Company: EVCM
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001853145-25-000009
Chunk: 70

Company: EverCommerce Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 70
---
 use, dissemination and security practices that appear to be unfair or deceptive. The FTC has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by FTC and state Attorneys General to regulate the collection, use, storage, and disclosure of personal information, through websites or otherwise, and to regulate the presentation of website content.

Outside of the United States, many jurisdictions have laws or regulations dealing with the collection, use, sharing, or other processing of personal information, including laws in the European Economic Area (“EEA”), Canada, Middle East, Australia and South America. For example, the General Data Protection Regulation (“GDPR”), in the EEA and its equivalent in the United Kingdom (“UK”, and such equivalent, the “UK GDPR”), impose a strict data protection compliance regime (which will continue to be interpreted through guidance and decisions over the coming years. Failure to comply with these laws could result fines of up to the greater of €20 million ($22 million / £17 million) or 4% of global turnover, stop processing orders, or civil litigation.

Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA, and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. As a result, we may have to make certain operational changes and we will have