Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 43

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 43
---
 and laws related to data privacy and security, and our efforts to comply with such obligations and laws may not be successful. For example, certain privacy laws, such as the EU’s GDPR, the U.K.’s GDPR, and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We also publish privacy policies, marketing materials, white papers, and other statements, such as compliance with certain certifications, standards, or self-regulatory principles, concerning data privacy, security, and AI. Regulators in the U.S. are increasingly scrutinizing these statements, and if any of these policies, materials, or statements are found by our customers or regulators to be overly broad, deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

In addition, privacy advocates and industry groups have proposed, and may further propose, standards with which we are legally or contractually bound to comply. For example, we are subject to the Payment Card Industry Data Security Standard (the “PCI DSS”). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with the PCI DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and loss of revenue. We also rely on vendors to process payment card data who may also be subject to the PCI DSS, and our business may be negatively impacted if our vendors are fined or suffer other consequences as a result of noncompliance with the PCI DSS.

Our obligations related to data privacy and security (and consumers’ data privacy and security expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effect of future legal frameworks. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our IT, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business practices.

Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail, or be perceived to have failed, to do so. Moreover, despite our efforts, our personnel or