Company: RETO
Filing Date: 2025-10-24
Form Type: 424B5
Source: 0001213900-25-102262
Chunk: 90

Company: ReTo Eco-Solutions, Inc.
Filing Date: 2025-10-24
Form: 424B5
Chunk 90
---
 than 1,000,000 users must now apply for cybersecurity approval when seeking listings in other nations because of the risk that such data and personal information could be “affected, controlled, and maliciously exploited by foreign governments.” The cybersecurity review will also look into the potential national security risks from overseas initial public offerings. As advised our PRC legal counsel, because (i) none of our PRC subsidiaries collecting personal information or processing data in actual operation, and (ii) none of our PRC subsidiaries is an “online platform operator holding more than one million users’ personal information”, we believe the cybersecurity review requirement is not applicable us. However, there remains uncertainty as to the interpretation and implementation of the revised Cybersecurity Review Measures and we cannot assure you that the CAC will reach the same conclusion as our PRC counsel. As advised by our PRC legal counsel, the PRC governmental authorities may have wide discretion in the interpretation and enforcement of these laws, including the interpretation of the scope of “critical information infrastructure operators.” If the Company or any of its PRC subsidiaries is deemed as a critical information infrastructure operator under the PRC cybersecurity laws and regulations, we and our PRC subsidiaries must fulfill certain obligations as required under the PRC cybersecurity laws and regulations, including, among others, storing personal information and important data collected and produced within the PRC territory during our operations in China, which we and our PRC subsidiaries have fulfilled in our business, and we and our PRC subsidiaries may be subject to review when purchasing internet products and services. We and our PRC subsidiaries may be subject to review when conducting data processing activities, and may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of this prospectus, we and our PRC subsidiaries have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we and our PRC subsidiaries have not received any inquiry, notice, warning, or sanctions in such respect. On November 14, 2021, the CAC released the Regulations on Network Data Security (draft for public comments) and accepted public comments until December 13, 2021. The draft Regulations on Network Data Security provide more detailed guidance on how to implement the general legal requirements under legislations such as the Cybersecurity Law, Data Security Law and the Personal Information Protection Law. The draft Regulations on Network Data Security follow the principle that the state will regulate based on a data classification and multi -levelprotection scheme.