EGAIN Corp

Previous wording

Because we recognize revenue when we have satisfied performance obligations to customers in connection with our sales contracts, most of our revenue each quarter results from recognition of deferred revenue related to agreements entered into during previous quarters. Consequently, declines in new or renewed subscription agreements and maintenance agreements that occur in one quarter will largely be felt in future quarters, both because we may be unable to generate sufficient new revenue to offset the decline and because we may be unable to adjust our operating costs and capital expenditures to align

Current wording

Because we recognize revenue when we have satisfied performance obligations to customers in connection with our sales contracts, most of our revenue each quarter results from recognition of deferred revenue related to agreements entered into during previous quarters. Consequently, declines in new or renewed subscription agreements and maintenance agreements

Previous wording

with the changes in revenue. In addition, our subscription model makes it more difficult for us to increase our revenue rapidly in any period, because revenue from new customers must be recognized over the applicable subscription term. It is difficult to forecast the expediency of the transition of our license customers to our cloud delivery model. Accordingly, we believe that period-to-period comparisons of our results of operations should not be relied upon as definitive indicators of future performance. Other factors that may cause our revenue and operating results to fluctuate include:

Current wording

that occur in one quarter will largely be felt in future quarters, both because we may be unable to generate sufficient new revenue to offset the decline and because we may be unable to adjust our operating costs and capital expenditures to align with the changes in revenue. In addition, our subscription model makes it more difficult for us to increase our revenue rapidly in any period, because revenue from new customers must be recognized over the applicable subscription term. It is difficult to forecast the expediency of the transition of our license customers to our cloud delivery model. Accordingly, we believe that period-to-period comparisons of our results of operations should not be relied upon as definitive indicators of future performance.

Previous wording

Any of these developments may adversely affect our revenue, operating results and financial condition. Furthermore, we maintain an allowance for doubtful accounts for estimated credit losses resulting from the inability of our customers to make required payments. In such cases, we may be required to defer revenue recognition on sales to affected customers. In the future, we may have to record additional reserves or write-offs, or defer revenue on sales transactions, which could negatively impact our financial results.

Current wording

Any of these developments may adversely affect our revenue, operating results and financial condition. Furthermore, we maintain a provision for credit losses resulting from the inability of our customers to make required payments. In such cases, we may be required to defer revenue recognition on sales to affected customers. In the future, we may have to record additional reserves or write-offs, or defer revenue on sales transactions, which could negatively impact our financial results.

Previous wording

Our SaaS only business model is subject to certain risks.

Current wording

Our SaaS business model is subject to certain risks.

Previous wording

Our business is highly dependent on our ability to continue to expand our SaaS business and cloud operations, including keeping pace with the market transition to SaaS solutions. While we continue to drive new SaaS sales, at the same time we are working to migrate our remaining perpetual license clients to SaaS. The expansion of our SaaS business and operations increases our reliance on our channel partners to grow our business. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors, do not effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our SaaS business and sell our SaaS solutions may be adversely affected.

Current wording

Our business is highly dependent on our ability to continue to expand our SaaS business and cloud operations, including keeping pace with the market transition to SaaS solutions. If customers choose not to renew, or reduce, their subscriptions, our operating results and financial results will suffer.

Previous wording

If we are unable to properly manage our SaaS transition, or if the transition does not progress as expected, our business may suffer.

Current wording

If we are unable to properly manage our SaaS transition, our business may suffer.

Previous wording

The long sales cycle for our products may cause license and subscription revenue and operating results to vary significantly from period to period. The sales cycle for our products can be six months or more and varies substantially from customer to customer. Because we sell complex and deeply integrated solutions, it can take many months of customer education to secure sales. Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer.

Current wording

The long sales cycle for our products may cause license and SaaS revenue and operating results to vary significantly from period to period. The sales cycle for our products can be six months or more and varies substantially from customer to customer. Because we sell complex and deeply integrated solutions, it can take many months of customer education to secure sales. Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer.

