Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 205

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 205
---
 For example, legal developments in the EEA and the U.K. have created complexity and uncertainty regarding processing and transfers of personal data from the EEA and the U.K. to the United States and other so- called third countries outside the EEA and the U.K. that have not been determined by the relevant data protection authorities to provide an adequate level of protection for privacy rights. Ongoing legal challenges and changes in adequacy decisions, such as the EU-U.S. Data Privacy Framework, may further restrict our ability to transfer personal data internationally, potentially disrupting our operations. In many cases, these laws and regulations apply not only to third-party transactions, but also to transfers of information among our entities. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, cybersecurity and information security, it is possible that our interpretations of the law, practices or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations, or obligations. Our failure, or the failure by our third-party partners, vendors, service providers, or customers, to comply with applicable laws or regulations or any other obligations 158 relating to privacy, data protection, cybersecurity, or information security, or any compromise of security that results in unauthorized access to, or use, modification, release, or other unauthorized processing of personal information or other data relating to customers, their employees, other personnel and / or other individuals, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation and brand, discourage new and existing customers from using our platform, or result in fines, investigations, or proceedings by governmental agencies, and private claims and litigation, any of which could adversely affect our business, financial condition, and results of operations. Furthermore, we and our third-party partners, vendors and service providers with whom we work are subject to a variety of evolving cybersecurity threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar