Company: PRMB
Filing Date: 2025-01-24
Form Type: S-1
Source: 0001193125-25-012325
Chunk: 38

Company: Primo Brands Corp
Filing Date: 2025-01-24
Form: S-1
Chunk 38
---
 will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Remote and hybrid working arrangements at our Company (and at many third-party providers) also increase cybersecurity risks
due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks.

While historically not material to our operations or business (individually or in the aggregate), we have experienced cyber-attacks and other
security incidents of varying degrees that have occurred from time to time. Further, we cannot guarantee that material incidents will not occur in the future. Any damage or significant disruption in the operation of our or our third-party
providers’ IT Systems to perform as expected, or any security breach of the IT Systems, could potentially lead to improper use of our IT Systems, unauthorized access, use, disclosure, loss, modification, or destruction of Confidential
Information, information about our customers, associates, and other individuals, defective products, production downtimes, and operational disruptions. In addition, a cyber-related attack or other system disruption could result in other negative
consequences, including damage to our reputation or competitiveness, a decrease in sales, costly and time-consuming remediation or increased protection actions, compliance and regulatory costs, fines, and penalties, litigation (including class
actions), or regulatory action. Any or all of the foregoing could materially adversely affect our business, financial condition, and results of operations. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an attack
or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

In addition, we and our third-party payment processing providers are subject to the Payment Card Industry Data Security Standard (“PCI-DSS”), issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines and standards with regard to our security
surrounding the physical administrative and technical storage, processing and transmission of individual cardholder data. By accepting debit cards for payment, we are also subject to compliance with American National Standards Institute data
encryption standards and payment network security operating guidelines. If we or our service providers are unable to comply with PCI-DSS or to meet other payment card standards, this may result in the
imposition of financial penalties, restrictions, or the allocation by the card brands of the costs of fraudulent charges to us, which could materially and adversely affect our business.

If we are unable to securely maintain our customers’, associates’, or company private or