DOMO INC

Previous wording

We incurred net losses of $24.4 million and $26.0 million for the three months ended April 30, 2023 and 2024, respectively, and had an accumulated deficit of $1,431.6 million at April 30, 2024. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Current wording

We incurred net losses of $40.5 million and $45.5 million for the six months ended July 31, 2023 and 2024, respectively, and had an accumulated deficit of $1,451.1 million at July 31, 2024. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Previous wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,431.6 million as of April 30, 2024. We have also experienced negative or close to breakeven cash flows from operating activities, including cash provided by operating activities of $0.8 million and $1.9 million for the three months ended April 30, 2023 and 2024, respectively. As of April 30, 2024, we had $61.2 million of cash, cash equivalents, and restricted cash which were held for working capital purposes, of which $3.7 million was restricted cash. Additionally, no amounts were available to draw under our credit facility.

Current wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,451.1 million as of July 31, 2024. We have also experienced negative or close to breakeven cash flows from operating activities, including cash provided by operating activities of $1.5 million and cash used in operating activities of $4.3 million for the six months ended July 31, 2023 and 2024, respectively. As of July 31, 2024, we had $55.7 million of cash, cash equivalents, and restricted cash which were held for working capital purposes, of which $3.7 million was restricted cash. Additionally, no amounts were available to draw under our credit facility.

Previous wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. However, recently proposed tax legislation, if enacted, would restore the ability to deduct currently domestic research and development expenditures through 2025 and would retroactively restore this benefit for 2022 and 2023. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.

Current wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.

Previous wording

In general, under Section 382 of the Internal Revenue Code of 1986, as amended, (the Code), a corporation that undergoes an "ownership change" (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset its future taxable income. An ownership change under Section 382 of the Code could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. We have historically contracted third parties to perform a Section 382 analysis to evaluate limitations on our NOLs due to ownership changes, with the most recent analysis being through January 31, 2023. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities for federal and state tax purposes. For these reasons, we may not be able to utilize a material portion of our NOLs, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Current wording

In general, under Section 382 of the Internal Revenue Code of 1986, as amended, (the Code), a corporation that undergoes an "ownership change" (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset its future taxable income. An ownership change under Section 382 of the Code could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. We have historically contracted third parties to perform a Section 382 analysis to evaluate limitations on our NOLs due to ownership changes, with the most recent analysis being through January 31, 2023. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities for federal and state tax purposes. Limitations may also apply under state law. For example, recently enacted California legislation limits the use of state NOL carryforwards for tax years beginning on or after January 1, 2024 and before January 1, 2027. As a result of this legislation or other unforeseen reasons, we may not be able to utilize some or all of our NOL carryforwards, even if we attain profitability.

Previous wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 79%, and 80% of our total revenue for the three months ended April 30, 2023 and 2024, respectively, was derived from sales within the United States. We have begun to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Current wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 79% and 80% of our total revenue for the six months ended July 31, 2023 and 2024, respectively, was derived from sales within the United States. We have begun to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Previous wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in the November 3, 2020 election. The CPRA amends and expands the CCPA in numerous respects, including by expanding the CCPA’s private right of action. The CPRA created additional obligations relating to consumer data beginning on January 1, 2022, and became effective January 1, 2023. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that becomes effective in 2024, Delaware, Iowa, New Jersey, Nebraska, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana has adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and information security, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and information security on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Current wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in the November 3, 2020 election. The CPRA amends and expands the CCPA in numerous respects, including by expanding the CCPA’s private right of action. The CPRA created additional obligations relating to consumer data beginning on January 1, 2022, and became effective January 1, 2023. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that has or will become effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and information security, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and information security on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Previous wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, the People’s Republic of China (the PRC), India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Current wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Previous wording

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds in September 2020. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), which would permit transfers of personal data from the E.U. to the U.S., by participating entities. The European Commission adopted an adequacy decision with respect to the DPF in July 2023, allowing for the DPF to be implemented and available for companies to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the DPF. Each of these frameworks may be subject to legal challenge. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, and the United Kingdom to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland and the United Kingdom to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, and the United Kingdom to the U.S. We and our customers may face a risk of enforcement actions by data protection authorities in the E.U. and other jurisdictions relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds in September 2020. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), which would permit transfers of personal data from the E.U. to the U.S., by participating entities. The European Commission adopted an adequacy decision with respect to the DPF in July 2023, allowing for the DPF to be implemented and available for companies to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, and the United Kingdom to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland and the United Kingdom to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, and the United Kingdom to the U.S. We and our customers may face a risk of enforcement actions by data protection authorities in the E.U. and other jurisdictions relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial co…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and information security, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the PRC was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Current wording

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and information security, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of China (PRC) was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Previous wording

Although we generally enter into confidentiality and invention assignment agreements with our employees and consultants that have access to material confidential information and enter into confidentiality agreements with our customers and the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our platform and propriety information or prevent reverse engineering. Further, these agreements may not prevent competitors from independently developing technologies that are substantially equivalent or superior to our platform, and we may be unable to prevent this competition.

Current wording

Although we generally enter into confidentiality and invention assignment agreements with our employees and consultants that have access to material confidential information and enter into confidentiality agreements with our customers and the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our platform and propriety information or prevent reverse engineering. Further, these agreements may not prevent competitors from independently developing technologies that are substantially equivalent or superior to our platform, and we may be unable to prevent this competition. In addition, from time to time, we have engaged consultants and developers located outside of the United States to assist with the development of our technology and intellectual property. Each jurisdiction has different rules regarding the language and procedures required to effectively assign to us certain intellectual property rights, and we may not have effectively implemented such language and procedures in each jurisdiction on every occasion, which may also limit our ability to perfect and protect our technology and intellectual property rights.