Company: SWAGW
Filing Date: 2025-04-14
Form Type: 10-K
Source: 0001213900-25-031596
Chunk: 23

Company: Stran & Company, Inc.
Filing Date: 2025-04-14
Form: 10-K
Item: Item 1
Chunk 23
---
”) General
Data Protection Regulation (“GDPR”) imposes stringent requirements for controllers and processors of personal data of persons
in the EU, including, for example, more robust disclosures to individuals and a strengthened individual data rights regime, shortened
timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories
of data, and additional obligations when we contract with third-party processors in connection with the processing of the personal data.
The GDPR also imposes strict rules on the transfer of personal data out of the EU to the United States and other third countries. In addition,
the GDPR provides that EU member states may make their own further laws and regulations limiting the processing of personal data.

The GDPR applies extraterritorially, and we may
be subject to the GDPR because of our data processing activities that involve the personal data of individuals located in the EU, such
as in connection with our EU-based students. Failure to comply with the requirements of the GDPR and the applicable national data protection
laws of the EU member states may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding
financial year, whichever is higher, and other administrative penalties. GDPR regulations may impose additional responsibility and liability
in relation to the personal data that we process, and we may be required to put in place additional mechanisms to ensure compliance with
the new data protection rules.

15

Following the withdrawal of the United Kingdom
from the EU and the expiry of the transition period, from January 1, 2021, the United Kingdom Data Protection Act 2018 (“UK GDPR”)
retains in large part the GDPR in United Kingdom national law. The UK GDPR mirrors the fines under the GDPR, e.g., we could be fined up
to the greater of €20 million/£17.5 million or 4% of global turnover under each regime.

The Controlling the Assault of Non-Solicited Pornography
And Marketing Act, as amended (the “CAN-SPAM Act”), and similar laws adopted by several states, regulate unsolicited commercial
emails, create criminal penalties for emails containing fraudulent headers, and control other abusive online marketing practices. The
law also restricts data collection and use in connection with its opt-out process requirements for senders of commercial emails. Similarly,
the U.S. Federal Trade Commission has guidelines that impose responsibilities on us with respect to communications with consumers and
impose fines and liability for failure to comply with rules with respect