Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 58

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 1A
Chunk 58
---
 parties with whom we work) to provide our platform.

53

Further, we could expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In any event, an actual or perceived breach of the security of our, or the third parties with whom we work, systems or data could materially harm our business, financial condition and operating results. Security incidents and associated consequences may prevent or cause customers to stop using our platform, deter new customers from using our platform, and negatively impact our ability to grow and operate our business.

We cannot assure you that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security lapse or breach. While we maintain cybersecurity insurance, our insurance may be insufficient or may not cover all liabilities incurred by such attacks. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceeds available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results and reputation. Additionally, sensitive information of the Company could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' use of generative AI technologies.

Our business could be adversely affected if marketers or their agencies are not satisfied with our solutions or our systems and infrastructure fail to meet their needs.

We derive nearly all of our revenue from marketers and their agencies. Accordingly, our business depends on our ability to satisfy marketers