Company: TVRD
Filing Date: 2025-01-27
Form Type: S-4/A
Source: 0001104659-25-006050
Chunk: 514

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-01-27
Form: S-4/A
Chunk 514
---
 Switzerland to the U.S. pursuant to the Swiss Federal Act on Data Protection. Tvardi expects the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, Tvardi expects the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, to the extent Tvardi begins transferring personal data out of the EEA, it may have to make certain operational changes and will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames.

Fines for certain breaches of the GDPR are significant: up to the greater of €20.0 million or 4% of total global annual turnover. Further, following the withdrawal of the United Kingdom from the EU on January 31, 2020, pursuant to the transitional arrangements agreed between the United Kingdom and the EU, Tvardi will have to comply with the GDPR and separately the GDPR as implemented in the United Kingdom, each regime having the ability to fine up to the greater of €20 million / £17 million or 4% of global turnover. Following December 31, 2020, and the expiry of the post-Brexit transitional arrangements between the United Kingdom and EU, although it is likely that the data protection obligations of the GDPR will continue to apply to UK-related processing of personal data in substantially unvaried form and fashion, for at least the short term thereafter, the relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear.

Moreover, Tvardi uses third-party service providers and subprocessors to help operate its business and engage in processing on its behalf. If Tvardi, its service providers, partners or other relevant third-parties have experienced, or in the future experience, any security incident(s) that result in any data loss, deletion or destruction, unauthorized access to, loss of, unauthorized acquisition or disclosure of, or inadvertent exposure or disclosure of sensitive information, or compromise related to the security, confidentiality, integrity of Tvardi’s (or their) information technology, software, services, communications or data, it may result in a material adverse impact, including without limitation, regulatory investigations or enforcement actions, litigation or an inability to process data in some jurisdictions. Applicable data protection laws, privacy policies and data protection obligations may require Tvardi to notify relevant stakeholders of security breaches, including affected individuals, customers and regulators. Such disclosures