Company: NTCL
Filing Date: 2025-10-20
Form Type: F-1
Source: 0001104659-25-100526
Chunk: 4

Company: NetClass Technology Inc
Filing Date: 2025-10-20
Form: F-1
Chunk 4
---
 overseas using a variable interest entity structure, adopting new measures to extend the scope of cybersecurity reviews, and expanding the efforts in anti-monopoly enforcement. We will not be subject to cybersecurity review with the Cyberspace Administration of the PRC (the “CAC”) under the Cybersecurity Review Measures, which became effective on February 15, 2022, since we currently do not have over one million users’ personal information and do not anticipate that we will be collecting over one million users’ personal information in the foreseeable future, which we understand might otherwise subject us to the Cybersecurity Review Measures; we are also not subject to cybersecurity review by the CAC if the Draft Regulations on the Network Data Security Administration are enacted as proposed, since we currently do not have over one million users’ personal information and do not collect data that affects or may affect national security and we do not anticipate that we will be collecting over one million users’ personal information or data that affects or may affect national security in the foreseeable future, which we understand might otherwise subject us to the Security Administration Draft; besides, according to Article 2 of the Measures, a critical information infrastructure operator purchases network products and services, or a network platform operator carries out data processing activities, which affect or may affect national security, a Cybersecurity Review shall be conducted in accordance with these Measures. If neither the Company is identified as a critical information infrastructure operator nor its operations are deemed as “affecting or may affecting the national security”, the Company will not be subject to cybersecurity review under Article 2 of the Measures. However, we might be required to conduct an annual data security assessment under the Draft Regulations on the Network Data Security Administration (the “Draft”). According to Article 32 of the Draft, “A data processor who processes important data or who is listed overseas shall complete an annual data security assessment either self-conducted or conducted by a data security service organization engaged, and before January 31 of each year, submit the annual data security assessment report of the previous year to the districted city-level cyberspace authority, which shall contain the following information: (1) the processing of any important data, if any, (2) any data security risks discovered and measures for their disposal, (3) the data security management system, data backup, encryption, access control and other security protection measures, and the implementation of the management system and the effectiveness of the protection measures, (4) the implementation of national data security laws, administrative regulations and standards, (5) any data security incidents that