EX-99.3 4 tm2124848d1_ex99-3.htm EXHIBIT 99.3

 

Exhibit 99.3

 

August 2021 Data Protection Protocols & Compliance Tim Hortons China

 

 

Background : • On July 10, 2021, the Office of the Central Cyberspace Affairs Commission and the Office of Cybersecurity Review under the Cyberspace Administration of China (“CAC”) released a discussion draft of the amendment to the Cybersecurity Review Measures (“New Rules”). The Draft extends the scope of cybersecurity reviews to data processors engaging in data processing activitie s t hat affect or may affect national security, including listing in a foreign country. Company’s Position & Initial Response : • TH International Limited (“Tims”) and its shareholders respect the jurisdiction and authority of CAC and other regulators, an d s hare the regulators’ commitment to safeguarding personal data. • To that end, Tims has determined that, prior to its listing on Nasdaq, it will transfer control and possession of personal da ta of Tims’ guests to a new company (“NewCo”) formed locally in China. NewCo will: - be jointly owned by a Chinese citizen resident in China; - have minimal overlap with Tims in terms of governance and management; - not be part of or owned by Tims or any listed company; - not use guest information for any purpose other than, in compliance with law and policy, supporting Tims; - be under a long - term contract with Tims, and not serve any other clients; - not be profit making (with verification authority held and exercised by Tims); and - be subject to general audit and data security verification by the relevant Chinese regulators (as would be any similarly situ ate d Chinese company). Commentary : • Tims believes that the creation and operation of NewCo addresses CAC’s valid concerns under the New Rules . Tims will advise CAC (and, as appropriate, other regulators) of the plans and operation of NewCo and fully appreciates that T ims ’ and NewCo’s operations remain subject to review by CAC and other regulators. 1 Data Protection Protocols & Compliance