Company: JSKJ
Filing Date: 2025-11-17
Form Type: F-1
Source: 0001477932-25-008401
Chunk: 20

Company: Jiansu (Shanghai) Information Technology Co., Ltd
Filing Date: 2025-11-17
Form: F-1
Chunk 20
---
 that, among others, in addition to “operator of critical information infrastructure”, any “data processor” controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities.

| 20 |

On November 14, 2022, CAC released the Regulations on Network Data Security (draft for public comments) and accepted public comments until December 13, 2022. The draft Regulations on Network Data Security provide that data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing data. If a data processor that processes personal data of more than one million users intends to list overseas, it shall apply for a cybersecurity review. In addition, data processors that process important data or are listed overseas shall carry out an annual data security assessment on their own or by engaging a data security services institution, and the data security assessment report for the prior year should be submitted to the local cyberspace affairs administration department before January 31 of each year. There remain to be further clarified as to when the final measures will be issued and take effect, how they will be enacted, interpreted or implemented, and whether they will affect us.

On December 28, 2022, the Measures for Cybersecurity Review (2022 version) was promulgated and took effect on February 15, 2023, which iterates that any “online platform operators” controlling personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review. To the best knowledge of us, we are not among the “operator of critical information infrastructure” or “data processor” as mentioned above. The Company, through Jensu HK and its subsidiaries, is engaged in providing supply chain management services for customers in the plastics and chemical industries in China, and neither the Company nor its subsidiaries is engaged in data activities as defined under the Personal Information Protection Law, which includes, without limitation, collection, storage, use, processing, transmission, provision, publication and deletion of data. In addition, neither the Company nor its subsidiaries is an operator of any “critical information infrastructure” as defined under the PRC Cybersecurity Law and the Security Protection Measures on Critical Information Infrastructure. However, Measures for Cybersecurity Review (2022 version) was recently adopted and the Opinions remain to be further clarified on how it will be interpreted, amended and implemented by the