Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 97

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 4
Chunk 97
---
 safeguard the safe and stable operation of the networks, respond to network
security incidents effectively, prevent illegal and criminal activities, and maintain the integrity, confidentiality and usability of
network data, and the network operator shall not collect the personal information irrelevant to the services it provides or collect or
use the personal information in contravention of the laws or agreements between both parties.

Regulations relating to Protection of User Identity and Information

The security and confidentiality of information
on the identity of internet users are also highly regulated in China. The Internet Information Service Administrative Measures promulgated
by the State Council requires internet information service providers to maintain an adequate system that protects the security of user
information. In December 2005, the MPS promulgated the Regulations on Technical Measures of Internet Security Protection, requiring internet
service providers to utilize standard technical measures for internet security protection. Moreover, the Rules for Regulating the Market
Order of Internet Content Services, which was promulgated in December 2011, further enhances the protection of internet users’
personal information by prohibiting internet information service providers from unauthorized collection, disclosure or use of personal
information of their users.

In December 2012, the SCNPC promulgated the Decision
on Strengthening Network Information Protection to enhance the legal protection of information security and privacy on the internet.
On July 16, 2013, the Ministry of Industry and Information Technology, or the MIIT, promulgated the Provisions for the Protection of
Telecommunication and Internet User Personal Information, or the Provisions for the Protection of Person Information. According to the
Provisions for the Protection of Person Information, under which Internet information service providers are subject to strict requirements
to protect personal information of internet users, including: if a network service provider wishes to collect or use personal information,
such personal information collected shall be used only in connection with the services to be provided by Internet information service
providers to such users and shall be kept in strict confidence. Furthermore, it must disclose to its users the purpose, method and scope
of any such collection or usage, and must obtain consent from the users whose information is being collected or used. Network service
providers are also required to establish and publish their protocols relating to personal information collection or usage, keep any collected
information strictly confidential and take technological and other measures to maintain the security of such information. Network service
providers are required to cease any collection or usage of the relevant personal information, and de register the relevant user account,
when a user stops using