Previous wording

The market for customer engagement software is intensely competitive. Other than product innovation and existing customer relationships, there are no substantial barriers to entry in this market, and established or new entities may enter this market in the future. While software internally developed by enterprises represents indirect competition, we also compete directly with packaged application software vendors, including Genesys Telecommunications Laboratories, Inc., LivePerson, Inc., NICE Ltd., and Verint Systems Inc. In addition, we face actual or potential competition from larger software companies such as Microsoft Corporation, Oracle Corporation, salesforce.com Inc., and ServiceNow, Inc., and similar companies that may attempt to sell customer engagement software to their installed base.

Current wording

The market for customer engagement software is intensely competitive. Other than product innovation and existing customer relationships, there are no substantial barriers to entry in this market, and established or new entities may enter this market in the future. While software internally developed by enterprises represents indirect competition, we also compete directly with packaged application software vendors, including Genesys Telecommunications Laboratories, Inc., LivePerson, Inc., NICE Ltd., and Verint Systems Inc. In addition, we face actual or potential competition from larger software companies such as Microsoft Corporation, Oracle Corporation, salesforce.com, Inc., ServiceNow, Inc., and similar companies that may attempt to sell customer engagement software to their installed base.

Previous wording

We believe that competition will continue to be fierce as current competitors increase the sophistication of their offerings and as new participants enter the market. Many of our current and potential competitors have longer operating histories, larger customer bases, broader brand recognition, and significantly greater financial, marketing and other resources. With more established and better-financed competitors, these companies may be able to undertake more extensive marketing campaigns, adopt more aggressive pricing policies, and make more attractive offers to businesses to induce them to use their products or services. If we are unable to compete successfully, our business will be adversely affected.

Current wording

larger customer bases, broader brand recognition, and significantly greater financial, marketing and other resources. With more established and better-financed competitors, these companies may be able to undertake more extensive marketing campaigns, adopt more aggressive pricing policies, and make more attractive offers to businesses to induce them to use their products or services. If we are unable to compete successfully, our business will be adversely affected.

Previous wording

Our success and future growth depend in part upon the skills, experience, performance and continued service of our distribution partners, including software and hardware vendors and resellers. Our distribution partners engage with us in a number of ways, including assisting us to identify prospective customers, distributing our products and services in geographies where we do not have a physical presence and distributing our products and services where they are considered complementary to other products of the partner or third-party products distributed by the partner. We believe that our future success depends in part upon our ability to develop, maintain and expand strategic, long-term and profitable partnerships and reseller relationships. If we are unable to do so for any reason, including as a result of any change in the leadership of our distribution partners, or if any existing or future distribution partners fail to successfully market, resell, implement or support our products for their customers, or if distribution partners represent multiple providers and devote

Current wording

Our success and future growth depend in part upon the skills, experience, performance and continued service of our distribution partners, including software and hardware vendors and resellers. Our distribution partners engage with us in a number of ways, including assisting us to identify prospective customers, distributing our products and services in geographies where we do not have a physical presence and distributing our products and services where they are considered complementary to other products of the partner or third-party products distributed by the partner. We believe that our future success depends in part upon our ability to develop, maintain and expand strategic, long-term and profitable partnerships and reseller relationships. If we are unable to do so for any reason, including as a result of any change in the leadership of our distribution partners, or if any existing or future distribution partners fail to successfully market, resell, implement or support our products for their customers, or if distribution partners represent multiple providers and devote greater resources to market, resell, implement and support competing products and services, our future revenue growth could be impeded.

Previous wording

We generally recognize revenue upon the transfer of control of promised services to our customers in the amount that is commensurate with the consideration that we expect to receive in exchange for those services. If an arrangement requires significant customization or implementation services from us, recognition of the associated license or subscription and service revenue could be delayed. The timing of the commencement and completion of these services is subject to factors that may be beyond our control, as this process may require access to the customer’s facilities and coordination with the customer’s personnel after delivery of the software. In addition, customers could cancel or delay product implementations. Implementation typically involves working with sophisticated software, computing and communications systems. If we experience difficulties with implementation or do not meet project milestones in a timely manner, we could be obligated to devote more customer support, engineering and other resources to a particular project. Some customers may also require us to develop customized features or capabilities. If new or existing customers cancel or have difficulty deploying our products or require significant amounts of our professional services, support, or customized features, revenue recognition could be cancelled or further delayed and our costs could increase, causing increased variability in our operating results.

