Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 112

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 112
---
 payment methods such as Apple Pay and gift cards, and we may offer new payment options in the future. The use of these payment options subjects us to rules, regulations, contractual obligations, and compliance requirements, including payment network rules 

25

and operating guidelines, data security standards and certification requirements, and rules governing electronic funds transfers. These requirements and related interpretations may change over time, which has made and could continue to make compliance more difficult or costly. In connection with credit or debit card transactions, we collect and transmit confidential information, including payment information, to card processors. The systems currently used for transmission and approval of electronic payment transactions, and the technology utilized in electronic payments themselves, all of which can put electronic payment at risk, are determined and controlled by the payment card industry, not by us, through enforcement of compliance with the Payment Card Industry - Data Security Standards (as modified from time to time, “PCI DSS”). We must abide by the PCI DSS in order to accept electronic payment transactions. If we fail to abide by the PCI DSS, we could be subject to fines, penalties, or litigation, which could adversely affect our results of operations. Furthermore, the payment card industry requires vendors to be compatible with smart chip technology for payment cards (“EMV-Compliant”), or else bear full responsibility for certain fraud losses, referred to as the EMV Liability Shift. To become EMV-Compliant, merchants often utilize EMV-Compliant payment card terminals at the point-of-sale and obtain a variety of certifications. We may become subject to claims for purportedly fraudulent transactions arising out of the actual or alleged theft, whether physical or electronic, of credit, debit, or gift card information, and we may also be subject to lawsuits or other proceedings relating to these types of incidents.

Our business is subject to complex and evolving laws and regulations regarding privacy, data protection, and cybersecurity.

There are numerous U.S. federal, state, local, and international laws and regulations regarding privacy, data protection, and cybersecurity that govern the Processing of personal information and other information. The scope of these laws and regulations is expanding and evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules. We are also subject to the terms of our privacy policies and obligations to third parties related to privacy, data protection, and cybersecurity.

For example, the California Consumer Privacy Act of 2018 (“CCPA”) took effect on January 1, 2020, which broadly defines personal information, gives California residents expanded privacy rights