Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 527

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 527
---
 of the new EU-US Data Privacy Framework (the DPF) as released on December 13, 2022. The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. The DPF also introduced a new redress mechanism for EU citizens which addresses a key concern in the previous CJEU judgments and may mean transfers under standard contractual clauses are less likely to be challenged in future. Additionally, on September 8, 2020, the Swiss Data Protection Authority (the Federal Data Protection and Information Commissioner) concluded that the Swiss-U.S. Privacy Shield does not provide an adequate level of protection for personal data transfer from Switzerland to the U.S. pursuant to the Swiss Federal Act on Data Protection. Tvardi expects the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, Tvardi expects the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, to the extent Tvardi begins transferring personal data out of the EEA, it may have to make certain operational changes and will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames.

Fines for certain breaches of the GDPR are significant: up to the greater of €20.0 million or 4% of total global annual turnover. Further, following the withdrawal of the United Kingdom from the EU on January 31, 2020, pursuant to the transitional arrangements agreed between the United Kingdom and the EU, Tvardi will have to comply with the GDPR and separately the GDPR as implemented in the United Kingdom, each regime having the ability to fine up to the greater of €20 million / £17 million or 4% of global turnover. Following December 31, 2020, and the expiry of the post-Brexit transitional arrangements between the United Kingdom and EU, although it is likely that the data protection obligations of the GDPR will continue to apply to UK-related processing of personal data in substantially unvaried form and

<div align='center'>307</div>

TABLE OF CONTENTS

fashion, for at least the short term thereafter, the relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear.

Moreover, Tvardi uses third-party service providers