Current wording

We generally recognize revenue upon the transfer of control of promised services to our customers in the amount that is commensurate with the consideration that we expect to receive in exchange for those services. If an arrangement requires significant customization or implementation services from us, recognition of the associated subscription and service revenue could be delayed. The timing of the commencement and completion of these services is subject to factors that may be beyond our control, as this process may require access to the customer’s facilities and coordination with the customer’s personnel after delivery of the software obligations. In addition, customers could cancel or delay product implementations. Implementation typically involves working with sophisticated software, computing, and communications systems. If we experience difficulties with implementation or do not meet project milestones in a timely manner, we could be obligated to devote more customer support, engineering, and other resources to a particular project. Some customers may also require us to develop customized features or capabilities. If new or existing customers cancel or have difficulty deploying our products or require significant amounts of our professional services, support, or customized features, revenue recognition could be cancelled or further delayed and our costs could increase, causing increased variability in our operating results.

Previous wording

We derived 22% and 21% of our revenue from EMEA sales during the three and nine months ended March 31, 2024 respectively, which is consistent with the three and nine months ended March 31, 2023. In addition to those discussed elsewhere in this section, our EMEA sales operations are subject to a number of specific risks, such as:

Current wording

We derived 25% and 21% of our revenue from EMEA sales during the three months ended September 30, 2024 and 2023. In addition to those discussed elsewhere in this section, our EMEA sales operations are subject to a number of specific risks, such as:

Previous wording

As of March 31, 2024, approximately 46% of our workforce was employed in India. Of our employees in India, approximately 50% are allocated to research and development. Although the movement of certain operations internationally was principally motivated by cost cutting, the continued management of these remote operations requires significant management attention and financial resources that could adversely affect our operating performance. In addition, with the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly. As a result of the increased competition for skilled workers, we experienced increased compensation costs and expect these costs to increase in the future. Our reliance on our workforce in India makes us particularly susceptible to disruptions in the business environment in that region. In particular, sophisticated telecommunications links, high-speed data communications with other eGain offices and customers, and overall consistency and stability of our business infrastructure are vital to our day-to-day operations, and any impairment of such infrastructure will cause our financial condition and results to suffer. In addition, the maintenance of stable political relations between the United States, the European Union (EU) and India are also of great importance to our operations.

Current wording

and financial resources that could adversely affect our operating performance. In addition, with the significant increase in the numbers of foreign businesses that have established operations in India, the competition to attract and retain employees there has increased significantly. As a result of the increased competition for skilled workers, we experienced increased compensation costs and expect these costs to increase in the future. Our reliance on our workforce in India makes us particularly susceptible to disruptions in the business environment in that region. In particular, sophisticated telecommunications links, high-speed data communications with other eGain offices and customers, and overall consistency and stability of our business infrastructure are vital to our day-to-day operations, and any impairment of such infrastructure will cause our financial condition and results to suffer. In addition, the maintenance of stable political relations between the United States, the European Union (EU), and India are also of great importance to our operations.

Previous wording

Our success largely depends on the efficient and uninterrupted operation of our computer and communications hardware and network systems. We currently serve our customers from third-party data center facilities operated by third parties in the United States and other international locations. Any damage to, or failure of, our systems generally could interrupt service or impair the use or functionality of our cloud operations. In addition, as we continue to increase the number of customers and users on our cloud operations, we will need to increase the capacity of our data center infrastructure. If we do not increase our capacity in a timely manner, customers could experience interruptions or delays in access to our cloud operations. Customer data that we store in third party data centers may also be vulnerable to damage or interruption from floods, fires, earthquake, power loss, telecommunications failures and similar events. Any damage to, or failure of, our systems, or those of our third-party data centers, could result in impairment of or interruptions in our service. Impairment or interruptions in our service may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers. Our business will also be harmed if our customers and potential customers believe our cloud operations are unreliable.

