Company: SPWH
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000950170-25-048890
Chunk: 56

Company: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1A
Chunk 56
---
 external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. 

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws(e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws).  Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA imposes obligations on covered businesses regarding their processing of personal data and provides for fines and a private right of action for certain data breaches.  Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our inability or failure to do so could result in adverse consequences, such as threats of class-action litigation alleging violations of wiretapping laws.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups, such as the PCI DSS, and we are, and may become in the future subject to such obligations. We rely on vendors to process payment card data, and those vendors are subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. 

We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. 

We publish privacy policies, marketing materials, and other statements concerning data privacy and security.  Regulators in the United States are increasingly scrutinizing these statements, and if these are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices