Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. Each RSG Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”). Each RSG Party and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party The Transaction Parties and its subsidiaries’ the subsidiaries of the Parent Guarantor’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Transaction Parties and its the subsidiaries of the Parent Guarantor as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Transaction Parties and its the subsidiaries of the Parent Guarantor have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other personliability, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Transaction Parties and its the subsidiaries of the Parent Guarantor are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, modification. Any certificate signed by any officer of any Transaction Party or any of the “Data Security Obligations”). Each RSG Party subsidiaries of the Parent Guarantor and its subsidiaries have taken all necessary actions as would reasonably be expected delivered to prepare the Lead Managers or to comply counsel for the Underwriters in connection with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as offering of the date hereof Securities shall be deemed a representation and warranty by such party to each Underwriter as becoming effective within 12 months after to the matters set forth therein on the date of such certificate and, unless subsequently amended or supplemented, at each Representation Date subsequent thereto. The Transaction Parties acknowledge that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 5 hereof, counsels for the Transaction Parties and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None the Underwriters will rely upon the accuracy and truthfulness of the RSG Parties has foregoing representations and hereby consents to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsuch reliance.

Cybersecurity; Data Protection. Each RSG Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”i) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party and its subsidiaries are presently in compliance, in all material compliance respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any legal obligations regarding the collection, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, accesstransfer, misappropriation or modification import, export, storage, protection, disposal and disclosure by the Company and its subsidiaries of Data (collectively, the “Data Security Obligations”); (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and are aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. Each RSG Party The Company and its subsidiaries have taken all steps reasonably necessary actions as in accordance with industry standard practices to protect such information against loss and against unauthorized access, use, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to prepare have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. To the knowledge of the Company, except as disclosed in the Registration Statement, the Disclosure Package and the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could would be reasonably likely to create have a material liability) Material Adverse Effect on the Company and its subsidiaries, taken as a whole, as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiariesSubsidiaries and the Consolidated Affiliated Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantsmaterial corruptions. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”)modification. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could would be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party (A) The Company and its subsidiaries’ information technology assets Subsidiaries have complied and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal data, confidentiality and archive administration (including all personal, personally identifiable, sensitive, confidential or regulated data, or any such data that may constitute trade secrets and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security or public interest pursuant to the applicable laws used in connection with their businesses and/or the offering of the Class A ordinary shares) (“Data Protection Laws”, and such data, “Data”) and to the protection of such IT Systems and Personal Data from loss and against unauthorized use, access, misappropriation misappropriation, modification, disclosure or modification other misuse; (collectivelyB) neither the Company nor any of its Subsidiaries is subject to any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the “Data Security Obligations”CSRC, or any other relevant governmental authority; (C) neither the Company nor any of its Subsidiaries has received any investigation, inquiry, notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice). Each RSG Party and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with , letter, complaint or allegation from the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereofrelevant cybersecurity, and for which data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None by it of the RSG Parties applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (D) neither the Company nor any of its Subsidiaries has to their knowledge received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (E) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (F) neither the Company nor its Subsidiaries has received any communication, enquiry, notification of of, warning or complaint regarding and any Data Protection Laws (including, without limitation, the CSRC Archive Rules) or from the CAC; (G) neither the Company nor its Subsidiaries is unaware aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there Protection Laws; (H) the Company is no action, suit or proceeding by or before not aware of any court or governmental agency, authority or body pending or threatened alleging non-investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, officers and employees; (I) the Company and its Subsidiaries have adequate and effective internal control measures and internal systems consistent with applicable regulatory standards and customary industry practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used, gathered or accessed in connection with their businesses and/or the offering of the Class A ordinary shares, and there have been no breaches, violations, outages, leakages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any Data Security Obligationother person, nor any incidents under internal review or investigations relating to the same; (J) neither the Company nor any of its Subsidiaries is, or is expected to be classified as a “critical information infrastructure operator” under the Revised Cybersecurity Review Measure; (K) neither the Company nor any of its Subsidiaries has received any objection to the offering of the Class A ordinary shares or the transactions contemplated under this Agreement from the CSRC, the CAC or any governmental authority.

