Company: SWAGW
Filing Date: 2025-01-22
Form Type: 10-K/A
Source: 0001213900-25-005516
Chunk: 35

Company: Stran & Company, Inc.
Filing Date: 2025-01-22
Form: 10-K/A
Chunk 35
---
 the CCPA, which may affect some of our customers who use our loyalty program services if they are found not to comply with the CCPA’s requirements. The Virginia Consumer Data Protection Act (“CDPA”) also establishes rights for Virginia consumers to control how companies use individuals’ personal data. The CDPA dictates how companies must protect personal data in their possession and respond to consumers exercising their rights, as prescribed by the law, regarding such personal data. The CDPA went into effect on January 1, 2023. Effective January 1, 2023, we also became subject to the California Privacy Rights Act (the “CPRA”), which expands upon the consumer data use restrictions, penalties and enforcement provisions under the California Consumer Privacy Act. Effective July 1, 2023, we also became subject to the Colorado Privacy Act and Connecticut’s An Act Concerning Personal Data Privacy and Online Monitoring, which are also comprehensive consumer privacy laws. Effective December 31, 2023, we also became subject to the Utah Consumer Privacy Act, regarding business handling of consumers’ personal data. Effective January 1, 2025, we may also become subject to the Iowa Consumer Privacy Act, a similar consumer data privacy law. Meanwhile, several other states and the federal government have considered or are considering privacy laws like the CCPA. We will continue to monitor and assess the impact of these laws, which may impose substantial penalties for violations, impose significant costs for investigations and compliance, allow private class-action litigation and carry significant potential liability for our business. 15 Outside of the U.S., data protection laws, including the EU General Data Protection Regulation (the “GDPR”), also might apply to some of our operations or business collaborators. Legal requirements in these countries relating to the collection, storage, processing and transfer of personal data/information continue to evolve. The GDPR imposes, among other things, data protection requirements that include strict obligations and restrictions on the ability to collect, analyze and transfer EU personal data/information, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances, and possible substantial fines for any violations (including possible fines for certain violations of up to the greater of 20 million Euros or 4% of total company revenue). Other governmental authorities around the world have enacted or are considering similar types of legislative and regulatory proposals concerning data protection. The interpretation and enforcement of the laws and regulations described above are uncertain and subject to change, and may require substantial costs to monitor and implement and maintain adequate compliance programs. Failure to