Commerce.com, Inc. 10-Q

Item 1A. Risk Factors. Except as set forth below, as of the date of this report, there are no material changes to our risk factors as previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2021. Evolving global laws, regulations and standards on privacy and data security, restrictions on cross-border data transfers, and data localization requirements may limit the use and adoption of our services, expose us to liability, or otherwise adversely affect our business. Federal, state, or foreign governmental bodies or agencies have in the past adopted, and may in the future adopt, laws and regulations affecting the use of the internet as a commercial medium. These laws and regulations could impact taxation, internet neutrality, tariffs, content, copyrights, liability for content, distribution, electronic contracts and other communications, consumer protection, online advertising, and the characteristics and quality of services. Legislators and regulators may make legal and regulatory changes, or apply existing laws, in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices. These laws and regulations and resulting increased costs could materially harm our business, results of operations, and financial condition. Laws and regulations governing data privacy are constantly evolving. Many of these laws and regulations, including the European Union’s General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”) and the California Consumer Privacy Act (the “CCPA”), contain detailed requirements regarding collecting and processing personal information, restrict the use and storage of such information, and govern the need for consumer consent. The California Privacy Rights Act (the “CPRA”) amended the CCPA and created additional obligations relating to consumer data beginning on January 1, 2022 with enforcement expected to begin in 2023. Like California, Virginia and Colorado have also enacted new privacy regulations set to come into effect in 2023. Similar laws have been proposed in other states, at the federal level, and in other countries, reflecting a global trend toward more stringent privacy. These laws and regulations could restrict our ability to store and process personal data (in particular, our ability to use certain data for purposes such as risk or fraud avoidance, marketing or advertising), to control our costs by using certain vendors or service providers, and to offer certain services in certain jurisdictions. Such laws and regulations could also restrict our customers’ ability to run their businesses; for example, by limiting their ability to effectively market to interested shoppers. This could reduce our revenue and the general demand for our services. Such laws and regulations may be subject to amendment or re-interpretation, which may cause us to incur significant costs and expend significant effort to ensure compliance. For example, in 2020, the Court of Justice of the European Union (CJEU) invalidated the U.S.-EU Privacy Shield as a basis for transfers of personal data from the EU to the U.S. and introduced requirements to carry out risk assessments in relation to use of other, alternative data transfer mechanisms such as the standard contractual clauses (“SSCs”) for personal data transfers. The European Commission has published revised standard contractual clauses for data transfers from the European Economic Area (“EEA”): the revised clauses must be used for relevant new data transfers from September 27, 2021. Existing standard contractual clauses must be migrated to the revised clauses by December 27, 2022. On March 25, 2022, the European Union and United States announced that they had reached an agreement in principle on a new Trans-Atlantic Data Privacy Framework, which will be translated into legal documents to be adopted in the European Union and United States to provide a renewed basis for transatlantic data transfers. However, if a new transatlantic data transfer framework is not adopted we may be unable to continue to rely on SCCs or rely upon other alternative means of data transfers from the European Union to the United States. Similarly, the UK’s Information Commissioner’s Office launched a public consultation on its draft revised data transfers mechanisms in August 2021. Implementing updated data transfer documentation, whether in the EEA or UK, adds complexity that may hinder or delay the contracting process with our customers and vendors. This may increase regulatory and compliance burdens and lead to uncertainty about or interruptions of personal data transfers from Europe to the United States (and beyond). Use of common data transfer mechanisms now involves additional compliance steps and in the event any court blocks personal data transfers to or from a particular jurisdiction on the basis that certain or all such transfer mechanisms are not legally adequate. This could give rise to operational interruption in the performance of services for customers and internal processing of employee information, greater costs to implement alternative data transfer mechanisms that are still permitted, regulatory liabilities, or reputational harm. In 2022, Austrian and the French data protection supervisory authorities ruled that, under 39 Table of Contents certain circumstances, use of Google Analytics by European website operators unlawfully transferred personal data to the United States; other EU supervisory authorities may reach similar conclusions. Similarly, in July 2022, the Irish Data Protection Commission (IDPC) was reported to have shared with other