Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 41

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 41
---
 is greater, for certain violations. The application of the EU’s GDPR alongside the U.K.’s GDPR exposes us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. In addition, data subject or consumer protection organizations (which are authorized by law to represent data subjects' interests) may initiate litigation to represent their interests. There are also stringent local data protection requirements in Germany and cloud-server initiatives in France which may impact our operations in these countries. Furthermore, as our business continues to expand and evolve, the EU’s GDPR, the U.K.’s GDPR, and similar data protection regulations may apply additional obligations on us to further secure personal data, provide further rights to data subjects, and require additional reporting to regulators.

In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, applies to our operations, as does Australia’s Privacy Act 1988. We also have operations in Singapore and the UAE, which means that we may be subject to Singapore’s Personal Data Protection Act and the UAE’s Federal Data Protection Law No. 45 of 2021, respectively. In addition, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), which applies to our operations, broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU’s GDPR. India’s new privacy legislation, the Digital Personal Data Protection Act, may also apply to our operations. 

Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing AI, including the EU’s AI Act, and we expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision-making, which may complicate our use of AI, lead to regulatory fines or penalties, be incompatible with our use of AI, require us to change our business practices, retrain our AI, or prevent our use of AI. For example, the Federal Trade Commission has required other companies to turn over or disgorge valuable insights or trainings generated through the use of AI where they allege the company has violated privacy and consumer protection laws. Our use of this technology could also result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

In the ordinary course of