HERBALIFE LTD.

Current report

Our actual or perceived failure to comply with privacy, artificial intelligence (AI) and data protection laws, rules, and regulations could materially harm our business, financial condition, and operating results.

Current report

Our business requires the collection, transmission, and retention of large volumes of confidential and proprietary information, including personal information of our Members, customers, leads, vendors, and employees in various information technology systems that we maintain and in those maintained by third parties with which we interact. For example, we introduced the beta version of our Pro2col platform, which will increase the amount of information collected, transmitted and retained. Anyone who is able to circumvent our security measures or those of our third-party service providers could misappropriate such confidential or proprietary information, including that of third parties such as our Members, cause interruption in our operations, damage our information technology infrastructure, damage our reputation, or otherwise damage our business. We may need to expend significant resources to protect against security breaches or to address problems caused by such breaches, and the potential risk of security breaches may increase as we introduce new technology systems and services. Any actual security breaches could result in legal and financial exposure, including litigation and other potential liability, reduced Member usage of our systems or digital platforms and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, and operating results and our reputation as a brand, business partner, and employer. In addition, employee error or malfeasance or other errors in the storage, use, or transmission of any such information could result in disclosure to third parties. If this should occur, we could incur significant expenses addressing such problems. Since we collect and store Member, customer, and vendor information, including credit card, banking, and consumer health information, and data that may be considered biometric data under certain laws, these risks are heightened. In addition, our role as a credit card merchant may also put us at a greater risk of being targeted by hackers and requires us to comply with certain regulatory requirements. See also the risk factor titled“We depend on the integrity and reliability of our information technology infrastructure, and any related interruptions or inadequacies may have a material adverse effect on our business, financial condition, and operating results.”

Current report

In addition, the use and handling of certain types of information, including personal, health and financial information, is regulated by evolving and increasingly demanding laws, rules, and regulations, such as the Vietnam Personal Data Protection Decree, the India Digital Personal Data Protection Act, the European Union General Data Protection Regulation, the Brazil Law on General Data Protection, the California Consumer Privacy Act, or the CCPA, as amended by the California Privacy Rights Act, the European Union Payment Services Directive 2, which requires stronger customer authentication for online transactions in that region, the China Personal Information Protection Law, and state consumer health privacy laws, such as Washington’s My Health My Data Act. These laws impose continuing, and at times new, responsibilities on our operations, including, among other things, the collection, deletion, disclosure, and maintenance of personal, health and financial information of our Members and their customers and could present technological challenges and negatively impact our sales. Compliance with these laws, rules, and regulations and potential and actual conflicts amongst them in the various jurisdictions in which we operate have resulted in greater compliance burden and risk and increased costs for us. Furthermore, as we expand our use of AI, we face additional regulatory risks due to the evolving legal landscape relating to AI, with various jurisdictions, including Europe and certain U.S. states, proposing or enacting AI-related laws. For example, certain of our software applications have the ability to utilize AI and we expect our usage of AI to increase with the rollout of our Pro2col platform and the adoption of certain cloud-based software applications, which could increase this risk. As such, it remains uncertain how AI laws and regulations will impact our business, or the associated cost or risks related to compliance therewith or with respect to embedding compliance mechanisms appropriately and effectively into our operations. If we fail to comply with these privacy, data security, and AI laws, rules, and regulations, we could be subject to significant litigation, monetary damages, and regulatory enforcement actions or fines in one or more jurisdictions, which could have a material adverse effect on our operating results.

Previous report

Acquisitions can expose us to significant risks and additional costs.

Previous report

We recently completed several acquisitions and may acquire other targets in the future. Acquisitions involve a number of risks, including:

Previous report

we may not accurately assess the value, strengths, weaknesses or potential profitability of a target;

Previous report

we may not receive the anticipated benefits from the transaction because an acquired business or assets may not perform as expected, or we may not manage the new business effectively;

Previous report

we may become liable for unknown or unforeseen pre-acquisition liabilities of an acquired business, including, tax and environmental liabilities and liabilities for employment practices;

Previous report

an acquisition can impair other acquired assets such as goodwill or Member or other third-party relationships;

Previous report

an acquisition can place significant demands on management’s time, which may divert their attention from our day-to-day business operations; and

Previous report

an acquisition can involve post-transaction disputes regarding a number of matters, including a purchase price or working capital adjustment, earn-out or other contingent payments.

Previous report

Acquisitions also require that we integrate into our existing operations separate companies and stand-alone assets that historically operated independently or as part of another, larger organization. Acquisitions may require integration of differing control, finance, and administrative systems, processes and cultures, among other things.

Previous report

We may not be able to manage these risks or successfully integrate a target, or may not be able to do so in a timely, efficient, or cost-effective manner. Any inability to manage these risks, including the integration process, and to realize the anticipated benefits of an acquisition could have a material adverse effect on our business, financial condition, or operating results.