Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 103

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 103
---
 is crucial to our business operations. We have internal rules and policies to govern how we may use and share personal information, as well as protocols, technologies and systems in place to ensure that such information will not be accessed or disclosed improperly. Users must acknowledge the terms and conditions of the user agreement before accessing our products and services, under which they consent to our collection, use, and disclosure of their data in compliance with applicable laws and regulations.

When our users access and interact on Zhihu, we collect certain personal information, including name, email address, mobile number, ID number, behavioral data, and other personal information. We first obtain consent from our users to collect, store, and transmit data for providing services to them on Zhihu. Our data privacy policy agreed to by our users describes our data practices in our operations. We do not use any data for any purpose other than those specified in the data privacy policy agreed to by our users.

Table of Contents

We store all the data accumulated in our operations in-house. At present, we do not engage in any data sharing arrangement with external parties, nor do our operations entail any cross-border data transfer. From an internal policy perspective, we limit access to our servers that store our user and internal data on a “need-to-know” basis. Our employees are granted access to the minimum extent that is necessary to fulfill their job responsibilities and are required to go through strict internal approval procedures before operating on such data. We also have entered into confidentiality agreements with employees and organized trainings to strengthen their awareness of data privacy and protection. In addition, we adopt a data encryption system intended to ensure the secured storage and transmission of data and prevent any unauthorized public member or third parties from accessing or using our data in any unauthorized manner. We have implemented internal controls to ensure that user data is protected, and that leakage and loss of such data is avoided. Furthermore, we have appointed a team of dedicated data protection professionals who are responsible for designing and monitoring data security management and emergency response. Data access attempts by any third party are subject to our evaluation and approval procedure based on the necessity and scope of the attempts and appropriate consent from our users. We typically provide third parties with anonymous and desensitized personal information and require such third parties to undertake equivalent data protection measures.

To date, we have not been subject to any material fines or other material penalties due to non-compliance with data privacy and security laws or regulations. Based on the foregoing, Global Law Office, our PRC legal counsel, is of the view