ITEM 16K. CYBERSECURITY

Risk Management and Strategy

We have developed a comprehensive cybersecurity threat defense system to address both internal and external threats. This system encompasses various levels, including network, host and application security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures. We strive to manage cybersecurity risks and protect sensitive information through various means, such as technical safeguards, procedural requirements, an intensive program of monitoring on our corporate network, continuous testing of aspects of our security posture internally and with outside vendors, a robust incident response program and regular cybersecurity awareness training for employees. Our IT department regularly monitors the performance of our app, platform and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

Governance

We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

Our board of directors is responsible for overseeing our cybersecurity risk management. Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the relevant disclosure issues, if any, presented by our chief executive officer, chief financial officer and cybersecurity officer on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our annual report on Form 20-F presented by our chief executive officer, chief financial officer and cybersecurity officer.

At management level, our chief executive officer, chief financial officer and cybersecurity officer, which are collectively referred to as our Cybersecurity Risk Management Officers, are responsible for assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. Our Cybersecurity Risk Management Officers have extensive experience in cybersecurity risk management in public companies and will report to our board of directors (i) on a quarterly basis on updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the relevant disclosure issues, if any, and (ii) on disclosure concerning cybersecurity matters in our annual report on Form 20-F. Our cybersecurity officer has extensive experience in public company compliance and cybersecurity risk management and is familiar with our company’s operational and data collection practice. Our cybersecurity officer also possesses thorough knowledge of the relevant information security and data compliance regulations.

If a cybersecurity incident occurs, our Cybersecurity Risk Management Officers will promptly organize relevant personnel for internal assessment and if it is determined that the incident could potentially be a material cybersecurity event, our Cybersecurity Risk Management Officers will promptly report the incident and assessment results to our disclosure committee, our board of directors, and other members of senior management and external legal counsel, to the extent appropriate. Our Cybersecurity Risk Management Officers shall prepare disclosure material on the cybersecurity incident for review and approval by the disclosure committee and board of directors, and other members of senior management (if necessary), before it is disseminated to the public.