Company: OTSA
Filing Date: 2025-03-26
Form Type: DRS/A
Source: 0001013762-25-002776
Chunk: 52

Company: OTSAW Ltd
Filing Date: 2025-03-26
Form: DRS/A
Chunk 52
---
 countries. For example, in the United States, all 50 states have now passed laws to regulate the actions that a business must take in the event of a data breach, such as prompt disclosure and notification to affected users and regulatory authorities. In addition to the data breach notification laws, some states have also enacted statutes and rules requiring businesses to reasonably protect certain types of personal information they hold or to otherwise comply with certain specified data security requirements for personal information. Additionally, the U.S. federal and state governments will likely continue to consider the need for greater regulation aimed at restricting certain uses of personal data for targeted advertising. In the European Union, or EU, the General Data Protection Regulation, or GDPR, which came into effect on May 25, 2018, increased our burden of regulatory compliance and requires us to change certain of our privacy and data security practices. The GDPR implements more stringent operational requirements for processors and controllers of personal data, including, for example, requiring expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities. The GDPR further provides that EU member states may make their own additional laws and regulations in relation to certain data processing activities, which could further limit our ability to use and share personal data and could require localized changes to our operating model. Under the GDPR, fines of up to €20 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, may be assessed for non -compliance, which significantly increases our potential financial exposure in the event of non -compliance. 27 For our daily operations, we rely on commercially available systems, software, and information technology and networks for processing, transmitting and storing confidential information, as well as to manage or support a variety of our operations, including financial transactions and maintenance of records, which may include personally identifiable information of customers, partners, employees, and prospective investees. Although we have taken steps to protect the security of the data maintained in our systems, it is possible that such security measures will not be able to prevent the systems’ improper functioning, or the improper disclosure of personally identifiable or confidential information such as in the event of non -complianceof our data privacy policy by our employees, suppliers, distributors, service providers, cyber -attacks, and similar breaches that may cause us to be in breach of relevant data privacy and cybersecurity