Company: FWRG
Filing Date: 2025-04-08
Form Type: ARS
Source: 0001789940-25-000033
Chunk: 36

Company: First Watch Restaurant Group, Inc.
Filing Date: 2025-04-08
Form: ARS
Chunk 36
---
 occurrence of any of these incidents could result in mitigation costs, reputational damage, adverse publicity, loss of consumer confidence, reduced sales and profits, complications in executing our growth initiatives and regulatory and legal risk, including criminal penalties or civil liabilities. As data security-related threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. We could be forced to expend significant financial and operational resources in responding to a security breach, including investigating and remediating any information security vulnerabilities, defending against and resolving legal and regulatory claims and complying with notification obligations, all of which could divert resources and the attention of our management and key personnel away from our business operations and adversely affect our business, financial condition and results of operations. In addition, our remediation efforts may not be successful and we could be unable to implement, maintain and upgrade adequate safeguards. We are continuing to expand, upgrade and develop our information technology capabilities. If we are unable to successfully upgrade or expand our technological capabilities, we may not be able to take advantage of market opportunities, manage our costs and transactional data effectively, satisfy customer requirements, execute our business plan or respond to competitive pressures. 22

We rely on a variety of marketing and advertising techniques, including email communications, affiliate partnerships, social media interactions, digital marketing, direct mailers, public relations initiatives and local community sponsorships, promotions and partnerships, and we are subject to various laws and regulations that govern such marketing and advertising practices. A variety of federal and state laws and regulations govern the collection, use, retention, sharing and security of consumer data, particularly in the context of digital marketing, which we rely upon to attract new customers. We are, and may increasingly become, subject to other various laws, directives, industry standards and regulations, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The information, security and privacy requirements imposed by governmental regulation are increasingly demanding and are subject to potentially differing interpretations. Laws and expectations relating to privacy continue to evolve, and we continue to adapt to changing needs. For example, the definition of “personal information” or “personal data” under newer privacy laws is much broader than the definition of “personally identifiable information” that appears in older privacy laws, and many jurisdictions have or will soon enact new privacy laws. Specifically, certain states in which we operate or may operate in the future have enacted or may soon enact comprehensive privacy laws that may be more