Company: CXDO
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001654954-25-002287
Chunk: 269

Company: Crexendo, Inc.
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1A
Chunk 269
---
0. While we believe that we are not a covered entity under the law, the effects of the CCPA potentially are significant, however, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We may also from time to time be subject to, or face assertions that we are subject to, additional obligations relating to personal data by contract or due to assertions that self-regulatory obligations or industry standards apply to our practices. Washington and Massachusetts have also introduced significant privacy bills and Congress is debating federal privacy legislation, which if passed, may restrict our business operations and require us to incur additional costs for compliance.

The European Commission also approved and adopted the General Data Protection Regulation (“GDPR”), its data protection law, which took effect in May 2018. A Data Protection Act substantially implementing the GDPR was enacted in the U.K., effective in May 2018. These data protection laws and regulations are intended to protect the privacy and security of personal data, including credit card information that is collected, processed, and transmitted in or from the relevant jurisdiction. We stopped hosting websites in GDPR-complaint countries or countries from which the bulk of business came from countries subject to GDPR. We also took steps to block those countries from accessing any other sites we host. While we do not currently provide services in countries where compliance would be required and are therefore not required to be compliant, if we did provide those services or otherwise were required to become complaint, implementation of and compliance with these laws and regulations may be more costly or take longer than we anticipate, or could otherwise adversely affect our business operations, which could negatively impact our financial position or cash flows.

Additionally, media coverage of data breaches has escalated, in part because of the increased number of enforcement actions, investigations, and lawsuits. As this focus and attention on privacy and data protection increases, we also risk exposure to potential liabilities and costs resulting from compliance with or any failure to comply with applicable legal requirements, conflicts among these legal requirements, or differences in approaches to privacy.

We face risks in our sales to certain market segments including, but not limited to, sales subject to HIPAA Regulations.

We have sold and will continue to attempt to sell to certain customer segments which may have requirements for additional privacy or security. In addition, sales may be made to customers that are subject to additional security requirements. Selling into segments with additional requirements increases potential liability, which in some instances may be unlimited. While the Company believes it meets or exceeds all requirements for sales into such segments