Company: NAVN
Filing Date: 2025-07-28
Form Type: DRS/A
Source: 0001628279-25-000476
Chunk: 63

Company: Navan, Inc.
Filing Date: 2025-07-28
Form: DRS/A
Chunk 63
---
 to receive significant proceeds from the sale of Class A common stock in the public markets following this offering. This may lead to higher employee attrition rates. If we do not replace departing employees on a timely basis, our business and growth may be harmed.

Risks Related to Privacy, Cybersecurity, and Intellectual Property

We are subject to stringent and changing privacy and security laws, regulations, standards, policies, and contractual obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to government investigations or enforcement actions, a disruption of our services, private litigation, changes to our business practices, increased costs of operations, adverse publicity, limitations on the use or adoption of our services, and other negative effects on our results of operations and business.

Our customers and travelers store personal, business, financial, and other sensitive information on our platform. In addition, we receive, store, and otherwise process personal and business information and other data, including sensitive, proprietary, or confidential information from and about actual and prospective customers and travelers, in addition to our employees and service providers. Our handling of

<div align='center'>41</div>

such information is subject to a variety of evolving privacy and security laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission and various state, local, and foreign governments. New or proposed laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions, and guidance on implementation and compliance practices are often updated or otherwise revised, which adds to the complexity of processing personal information. Moreover, we publish privacy and security policies, representations, certifications, standards, publications, contracts, and other obligations to third parties related to privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

In the United States, numerous federal and state laws and regulations, including state personal information laws, state data breach notification laws, federal and state consumer protection laws and regulations, and other similar laws (such as wiretapping laws) govern the collection, use, disclosure, and protection of personal information. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may