Company: SVV
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001883313-25-000013
Chunk: 55

Company: Savers Value Village, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 55
---
 are subject to the terms of our privacy policies and notices and may be bound by contractual requirements applicable to our collection, use, processing, security and disclosure of personal information, and may be bound by or alleged to be subject to, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. Additionally, numerous state, provincial, and federal laws, rules and regulations of the countries where we operate govern the collection, use and protection of this information. Such requirements are constantly evolving, and we expect that there will continue to be new proposed requirements relating to privacy, data protection and information security in the U.S., Canada and Australia, or changes in the interpretation of existing privacy requirements. For example, the California Consumer Privacy Act (“CCPA”, effective January 1, 2020) broadly defines personal information, imposes stringent consumer data protection requirements, gives California residents expanded privacy rights, provides for civil penalties for violations and introduces a private right of action for data breaches, and the California Privacy Rights Act (“CPRA”, effective January 1, 2023) creates additional obligations relating to personal information. Approximately seventeen U.S. states have enacted laws and regulations relating to privacy similar to California’s, seven of which went into effect between 2023-2024. An additional five states have privacy laws that went into effect in January 2025 and an additional five states have privacy laws going into effect the following year. 

25

We have significant operations in Canada and Australia, and must also comply with data privacy laws in those jurisdictions. In Canada, our collection, use, disclosure and management of personal information must comply with both federal and provincial privacy laws. The Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies in all Canadian provinces except, in certain contexts, Alberta, British Columbia and Québec, as well as to the transfer of personal information across provincial or international borders. PIPEDA imposes stringent personal information protection obligations, requires privacy breach reporting, and limits the purposes for which organizations may collect, use and disclose personal information, which includes consumer data. The Consumer Privacy Protection Act is intended to replace PIPEDA and is expected to become federal law in Canada in 2025. The provinces of Alberta, British Columbia, and Québec have enacted separate data privacy laws that are substantially similar to PIPEDA, but, among other differences, all three additionally apply to our handling of our own employees’ personal data within their respective provinces. Québec’s privacy act includes transparency and privacy impact assessment requirements and also imposes financial penalties for certain