Company: XTKG
Filing Date: 2025-04-25
Form Type: 20-F
Source: 0001213900-25-035626
Chunk: 103

Company: X3 Holdings Co., Ltd.
Filing Date: 2025-04-25
Form: 20-F
Item: Item 4
Chunk 103
---
 service providers may not collect any users’ personal information or provide any such information
to third parties without the consent of the user.

An internet information
service provider shall expressly inform the users of the method, content and purpose of the collection and processing of such users’
personal information and may only collect information necessary for the provision of its services. An internet information service provider
is also required to properly maintain the users’ personal information, and in case of any leak or likely leak of the users’
personal information, the internet information service provider must take immediate remedial measures and, in severe circumstances, immediately
report to the telecommunications authority.

Decision of the SCNPC on Strengthening
Internet Information Protection

The Standing
Committee of the National People’s Congress (“ SCNPC”) issued the Decision on Strengthening Internet Information Protection
in December 2012. Pursuant to this decision, the State protects the electronic information that can identify the personal identity
of citizens and that involves privacy of citizens. No organization or individual may obtain the personal electronic information of citizens
by steal or other illegal means, nor sell or illegally provide certain information to others. The Decision further set out the requirement
for the internet service providers.

Cyber Security Law

The SCNPC promulgated
the Cyber Security Law in November 2016, which became effective in June 2017, to protect cyberspace security and order. Pursuant
to the Cyber Security Law, any individual or organization using the network must comply with the Constitution and the applicable laws,
follow the public order and respect social moralities, and must not endanger cyber security, or engage in activities by making use of
the network that endanger the national security, honor and interests, or infringe on the fame, privacy, intellectual property and other
legitimate rights and interests of others.

Data Security Law

The Data Security
Law of the PRC, which was promulgated by the SCNPC in June 2021 and took effect in September 2021, provides that the PRC shall
establish a data classification and grading protection system, formulate the important data catalogs to enhance the protection of important
data. Processors of important data shall specify the person responsible for data security and management agencies to implement data security
protection responsibilities. Relevant authorities will establish the measures for the cross-border transfer of important data. If
any company violates the Data Security Law of the PRC to provide important data outside the PRC, such company may be punished by administration
sanctions