Company: NAVN
Filing Date: 2025-07-28
Form Type: DRS/A
Source: 0001628279-25-000476
Chunk: 68

Company: Navan, Inc.
Filing Date: 2025-07-28
Form: DRS/A
Chunk 68
---
 to target advertisements. Other browsers, such as Firefox and Safari, have already adopted similar measures. In addition, legislative proposals and present laws and regulations regulate the use of cookies and other tracking technologies, electronic communications, and marketing. For example, in the EEA and the UK, regulators are increasingly focusing on compliance with requirements related to the targeted advertising ecosystem. European regulators have issued significant fines in certain circumstances where the regulators alleged that appropriate consent was not obtained in connection with targeted advertising activities. The ePrivacy Regulation and national implementing laws are anticipated to replace the current national laws implementing the ePrivacy Directive, which may require us to make significant operational changes. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control. Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal data to deliver targeted advertising. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” software to prevent the collection of their personal data for targeted advertising purposes. As a result, we may be required to change the way we market our offerings, and any of these developments or changes could significantly impair our ability to reach new or existing customers or otherwise negatively affect our operations.

Further, our business relies significantly on our ability to accept credit or debit card payments. Such payments are subject to the Payment Card Industry, or PCI, Data Security Standard, which is a multifaceted security standard that is designed to protect credit card account data as mandated by PCI entities. We rely on vendors to handle PCI matters and to ensure PCI compliance. Despite our

<div align='center'>44</div>

compliance efforts, we may become subject to claims that we have violated the PCI Data Security Standard, or PCI-DSS, based on past, present, and future business practices. In addition, payment card networks may adopt changes to the PCI-DSS, or change their interpretations of such rules in a way that we or our processors might find it difficult or even impossible to follow, or costly to implement. If we violate the PCI-DSS or other applicable rules, we may incur fines, restrictions on our ability to accept payment cards, or suffer reputational harm, all of which could have an adverse impact on our business.