Current wording

Our success largely depends on the efficient and uninterrupted operation of our computer and communications hardware and network systems. We currently serve our customers from third-party data center facilities operated by third parties in the United States and other international locations. Any damage to, or failure of, our systems generally could interrupt service or impair the use or functionality of our cloud operations. In addition, as we continue to increase the number of customers and users on our cloud operations, we will need to increase the capacity of our data center infrastructure. If we do not increase our capacity in a timely manner, customers could experience interruptions or delays in access to our cloud operations. Customer data that we store in third party data centers may also be vulnerable to damage or interruption from floods, fires, earthquake, power loss, telecommunications failures and similar events. Any damage to, or failure of, our systems, or those of our third-party data centers, could result in impairment of, or interruptions in, our service. Impairment or interruptions in our service may reduce our revenue, cause us to issue credits, pay penalties, or cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers. Our business will also be harmed if our customers and potential customers believe our cloud operations are unreliable.

Previous wording

We maintain a business continuity plan for our customers in the event of an outage. We maintain other co-locations for the purpose of disaster recovery as well as maintaining backups of our customer’s information. We provide premium disaster recovery and standard disaster recovery to our customers. If a customer opts not to pay for premium disaster recovery, we will only assure that their data is available within 72 hours. This delay could cause severe disruptions to our customers’

Current wording

We maintain a business continuity plan for our customers in the event of an outage. We maintain other co-locations for the purpose of disaster recovery as well as maintaining backups of our customer’s information. We provide premium disaster recovery and standard disaster recovery to our customers. If a customer opts not to pay for premium disaster recovery, we will only assure that their data is available within 72 hours. This delay could cause severe disruptions to our customers’ customers and may result in customer termination of our solutions. Our premium disaster recovery service provides for an alternative data center and a return to operations within one business day.

Previous wording

If we are unable to increase the profitability of subscription revenue, if we experience significant customer attrition, or if we are required to delay recognition of revenue, our operating results could be adversely affected.

Current wording

If we are unable to increase the profitability of SaaS revenue, if we experience significant customer attrition, or if we are required to delay recognition of revenue, our operating results could be adversely affected.

Previous wording

Furthermore, our business model is premised on business assumptions that are still evolving. Our business model assumes that both customers and companies will increasingly elect to communicate through multiple channels, as well as demand integration of the online channels into the traditional telephone-based call center. If any of these assumptions is incorrect or if customers and companies do not adopt digital technology in a timely manner, our business will be seriously harmed and our stock price will decline.

Current wording

Furthermore, our business model is premised on business assumptions that are still evolving. Our business model assumes that both customers and companies will increasingly elect to communicate through multiple channels, as well as demand integration of the online channels into the traditional telephone-based call center. If any of these assumptions is incorrect

Previous wording

We employ third-party technologies for use in or with our platform and the inability to license such technologies on commercially reasonable terms or the inability to maintain these licenses or errors in the software we license could result in increased costs, or reduced service levels, which could adversely affect our business.

Current wording

We employ third-party technologies for use in or with our platform andthe inability to license such technologieson commercially reasonable terms or the inability tomaintain these licenses or errors in the software we license could result in increased costs, or reduced service levels, which could adversely affect our business.

Previous wording

to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace such software. In addition, integration of the software used in our platform with new third-party software may require significant work and require substantial investment of our time and resources. Also, to the extent that our platform depends upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our platform, delay new feature introductions, result in a failure of our functionality, and injure our reputation. Our use of additional or alternative third-party software would require us to enter into license agreements with third parties. To the extent we need to license third-party technologies, we may be unable to do so on commercially reasonable terms or at all.

Current wording

Our platform incorporates certain third-party software obtained under licenses from other companies, and we use third-party software development tools as we continue to develop and enhance our platform. We anticipate that we will continue to rely on such third-party software in the future. Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace such software. In addition, integration of the software used in our platform with new third-party software may require significant work and require substantial investment of our time and resources. Also, to the extent that our platform depends upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our platform, delay new feature introductions, result in a failure of our functionality, and injure our reputation. Our use of additional or alternative third-party software would require us to enter into license agreements with third parties. To the extent we need to license third-party technologies, we may be unable to do so on commercially reasonable terms or at all.

