Company: MYSEW
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001013762-25-004290
Chunk: 155

Company: Myseum, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 155
---
 legal regime applicable
in the destination country, including, in particular, applicable surveillance laws and rights of individuals, and additional measures
and/or contractual provisions may need to be put in place; however, the nature of these additional measures is currently uncertain. The
CJEU also states that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in
the destination country and that the required level of protection cannot be secured by other means, such supervisory authority is under
an obligation to suspend or prohibit that transfer.

Additionally, the GDPR greatly increased the
European Commission’s jurisdictional reach of its laws and added a broad array of requirements for handling personal data. EU member
states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets
the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR,
together with national legislation, regulations and guidelines of the EU member states a governing the processing of personal data, impose
strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal
data. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal
data relates, security breach notifications and the security and confidentiality of personal data.

14

Failure to comply with the GDPR could result
in penalties for noncompliance (including possible fines of up to the greater of €20 million and 4% of our global annual turnover
for the preceding financial year for the most serious violations, as well as the right to compensation for financial or non-financial
damages claimed by individuals under Article 82 of the GDPR).

In addition to the GDPR, the European Commission
has another draft regulation in the approval process that focuses on a person’s right to conduct a private life. The proposed legislation,
known as the Regulation of Privacy and Electronic Communications (“ePrivacy Regulation”), would replace the current ePrivacy
Directive. While the text of the ePrivacy Regulation is still under development, a recent European court decision and regulators’
recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach
in recent guidance, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing
activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional
liabilities. Regulation of cookies and similar technologies may lead to broader restrictions