Company: XHG
Filing Date: 2025-09-09
Form Type: F-3
Source: 0001213900-25-086186
Chunk: 41

Company: XChange TEC.INC
Filing Date: 2025-09-09
Form: F-3
Chunk 41
---
 SCNPC, on June 10, 2021 and became effective on September 1,
2021, outlines the main system framework of data security protection.

<div align='center'>20</div>

In December 2021, the Cyberspace Administration
of China (the “CAC”) promulgated the amended Measures of Cybersecurity Review which require cyberspace operators with personal
information of more than one million users to file for cybersecurity review with the Cybersecurity Review Office (“CRO”),
in the event such operators plan for an overseas listing. The amended Measures of Cybersecurity Review provide that, among others, an
application for cybersecurity review must be made by an issuer that is a “critical information infrastructure operator” or
a “data processing operator” as defined therein before such issuer’s securities become listed in a foreign country,
if the issuer possesses personal information of more than one million users, and that the relevant governmental authorities in the PRC
may initiate cybersecurity review if such governmental authorities determine an operator’s cyber products or services, data processing
or potential listing in a foreign country affect or may affect China’s national security. The amended Measures of Cybersecurity
Review took effect on February 15, 2022. In August 2021, the Standing Committee of the National People’s Congress of China promulgated
the Personal Information Protection Law which became effective on November 1, 2021. The Personal Information Protection Law provides a
comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection
compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing
of personal information of persons outside of China if such processing is for purposes of providing products and services to, or analyzing
and evaluating the behavior of, persons in China. The Personal Information Protection Law also provides that critical information infrastructure
operators and personal information processing entities who process personal information meeting a volume threshold to be set by Chinese
cyberspace regulators are also required to store in China the personal information generated or collected in China, and to pass a security
assessment administered by Chinese cyberspace regulators for any export of such personal information. Moreover, pursuant to the Personal
Information Protection Law, persons who seriously violate this law may be fined for up to RMB50 million or 5% of annual revenues generated
in the prior year and may also be ordered to suspend any related activity by competent authorities.

In November 2021, the CAC released