Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 69

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 69
---
 and future business practices. In addition, payment card networks may adopt changes to the PCI-DSS, or change their interpretations of such rules in a way that we or our processors might find it difficult or even impossible to follow, or costly to implement. If we violate the PCI-DSS or other applicable rules, we may incur fines, restrictions on our ability to accept payment cards, or suffer reputational harm, all of which could have an adverse impact on our business. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work have in some cases failed and may fail in the future to comply with such obligations, which could negatively impact our business operations. Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy, data protection, or information security, may result in governmental investigations and enforcement actions, litigation (including class claims), fines and penalties, or adverse publicity, and could cause our customers, travelers, suppliers, and other partners to lose trust in us, which could have an adverse effect on our reputation and business. Furthermore, there can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with applicable privacy and security laws, privacy policies, or data protection obligations related to information security or security breaches. We also cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. We expect that there will continue to be new