Company: DDC
Filing Date: 2025-08-05
Form Type: F-3/A
Source: 0001213900-25-072059
Chunk: 52

Company: DDC Enterprise Ltd
Filing Date: 2025-08-05
Form: F-3/A
Chunk 52
---
</div>

On August 20, 2021, the
SCNPC promulgated the PRC Personal Information Protection Law, or the PIPL, which took effect in November 2021. In addition to other
rules and principles of personal information processing, the PIPL specifically provides rules for processing sensitive personal information.
Sensitive personal information refers to personal information that, once leaked or illegally used, could easily lead to the infringement
of human dignity or harm to the personal or property safety of an individual, including biometric recognition, religious belief, specific
identity, medical and health, financial account, personal whereabouts and other information of an individual, as well as any personal
information of a minor under the age of 14. Only where there is a specific purpose and sufficient necessity, and under circumstances where
strict protection measures are taken, may personal information processors process sensitive personal information. A personal information
processor shall inform the individual of the necessity of processing such sensitive personal information and the impact thereof on the
individual’s rights and interests apart from the matters of, including without limitation, name and contact number of the processor,
processing purpose and method, type to be processed, preservation period of the information, means and procedures by which individuals
exercise the rights provided by the PIPL. As uncertainties remain regarding the interpretation and implementation of the PIPL, we
cannot assure you that we will comply with the PIPL in all respects and regulatory authorities may order us to rectify or terminate our
current practice of collecting and processing sensitive personal information.

While we take various measures
to comply with all applicable data privacy and protection laws and regulations, there is no guarantee that our current security measures
and those of our third-party service providers may always be adequate for the protection of our customer or company data. Any failure,
or perceived failure to maintain the security of our user data or to comply with applicable PRC or foreign privacy, data security and
personal information protection laws and obligations may result in civil or regulatory liability, including governmental or data protection
authority enforcement actions and investigations, fines, penalties, enforcement orders requiring us to cease operating in a certain way,
litigation, or adverse publicity, and may require us to expend significant resources in responding to and defending allegations and claims,
all of which may have material adverse effect on our business, operations and financial condition. In addition, compliance with applicable
laws on data privacy requires substantial expenditure and resources, including to continually evaluate our policies and processes and
adapt to new requirements that are or become applicable to us