Company: KWIK
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001683168-25-002055
Chunk: 198

Company: KwikClick, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 198
---
 the noncompliant company, whichever is greater. We may not be entirely successful in our compliance
efforts due to various factors either within our control (such as limited internal resource allocation) or outside our control (such as
a lack of vendor cooperation, new regulatory interpretations, or lack of regulatory guidance in respect of certain GDPR requirements).

 18 

In addition, E.U. data protection laws,
including the GDPR, also generally prohibit the transfer of personal information from Europe to the United States and most other
countries unless the recipient country has been deemed to have adequate privacy protections in place to protect the personal
information. Parties transferring protected personal data to jurisdictions deemed inadequate must establish a legal basis for, and
implement specific safeguards for, such intra-party or inter-party transfers. A recent judgment of the Court of Justice of the
European Union found a common basis for such transfers, the E.U.-U.S. Privacy Shield, insufficient, and a parallel arrangement with
Switzerland may similarly be deemed insufficient. While KwikClick did not rely upon Privacy Shield for cross-border transfers,
Reverb previously had done so. While effective solutions may be available to permit these transfers, such as Standard Contractual
Clauses (“SCCs”) continuing changes to the rules related to cross-border transfers may nonetheless impede KwikClick and
Reverb’s ability to effectively transfer data between jurisdictions with parties such as partners, vendors and users, or may
make such transfers of personal data more costly. Another recent decision and related European Commission guidance and updates to
the SCCs may impose additional obligations on companies seeking to rely on the SCCs and may require significant expense and
resources associated with compliance. For example, transfers with the United Kingdom might be deemed inadequate after its departure
from the European Union and European Economic Area and require substantial expense and resources to comply with based upon adequacy
mechanisms such as SCCs. Transfers by us or our vendors of personal information from Europe pursuant to SCCs may not comply with
E.U. data protection law, may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data
transfer restrictions, and may result in lower sales on our platform because of the difficulty of establishing a lawful basis for
personal information transfers out of Europe.

Although we will endeavor to comply with our policies
and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not
be successful in achieving compliance, such as