We collect basic user information that is necessary to provide the corresponding services, such as phone number and location. Therefore, to comply with the laws and regulations, including the cybersecurity requirements of CAC and other authorities, and to ensure systematic cybersecurity, data and privacy protection, we periodically update our privacy policies, security policies and technologies, including encryption technology, firewall policies, virtual private cloud and host-based intrusion detection systems. As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the CAC. Nonetheless, we still face inherent risks in managing and safeguarding personal data, with our website, Viomi mobile app, e-commerce platform, IoT@Home platform and information systems being potential targets for various cyber threats, such as viruses, malware or phishing attacks. Given the development of techniques used to sabotage or obtain unauthorized access to systems and the fact that these techniques generally are not recognized until they are launched against a target, we may not be able to anticipate or implement effective preventative measures against these evolving threats. Furthermore, the growing sophistication and diversity of our products and services, along with the increasing expertise of hackers and advancements in cryptography, may lead to compromises or breaches of our website, app, platforms or information systems.
In particular, we face a number of challenges relating to data from transactions and other activities on our platform, including:
- protecting the data in and hosted on our system, including against attacks on our system by outside parties or fraudulent behavior or improper use by our employees; and - addressing concerns related to privacy and sharing, safety, security and other factors; and complying with applicable laws, rules and regulations relating to the collection, use, storage, transfer, disclosure and security of personal information, which are subject to change and new interpretations, including any changes in regulatory requirements and interpretation as well as requests from regulatory and government authorities relating to such data.
Regulatory authorities in China have enhanced regulatory requirements related to data security, personal information protection and cybersecurity, many of which are subject to change and uncertain interpretation. These laws continue to develop, and the PRC government may adopt further rules, restrictions and clarifications in the future. See "Item 4. Information on the Company-B. Business Overview-Regulations-Regulations on Information Security and Privacy Protection." We expect that compliance with data security, personal information protection and cybersecurity will receive greater attention and focus from regulators, both domestically and globally, as well as continued or greater public scrutiny and attention going forward. This trend would increase our compliance costs, result in our adjustments to business practices, and subject us to heightened risks and compliance challenges associated with these matters. We may be required to adopt stricter measures for protecting and managing the data and information we possess, and we may be required to complete cybersecurity review or take other specific actions. However, we face uncertainties as to whether we can complete these additional procedures in a timely manner, or at all. These uncertainties may subject us to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the application stores, which could materially and adversely affect our business and results of operations. In addition, pursuant to our business cooperation agreement with Xiaomi, we share with Xiaomi all the user data collected in relation to the respective Xiaomi-branded products. Any leak or abuse of user data by Xiaomi may cause our users to lose trust in us and could expose us to legal claims. If our security measures are compromised because of third-party actions, employee errors, malfeasance, any violation of laws and regulations by our business partners pertaining to personal information protection and data security, or any failure in full compliance with the agreements with us, it could result in the theft or misuse of user data. If we are unable to manage these risks, or if we are accused of failing to comply with such laws and regulations timely, or at all, we could become subject to government enforcement actions, investigations, disputes and litigation, negative publicity, penalties, such as fines, suspension of business, websites, or applications, and revocation of required licenses, or even criminal liabilities, and our reputation and results of operations could be materially and adversely affected.
Further, as we spread our footprints in overseas markets, we may also be subject to laws and regulations of other countries regarding cybersecurity, information security, privacy and data protection. For example, there are a number of legislative proposals in the European Union, the United States and other jurisdictions that could impose new obligations affecting our business. Additionally, a growing number of legislative and regulatory bodies have implemented consumer notification requirements in the event of unauthorized data access. These breach notification laws are evolving and may vary across jurisdictions, posing potential challenges, especially with our international expansion plans.