Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 64

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 64
---
 we may be subject to investigation, enforcement actions by regulators or other adverse consequences. In the United States, numerous federal and state laws and regulations, including state personal information laws, state data breach notification laws, federal and state consumer protection laws and regulations, and other similar laws (such as wiretapping laws) govern the collection, use, disclosure, and protection of personal information. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, in California, the California Consumer Privacy Act, or the CCPA, requires, among other things, that covered businesses provide disclosures to California residents and afford residents abilities to opt-out of certain sales of personal information, and gives California residents the ability to limit use of certain sensitive information. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. These laws demonstrate the evolving regulatory environment related to personal information and make it difficult to predict the impact of such laws on our business or operations. Such complexities have required and may continue to require us to modify our data-processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. In addition, several foreign countries and governmental bodies, including the EU, and the UK, have laws and regulations governing the handling and processing of personal information, which are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, security, transfer, and other processing of various types of data, including data that identifies or may be used to identify an individual. Our current and prospective service offerings subject us to the European Union General Data Protection Regulation 2016/679, or the EU GDPR, the United Kingdom (UK) Data Protection Act of 2018 that effectively implemented