Company: NAVN
Filing Date: 2025-10-10
Form Type: S-1/A
Source: 0001628280-25-044812
Chunk: 76

Company: Navan, Inc.
Filing Date: 2025-10-10
Form: S-1/A
Chunk 76
---
 laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control. Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal data to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal data for targeted advertising purposes. As a result, we may be required to change the way we market our offerings, and any of these developments or changes could significantly impair our ability to reach new or existing customers or otherwise negatively affect our operations. Further, our business relies significantly on our ability to accept credit or debit card payments. Such payments are subject to the Payment Card Industry, or PCI, Data Security Standard, which is a multifaceted security standard that is designed to protect credit card account data as mandated by PCI entities. We rely on vendors to handle PCI matters and to ensure PCI compliance. Despite our 50 compliance efforts, we may become subject to claims that we have violated the PCI Data Security Standard, or PCI-DSS, based on past, present, and future business practices. In addition, payment card networks may adopt changes to the PCI-DSS, or change their interpretations of such rules in a way that we or our processors might find it difficult or even impossible to follow, or costly to implement. If we violate the PCI-DSS or other applicable rules, we may incur fines, restrictions on our ability to accept payment cards, or suffer reputational harm, all of which could have an adverse impact on our business. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and