Company: XCH
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056976
Chunk: 84

Company: XCHG Ltd
Filing Date: 2025-04-23
Form: 20-F
Item: Item 4
Chunk 84
---
3. These measures require personal information processors providing personal information to overseas recipients by entering into standard contracts and falling under any of the specified circumstance to file with the local counterpart of the CAC within ten business days from the effective date of the relevant standard contracts. On March 22, 2024, the CAC promulgated the Provisions on Promoting and Standardizing Cross-Border Data Transfer, which further set forth the circumstances that are exempted from, and thresholds for, performing the security assessment or filing procedures for cross-border data transfer under these measures.
On September 24, 2024, the CAC promulgated the Regulations for the Administration of Network Data Security, which came into effect on January 1, 2025. The Regulations for the Administration of Network Data Security covers a wide range of internet data security issues, including the supervision and management of data security in the PRC, and apply to situations using networks to carry out data processing activities. The Regulations for the Administration of Network Data Security set out general guidelines covering subjects including protection of personal information, security of important data, security management of cross-border data transmission, obligations of internet platform operators, supervision and management, and legal liabilities of internet data security. The regulations also stipulate that data processors that engage in network data processing activities, which affect or may affect national security, shall conduct national security review in accordance with relevant laws and regulations.

Regulations Relating to Privacy Protection
The Civil Code of the PRC, issued by the National People’s Congress of the PRC on May 28, 2020 and effective from January 1, 2021, provides legal basis for privacy and personal information infringement claims under the Chinese civil laws.
Criminal Law of the PRC, as amended on December 26, 2020, prohibits institutions, companies and their employees from selling or otherwise infringement of a citizen’s personal information obtained in performing duties or providing services or obtaining such information through theft or other illegal ways.
According to the Cybersecurity Law, a network operator shall not collect personal information irrelevant to the services it provides or collect or use personal information in violation of the provisions of laws or agreements between both parties.
According to the Personal Information Protection Law of the PRC, which was promulgated by the SCNPC on August 20, 2021 and came into effect on November 1, 2021, personal information shall be handled in accordance with the principles of lawfulness, legitimacy, necessity and good faith, and it is not allowed to handle