Company: PTHS
Filing Date: 2025-05-09
Form Type: PREM14C
Source: 0001140361-25-018219
Chunk: 332

Company: Pelthos Therapeutics Inc.
Filing Date: 2025-05-09
Form: PREM14C
Chunk 332
---
 processing of personal data by any company established in the EEA and to companies established outside the EEA to the extent they process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The GDPR enhances data protection obligations for data controllers of personal data, including stringent requirements relating to the consent of data subjects, expanded disclosures about how personal data is used, enhanced requirements for securing personal data, requirements to conduct privacy impact assessments for “high risk” processing, limitations on retention of personal data, mandatory data breach notification and “privacy by design” requirements, and creates direct obligations on service providers acting as processors. The GDPR also imposes strict rules on the transfer of personal data outside of the EEA to countries that do not ensure an adequate level of protection, like the United States. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EEA member states, which may deviate slightly from the GDPR, may result in fines of up to 4% of a company’s global revenue for the preceding financial year, or €20 million, whichever is greater. Moreover, the GDPR grants data subjects the right to claim material and non-material damages resulting from infringement of the GDPR. Given the breadth and depth of changes in data protection obligations, maintaining compliance with the GDPR will require significant time, resources and expense, and Channel may be required to put in place additional controls and processes ensuring compliance

<div align='center'>184</div>

#### TABLE OF CONTENTS
with the new data protection rules. There has been limited enforcement of the GDPR to date, particularly in biopharmaceutical development, so Channel faces uncertainty as to the exact interpretation of the new requirements on any future trials and Channel may be unsuccessful in implementing all measures required by data protection authorities or courts in interpretation of the new law. Further, the United Kingdom’s decision to leave the European Union, means that it has in force its own legislation, which is aligned with the GDPR, known as the Data Protection Act 2018. The requirements are similar except that the United Kingdom is now regarded as a “third country” for the purposes of transfers of personal data from the EEA. Transfers continue to flow freely from the UK to the EEA following an adequacy decision from the European Commission adopted on June 28, 2021 and valid for four years.

Data protection authority activity differs across the European Union, with certain authorities applying their own agenda which shows there is