Risk Management and Strategy

We have implemented cybersecurity risk assessment procedures to ensure effectiveness in cybersecurity management, strategy and governance and reporting cybersecurity risks. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

It encompasses various levels, including network, host and application security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures. We strive to manage cybersecurity risks and protect sensitive information through various methods, including technical safeguards, procedural requirements, an intensive monitoring program on our corporate network, continuous testing of our security posture both internally and with outside vendors, a robust incident response program, a review of the effectiveness of our security system with reference to applicable security standards by qualified third parties and regular cybersecurity awareness training for employees. We continuously monitor the performance of our apps, platforms and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

The Company has established and maintains a comprehensive cybersecurity risk management program that is fully integrated into its broader Enterprise Risk Management architecture, designed to continuously identify, assess, prioritize, and remediate material risks arising from evolving cyber threats, system vulnerabilities, and unauthorized access to critical data and digital infrastructure. Aligned with recognized international security standards and industry’s best practices, the Company implements a rigorous third-party vendor risk management process requiring rigorous pre-onboarding technical due diligence, contractual data privacy and breach-notification covenants, and ongoing compliance reviews for service providers with network access. Operational safeguards include a structured Incident Response Plan, continuous multi-factor authentication and endpoint monitoring, recurring third-party assessments and penetration testing, and mandatory employee data security training.

As of the date of this Report, the Company has not experienced or identified any material cybersecurity incidents or identified any material cybersecurity threats that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect us, our business strategy, operational results, or financial condition.

Our Board of Directors is responsible for overseeing the Company’s cybersecurity risk management and be informed on risks from cybersecurity threats. The Board shall review, approve and maintain oversight of the disclosure (i) on Form 6-K for material cybersecurity incidents (if any) and (ii) related to cybersecurity matters in the periodic reports (including annual report on Form 20-F) of the Company. In addition, our management team, including those with experience in dealing with confidentiality-related cybersecurity issues, oversee and manage cybersecurity-related matters and formulate policies as necessary. Our Board reviews on an annual basis regarding assessment, identification and management on material risks from cybersecurity threats that happened in the ordinary course of our business operations. If a cybersecurity incident occurs, our Board will promptly organize relevant personnel for internal assessment and, depending on the situation, seek the opinions of external experts and legal advisors. If it is determined that the incident could potentially be a material cybersecurity event, our Board will decide on the relevant response measures and whether any disclosure is necessary. If such disclosure is determined to be necessary, such disclosure material will be prepared and reviewed by our Board before it is disseminated to the public.

As of the date of this Report, the Company has not experienced or identified any material cybersecurity incidents or identified any material cybersecurity threats that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect us, our business strategy, operational results, or financial condition.