Previous wording

Third-party licenses may expose us to increased risks, including risks associated with the integration of new technology, the diversion of resources from the development of our own proprietary technology, and our inability to generate revenue from new technology sufficient to offset associated acquisition and maintenance costs. In the event that we are not able to maintain our licenses to third-party software, or cannot obtain licenses to new software as needed, or in the event third-party software used in conjunction with our platform contains errors or defects, our business, operating results, and financial condition may be adversely affected.

Current wording

Third-party licenses may expose us to increased risks, including risks associated with the integration of new technology, the diversion of resources from the development of our own proprietary technology, and our inability to generate revenue from new technology sufficient to offset associated acquisition and maintenance costs. In the event that we are not able to maintain our licenses to third-party software, or cannot obtain licenses to new software as needed, or in the event third-

Previous wording

Our reserves may be insufficient to cover receivables we are unable to collect.

Current wording

Our provision may be insufficient to cover accounts receivable we are unable to collect.

Previous wording

We assume a certain level of credit risk with our customers in order to do business. Conditions affecting any of our customers could cause them to become unable or unwilling to pay us in a timely manner, or at all, for products or services we have already provided them. In the past, we have experienced collection delays from certain customers, and we cannot predict whether we will continue to experience similar or more severe delays in the future. Although we have established reserves to cover losses due to delays or inability to pay, there can be no assurance that such reserves will be sufficient to cover our losses. If losses due to delays or inability to pay are greater than our reserves, it could harm our business, operating results and financial condition.

Current wording

We assume a certain level of credit risk with our customers in order to do business. Conditions affecting any of our customers could cause them to become unable or unwilling to pay us in a timely manner, or at all, for products or services we have already provided them. In the past, we have experienced collection delays from certain customers, and we cannot predict whether we will continue to experience similar or more severe delays in the future. Although we have established provision to cover losses due to delays or inability to pay, there can be no assurance that such reserves will be sufficient to cover our losses. If losses due to delays or inability to pay are greater than our reserves, it could harm our business, operating results and financial condition.

Previous wording

Our technology platforms enable representatives of our customers as well as individual service providers to communicate with consumers and other persons seeking information or advice on the Internet. The law relating to the liability of online platform providers such as us for the activities of users of their online platforms is often challenged in the U.S. and internationally. We may be unable to prevent users of our technology platforms from providing negligent, unlawful or inappropriate advice, information or content through our technology platforms, or from behaving in an unlawful manner, and we may be subject to allegations of civil or criminal liability for negligent, fraudulent, unlawful or inappropriate activities carried out by users of our technology platforms.

Current wording

platform providers such as us for the activities of users of their online platforms is often challenged in the U.S. and internationally. We may be unable to prevent users of our technology platforms from providing negligent, unlawful or inappropriate advice, information or content through our technology platforms, or from behaving in an unlawful manner, and we may be subject to allegations of civil or criminal liability for negligent, fraudulent, unlawful or inappropriate activities carried out by users of our technology platforms.

Previous wording

Security incidents have become more prevalent across industries and may occur on our systems. Our service involves the storage and transmission of customers’ proprietary information, and security incidents could expose us to a risk of loss of this information, loss of access, litigation and possible liability. The techniques used to effect unauthorized penetration of computer systems are constantly evolving and have been increasing in sophistication. While we have security measures in place that are designed to protect customer information and prevent data loss and other security breaches, these security measures may be breached as a result of third-party action, including intentional misconduct by computer hackers (which may involve nation states and individuals sponsored by them), employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our customers’ data or our data, including our intellectual property and other confidential business information, or our IT systems. Additionally, third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as usernames, passwords or other information in order to gain access to our customers’ data or our data or IT systems.

