Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
Not
applicable.
Item
1C. Cybersecurity
Risk
Management and Strategy
The
goal of our cybersecurity risk management strategy is to protect the privacy, integrity and availability of our systems, information
and data. Our subsidiaries are required to comply with rapidly evolving and complex PRC laws and regulations with respect to cybersecurity,
data security and personal information protection. In response to the recent changes in the regulatory requirements, we have designed
a data and information protection mechanism as part of our risk management process and efforts. The measures include the following main
components: (i) enhancing data security technical measures by the introduction of an extended verification (EV) SSL certificate at the
user information security technology implementation level, offering strong encryption technology and extended verification function,
and providing security guarantee for online transactions; (ii) improving the technical level protection and the monitoring mechanism
for data use, and for the data modules related to user information in the e-commerce platform system, using MD5 irreversible encryption
for storage and display of information security sensitive fields; (iii) developing a complete personal information operating process
and system and designating personnel for information security; (iv) developing a user information collection, storage and user rules
and privacy agreement, following the “inform + express consent” model, informing users of the purpose, method and scope of
information collection and use, as well as the channels for inquiring and correcting inaccuracies in information and data; (v) conducting
assessments on technology, operational risks and system common issues, and data security governance; (vi) engaging a data security service
organization to conduct an annual data security assessment and providing disclosure and updates to all stakeholders; (vii) establishing
an emergency plan for personal information security incidents, which includes an emergency response mechanism for security incidents,
incident impact assessment and mitigation measures, and emergency response training and drills; (viii) providing periodic training to
employees; and (ix) promoting consumer data protection awareness. We
have implemented and are in the process of implementing these measures.
Governance
The Company’s board of directors
has oversight responsibility for the Company’s overall risk management, including cybersecurity risks, and has not delegated oversight
authority for cybersecurity risks to any committee. Our management, led by our Chief Executive Officer and Chief Financial Officer, is
responsible for assessing cybersecurity risks and supervising relevant personnel with respect to our efforts and measures with the aim
we have an appropriate cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief
Executive Officer and Chief Financial Officer meet periodically with the individuals charged with the day-to-day operations supervisory
responsibilities including IT operations and infrastructure regarding cybersecurity to review and assess potential issues and any changes
needed to be made related to our information technology system and cybersecurity measures. Cybersecurity awareness trainings are provided
for all employees.
In
fiscal year 2023, we did not identify
any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results
of operations, or financial condition. However, we face potential cybersecurity threats that, if realized, would materially affect us.
These threats include but are not limited to ransomware and malware attacks, and compromised business email and other social engineering
threats. Our suppliers, customers, contractors and business partners also face similar cybersecurity risks, which could have an adverse
impact on our business. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, “Risk Factors -
While we are not aware of any data breach in the past, future cyberattacks, computer viruses
or any failure to adequately maintain security and prevent unauthorized access to our information technology system or data could result
in a disruption of our business operations and materially adversely affect our reputation, financial condition and operating results .”