PRC Personal Information Protection Law also introduces the rules for processing sensitive personal information, which refers to the personal information that, once leaked or illegally used, can easily lead to the infringement of the personal dignity of natural persons or harm personal and property safety, including biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts and other information, as well as personal information of minors under the age of fourteen. Personal information processors can process sensitive personal information only if they have a specific purpose and sufficient necessity, and take strict protective measures. In addition, the law provides rules for cross-border provision of personal information. In particular, it is provided that the operators of critical information infrastructures and the personal information processors that process personal information up