Cybersecurity; Data Protection. Each RSG Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”i) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries have implemented backup and maintained commercially reasonable controlsdisaster recovery technology reasonably consistent with industry standards and practices; and (ii) to the knowledge of the Company, policies, procedures, there has been no security breach or other compromise to the personal data and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data, including the data (“Personal Data”)) used of the Company and its subsidiaries’ respective employees, suppliers, vendors and third parties, in each case, maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, and there have been no breaches, violations, outages or unauthorized uses of or accesses to samethe “Confidential Data”), except for those any breach or compromise that have has been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority disclose such breach or compromise to any other person, nor any incidents under internal review governmental entity or investigations relating regulatory agency or which otherwise would not be expected, individually or in the aggregate, to have a Material Adverse Effect. Except as described in the Registration Statement, the Disclosure Package and the Prospectus, to the same. Each RSG Party knowledge of the Company, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of information technology and computer systems, networks, hardware, software, data, equipment or technology of the Company and its subsidiaries (collectively, “IT Systems Systems”) and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (collectivelymodification, the “Data Security Obligations”). Each RSG Party and its subsidiaries have taken all necessary actions except as would reasonably not be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts thatexpected, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation to have a Material Adverse Effect. Any certificate signed by or on behalf of the Company and delivered to the Underwriter or to counsel for the Underwriter shall be deemed to be a representation and warranty by the Company to the Underwriter as to the matters covered thereby. The Company acknowledges that the Underwriter and, for purposes of the opinions to be delivered pursuant to Section 6 hereof, counsel to the Company and to their knowledge there is no actionthe Underwriter, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationwill rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiariesSubsidiaries and the Consolidated Affiliated Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantsmaterial corruptions. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”)modification. Each RSG Party The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could would be reasonably likely to create a material liability) as soon they take effect. None Any certificate signed by an officer of the RSG Parties has Company and delivered to their knowledge received any notification of Cowen or complaint regarding and is unaware of any other facts that, individually to counsel for Cowen pursuant to or in connection with this Agreement shall be deemed to be a representation and warranty by the aggregateCompany to Cowen as to the matters set forth therein. The Company acknowledges that Cowen and, would reasonably indicate non-compliance with any Data Security Obligation for purposes of the opinions to be delivered pursuant to Section 7 hereof, each counsel to the Company and each counsel to their knowledge there is no actionCowen, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationwill rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiaries’ information technology assets Subsidiaries have complied and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal data, confidentiality and archive administration (including all personal, personally identifiable, sensitive, confidential or regulated data, or any such data that may constitute trade secrets and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security or public interest pursuant to the applicable laws used in connection with their businesses and/or the offering of the Class A ordinary shares) (“Data Protection Laws”, and such data, “Data”) and to the protection of such IT Systems and Personal Data from loss and against unauthorized use, access, misappropriation misappropriation, modification, disclosure or modification other misuse; (collectivelyB) neither the Company nor any of its Subsidiaries is subject to any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the “Data Security Obligations”CSRC, or any other relevant governmental authority; (C) neither the Company nor any of its Subsidiaries has received any investigation, inquiry, notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice). Each RSG Party and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with , letter, complaint or allegation from the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereofrelevant cybersecurity, and for which data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None by it of the RSG Parties applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (D) neither the Company nor any of its Subsidiaries has to their knowledge received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (E) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (F) neither the Company nor its Subsidiaries has received any communication, enquiry, notification of of, warning or complaint regarding and any Data Protection Laws (including, without limitation, the CSRC Archive Rules) or from the CAC; (G) neither the Company nor its Subsidiaries is unaware aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there Protection Laws; (H) the Company is no action, suit or proceeding by or before not aware of any court or governmental agency, authority or body pending or threatened alleging non-investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, officers and employees; (I) the Company and its Subsidiaries have adequate and effective internal control measures and internal systems consistent with applicable regulatory standards and customary industry practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used, gathered or accessed in connection with their businesses and/or the offering of the Class A ordinary shares, and there have been no breaches, violations, outages, leakages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any Data Security Obligationother person, nor any incidents under internal review or investigations relating to the same; (J) neither the Company nor any of its Subsidiaries is, or is expected to be classified as a “critical information infrastructure operator” under the Revised Cybersecurity Review Measure; (K) neither the Company nor any of its Subsidiaries has received any objection to the offering of the Class A ordinary shares or the transactions contemplated under this Agreement from the CSRC, the CAC or any governmental authority.

Cybersecurity; Data Protection. Each RSG Party Except as disclosed in the Registration Statement and the Prospectus or as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, (i) the Company and each of its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases used to process, store, maintain and operate date, information and functions (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and each RSG Party and of its subsidiaries Subsidiaries as currently conducted, (ii) the Company and to the RSG Parties’ knowledge, free and clear each of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and (iii) to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating and (iv) to the same. Each RSG Party Company’s knowledge, the Company and each of its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or laws, statutes and all regulations and any judgments, orders, orders or rules and regulations of any court or court, arbitrator or governmental regulatory authority having lawful jurisdiction over the Company or regulatory authorityany of its Subsidiaries, internal policies and any contractual obligations relating to the privacy and security of such IT Systems Systems. The Company acknowledges that the Agents, the Forward Sellers and Personal Data the Forward Purchasers and, for purposes of the opinions to be delivered pursuant to Sections 5 and 6 hereof, counsel to the protection of such IT Systems Company and Personal Data from unauthorized use, access, misappropriation or modification (collectivelycounsel to the Agents, the “Data Security Obligations”). Each RSG Party Forward Sellers and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (Forward Purchasers, will rely upon the accuracy and all other applicable laws and regulations with respect to Personal Data that have been announced as truthfulness of the date hereof as becoming effective within 12 months after the date hereof, foregoing representations and for which any non-compliance with same could be reasonably likely hereby consents to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsuch reliance.

Cybersecurity; Data Protection. Each RSG Party The Company’s and its subsidiariesSubsidiaries’ and Affiliated Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Subsidiaries and Affiliated Entities as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries Subsidiaries and Affiliated Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Subsidiaries and Affiliated Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”)modification. Each RSG Party The Company and its subsidiaries Subsidiaries and Affiliated Entities have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could would be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party The Company, CTWS and its their respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company, CTWS and its their respective subsidiaries as currently conducted, and and, to the RSG Parties’ Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company, CTWS and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company, CTWS and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectivelymodification. To the Company’s knowledge, the “Data Security Obligations”). Each RSG Party Company, CTWS and its their respective subsidiaries have taken all necessary actions actions, to the extent required to have been taken as would reasonably be expected of the date hereof, to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could would be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party (A) The Company and its subsidiaries’ information technology assets Subsidiaries have complied and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal data, confidentiality and archive administration (including all personal, personally identifiable, sensitive, confidential or regulated data, or any such data that may constitute trade secrets and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security or public interest pursuant to the applicable laws used in connection with their businesses and/or the offering of the ordinary shares) (“Data Protection Laws”, and such data, “Data”) and to the protection of such IT Systems and Personal Data from loss and against unauthorized use, access, misappropriation misappropriation, modification, disclosure or modification other misuse; (collectivelyB) neither the Company nor any of its Subsidiaries is subject to any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the “Data Security Obligations”CSRC, or any other relevant governmental authority; (C) neither the Company nor any of its Subsidiaries has received any investigation, inquiry, notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice). Each RSG Party and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with , letter, complaint or allegation from the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereofrelevant cybersecurity, and for which data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None by it of the RSG Parties applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (D) neither the Company nor any of its Subsidiaries has to their knowledge received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data, and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (E) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (F) neither the Company nor its Subsidiaries has received any communication, enquiry, notification of of, warning or complaint regarding and any Data Protection Laws (including, without limitation, the CSRC Archive Rules) or from the CAC; (G) neither the Company nor its Subsidiaries is unaware aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there Protection Laws; (H) the Company is no action, suit or proceeding by or before not aware of any court or governmental agency, authority or body pending or threatened alleging non-investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, officers and employees; (I) the Company and its Subsidiaries have adequate and effective internal control measures and internal systems consistent with applicable regulatory standards and customary industry practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used, gathered or accessed in connection with their businesses and/or the offering of the ordinary shares, and there have been no breaches, violations, outages, leakages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any Data Security Obligationother person, nor any incidents under internal review or investigations relating to the same; (J) neither the Company nor any of its Subsidiaries is, or is expected to be classified as a “critical information infrastructure operator” under the Revised Cybersecurity Review Measure; (K) neither the Company nor any of its Subsidiaries has received any objection to the offering of the ordinary shares or the transactions contemplated under this Agreement from the CSRC, the CAC or any governmental authority.

