Company: CDLX
Filing Date: 2025-04-03
Form Type: ARS
Source: 0001666071-25-000048
Chunk: 66

Company: Cardlytics, Inc.
Filing Date: 2025-04-03
Form: ARS
Chunk 66
---
 management, who participate in our disclosure controls and procedures. Every six months, management discusses cybersecurity risk and reviews our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters. Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing and testing of incident response plans. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents. 37

Our board of directors oversees our risk management strategy with respect to cybersecurity risks and threats. The board, through its audit committee, holds regular meetings quarterly to discuss issues including our cybersecurity threats, and has a dedicated agenda during such meetings that are designed to assist the audit committee to exercise its oversight function. The meetings involve presentations and reports from the Chief Information Security Officer and management, including updates on contemporary cybersecurity threats faced by us and steps we are taking to address them. ITEM 2. PROPERTIES Our principal executive offices are located in Atlanta, Georgia, where we occupy a facility of approximately 17,000 square feet. Our lease expires in January 1, 2032, and we have the option to renew for an additional five-year period. We have additional offices in New York, NY; Menlo Park, CA; Los Angeles, CA; Champaign, IL; and London, U.K. We believe that our facilities are sufficient for our current needs and that, should it be needed, additional facilities will be available to accommodate the expansion of our business. ITEM 3. LEGAL PROCEEDINGS From time to time we may become involved in legal proceedings or be subject to claims arising in the ordinary course of our business. On January 22, 2025, a putative securities class action lawsuit was filed against Cardlytics and certain of its current and former officers in the U.S. District Court for the Northern District of Georgia, captioned Froess v. Cardlytics, Inc., Case No. 1:25- cv-00279-MHC. The complaint, brought on behalf of a putative class of all persons who purchased our securities between March 14, 2024 and August 7, 2024, alleged that defendants violated Sections 10(b) and 20(a) of the Exchange Act and Rule 10b-5 promulgated thereunder. On February 13, 2025, we filed