Company: NAVN
Filing Date: 2025-09-19
Form Type: S-1
Source: 0001628280-25-042130
Chunk: 204

Company: Navan, Inc.
Filing Date: 2025-09-19
Form: S-1
Chunk 204
---
 subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission (which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and cybersecurity). Numerous U.S. states have enacted comprehensive consumer privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording consumers with certain rights concerning their personal information. Certain states also impose stricter requirements for processing certain personal information, including sensitive personal information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA applies to personal information of consumers, business representatives, employees, and others who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Moreover, all U.S. states have enacted state data breach notification laws requiring businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Furthermore, as we accept and store debit and credit cards for payment, we are subject to the PCI- DSS, issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing, and transmission of cardholder data. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could also disrupt or reduce the efficiency of our operations. We contract with third-party service providers, including shared cloud computing services, to store or process data (including personal information) on our behalf in compliance with applicable laws, regulations, rules and standards. To that end, we strive to enter into data processing agreements with all our third-party providers to clearly define the services being provided and the nature of the engagement, for example the protection and ownership of the data being processed by the service provider. We also maintain processes to ensure that all our third-party providers comply with our data processing agreements, as applicable. However, we may at times fail to do so and cannot ensure that our data processing agreements will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy or cybersecurity. Furthermore, the evolving regulatory framework complicates data transfers across borders.