Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 113

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 113
---
-U.S. Privacy Shield on which many companies had relied as an acceptable mechanism for transferring such data from the EU to the U.S. On July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards to address the points raised in the Schrems II decision. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The European Commission will continually review developments in the U.S. along with its adequacy decision. Adequacy decisions can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction. Future actions of EU data protection authorities are difficult to predict. Some customers or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships. 55

If we have to rely on third parties to carry out services for us, including processing personal data on our behalf, we are required under the GDPR to enter into contractual arrangements to help ensure that these third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation, fines and penalties or adverse publicity and could cause customers to lose trust in us, which would have an adverse impact on our reputation and business. Any contractual arrangements requiring the transfer of personal data from the EU to us in the United States will require greater scrutiny and assessments as required under Schrems II and may have an adverse impact on cross-border transfers of personal data, or increase costs of compliance. The GDPR provides an enforcement authority to impose large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. We will be subject to the GDPR when we have a