Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 37

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 37
---
 data processor is stored within the territory of China, allowing inquiry, retrieval, download and export by overseas agencies, organizations or individuals; and (iii) other data handling activities such as handling of the personal information of domestic natural persons abroad under the circumstances specified in Paragraph 2 of Article 3 of the Personal Information Protection Law.
On 12 February 2025, the CAC promulgated the Administrative Measures for Personal Information Protection Compliance Audits, or the Audits Administrative Measures, which will become effective on May 1, 2025. The Audits Administrative Measures provided that any personal information handler handling the personal information of more than 10 million people shall carry out the personal information protection compliance audits at least once every two years. For a personal information handler who falls under any of the following circumstances, the cyberspace administration of China and other authorities performing responsibilities of personal information protection (hereinafter collectively referred to as the “protection authorities” in short) may require the personal information handler to entrust a specialized agency with the compliance audit of its personal information handling activities: (i) Where its personal information handling activities involve relatively large risks such as serious impact on personal rights and interests or serious lack of security measures; (ii) Where its personal information handling activities may infringe upon the rights and interests of many people; or (iii) Where a personal information security incident occurs, resulting in the divulgence, tampering with, loss or damage of the personal information of more than one million people or the sensitive personal information of more than 100,000 people. For the same personal information security incident or risk, it is not allowed to repeatedly require the personal information handler concerned to entrust a specialized agency with the personal information protection compliance audits.
In general, compliance with the existing laws and regulations of mainland China, as well as additional laws and regulations that PRC regulatory bodies may enact in the future, related to data security and personal information protection, may be costly and result in additional expenses to us, and subject us to negative publicity, which could harm our reputation and business operations. It may place restrictions on the conduct of our business and the manner in which we interact with our students and/or their parents. Any failure to comply with applicable regulations could also result in regulatory enforcement actions against us, and misuse of or failure to secure personal information could also result in violation of data privacy laws and regulations, proceedings against us by governmental authorities or other authorities or damage to our reputation and credibility and could have a negative impact on revenues and profits. Significant