Company: AFRM
Filing Date: 2025-08-28
Form Type: 10-K
Source: 0001820953-25-000080
Chunk: 83

Company: Affirm Holdings, Inc.
Filing Date: 2025-08-28
Form: 10-K
Item: Item 1A
Chunk 83
---
 our profitability and could reduce income from certain business initiatives.

We publicly post policies and documentation regarding our practices concerning the processing of data. This publication of our privacy policy and other documentation that provide promises and assurances about privacy and security is required by applicable law and can subject us to proceedings and actions brought by data protection authorities, government entities, or others (including, potentially, in class action proceedings brought by individuals) if our policies are alleged to be deceptive, unfair, or misrepresentative of our actual practices. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so.

Our failure, or the failure of any third-party with whom we work, to comply with privacy and data protection laws could result in potentially significant regulatory investigations and government actions, litigation, fines, or sanctions, consumer, funding source, bank partner, or commercial partner actions, and damage to our reputation and brand, all of which could have a material adverse effect on our business. Complying with privacy and data protection laws and regulations may cause us to incur substantial operational costs or require us to change our business practices. We may not be successful in our efforts to achieve compliance either due to internal or external factors, such as resource allocation limitations or a lack of vendor cooperation. We have in the past, and may in the future, receive complaints or notifications from third parties alleging that we have violated applicable privacy and data protection laws and regulations. Non-compliance could result in proceedings against us by governmental 

50

Table of Contents

entities, consumers, data subjects, or others. We may also experience difficulty retaining or obtaining new consumers in these jurisdictions due to the legal requirements, compliance cost, potential risk exposure, and uncertainty for these entities, and we may experience significantly increased liability with respect to these consumers pursuant to the terms set forth in our engagements with them.

As we continue to expand our operations internationally, we may become subject to various foreign privacy and data protection laws and regulations, which may in some cases be more stringent than the requirements in the jurisdictions in which we currently operate. Because the interpretation and application of many privacy and data protection laws are uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our products and services. If so, in addition to the possibility of fines, lawsuits, regulatory investigations, and other claims and penalties, we could be required to change our business activities and practices or modify our products or services