Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 115

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 115
---
 we have an information security team comprised of experts who specialize in different areas, including network security, data security, compliance, and risk management. Our information security team is deeply involved in the key aspects of our business operations, providing professional advisory services to other departments.
We have made great efforts to improve our client privacy and data security systems and processes. We have built a secure Software Development Lifecycle to ensure the security of all the software systems we develop before launch. We have also established a security management framework and obtained ISO 27001 (information security management) and ISO 29151 (personally identifiable information protection) certifications issued by DNV. To ensure our compliance with applicable laws and regulations, we have also implemented a series of internal policies on cybersecurity and data protection. We collect clients’ personal information legally required for our business operations only, including account opening procedures, know-your-client and anti-money laundering review processes, as well as for their investments with us. For our daily operations, we collect and store personal identity information, including sensitive information such as client ID numbers, bank accounts information, proof of income and assets, in an encrypted form, to preserve the confidentiality of all clients’ information. We have formulated our own privacy policies that are embedded with our mobile applications and websites to inform our clients of the purposes and methods of processing personal information, the type of personal information to be processed and its retention period, as well as the procedures for the clients to exercise their rights under the Personal Information Protection Law. Before any personal information can be provided to any third parties or transferred abroad, we will inform our clients of the name and contact information of the receiving parties, the type of personal information involved, and the purposes and methods of providing such information, as well as how they can exercise their rights under applicable laws and regulations. If any sensitive personal information is to be processed, we will also inform the relevant individuals of the necessity of processing such information and the potential impact on their rights and interests.
We use personal information of our clients only for limited purposes as authorized by the individuals or required by laws and regulations. If the use of such personal information is beyond the original scope authorized, a separate authorization is required. In addition, we will conduct Personal Information Protection Assessment according to Noah Personal Information Protection Impact Assessment Policy on our personal information processing activities that involve greater risks, such as processing sensitive personal information, providing personal information to other third parties, as well as transferring personal information abroad. From an internal policy perspective, we have set up access control mechanisms to ensure that our employees are