Current wording

Security incidents have become more prevalent across industries and the methods and techniques used by threat actors continue to evolve at a rapid pace. These cyberattacks may occur on our systems and we may be unable to identify current attacks, anticipate these attacks or implement adequate security measures. Our service involves the storage and transmission of customers’ proprietary information, and security incidents could expose us to a risk of loss of this information, loss of access, litigation and possible liability. The techniques used to effect unauthorized penetration of computer systems are constantly evolving and have been increasing in sophistication. While we have security measures in place that are designed to protect customer information and prevent data loss and other security breaches, these security measures may be breached as a result of third-party action, including intentional misconduct by computer hackers (which may involve nation states and individuals sponsored by them), employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our customers’ data or our data, including our intellectual property and other confidential business information, or our IT systems. Additionally, third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our customers’ data or our data or IT systems.

Previous wording

Employees or contractors have introduced vulnerabilities in, and enabled the exploitation of, our IT environments in the past and may do so in the future. These cybersecurity attacks threaten to misappropriate our proprietary information, cause interruptions of our IT services and commit fraud. Because the techniques used to obtain unauthorized access, or to sabotage systems, change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. Further, if unauthorized access or sabotage remains undetected for an extended period of time, the effects of such breach could be exacerbated.

Current wording

Employees or contractors have introduced vulnerabilities in, and enabled the exploitation of, our IT environments in the past and may do so in the future. These cybersecurity attacks threaten to misappropriate our proprietary information, cause interruptions of our IT services and commit fraud. Because the techniques used to obtain unauthorized access, or to sabotage systems, change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. Further, if unauthorized access or sabotage remains undetected for an extended period of time, the effects of such breach could be exacerbated. In addition, our ability to defend against and mitigate cyberattacks depends in part on prioritization decisions that we and third parties upon whom we rely make to address vulnerabilities and security defects. While we endeavor to address all identified vulnerabilities in our products, we must make determinations as to how we prioritize developing and deploying the respective fixes, and we may be unable to do so prior to an attack.

Previous wording

Our platform involves the storage and transmission of our customers’ information, which may include their business and financial data. As a result, unauthorized access to customer data or security breaches could result in the loss, or unauthorized dissemination, of such data, which could seriously harm our or our customers’ businesses and reputations. Any of these security incidents could negatively affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions, result in reputational damage or subject us to third-party lawsuits, regulatory fines, or other action or liability, which could adversely affect our operating results. Any insurance coverage we may have related to security and privacy damages may not be adequate for liabilities actually incurred and we cannot be certain that insurance will continue to be available to us on economically reasonable terms, or at all. These risks are likely to increase as we continue to grow the scale and functionality of our platform and process, store, and transmit increasingly large amounts of our customers’ information and data, which may include proprietary or confidential data or personal or identifying information.

Current wording

Our platform involves the storage and transmission of our customers’ information, which may including their business and financial data. As a result, unauthorized access to customer data or security breaches could result in the loss, or unauthorized dissemination, of such data, which could seriously harm our or our customers’ businesses and reputations. Any of these security incidents could negatively affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions, result in reputational damage or subject us to third-party lawsuits, regulatory fines, or other action or liability, which could adversely affect our operating results. Any insurance coverage we may have related to security and privacy damages may not be adequate for liabilities actually incurred and we cannot be certain that insurance will continue to be available to us on economically reasonable terms, or at all. These risks are likely to increase as we continue to grow the scale and functionality of our platform and process, store, and transmit increasingly large amounts of our customers’ information and data, which may include proprietary or confidential data or personal or identifying information.

Previous wording

We have in the past relied on adherence to the U.S. Department of Commerce’s Safe Harbor Privacy Principles, the U.S.- EU and U.S.-Swiss Safe Harbor Frameworks, and their successors, the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, as agreed to and set forth by the U.S. Department of Commerce, and the EU and Switzerland, which established a means for legitimating the transfer of personally identifiable information (PII) by U.S. companies doing business in Europe from the European Economic Area (EEA) and Switzerland to the U.S. However, as a result of the October 6, 2015 EU Court of Justice (ECJ), opinion in Case C-362/14 (Schrems v. Data Protection Commissioner) regarding the adequacy of the U.S.-EU Safe Harbor Framework, and the July 16, 2020 ECJ judgment in Case C-311/18 (Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems) regarding the adequacy of the Privacy Shield Framework, both frameworks are no longer deemed to constitute a valid method of compliance with restrictions set forth in European law regarding the transfer of data outside of the EEA. We are therefore required to rely on alternative mechanisms permitted under European law, such as consent and approved standard contractual clauses. The standard contractual clauses approved by the European Commission for these purposes have recently been replaced and a significant repapering exercise is therefore required. The UK is also currently consulting on its own updated version of the standard contractual clauses and the result of this may be that different standard contractual clauses are needed depending on the origin of the PII.