European regulators a draft decision that Facebook’s transfers of European Facebook user data from the European Union to the United States should be suspended. Facebook relies on the SCCs for international data transfers and a decision against Facebook could more broadly revoke or curtail the use of the SCCs as a valid transfer mechanism. We rely on the SSCs for many international data transfers and this may impact our platform, services and business tools we use and adversely impact us to the extent such decisions are perceived as more broadly applicable to transfers of personal data from Europe to the United States. Our response to these requirements globally may not meet the expectations of individual customers, their shoppers, or other stakeholders, which could reduce the demand for our services. Some customers or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships. Our current operations are international in scope, and we plan further geographic expansion. This will create a variety of operational challenges. We are subject to risks from geopolitical crises, such as the Russian invasion of Ukraine. A component of our growth strategy involves the further expansion of our operations and customer base internationally. In the case of the two most recent fiscal years, approximately 20 percent of our revenue has been generated from customers outside the United States. We currently have locations in the United States, Australia, the United Kingdom (“UK”), Singapore, and Ukraine. We are continuing to adapt and develop strategies to address international markets, but such efforts may not be successful. In addition, the COVID-19 pandemic and related stay-at-home, business closure, and other restrictive orders and travel restrictions in the US, EMEA, Australia and Asia, may pose additional challenges for international expansion and may impact our ability to launch new locations and further expand geographically. We have a significant number of employees outside of the United States. We expect that our international activities will continue to grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets. This will require significant management attention and financial resources. We may face difficulties, including: geopolitical crises, such as the Russian invasion of Ukraine, costs associated with developing software and providing support in many languages, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles and difficulties in collecting accounts receivable, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights, a geographically and culturally diverse workforce and customer base, and travel restrictions associated with the COVID-19 pandemic. Failure to overcome any of these difficulties could negatively affect our results of operations. Our current international operations and future initiatives involve a variety of risks, including: • geopolitical crises, such as the Russian invasion of Ukraine and other escalating global tensions that could lead to disruption, instability and volatility in global markets and industries; • changes in a country’s or region’s political or economic conditions; • the need to adapt and localize our platform for specific countries; • greater difficulty collecting accounts receivable and longer payment cycles; • potential changes in trade relations arising from policy initiatives critical of existing and proposed trade agreements; • unexpected changes in laws, regulatory requirements, taxes, or trade laws; • more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, increasingly common around the globe; • differing labor regulations, especially in Europe, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations; • challenges inherent in efficiently managing an increased number of employees over large geographic distances (including in a work-from-home environment), including the need to implement appropriate systems, policies, benefits, and compliance programs; • difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems, and regulatory systems; 40 Table of Contents • increased travel, real estate, infrastructure, and legal compliance costs associated with international operations; • currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we chose to do so in the future; • limitations on our ability to reinvest earnings from operations in one country to fund the capital needs of our operations in other countries; • laws and business practices favoring local competitors or general preferences for local vendors; • limited or insufficient intellectual property protection or difficulties enforcing our intellectual property; • political instability or terrorist activities; • risks related to global health epidemics, such as the COVID-19 pandemic, including restrictions on our ability and our customers’ ability to travel, disruptions in our customers’ ability to distribute products, and temporary closures of our customers’ facilities; • exposure to liabilities under anti-corruption and anti-money laundering laws, including the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the UK Bribery Act of 2010, the UK Proceeds of Crime Act 2002, and similar laws and regulations in other jurisdictions; • adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash; and • our limited experience in operating our business internationally increases the risk that future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully, our business and operating results will suffer. Unfavorable conditions in our industry or the global economy, or reductions in IT spending, could limit our ability to grow our business and negatively affect our results of operations. Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers. The revenue growth and potential profitability of our business depend on demand for our platform. Current or future economic uncertainties or downturns could adversely affect our business and results of operations. Negative conditions in the global economy or individual markets, including changes in gross domestic product growth, financial and credit market fluctuations, political turmoil, natural catastrophes, warfare and terrorist attacks on the United States, Europe, Australia, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on IT and negatively affect our business. In particular, given our investment in our development capabilities in Ukraine, political turmoil, warfare, or terrorist attacks in Ukraine could negatively affect our business. Political and military events in Ukraine, including the ongoing war between Ukraine and Russia, poor relations between the U.S. and Russia, and sanctions by the international community against Russia or separatist areas of Ukraine may also have an adverse impact on our employees, customers, partners, and vendors. In turn, any of these may adversely impact our ability to grow our business and negatively affect our results of operations. To the extent our platform is perceived by customers and potential customers as costly, or too difficult to launch or migrate to, it would negatively affect our growth. Our revenue may be disproportionately affected by delays or reductions in general IT spending. Competitors, many of whom are larger and more established than we are, may respond to market conditions by lowering prices and attempting to lure away our customers. In addition, consolidation in certain industries may result in reduced overall spending on our platform. We cannot predict the timing, strength, or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, including as a result of recent political and military events in Ukraine, our business, results of operations and financial condition could be adversely affected. Operations at our strategic development center in Kyiv, Ukraine have been impacted as a result of the ongoing military action by Russia in Ukraine and our business, financial condition and results of operations may be materially adversely affected by any negative impact on the global economy resulting from the war in Ukraine or the unavailability of our personnel in Ukraine. We have historically operated a strategic development center in Ukraine where we employed 106 individuals as of December 31, 2021. We have also invested significant resources in Ukraine over the last several years. As a result, warfare, political turmoil or terrorist attacks in Ukraine could negatively affect our Ukrainian operations and our business. 41 Table of Contents As a result of the ongoing war between Russia and Ukraine , we assisted many of our employees in Kyiv in relocating to neighboring countries to the extent they desired to do so. While the war in Ukraine has not had a material negative impact on the Company or its financial performance to date, the ongoing war could cause harm to our employees and otherwise impair their ability to work for extended periods of time, as well as disrupt telecommunications systems, banks, and other critical infrastructure necessary to conduct business in Ukraine and neighboring countries. As the scope and intensity of the war changes rapidly, we are continuing to receive reports on our employees, operations and facilities and monitoring the evolving situation. The war between Russia and Ukraine has resulted in the imposition of sanctions by the United States, other North Atlantic Treaty Organization ("NATO") member states, as well as non-member states against Russia, certain Russian citizens, and enterprises. More generally, the war has led to and could lead to further disruptions in the global financial markets and economy, including, without limitation, currency volatility, inflation and instability in the global capital markets. In addition, Russia's prior annexation of Crimea, recent recognition of two separatist republics in the Donetsk and Luhansk regions of Ukraine and subsequent military interventions in Ukraine have led to sanctions being levied by the United States, European Union and other countries against Russia, with additional potential sanctions threatened and/or proposed. Russia's military incursion and the resulting sanctions could adversely affect the global economy and financial markets and thus could affect our business, operations, operating results and financial condition as well as the price of our common stock. The extent and duration of the military action, sanctions and resulting market disruptions are impossible to predict, but could be substantial. The war between Russia and Ukraine could draw military or other intervention from additional countries, which could lead to a much larger war and/or additional sanctions imposed by the United States and other governments that restrict business with specific persons, organizations or countries with respect to certain products or services. Any such disruptions or escalations caused by Russian military action or resulting sanctions may magnify the impact of other risks described in Part I, “Item 1A. Risk Factors” in our 2021 Annual Report on Form 10K. The risk of cybersecurity incidents has increased in connection with the ongoing war, driven by justifications such as retaliation for the sanctions imposed in conjunction with the war, or in response