Company: OTSA
Filing Date: 2025-06-09
Form Type: F-1
Source: 0001213900-25-052720
Chunk: 54

Company: OTSAW Ltd
Filing Date: 2025-06-09
Form: F-1
Chunk 54
---
 continue to consider the need for greater regulation aimed at restricting certain uses of personal data for targeted advertising. In the European Union, or EU, the General Data Protection Regulation, or GDPR, which came into effect on May 25, 27 2018, increased our burden of regulatory compliance and requires us to change certain of our privacy and data security practices. The GDPR implements more stringent operational requirements for processors and controllers of personal data, including, for example, requiring expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities. The GDPR further provides that EU member states may make their own additional laws and regulations in relation to certain data processing activities, which could further limit our ability to use and share personal data and could require localized changes to our operating model. Under the GDPR, fines of up to €20 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, may be assessed for non -compliance, which significantly increases our potential financial exposure in the event of non -compliance. For our daily operations, we rely on commercially available systems, software, and information technology and networks for processing, transmitting and storing confidential information, as well as to manage or support a variety of our operations, including financial transactions and maintenance of records, which may include personally identifiable information of customers, partners, employees, and prospective investees. Although we have taken steps to protect the security of the data maintained in our systems, it is possible that such security measures will not be able to prevent the systems’ improper functioning, or the improper disclosure of personally identifiable or confidential information such as in the event of non -complianceof our data privacy policy by our employees, suppliers, distributors, service providers, cyber -attacks, and similar breaches that may cause us to be in breach of relevant data privacy and cybersecurity law and regulations. Any failure or alleged failure to comply with the relevant data privacy and cybersecurity laws and regulations could interrupt our operations, damage our reputation, result in negative publicity, inhibit sales and subject us to liability claims or regulatory penalties. Concerns about our practices with regard to the collection, use, disclosure, or safekeeping of personal information or other privacy related matters, even if unfounded, could damage our reputation and adversely affect our operating results. We are subject to cybersecurity risks to our operations, information technology infrastructure