Company: EVLVW
Filing Date: 2025-11-13
Form Type: 10-Q
Source: 0001805385-25-000017
Chunk: 42

Company: Evolv Technologies Holdings, Inc.
Filing Date: 2025-11-13
Form: 10-Q
Item: Part I, Item 3
Chunk 42
---
 or other unauthorized or inadvertent access to or disclosure of such information. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal data has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. Any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources.

Internationally, virtually every jurisdiction in which we operate, have customers or have prospective customers has established its own data security and privacy legal frameworks with which we, our reseller partners or our customers must comply. 

For example, in the European Union, the GDPR imposes requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual rights regime, shortened timelines for data breach notifications and restrictions on the transfer of personal data outside of the European Economic Area. Following its departure from the European Union, the United Kingdom has adopted a separate regime based on the GDPR (“UK GDPR”) that imposes similarly onerous requirements. Companies that violate the EU or UK regime can face regulatory investigations, private litigation, prohibitions on data processing, and fines. Other EU and UK data protection laws and evolving regulatory guidance restrict the ability of companies to market electronically, including through the use of cookies and similar technologies, and companies are increasingly subject to strict enforcement action including fines for noncompliance.

Certain data privacy legislation restricts the cross-border transfer of personal data and some countries introduced data localization into their laws. Specifically, the GDPR, the UK GDPR and other European and UK data protection laws generally prohibit the transfer of personal data from Europe, including the European Economic Area, United Kingdom and Switzerland, to third countries, unless the transfer is to a country deemed to provide adequate protection or the parties to the transfer have implemented specific safeguards to protect the transferred personal data. European case law and guidance have imposed additional onerous requirements in relation to data transfers, and we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue in Europe and globally. If we do not implement the relevant transfer mechanism to transfer personal data, we may violate or infringe data privacy legislation requirements, and we may be exposed to regulatory proceedings or litigation and increased exposure to fines, penalties, or commercial liabilities, as well as reputational damages.

We strive to comply with all applicable laws, policies, legal obligations relating