Company: KYIV
Filing Date: 2025-09-05
Form Type: F-1
Source: 0001213900-25-085122
Chunk: 78

Company: Kyivstar Group Ltd.
Filing Date: 2025-09-05
Form: F-1
Chunk 78
---
 change our business practices in a manner adverse to our business or conflict with other laws to which we are subject, thereby exposing us to regulatory risk. The stringent cross -bordertransfer rules in certain jurisdictions may also prohibit us from disclosing data to foreign authorities upon their request, which may generate a scenario where it is not possible for us to comply with both laws. If so, in addition to the possibility of fines, this could result in an order requiring that we change our data practices, which could have an adverse effect on our business and results of operations. Failure to comply with applicable data protection laws could result in penalties for noncompliance. Since we are subject to the supervision of relevant data protection authorities under multiple legal regimes (including under both the EU GDPR and the UK GDPR), we could be fined under those regimes independently in respect of the same breach. In addition to fines, a breach of applicable data protection laws may result in regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions). Furthermore, the laws and regulations regarding data privacy may become more stringent over time. Any failure or perceived failure by us to comply with privacy or security laws, policies, legal obligations or industry standards may result in governmental enforcement actions and investigations, blockage or limitation of our services, fines and penalties. In general, mobile operators are directly liable for actions of third parties to whom they forward personal data for processing. If the third parties we work with violate applicable laws, contractual obligations or suffer a security breach, such violations may also put us in breach of our obligations under privacy laws and regulations and/or could in turn harm our business. In addition, concerns regarding our practices with regard to the collection, use, disclosure or security of personal data or other privacy -relatedmatters could result in negative publicity and have an adverse effect on our reputation. Violation of these data protection laws and regulations may lead to a seizure of our database and equipment, imposition of administrative sanctions (including in the form of fines, suspension of activities or revocation of license) or result in a ban on the processing of personal data, which, in turn, could lead to the inability to provide services to our customers. The occurrence of any of the aforementioned events, individually or in the aggregate, could harm our brand, business, financial condition, results of operations, cash flows or prospects. We are, and may in the future be, involved in, associated with, or otherwise subject to