Company: EVLVW
Filing Date: 2025-05-20
Form Type: 10-Q
Source: 0001628280-25-026845
Chunk: 400

Company: Evolv Technologies Holdings, Inc.
Filing Date: 2025-05-20
Form: 10-Q
Item: Part I, Item 2
Chunk 400
---
 jurisdictions in which we operate, and may be subject to contractual obligations relating to data privacy and security in the jurisdictions in which we operate.  

For example, in the United States, there are numerous data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage, and other processing of personal data (as defined in such laws), including state data privacy laws, state data breach notification laws, and federal and state consumer protection laws. The FTC and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue or inaccurate, we may be subject to claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal data secure may constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

Our failure, or perceived failure, to comply fully with developing interpretations of AI laws and regulations or meet evolving and varied stakeholder expectations and industry standards, could harm our business, reputation, financial condition and results of operation.

38

Further, some laws may require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal data or other unauthorized or inadvertent access to or disclosure of such information. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal data has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. Any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources.

Internationally, virtually every jurisdiction in which we operate, have customers or have prospective customers has established its own data security and privacy legal frameworks with which we, our reseller partners or our customers must comply. 

For example, in the European Union, the GDPR imposes requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual