Our business generates and processes a large quantity of personal, transaction, and behavior data. We face risks inherent in handling large volumes of data and in protecting the security of such data. In particular, we face a number of challenges relating to data from transactions and other activities on our system, including: ? protecting the data in and hosted on our system, including against attacks on our system by third parties or fraudulent behavior by our employees; ? addressing concerns related to privacy and sharing, safety, security and other factors; and ? complying with applicable laws, rules and regulations relating to the collection, use, disclosure or security of personal information, including any requests from regulatory and government authorities relating to such data. Any systems failure or security breach or lapse that results in the release of customer data could harm our reputation and brand and, consequently, our business, in addition to exposing us to potential legal liability. Furthermore, our business partners and their employees may improperly use or disclose the data we disclose to them for our operation and we have limited control over the actions of our business partners and their employees. Any failure, or perceived failure, by us, our employees, our business partners, or their employees to comply with privacy policies or with any regulatory requirements or privacy protection-related laws, rules and regulations could result in proceedings or actions against us by governmental entities or others. These proceedings or actions may subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs and severely disrupt our business. Recently, companies’ practices regarding collection, use, retention, transfer, disclosure and security of user data have been the subject of enhanced regulations and increased public scrutiny. For example, historically, we have been named by regulatory authorities among other apps for not expressly obtaining all authorizations from users, for which we have taken measures, including adjustments to our user privacy terms, to address the issue. The regulatory frameworks regarding privacy issues in many jurisdictions are constantly evolving and can be subject to significant changes from time to time. In China, the PRC Cybersecurity Law, which became effective in June 2017, provides that personal information and important data collected and generated by operators of critical information infrastructure in the course of their operations in the PRC should be stored in the PRC. The PRC government is increasingly focused on data security, recently launching cybersecurity review against a number of mobile apps operated by several U.S.-listed Chinese companies and prohibiting these apps from registering new users during the review period. In addition, regulators in China may implement measures to ensure that encryption of users’ data does not hinder law enforcement agencies’ access to that data. For example, according to the PRC Cybersecurity Law and relevant regulations, network operators, are obligated to provide assistance and support in accordance with the law for public security and national security authorities to protect national security or assist with criminal investigations. Compliance with these laws and requirements in manners that are perceived as harming privacy could lead to significant damage to our reputation and proceedings and actions against us by regulators and private parties. On March 12, 2021, the CAC, the MIIT, the Ministry of Public Security and the SAMR jointly promulgated the Provisions on the Scope of Necessary Personal Information Required for Common Types of Mobile Internet Applications, which became effective on May 1, 2021, clarifying the scope of necessary information required for certain common mobile apps and stating that mobile apps operators may not deny users’ access to basic functions and services when the users opt out of the collection of unnecessary personal information. The CAC has since named a number of mobile apps in its regulatory announcement for failure to comply with privacy and data security regulations, and ordered these apps to rectify their data collection and use practices. On June 10, 2021, the Standing Committee of the National People’s Congress of China promulgated the Data Security Law which took effect on September 1, 2021, and on August 20, 2021, the Standing Committee of the National People’s Congress of China promulgated the Personal Information Protection Law which took effect on November 1, 2021. The Data Security Law provides for data security and privacy obligations of entities and individuals carrying out data activities, prohibits entities and individuals in China from providing any foreign judicial or law enforcement authority with any data stored in China without approval from competent PRC authority, and sets forth the legal liabilities of entities and individuals found to be in violation of their data protection obligations, including rectification order, warning, fines of up to RMB10 million, suspension of relevant business, and revocation of business permits or licenses. See “Item 4. Information on the Company—4.B. Business Overview—Regulation—Regulation on Internet Privacy.” The Personal Information Protection Law took effect on November 1, 2021, integrates the various rules with respect to personal information rights and privacy protection and applies to the processing of personal information within mainland China as well as certain personal information processing activities outside mainland China, including those for the provision of products and services to natural persons within China or for the analysis and assessment of acts of natural persons within China. Numerous regulations, guidelines and other measures have been or are expected to be adopted under the umbrella of, or in addition to, the Cybersecurity Law and Data Security Law. For example, Regulations on the Security Protection of Critical Information Infrastructure, or the CII Protection Regulations, became effective on September 1, 2021. According to the CII Protection Regulations, critical information infrastructure, or the CII, refers to any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, which may endanger national