Company: KYIV
Filing Date: 2025-12-09
Form Type: F-1/A
Source: 0001213900-25-119722
Chunk: 78

Company: Kyivstar Group Ltd.
Filing Date: 2025-12-09
Form: F-1/A
Chunk 78
---
, training and audit, as well as regulating cross -bordertransfers of personal data out of the EEA and the U.K. There are also other laws that restrict cross border data transfers unless certain criteria are met and/or are developing or implementing data localization laws requiring that certain types of data be stored locally. These laws may restrict our flexibility to leverage our data and build new, or consolidate existing, technologies, databases and IT systems, limit 36 our ability to use and share personal data, cause us to incur costs (including those related to storing data in multiple jurisdictions), require us to change our business practices in a manner adverse to our business or conflict with other laws to which we are subject, thereby exposing us to regulatory risk. The stringent cross -bordertransfer rules in certain jurisdictions may also prohibit us from disclosing data to foreign authorities upon their request, which may generate a scenario where it is not possible for us to comply with both laws. If so, in addition to the possibility of fines, this could result in an order requiring that we change our data practices, which could have an adverse effect on our business and results of operations. Failure to comply with applicable data protection laws could result in penalties for noncompliance. Since we are subject to the supervision of relevant data protection authorities under multiple legal regimes (including under both the EU GDPR and the UK GDPR), we could be fined under those regimes independently in respect of the same breach. In addition to fines, a breach of applicable data protection laws may result in regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions). Furthermore, the laws and regulations regarding data privacy may become more stringent over time. Any failure or perceived failure by us to comply with privacy or security laws, policies, legal obligations or industry standards may result in governmental enforcement actions and investigations, blockage or limitation of our services, fines and penalties. In general, mobile operators are directly liable for actions of third parties to whom they forward personal data for processing. If the third parties we work with violate applicable laws, contractual obligations or suffer a security breach, such violations may also put us in breach of our obligations under privacy laws and regulations and/or could in turn harm our business. In addition, concerns regarding our practices with regard to the collection, use, disclosure or security of personal data or other privacy -relatedmatters could result in negative publicity and have an adverse effect on our reputation. Violation of these data protection