Company: PTHS
Filing Date: 2025-05-27
Form Type: DEFM14C
Source: 0001140361-25-020509
Chunk: 333

Company: Pelthos Therapeutics Inc.
Filing Date: 2025-05-27
Form: DEFM14C
Chunk 333
---
. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EEA member states, which may deviate slightly from the GDPR, may result in fines of up to 4% of a company’s global revenue for the preceding financial year, or €20 million, whichever is greater. Moreover, the GDPR grants data subjects the right to claim material and non-material damages resulting from infringement of the GDPR. Given the breadth and depth of changes in data protection obligations, maintaining compliance with the GDPR will require significant time, resources and expense, and Channel may be required to put in place additional controls and processes ensuring compliance

<div align='center'>185</div>

#### TABLE OF CONTENTS
with the new data protection rules. There has been limited enforcement of the GDPR to date, particularly in biopharmaceutical development, so Channel faces uncertainty as to the exact interpretation of the new requirements on any future trials and Channel may be unsuccessful in implementing all measures required by data protection authorities or courts in interpretation of the new law. Further, the United Kingdom’s decision to leave the European Union, means that it has in force its own legislation, which is aligned with the GDPR, known as the Data Protection Act 2018. The requirements are similar except that the United Kingdom is now regarded as a “third country” for the purposes of transfers of personal data from the EEA. Transfers continue to flow freely from the UK to the EEA following an adequacy decision from the European Commission adopted on June 28, 2021 and valid for four years.

Data protection authority activity differs across the European Union, with certain authorities applying their own agenda which shows there is uncertainty in the manner in which data protection authorities will seek to enforce compliance with GDPR. For example, it is not clear if the authorities will conduct random audits of companies doing business in the European Union, or if the authorities will wait for complaints to be filed by individuals who claim their rights have been violated. Enforcement uncertainty and the costs associated with ensuring GDPR compliance are onerous and may adversely affect Channel’s business, financial condition, results of operations and prospects.

Should Channel utilize third-party distributors, compliance with such foreign governmental regulations would generally be the responsibility of such distributors, who may be independent contractors over whom Channel has limited control.

#### Recent Developments of Channel

#### Bridge Notes
On February 25, 2025, Channel issued an unsecured promissory note in the aggregate principal amount of $325,000 (the “February Bridge Note”) to