Company: WHWK
Filing Date: 2025-01-31
Form Type: DEFM14A
Source: 0001193125-25-018470
Chunk: 390

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-01-31
Form: DEFM14A
Chunk 390
---
 government regulation that may arise from future legislation or administrative action.

We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action, either in the
United States or in other jurisdictions. If we or our collaborators are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we or our collaborators are not able to maintain regulatory
compliance, our product candidates may lose any marketing approval that may have been obtained and we may not achieve or sustain profitability, which would adversely affect our business.

Additionally, the collection and use of health data in the European Union is governed by the General Data Protection Regulation (the “GDPR”), which
extends the geographical scope of European Union data protection law to non-European Union entities under certain conditions and imposes substantial obligations upon companies and new rights for individuals.
Failure to comply with the GDPR and the applicable national data protection laws of European Union member states may result in fines up to €20.0 million or up to 4% of the total worldwide annual turnover of the preceding financial year,
whichever is higher, and other administrative penalties. Additionally, the UK has implemented legislation that substantially implements the GDPR, the UK GDPR, which provides for similar obligations and provides for penalties for noncompliance of up
to the greater of £17.5 million or four percent of worldwide revenues. The GDPR and UK GDPR may increase our responsibility and liability in relation to personal data that we may process, and we may be required to put in place additional
mechanisms in an effort to comply with the GDPR and UK GDPR. This may be onerous and if our efforts to comply with the GDPR, UK GDPR or other applicable European Union laws and regulations are not successful, it could adversely affect our business
in the European Union and United Kingdom.

Finally, state and foreign laws may apply generally to the privacy and security of information we maintain, and
may differ from each other in significant ways, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which took effect on January 1, 2020, and subsequently was amended and
supplemented by the CPRA, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information
is used. In addition, the CCPA (a) allows enforcement by the California Attorney General, with fines set at $2,500