Current wording

We have in the past relied on adherence to the U.S. Department of Commerce’s Safe Harbor Privacy Principles, the U.S.- EU and U.S.-Swiss Safe Harbor Frameworks, and their successors, the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, as agreed to and set forth by the U.S. Department of Commerce, and the EU and Switzerland, which established a means for legitimating the transfer of personally identifiable information (PII) by U.S. companies doing business in Europe from the European Economic Area (EEA) and Switzerland to the U.S. However, as a result of the October 6, 2015 EU Court of Justice (ECJ), opinion in Case C-362/14 (Schrems v. Data Protection Commissioner) regarding the adequacy of the U.S.-EU Safe Harbor Framework, and the July 16, 2020 ECJ judgment in Case C-311/18 (Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems) regarding the adequacy of the Privacy Shield Framework, both frameworks are no longer deemed to constitute a valid method of compliance with restrictions set forth in European law regarding the transfer of data outside of the EEA. The EJC also noted that standard contractual clauses (approved by the European Commission as an adequate personal data transfer mechanism) may not necessarily be relied upon in all circumstances. In addition to other mechanisms, in limited circumstances we may rely on Privacy Shield certifications of third parties (for example, vendors and partners). The European Commission and the United Kingdom’s Information Commissioner’s Office have published new standard contractual clauses that are required to be implemented. Following issuance of a U.S. Executive Order, a new framework, the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) was created as a successor to the Privacy Shield. Following an adequacy decision issued by the European Commission on July 10, 2023, the DPF, along with a UK extension to the EU-U.S. DPF that allows the transfer of personal data from the UK to the U.S. (the “UK DPF Extension”), is available for companies as a lawful transfer mechanism for personal data transfers to the U.S. from the EEA and UK. The Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) also has been established, but has not yet been granted an adequacy decision by the Swiss Federal Data Protection and Information Commissioner. We have self-certified to the EU-U.S. DPF, the UK DPF Extension, and the Swiss-U.S. DPF. The EU-U.S. DPF already has been the subject of legal challenge, however, and more generally, these frameworks may be subject to legal challenges from privacy advocacy groups or others. Additionally, the European Commission's adequacy decision regarding the DPF provides that the DPF will be subject to future reviews and may be subject to suspension,

Previous wording

While we have sought to implement appropriate transfer mechanisms following the invalidation of the Safe Harbor and Privacy Shield frameworks, owing to the significant changes that are ongoing in this area, we may be unsuccessful in establishing legitimate means of transferring data from the EEA or UK to the U.S. Moreover, further challenges may be raised against the transfer mechanisms that we have adopted which may require future adaptation. We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our services due to the potential risk exposure to such customers as a result of the international legal developments. We and our customers are at risk of enforcement actions taken by an EU or UK data protection authority until such point in time that we ensure that all data transfers to us from the EEA and UK are legitimized. We may find it necessary to establish systems to maintain EU/UK-origin data in the EEA or UK, which may involve substantial expense and distraction from other aspects of our business.

Current wording

We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our services due to the potential risk exposure to such customers as a result of the international legal developments. We and our customers are at risk of enforcement actions taken by an EU or UK data protection authority until such point in time that we ensure that all data transfers to us from the EEA and UK are legitimized. We may find it necessary to establish systems to maintain EU/UK-origin data in the EEA or UK, which may involve substantial expense and distraction from other aspects of our business.

