The formulation of the Company’s cybersecurity strategy is based on the Company’s business processes, strategic objectives and legal requirements and regulations; we assess and classify cybersecurity risks, formulate corresponding security policies and standards, and design security frameworks and contingency plans. The monitoring of cybersecurity risks has been included in the Company’s comprehensive risk management plan, fully ensuring that cybersecurity risks are managed and the Company’s relevant policies and standards are complied with.

The Company has established a complete technical security team, and regularly provides adequate resources and training to IT security personnel so that they are fully aware of the Company’s guidelines and expectations regarding cybersecurity strategy.

The Company requires employees to use approved public devices and secure office networks within the scope defined by the cybersecurity policy, and to utilize technical means provided by third-party security companies, updated in 2025, for 24/7 continuous monitoring, event resolution, and reporting to enhance the cybersecurity environment, including reducing cybersecurity attacks, threat monitoring, vulnerability remediation, and implementing security patches.

As of the date of this annual report, there have not been any risks from cybersecurity threats or any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.

However, despite our efforts, risks from cybersecurity threats cannot be completely eliminated. There can be no assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Item 3. Key Information — D. Risk Factors — Cyberattacks and security breaches of our system, or those impacting our third parties, could adversely impact our brand and reputation and our business, operating results, and financial condition” and “— We may suffer significant and adverse effects because of hacking or one or more adverse software events.”

The formulation of the Company’s cybersecurity strategy is based on the Company’s business processes, strategic objectives and legal requirements and regulations; we assess and classify cybersecurity risks, formulate corresponding security policies and standards, and design security frameworks and contingency plans. The monitoring of cybersecurity risks has been included in the Company’s comprehensive risk management plan, fully ensuring that cybersecurity risks are managed and the Company’s relevant policies and standards are complied with.

The Board of Directors reviews and approves the Company’s cybersecurity strategy, monitors and reviews the implementation of cybersecurity policies, and makes appropriate adjustments and assists with cybersecurity strategies and processes as necessary.

The Board of Directors ensures that the Company has sufficient resources (including personnel, technical and financial resources) to support effective cybersecurity measures and that the Company has conducted a comprehensive risk assessment, including identifying potential cybersecurity threats, assessing the likely impact of those threats and determining appropriate measures in response.

The Board of Directors is responsible for overseeing the implementation and execution of the cybersecurity strategy, and for providing ongoing oversight of the plans, procedures, processes, and execution of the Company’s controls in the areas of cybersecurity, system security, data transmission security, and data privacy controls.

The Board of Directors requires the Company’s management to report regularly, and at least annually on the implementation of information security matters, including the occurrence of any cybersecurity incidents as well as the process and results of handling them, the progress of major cybersecurity initiatives, and the overall status of the adjustment and implementation of cybersecurity strategies.

The Board of Directors requires the Company’s management to report regularly, and at least annually on the implementation of information security matters, including the occurrence of any cybersecurity incidents as well as the process and results of handling them, the progress of major cybersecurity initiatives, and the overall status of the adjustment and implementation of cybersecurity strategies.