Company: SMNR
Filing Date: 2025-08-13
Form Type: 424B3
Source: 0001193125-25-179226
Chunk: 530

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-08-13
Form: 424B3
Chunk 530
---
 contractual measures appears to conclude that any combination of such measures may not be sufficient to allow effective reliance on the Standard
Contractual Clauses in the context of transfers of personal data “in the clear” to recipients in countries where the power granted to public authorities to access the transferred data goes beyond that which is “necessary and
proportionate in a democratic society”—which may, following the CJEU’s conclusions in Schrems II on relevant powers of United States public authorities and commentary in draft EDPB guidance, include the United States in certain
circumstances (e.g., where Section 702 of the U.S. Foreign Intelligence Surveillance Act applies). Further, the UK Information Commissioner’s Office has provided for separate international data transfer mechanisms for restricted transfers
of data from the UK: an international data transfer agreement (the UK equivalent of the EU Standard Contractual Clauses) (“IDTA”) and an international data transfer addendum (which amends the EU Standard Contractual Clauses for purposes
of international data transfers from the UK to countries without an essentially equivalent data protection framework) (the “Addendum”). Both the IDTA and the Addendum came into force in March 2022.

If we are unable to implement a valid solution to transfer personal data from the EEA to the United States or other countries that have not been deemed to
provide an essentially equivalent level of data protection, we may face increased exposure to regulatory action, substantial fines, or injunction orders to stop processing personal data from EEA, Swiss, or UK residents. Any inability to import
personal data to the United States may also restrict our clinical trials activities in the EU; limit our ability to collaborate with contract research organizations as well as other service providers, contractors and other companies subject to EU
data privacy and security laws;

329

and require us to increase our data processing capabilities in the EU and the UK at a significant expense. Additionally, other countries outside of the EU have enacted or are considering enacting
similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business. The types of challenges we face in the EEA, Switzerland, and
the UK will likely also arise in other jurisdictions that adopt laws similar to the GDPR or regulatory frameworks of equivalent complexity.

If we fail to
comply with applicable foreign regulatory requirements, we may be subject to, among other things, fines, suspension or withdrawal of regulatory approvals, product recalls, seizure of products, operating restrictions or criminal