Previous wording

Further to the above, regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU’s e-Privacy Directive (which is set to be replaced by a new EU e-Privacy Regulation which will have a “direct effect” in each EU Member State), and the country-specific regulations that implement that directive. These and other requirements could reduce demand for our solutions or restrict our ability to store and process data or, in some cases, impact our ability to offer our services and solutions in certain locations.

Current wording

Further to the above, regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU’s e-Privacy Directive (which is set to be replaced by a new EU e-Privacy Regulation which will have a “direct effect” in each EU Member State), and the country-specific regulations that implement that directive. These and other requirements could reduce demand for our solutions or restrict our ability to store and process data or, in some cases, impact our ability to offer our services and solutions in certain locations. Although we have implemented contracts, diligence programs, policies and procedures designed to address compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, partners, suppliers, data providers or agents will not violate such laws and regulations or our contracts, policies and procedures. Additionally, public perception and standards related to the privacy of personal information can shift rapidly, in ways that may affect our reputation or influence regulators to enact regulations and laws that may limit our ability to provide certain products and services. For example, numerous jurisdictions, including the EU, are considering laws and regulations that would impose additional data privacy and other compliance requirements on the use of AI and could require us to adjust or limit our product offerings in such jurisdictions.

Previous wording

In the U.S., California enacted the California Consumer Privacy Act (CCPA) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. On November 3, 2020, California passed the California Privacy Rights Act (CPRA), which became effective on January 1, 2023 and amends and expands the CCPA, including the introduction of sensitive personal information as a new regulated dataset in California that is subject to new disclosure and purpose limitation requirements. Additionally, the Virginia Consumer Data Protection Act (VCDPA) became effective on January 1, 2023, the Colorado Privacy Act and the Connecticut Data Privacy Act both become effective on July 1, 2023, and the Utah Consumer Privacy Act will become effective on December 31, 2023. Furthermore, New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which became effective March 2020 and requires companies with data relating to New Yorkers to adopt comprehensive cybersecurity programs. Aspects of the CCPA, CPRA and other laws remain unclear and we may be required to modify our practices further in an effort to comply with them. These statutes may increase our compliance costs and potential liability. Furthermore, on August 11, 2023, India’s Digital Personal Data Protection Bill (DPDP) received presidential assent after passing both houses of India’s legislature but there has been no official slated implementation date. DPDP applies to personal data processed within India and personal data outside the territory of India if such processing is in connection with any activity related to offering of goods or services to data subjects. We will continue to monitor developments related to new privacy laws which will require us to incur additional costs and expenses in an effort to monitor and comply with such laws.

Current wording

In the U.S., California enacted the California Consumer Privacy Act (CCPA) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. On November 3, 2020, California passed the California Privacy Rights Act (CPRA), which became effective on January 1, 2023 and amends and expands the CCPA, including the introduction of sensitive personal information as a new regulated dataset in California that is subject to new disclosure and purpose limitation requirements. Additionally, by July 2024, additional states had enacted numerous comprehensive state data privacy laws, requiring businesses to evaluate each law individually for specific compliance requirements and consumer rights, including the following:

Previous wording

Our directors and executive officers, together with their affiliates and members of their immediate families, beneficially owned, in the aggregate, approximately 33% of our outstanding capital stock as of March 31, 2024, of which our Chief Executive Officer, Ashutosh Roy, beneficially owned approximately 29% as of such date. As a result of these concentrated holdings, Mr. Roy individually or together with this group has the ability to exercise significant control over most matters requiring our stockholders’ approval, including the election and removal of directors and the approval of significant corporate transactions, such as a merger or sale of our company or its assets.

Current wording

Our directors and executive officers, together with their affiliates and members of their immediate families, beneficially owned, in the aggregate, approximately 35% of our outstanding capital stock as of September 30, 2024, of which our Chief Executive Officer, Ashutosh Roy, beneficially owned approximately 32% as of such date. As a result of these concentrated holdings, Mr. Roy individually or together with this group has the ability to exercise significant control over most matters requiring our stockholders’ approval, including the election and removal of directors and the approval of significant corporate transactions, such as a merger or sale of our company or its assets.