to certain companies’ continued operations in Russia. For example, the war has been accompanied by cyberattacks against the Ukrainian government and other countries in the region. It is possible that these attacks could have collateral effects on additional critical infrastructure and financial institutions globally, which could adversely affect our operations and could increase the frequency and severity of cyber-based attacks against our information technology systems. The proliferation of malware from the war into systems unrelated to the war or cyberattacks against U.S. companies in retaliation for U.S. sanctions against Russia or U.S. support of Ukraine, could also adversely affect our operations. Even if the war moderates or a resolution between Ukraine and Russia is reached, we expect that we may continue to experience ongoing financial and operational impacts resulting from the war for the foreseeable future as Ukraine rebuilds its economy and infrastructure. Additionally, certain of the economic and other sanctions imposed, or that may be imposed, against Russia may continue for a period of time after any resolution has been reached. The COVID-19 pandemic continues to present uncertainty regarding our business and may continue to materially and adversely affect our business, financial condition and results of operations. There is uncertainty regarding the nature and degree of the pandemic’s ongoing impacts on our business. During portions of the pandemic, we experienced heightened revenue growth, as our customers rapidly shifted in response to the increased demand for online shopping alternatives to traditional shopping experiences. We expect that our revenue growth rates may continue to be impacted as consumer behavior evolves in response to the evolving pandemic, traditional retail venues fully reopening and other factors. In addition, the COVID-19 pandemic, and the actions taken in response to the pandemic, have led to global supply chain challenges, reduced availability of goods and inflation, each of which may impact our customers and could ultimately impact demand for our services. We expect these disruptions and impacts to continue. In response to the COVID-19 pandemic, we have taken a number of actions that have impacted and continue to impact our business, including transitioning employees across all our offices to remote work-from-home arrangements and then hybrid in office and remote work. The COVID-19 pandemic may also disrupt or delay the ability of employees to work because they become sick or are required to care for those who become sick, or for dependents for whom external care is not available. It could cause delays or disruptions in services provided by key suppliers and vendors including supply chain delays, make us, our partners, and our service providers more vulnerable to security breaches, denial of service attacks or other hacking or phishing attacks, or cause other unpredictable effects. Since the impact of the COVID-19 pandemic is ongoing, the effect of the COVID-19 pandemic and the related impact on the global economy may not be fully reflected in our results of operations until future periods. The full impact of the pandemic on our business will continue to depend on future developments, including but not limited to, the emergence of new coronavirus variants, the duration of the pandemic, the actions undertaken to contain the virus or mitigate its impacts, including actions mandated by federal, state and local governments and health authorities and changing public health directives or restrictions, vaccine efficacy against COVID-19 variants, current or future travel restrictions and how quickly and to what extent normal global economic and operating conditions can or will resume, all of which are rapidly evolving and are difficult to predict. Volatility in the capital markets has been 42 Table of Contents heightened during recent months and such volatility may continue, which may cause further declines in the price of our common stock. We may be adversely affected by the effects of inflation. Inflation has the potential to adversely affect our liquidity, business, financial condition and results of operations by increasing our overall cost structure, particularly if we are unable to achieve commensurate increases in the prices we charge our customers or if increased prices may lead to decreased spending by our customers. The existence of inflation in the economy has resulted in, and may continue to result in, higher interest rates and capital costs, shipping costs, supply shortages, increased costs of labor, weakening exchange rates and other similar effects. The Federal Reserve has raised, and may again raise, interest rates in response to concerns about inflation. In response, market interest rates have risen in recent periods. While the timing and impact of rising interest rates are unknown, a continued increase in market interest rates could have an adverse effect on our cost structure, results of operations and financial condition. As a result of inflation, we have experienced, and may continue to experience, pressure on our business generation and cost of business. Although we may take measures to mitigate the impact of this inflation, if these measures are not effective our business, financial condition, results of operations and liquidity could be materially adversely affected. Even if such measures are effective, there could be a difference between the timing of when these beneficial actions impact our results of operations and when the cost inflation is incurred.