Company: OWLS
Filing Date: 2025-08-01
Form Type: DRS/A
Source: 0000950123-25-006894
Chunk: 78

Company: OBOOK HOLDINGS INC.
Filing Date: 2025-08-01
Form: DRS/A
Chunk 78
---
 our services, including without limitation their
names, addresses, social security/tax ID numbers (or foreign equivalents), government IDs, payment card numbers and expiration dates and bank account information.

A core aspect of our business, in particular with respect to our payment products services, is our reliability and security. Any real or
perceived improper use of, disclosure of, or access to such data, or any compromise of security that results in the unauthorized use, theft or destruction of such data, could harm our reputation and our ability to retain customers or attract new
customers and adversely affect our business. Managing and protecting these data will expose us to risks, including to our reputation, that will only increase as our business continues expanding, including through potential acquisitions of or
investments in other companies and technologies. While we have implemented administrative, technical and physical security measures and controls, there can be no assurance that our security measures would be adequate and not subject to data
breaches. Our products and services operate in conjunction with, and we are dependent upon, third-party providers, and it is also possible that our third-party providers may be subject to data breaches that affect our products and services or our
customers.

More specifically, under card network rules and our contracts with our card processors, if there is a breach of payment
card information that we store or that is stored by our merchants or other third parties with which we do business, we could be liable to the card network or payment card issuing banks for certain of their costs and expenses. If there is improper
disclosure of or unauthorized access to funds, digital assets, or other assets, or other sensitive data on our systems or our collaborators’ systems, we could incur significant financial losses and remediation costs and become subject to
claims, litigation, regulatory scrutiny and investigations. In addition, if our own confidential business information or sensitive customer information were improperly disclosed, our business could be adversely affected.

We are subject to numerous laws across various jurisdictions regarding the collection, use, retention, processing and transfer of data in
connection with our operations, and these laws and related regulatory regimes are evolving and may be subject to differing interpretations. Many jurisdictions have enacted laws requiring companies to notify individuals, customers or government
regulators of data security breaches involving certain

53

types of personal data and our agreements with certain business customers and our collaborators require us to notify them in the event of a security incident, and such notification may be costly
and could lead to negative publicity. Any failure, or perceived failure, for us to