Company: CDLX
Filing Date: 2025-04-03
Form Type: ARS
Source: 0001666071-25-000048
Chunk: 26

Company: Cardlytics, Inc.
Filing Date: 2025-04-03
Form: ARS
Chunk 26
---
 and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. A security breach could result in operational or administrative disruptions, or impair our ability to meet our marketers' requirements, which could result in decreased revenue. Also, our reputation could suffer irreparable harm, causing our current and prospective marketers and FI partners to decline to use our solutions in the future. Future or past business transactions (such as acquisitions or integrations) could expose us to additional 15

cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We utilize third parties to operate critical business systems and to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our systems (such as our hardware and software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities, at all or on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Even if we have issued or otherwise made patches for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.