Company: REE
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025661
Chunk: 63

Company: REE Automotive Ltd.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 63
---
, including the storage, transmission and sharing of confidential inform ation. REE collects, stores, transmits and otherwise processes data from products, customers, employees and others as part of its business and operations, which may include personal data or confidential or proprietary information. REE also works with suppliers and strategic partners that collect, store and process such data on its behalf and in connection with its products.

REE has adopted strict information security policies and deployed advanced measures to implement the policies, including, among others, advanced encryption technologies, and continues to update systems and deploy additional measurers as REE grows. REE also considers the guidance provided by recognized frameworks established by the Israel National Cyber Directorate, ISO 27001, ISO 21434, ISO 9001, and other applicable industry standards to establish, implement, maintain and continually improve its information security management system. However, advances in technology, an increased level of sophistication and diversity of REE’s products and services, an increased level of expertise of hackers, new discoveries in the field of cryptography or others can still result in a compromise or breach of the measures that REE uses. If REE is unable to protect its systems, and hence the information stored in its systems, from unauthorized access, use, disclosure, disruption, modification or destruction, such problems or security breaches could cause a loss, give rise to REE’s liabilities to the owners of confidential information or even subject it to fines and penalties. In addition, complying with various laws and regulations could cause REE to incur substantial costs or require it to change its business practices, including its data practices, in a manner adverse to REE’s business.

In addition, REE will need to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the U. S., Europe and elsewhere. For example, the European Union adopted the General Data Protection Regulation, or GDPR, which became effective on May 25, 2018 and the State of California adopted the California Consumer Privacy Act of 2018, or CCPA, which became effective in January 2020. Both the GDPR and the CCPA impose additional obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under the GDPR) and regulations can be costly and may place restrictions REE’s business and the manner in which it interacts with its customers. Any failure to comply with applicable regulations could also result in