Company: GRAN
Filing Date: 2025-07-01
Form Type: 424B4
Source: 0001213900-25-060039
Chunk: 57

Company: Grande Group Ltd/HK
Filing Date: 2025-07-01
Form: 424B4
Chunk 57
---
 20, 2021, the 30 thmeeting of the Standing Committee of the 13 thNational People’s Congress voted and passed the “Personal Information Protection Law of the People’s Republic of China”, or “PRC Personal Information Protection Law,” or the “PIPL,” which became effective on November 1, 2021. The PRC Personal Information Protection Law applies to the processing of personal information of natural persons within the territory of China that is carried out outside of China where (1) such processing is for the purpose of providing products or services for natural persons within China, (2) such processing is to analyze or evaluate the behavior of natural persons within China, or (3) there are any other circumstances stipulated by related laws and administrative regulations. Pursuant to the PIPL, personal data processors (“data processors”) shall meet one of the conditions in order to transmit personal information overseas for their business operations: (i) passing the security evaluation organized by the Cyberspace Administration of China (the “CAC”); (ii) acquiring personal information protection certification from the professional organizations regulated by the CAC; (iii) adopting the standard contract forms stipulated by the CAC when entering into contracts with overseas information receivers, setting forth the rights and obligations of the parties; and (iv) other conditions regulated by laws, regulations and the CAC. Prior to the cross -borderprovision of personal information of the natural persons, personal information processors shall obtain the approval of the corresponding natural persons and advise them of the overseas receiver’s name, contact information, processing purpose and methods, classification of personal information and information reception procedures, etc. On December 28, 2021, the CAC, jointly with the relevant authorities, formally published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022 and replace the former Measures for Cybersecurity Review (2020) issued on July 10, 2021. Measures for Cybersecurity Review (2021) stipulates that in addition to “operator of critical information infrastructure,” any “data processor” carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or transferred outside the country; and (ii) the risk of critical information