Company: FWRG
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0001789940-25-000010
Chunk: 43

Company: First Watch Restaurant Group, Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 43
---
. Further, our customers and employees have a high expectation that we and our service providers will adequately protect their personal information. 

Further, the standards for systems currently used for transmission and approval of electronic payment transactions, and the technology utilized in electronic payment themselves, all of which can put electronic payment data at risk, are determined and controlled by the payment card industry, not by us. For example, we are subject to industry requirements such as the Payment Card Industry Data Security Standard, or PCI-DSS, as well as certain other industry standards. Any failure to comply with these rules and/or requirements could significantly harm our brand, reputation, business and results of operations, and in the case of PCI-DSS, could result in monetary penalties and/or the exclusion from applicable card brands. We also rely on independent service providers for payment processing, including payments made using credit and debit cards. If these independent service providers become unwilling or unable to provide these services to us or if the cost of using these providers increases, our business could be harmed. 

We rely on a variety of marketing and advertising techniques, including email communications, affiliate partnerships, social media interactions, digital marketing, direct mailers, public relations initiatives and local community sponsorships, promotions and partnerships, and we are subject to various laws and regulations that govern such marketing and advertising practices. A variety of federal and state laws and regulations govern the collection, use, retention, sharing and security of consumer data, particularly in the context of digital marketing, which we rely upon to attract new customers. We are, and may increasingly become, subject to other various laws, directives, industry standards and regulations, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The information, security and privacy requirements imposed by governmental regulation are increasingly demanding and are subject to potentially differing interpretations. Laws and expectations relating to privacy continue to evolve, and we continue to adapt to changing needs. For example, the definition of “personal information” or “personal data” under newer privacy laws is much broader than the definition of “personally identifiable information” that appears in older privacy laws, and many jurisdictions have or will soon enact new privacy laws. Specifically, certain states in which we operate or may operate in the future have enacted or may soon enact comprehensive privacy laws that may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than current federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts.