Company: GOLD
Filing Date: 2025-02-10
Form Type: 10-Q
Source: 0000950170-25-016909
Chunk: 23

Company: Gold.com, Inc.
Filing Date: 2025-02-10
Form: 10-Q
Item: Item 4
Chunk 23
---
 other adverse business impacts.

Applicable Data Privacy Obligations are imposed in several international jurisdictions in which we operate. For example, in 2016, the European Union ("EU") adopted the General Data Protection Regulation (“GDPR”), effective May 2018. The United Kingdom (“UK”) adopted similar privacy regulations, effective in 2021 (the “UK GDPR”). Because we offer goods and services in the EU and UK, we are likely subject to the GDPR and UK GDPR, which impose a strict data protection compliance regime with severe penalties. We may also be subject to many other foreign privacy laws that are modeled at least in part after the GDPR, including, but not limited to, China’s Personal Information Protection Law (PIPL), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and territorial Canadian privacy laws, and the Privacy Acts of Australia and New Zealand.

Our Direct-to-Consumer business currently has limited international operations which would subject it to these foreign privacy laws. Our Wholesale Sales & Ancillary Services segment maintains an office in Vienna, Austria that provides marketing support services for its international customers. We have evaluated foreign privacy laws and regulations and their requirements, and believe we are currently in compliance in all material respects. Going forward, however, the expansion of our international operations could require us to change our business practices and may increase the costs and complexity of compliance. Also, a violation by the Company of applicable foreign laws and regulations could expose us to penalties and sanctions.

94

Additionally, several states in the United States have enacted consumer privacy laws and, in some instances, promulgated additional regulations and rules. These currently include California, Colorado, Connecticut, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia. These state consumer privacy laws impose significant obligations on businesses within scope: including providing and responding to certain data privacy rights (such as the right to delete, access, correct data or opt out of data sale, sharing, or targeted advertising); data mapping, minimization, and transparency; providing disclosures concerning the processing of Personal Data (such as through privacy policies); preparing risk assessments for certain processing; vendor and service provider management; and other compliance activities. Failure to comply with state consumer privacy law obligations may result in public investigations, significant fines and penalties, disgorgement of data, reputational harm, and other ramifications. Additionally, Nevada law requires operators of websites and online services to post a notice on their websites regarding their privacy practices. Several other states have passed similar consumer privacy