Cybersecurity; Data Protection. (i) Each RSG Party of the Company and its subsidiariesSubsidiaries has complied with all applicable laws concerning cybersecurity, data security and protection, confidentiality and archive administration (collectively, the “Data Protection Laws”) in all material respects; (ii) neither the Company nor any of its Subsidiaries has been informed by any relevant authority that the Company or any of its Subsidiaries has been identified as a “critical information infrastructure operator” under the cybersecurity laws of the PRC; (iii) neither the Company nor any of its Subsidiaries is subject to any investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the Cyberspace Administration of China (the “CAC”), the China Securities Regulatory Commission (the “CSRC”), or any other relevant governmental authority; (iv) neither the Company nor any of its Subsidiaries has received any notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice), letter, complaint or allegation from the relevant cybersecurity, data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance by it of the applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (v) neither the Company nor any of its Subsidiaries has received any claim for compensation or any other claim from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (vi) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (vii) neither the Company nor any of its Subsidiaries has received any communication, enquiry, notice, warning or sanctions with respect to the cybersecurity law of the PRC or from the CAC or pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (viii) the Company is not aware of any pending or threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors; (ix) the Company is not aware of any pending or threatened actions, suits, claims, demands, investigations, judgments, awards and proceedings on the Company or any of its Subsidiaries or any of their respective directors pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (x) neither the Company nor any of its Subsidiaries has received any objection to the offering of the Shares or the transactions contemplated under this Agreement from the CSRC, the CAC or any other relevant governmental authority, except as would not, in each case under clauses (i) to (x) above, individually or in the aggregate, have a Material Adverse Change; and (xi) The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityGovernmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”)modification. Each RSG Party The Company and its subsidiaries Subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge not received any notification of or complaint regarding and is are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation Obligations, and to their knowledge there is have been no action, suit or proceeding by or before any court or governmental government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, knowledge of the Company and the Guarantors are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other material corruptants. Each RSG Party The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and, to the knowledge of the Company and the Guarantors, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”). Each RSG Party and its subsidiaries have taken all necessary actions except as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts thatnot, individually or in the aggregate, would reasonably indicate non-compliance be expected to have a Material Adverse Effect. Any certificate signed by any officer of the Company or any of the Guarantors and delivered to the Representative or counsel for the Initial Purchasers in connection with any Data Security Obligation the offering of the Securities shall be deemed a representation and warranty by the Company or the Guarantors, as applicable, as to their knowledge there is no actionmatters covered thereby, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationto each Initial Purchaser.

Cybersecurity; Data Protection. Each RSG ▇▇▇▇ Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG ▇▇▇▇ Party and its subsidiaries as currently conducted, and to the RSG ▇▇▇▇ Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG ▇▇▇▇ Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG ▇▇▇▇ Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”). Each RSG ▇▇▇▇ Party and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG ▇▇▇▇ Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Each RSG Party Except as disclosed in the Registration Statement and the Prospectus or as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, (i) the Company and each of its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases used to process, store, maintain and operate data, information and functions (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and each RSG Party and of its subsidiaries Subsidiaries as currently conducted, (ii) the Company and to the RSG Parties’ knowledge, free and clear each of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and (iii) to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating and (iv) to the same. Each RSG Party Company’s knowledge, the Company and each of its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or laws, statutes and all regulations and any judgments, orders, orders or rules and regulations of any court or court, arbitrator or governmental regulatory authority having lawful jurisdiction over the Company or regulatory authorityany of its Subsidiaries, internal policies and any contractual obligations relating to the privacy and security of such IT Systems Systems. The Company acknowledges that the Agents, the Forward Sellers and Personal Data the Forward Purchasers and, for purposes of the opinions to be delivered pursuant to Sections 5 and 6 hereof, counsel to the protection of such IT Systems Company and Personal Data from unauthorized use, access, misappropriation or modification (collectivelycounsel to the Agents, the “Data Security Obligations”). Each RSG Party Forward Sellers and its subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (Forward Purchasers, will rely upon the accuracy and all other applicable laws and regulations with respect to Personal Data that have been announced as truthfulness of the date hereof as becoming effective within 12 months after the date hereof, foregoing representations and for which any non-compliance with same could be reasonably likely hereby consents to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsuch reliance.

Cybersecurity; Data Protection. Each RSG Party The Issuer and its subsidiaries’ the subsidiaries of the Issuer’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Issuer and its the subsidiaries of the Issuer as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Issuer and its the subsidiaries of the Issuer have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other personliability, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Issuer and its the subsidiaries of the Issuer are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, modification. Any certificate signed by any officer of the “Data Security Obligations”). Each RSG Party Issuer or any of the subsidiaries of the Issuer and its subsidiaries have taken all necessary actions as would reasonably be expected delivered to prepare the Representatives or to comply counsel for the Underwriters in connection with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as offering of the date hereof Securities shall be deemed a representation and warranty by the Issuer to each Underwriter as becoming effective within 12 months after to the matters set forth therein on the date of such certificate and, unless subsequently amended or supplemented, at each Representation Date subsequent thereto. The Issuer acknowledges that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 5 hereof, counsel for the Issuer and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None the Underwriters will rely upon the accuracy and truthfulness of the RSG Parties has foregoing representations and hereby consents to their knowledge received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsuch reliance.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiariesControlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Controlled Entities as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except for those that would not result in a Material Adverse Effect. Each RSG Party The Company and its subsidiaries Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and except as disclosed in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other personthird party, nor any material incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectivelymodification. In addition, any certificate signed by any executive officer of the “Data Security Obligations”). Each RSG Party Company and its subsidiaries have taken all necessary actions as would reasonably be expected delivered to prepare to comply the Borrower and the Underwriter or counsel for the Borrower and the Underwriter in connection with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as offering of the date hereof Securities shall be deemed to be a representation and warranty by the Company, as becoming effective within 12 months after the date hereofto matters covered thereby, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None each of the RSG Parties has to their knowledge received any notification of or complaint regarding Borrower and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationUnderwriter.

Cybersecurity; Data Protection. Each RSG Party The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the privacy, confidentiality, integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and, except as disclosed in the Registration Statement, Pricing Disclosure Package and the Prospectus, there have been no breaches, violations, outages or unauthorized uses or processing of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices. The Company and its subsidiaries have materially complied, and are presently in material compliance with with, all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies policies, and contractual obligations obligations, each relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation misappropriation, modification or modification other processing (collectively, the each a “Data Security ObligationsProtection Requirement”). Each RSG Party The Company and its subsidiaries have, to the extent required by applicable Data Protection Requirements, provided adequate notice to and obtained any necessary consents from data subjects for any past and present collection, use, disclosure, or other processing of Personal Data by or for the Company and its subsidiaries and none of such disclosures have taken all necessary actions been inaccurate, misleading or in violation of any applicable Data Protection Requirements. Except as disclosed in the Registration Statement, Pricing Disclosure Package and the Prospectus, neither the Company nor any subsidiary: (i) has received written notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to prepare result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to comply with the European Union General any Data Protection Regulation Requirement; or (and all other applicable laws and regulations with respect iii) is a party to Personal Data any order, decree, or agreement that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which imposes any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge received obligation or liability by any notification of governmental or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with regulatory authority under any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. (i) Each RSG Party of the Company and its subsidiariesSubsidiaries has complied with all applicable laws concerning cybersecurity, data security and protection, confidentiality and archive administration (collectively, the “Data Protection Laws”) in all material respects; (ii) neither the Company nor any of its Subsidiaries has been informed by any relevant authority that the Company or any of its Subsidiaries has been identified as a “critical information infrastructure operator” under the cybersecurity laws of the PRC; (iii) neither the Company nor any of its Subsidiaries is subject to any investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the Cyberspace Administration of China (the “CAC”), the China Securities Regulatory Commission (the “CSRC”), or any other relevant governmental authority; (iv) neither the Company nor any of its Subsidiaries has received any notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice), letter, complaint or allegation from the relevant cybersecurity, data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance by it of the applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (v) neither the Company nor any of its Subsidiaries has received any claim for compensation or any other claim from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (vi) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (vii) neither the Company nor any of its Subsidiaries has received any communication, enquiry, notice, warning or sanctions with respect to the cybersecurity law of the PRC or from the CAC or pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (viii) the Company is not aware of any pending or threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors; (ix) the Company is not aware of any pending or threatened actions, suits, claims, demands, investigations, judgments, awards and proceedings on the Company or any of its Subsidiaries or any of their respective directors pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (x) neither the Company nor any of its Subsidiaries has received any objection to the offering of the ADSs or the transactions contemplated under this Agreement from the CSRC, the CAC or any other relevant governmental authority, except as would not, in each case under clauses (i) to (x) above, individually or in the aggregate, have a Material Adverse Change; and (xi) The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of each RSG Party the Company and its subsidiaries Subsidiaries as currently conducted, and to the RSG Parties’ knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Each RSG Party The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the ADSs, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, without material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same. Each RSG Party The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityGovernmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security Obligations”)modification. Each RSG Party The Company and its subsidiaries Subsidiaries have taken all necessary actions as would reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a material liability) as soon they take effect. None of the RSG Parties has to their knowledge not received any notification of or complaint regarding and is are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation Obligations, and to their knowledge there is have been no action, suit or proceeding by or before any court or governmental government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.