security, people’s livelihood and public interest in the case of damage, function loss or data leakage. Regulators supervising specific industries are required to formulate detailed guidance to identifies CII in the respective sectors, and a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the CII’s security by performing certain prescribed obligations. For example, CIIOs are required to conduct network security test and risk assessment, report the assessment results to relevant regulatory authorities, and timely rectify the issues identified at least once a year. As of the date of this annual report, we have not been identified as a CIIO by the relevant regulatory authority. Additionally, in December 2021, the CAC and several other administrations jointly promulgated the amended Cybersecurity Review Measures, or the Cybersecurity Review Measures, which took effect on February 15, 2022. Pursuant to the Cybersecurity Review Measures, where the relevant activity affects or may affect national security, a CIIO that purchases network products and services, or an internet platform operator that conducts data process activities, shall be subject to the cybersecurity review. The Cybersecurity Review Measures also expands the cybersecurity review requirement to cover “internet platform operators” in possession of personal information of over one million users if such operators intend to list their securities in a foreign country. See “—Risks Relating to Doing Business in China—The approval, filing or other requirements of the CSRC, the CAC or other PRC government authorities may be required under PRC law in connection with our offshore securities offering, and, if required, we cannot predict whether or for how long we will be able to obtain such approval.” Additionally, relevant governmental authorities in the PRC may initiate cybersecurity review if they determine an internet platform operator’s network products or services or data processing activities affect or may affect national security. Furthermore, on November 14, 2021, Measures on Network Data Security Management (Draft for Comment), or the Draft Measures on Network Data, was proposed by the CAC for public comments until December 13, 2021. The Draft Measures on Network Data requires data processors to apply for cybersecurity review in accordance with the relevant laws and regulations for carrying out activities including but not limited to: (i) a merger, reorganization, or division to be conducted by an internet platform operator who has amassed a substantial amount of data resources that concern national security, economic development or the public interest, which will or may impact national security; (ii) an overseas initial public offering to be conducted by a data processor processing the personal information of more than one million individuals; (iii) an overseas initial public offering in Hong Kong to be conducted by a data processor, which will or may impact national security; and (iv) other data processing activities that will or may have an impact national security. Any failure to comply with such requirements may subject us to, among others, suspension of services, fines, revoking relevant business permits or business licenses and penalties on responsible persons. The Draft Measures on Network Data was released for public comment only, there remains substantial uncertainty, including but not limited to its final content, adoption timeline, effective date or relevant implementation rules. Since these laws and regulations in China are relatively new, uncertainties still exist in relation to their interpretation and implementation. Any change in laws and regulations relating to privacy, data protection and information security and any enhanced governmental enforcement action of such laws and regulations could greatly increase our cost in providing our products and services, limit their use or adoption or require certain changes to be made to our operations. If we fail to comply with these new laws and regulations described above, we may be ordered to rectify and terminate any actions that are deemed illegal by the government authorities and become subject to fines and other government sanctions, which may materially and adversely affect our business, financial condition, and results of operations. Complying with these obligations under the PRC Cybersecurity Law, the PRC National Security Law, the Data Security Law, the Personal Information Protection Law, the Cybersecurity Review Measures, the Measures on Network Data Security Management, as well as additional laws and regulations that PRC regulatory bodies may enact in the future, including data security and personal information protection laws could cause us to incur substantial costs and subject us to negative publicity, which could harm our reputation among users and negatively affect the trading prices of our ADSs and/or other securities. There are also uncertainties with respect to how the PRC Cybersecurity Law, the PRC National Security Law, the Personal Information Protection Law, the Data Security Law, the Cybersecurity Review Measures and the Measures on Network Data Security Management will be implemented and interpreted. In practice, PRC regulators, including the Department of Public Security, the MIIT, the SAMR and the CAC, have been increasingly focused on regulation in the areas of data security and data protection, including for mobile apps, and are enhancing the protection of privacy and data security by rulemaking and enforcement actions at central and local levels. We expect that these areas will receive greater and continued attention and scrutiny from regulators and the public going forward, which could increase our compliance costs and subject us to heightened risks and challenges associated with data security and protection. Any failure to comply with applicable regulations, whether by us, business partners, or other third parties, or as a result of employee error or negligence or otherwise, could result in regulatory enforcement actions, including fines, suspension of business, prohibition against new user registration (even for a short period of time) and revocation of required licenses, against us and have an adverse impact on our business operations and our reputation.