Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 120

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 4
Chunk 120
---
 Commerce & Finance Law Offices, our PRC legal counsel, due to the fact that our ADSs have been listed on the Nasdaq Global Select Market and our ordinary shares have been listed on the Hong Kong Stock Exchange, we are deemed as an “Existing Issuer” pursuant to the Overseas Offering and Listing Measures and the implementation guidance and are not required to complete the filing procedures with the CSRC for our historical securities offering. Nevertheless, in the event that we conduct any securities offerings that will be captured by the Overseas Offering and Listing Measures in the future, we will have to complete the filing procedures with the CSRC within three business days following the closing of the securities issuance or offering on the Nasdaq Global Select Market or the Hong Kong Stock Exchange, or within three business days following the submission of application for overseas offering and listing on any other overseas market(s). 
 
71 

 Regulations of Other Jurisdictions 
 Regulations in Europe 
 In the European Union and the United Kingdom, we are subject to laws and regulations regarding data privacy and protection, including the General Data Protection Regulation, known as the EU GDPR, on the protection of natural persons with regard to the processing and free movement of personal data. The EU GDPR applies directly in all European Union member states from May 25, 2018 and applies to companies with an establishment in the European Economic Area and to certain other companies not in the European Economic Area that offer or provide goods or services to individuals located in the European Economic Area or monitor individuals located in the European Economic Area. In the United Kingdom, we are subject to the United Kingdom General Data Protection Regulation and Data Protection Act 2018, collectively known as the UK GDPR. We refer to the EU GDPR and UK GDPR as the GDPR. The GDPR implements stringent operational requirements for controllers of personal data, including, for example, maintaining a record of data processing activities, expanded disclosures about how personal data is to be collected and processed, limitations on retention of personal data (including pseudonymized data), increased cybersecurity requirements, possible mandatory data breach notification requirements, a requirement for controllers to demonstrate that they have obtained a valid legal basis for certain data processing activities, complying with rights for data subjects in regard to their personal data (including data access, erasure (the right to be “forgotten”) and portability), ensuring appropriate safeguards are in place where personal data is transferred out of the European Economic Area and the United Kingdom, and complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. The activities