What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-09-10 compared with 2020-09-11 · 132 added, 108 removed, 324 unchanged (43% of the section changed)

5 unchanged sentences

● general economic and business conditions;

● currency exchange rate fluctuations;

7 unchanged sentences

A general weakening of, and related declining corporate confidence in, the global economy or the curtailment in government or corporate spending could cause current or potential customers to reduce their technology budgets or be unable to fund software or services purchases, which could cause customers to delay, decrease or cancel purchases of our products and services or cause customers to not pay us or to delay paying us for previously purchased products and services.

We face risks related to health epidemic, including the COVID-19 pandemic, which could have a material adverse effect on our business, financial condition and results of operations.

We face various risks, related to public health issues, including epidemics, pandemics, and other outbreaks, including the recent pandemics of respiratory illness caused by a novel coronavirus known as COVID-19, which the World Health Organization characterized as a pandemic in March 2020.

The impact of COVID-19, including changes in consumer and business behavior, pandemic fears and market downturns and restrictions on business and individual activities, has created significant volatility in the global economy and led to reduced economic activity.

The pandemic has resulted in government authorities implementing numerous measures to try to contain the virus, such as travel bans and restrictions, quarantines, shelter-in-place or stay-at-home orders, and business shutdowns.

For example, employees at our headquarters located in Sunnyvale, California, are currently subject to a shelter-in-place order from the local government.

Our offices in India and United Kingdom have also been impacted by COVID-19 and have been subject to various measures implemented by local government to reduce the spread of COVID-19.

These measures may adversely impact our employees and operations and the operations of our customers and third-party distribution partners, and may negatively impact our sales and marketing activities.

These measures by government authorities may remain in place for a significant period of time and they are likely to continue to adversely affect our sales and marketing activities and our business, financial condition and results of operations.

The spread of COVID-19 has caused us to modify our business practices (including employee travel, mandating that all non-essential personnel in our headquarters work from home, temporary closures of our offices, and cancellation of physical participation in sales activities, meetings, events and conferences), and we may take further actions as may be required by government authorities, or that we determine are in the best interests of our employees and customers.

There is no certainty that such actions will be sufficient to mitigate the risks posed by the virus or otherwise be satisfactory to government authorities.

In addition, we face additional risks and challenges related to having a portion of our workforce working from home, including added pressure on our IT systems and the security of our network, and new challenges as

our team adjust to online collaboration.

If significant portions of our workforce are unable to work effectively, including due to illness, quarantines, social distancing, government actions or other restrictions in connection with the COVID-19 pandemic, our operations will be impacted.

The extent to which the COVID-19 pandemic impacts our business, prospects and results of operations will depend on future developments, which are highly uncertain and cannot be predicted, including, but not limited to, the duration and spread of the pandemic, its severity, the actions to contain the virus or treat its impact, and how quickly and to what extent normal economic and operating activities can resume.

The COVID-19 pandemic could cause fluctuations in foreign currency markets, impact the availability of future borrowings and our ability to access capital, increase the cost of borrowings, increase credit risks of our customers, negatively affect our liquidity and the liquidity and stability of markets of our securities.

We face risks related to health epidemics, including the COVID-19 pandemic, which could have a material adverse effect on our business, financial condition and results of operations .

The COVID-19 pandemic has created significant worldwide uncertainty, volatility and economic disruption.

The ultimate impact of the COVID-19 pandemic on our business, results of operations, financial condition and cash flows is dependent on future developments, including the duration of the pandemic, the severity of the disease and outbreak, the impact of new strains of the virus, effectiveness and availability of a vaccine, future and ongoing actions that may be taken by governmental authorities, the impact on the businesses of our customers and partners, and the length of its impact on the global economy, which are uncertain and are difficult to predict at this time.

The potential effects of the COVID-19 pandemic, each of which could adversely affect our business, results of operations, financial condition and cash flows, include:

● the rate of IT spending and the ability of our customers to purchase our offerings could be adversely impacted.

Further, the impact of the COVID-19 pandemic could delay prospective customers’ purchasing decisions and cause them to become less inclined to trade-up from existing solutions, impact customers’ pricing expectations for our offerings, lengthen payment terms, reduce the value or duration of their subscription contracts, or adversely impact renewal rates;

● we could experience disruptions in our operations as a result of continued office closures, risks associated with our employees working remotely, a significant portion of our workforce suffering illness and travel restrictions.

Starting in early 2020, we temporarily closed our offices, instituted a global remote work mandate and instituted significant travel restrictions.

