Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 90

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 90
---
 to the DPF that allows the transfer of personal data from the United Kingdom to the U.S., or UK DPF Extension, are available for companies to use to legitimize personal data transfers from the EEA and United Kingdom to the U.S. Further, a framework similar to the DPF, the Swiss-U.S. Data Privacy Framework, or Swiss-U.S. DPF, also has been established to facilitate the lawful transfer of personal data from Switzerland to the U.S. There have, however, legal challenges to the DPF, and it, the UK DPF Extension and the Swiss-U.S. DPF may be subject to legal challenges in the future from privacy advocacy groups or others . These and other developments may result in European data protection regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from the EEA, United Kingdom, and Switzerland to the United States. We may be required to take additional steps to legitimize any impacted personal data transfers and may be subject to increased costs of compliance and limitations on our vendors, contractors, consultants and us. On June 4, 2021, the European Commission published new SCCs. The CJEU’s decision, the revised SCCs, regulatory guidance and opinions and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of the EEA, United Kingdom and Switzerland. More generally, we may find it necessary or desirable to modify our data handling practices, and our practices relating to cross-border transfers of data or other data handling practices, or those of our vendors, contractors and consultants, may be challenged and our business, financial condition and operating results may be adversely impacted. We continue to monitor and review the impact of any developments relating to cross-border data transfers from the EEA, United Kingdom and Switzerland that could affect our operations.

Further, the United Kingdom has established its own domestic regime with the UK General Data Protection Regulation, or UK GDPR, and other domestic data protection laws, such as the UK Data Protection Act of 2018, which provide for penalties for noncompliance of up to the greater of £17.5 million or 4% of worldwide revenues. Although the European Commission adopted an adequacy decision for the United Kingdom in June 2021 that allows for the continued flow of personal data from the EU to the United Kingdom, this decision may be revoked or modified and will need to be renewed after four years from the date of adoption. In February 2022, the United