Company: HURA
Filing Date: 2025-05-23
Form Type: 424B3
Source: 0001193125-25-125499
Chunk: 241

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-23
Form: 424B3
Chunk 241
---
 lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations
of the EU GDPR. Relatedly, following the United Kingdom’s withdrawal from the EU (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as
the “UK GDPR”). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to
the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR, the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar
compliance and operational costs with potential fines of up to the greater of £17.5 million or 4% of global turnover.

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and
Kineta may be required to put in place additional mechanisms ensuring compliance with the new data protection rules. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are
constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”), which took effect on
January 1, 2020, became enforceable by the California Attorney General on July 1, 2020, and has been dubbed the first “GDPR-like” law in the United States. The CCPA gives California residents expanded rights to access and delete
their personal information, opt out of certain personal information sharing and receive detailed information about how their

148

personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-outof certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy Rights Act (the “CPRA”) recently passed in California. The CPRA will impose additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher