Company: NAVN
Filing Date: 2025-10-10
Form Type: S-1/A
Source: 0001628280-25-044812
Chunk: 74

Company: Navan, Inc.
Filing Date: 2025-10-10
Form: S-1/A
Chunk 74
---
 work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (such as China, Russia, and Iran) and covered individuals (meaning individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, as a result of the rapidly evolving regulatory framework for privacy issues worldwide. As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures designed to protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, or unauthorized access. If our policies, procedures, or measures relating to privacy, data protection, information security, marketing, or customer communications fail to comply with laws, regulations, policies, legal obligations, or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties, and negative publicity, and it could cause our 49 application providers, customers, suppliers, and other partners to lose trust in us, which could harm our business, financial condition, results of operations, and prospects. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, and may become in the future, subject to such obligations. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.