Company: CDLX
Filing Date: 2025-04-03
Form Type: ARS
Source: 0001666071-25-000048
Chunk: 51

Company: Cardlytics, Inc.
Filing Date: 2025-04-03
Form: ARS
Chunk 51
---
 jurisdictions may adopt, or have already adopted, similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and U.K. to the U.S. in compliance with law, such as the EEA standard contractual clauses and U.K.'s International Data Transfer Agreement, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for us to transfer personal data from the EEA, the U.K., or other jurisdictions to the U.S., or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and U.K. to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating GDPR's cross-border data transfer limitations. Furthermore, our business relies on the acquisition and sale of personal data, including data obtained from third-party data suppliers. The acquisition and sale of personal data from or to third parties has become subject to increased regulatory scrutiny. For example, California's Delete Act requires the CPPA to establish, by January 1, 2026, a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal information held by all registered data brokers and their service providers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. Obtaining and selling personal data from third parties carries risk to us. These challenges may make it so difficult for us and our suppliers to provide the data and the costs associated with the data materially increase or may materially decrease the availability of data that we or our