While we have begun to re-open some of our offices, the vast majority of our employees continue to work remotely and for our offices that have begun to re-open, we have implemented significant new safety protocols, which may limit the effectiveness and productivity of our employees;

● we may be unable to collect amounts due on billed and unbilled revenue if our customers or partners delay payment or fail to pay us under the terms of our agreements as a result of the impact of the COVID-19 pandemic on their businesses, including their seeking bankruptcy protection or other similar relief.

As a result, our cash flows could be adversely impacted, which could affect our ability to fund future product development and acquisitions or return capital to shareholders;

● we may experience disruptions or delays to our supply chain or fulfillment and delivery operations as a result of the COVID-19 pandemic;

● our marketing effectiveness and demand generation efforts may be impacted due to the cancelling of customer events or shifting events to virtual-only experiences.

We may need to postpone or cancel other customer, employee or industry events or other marketing initiatives in the future;

● our business is dependent on attracting and retaining highly skilled employees, and our ability to attract and retain such employees may be adversely impacted by intensified restrictions on travel, immigration, or the availability of work visas during the COVID-19 pandemic;

● increased cyber incidents during the COVID-19 pandemic and our increased reliance on a remote workforce could increase our exposure to potential cybersecurity breaches and attacks;

● our results of operations are subject to fluctuations in foreign currency exchange rates, which risks may be heightened due to increased volatility of foreign currency exchange rates as a result of COVID-19.

Further, our forecasted revenue, operating results and cash flows could vary materially from those we provide as guidance or from those anticipated by investors and analysts if the assumptions on which we base our financial projections are inaccurate as a result of the unpredictability of the impact that the COVID-19 pandemic will have on our businesses, our customers’ and partners’ businesses and the global markets and economy or we make changes to our licensing programs or payment terms in connection with COVID-19.

Even after the COVID-19 pandemic has subsided, we may continue to experience an adverse impact to our business and the value of our securities as a result of its global economic impact, including any recession that has occurred or may occur in the future.

2 unchanged sentences

However, the effects could have a material impact on our results of operations, and we will continue to monitor the situation closely.

To the extent the COVID-19 pandemic adversely affects our business, results of operations, financial condition and cash flows, it may also heighten many of the other risks described in this “Risk Factor” section.

Our revenue and operating results have fluctuated in the past and are likely to fluctuate in the future, and because we recognize revenue from subscriptions over a period of time, downturns in revenue may not be immediately reflected in our operating results.

21 unchanged sentences

We cannot accurately predict subscription renewal rates and the impact these rates may have on our future revenue and operating results.

Even though our subscription contracts are typically structured for auto-renewals, we do allow our customers to elect not to renew their subscriptions for our service after the expiration of their initial subscription period, which is typically 12 to 36 months, and some customers have elected not to renew.

We allow our customers to elect not to renew their subscriptions for our service after the expiration of their initial subscription period, which is typically 12 to 36 months, and some customers have elected not to renew.

In addition, our customers may choose to renew for fewer subscriptions (in quantity or products) or renew for shorter contract lengths.

9 unchanged sentences

The sales cycle for our products can be six months or more and varies substantially from customer to customer.

Because we sell complex and deeply integrated solutions, it can take many months of customer education to secure sales.

Because we sell complex and deeply integrated solutions, it can take many months of customer education to

secure sales.

Since our potential customers may evaluate our products before, if ever, executing definitive agreements, we may incur substantial expenses and spend significant management and legal effort in connection with a potential customer.

11 unchanged sentences

Other than product innovation and existing customer relationships, there are no substantial barriers to entry in this market, and established or new entities may enter this market in the future.

While software internally developed by enterprises represents indirect competition, we also compete directly with packaged application software vendors, including Genesys Telecommunications, LivePerson, Inc., and Moxie Software, Inc.

In addition, we face actual or potential competition from larger software companies such as Microsoft Corporation, Oracle Corporation, and similar companies that may attempt to sell customer engagement software to their installed base.

In addition, we face actual or potential competition from larger software companies such as Microsoft Corporation, Oracle Corporation, salesforce.com Inc., and ServiceNow, Inc., and similar companies that may attempt to sell customer engagement software to their installed base.

We believe competition will continue to be fierce as current competitors increase the sophistication of their offerings and as new participants enter the market.

11 unchanged sentences

Our success and future growth depend in part upon the skills, experience, performance and continued service of our distribution partners, including software and hardware vendors and resellers.

Our distribution partners engage with us in a number of ways, including assisting us to identify prospective customers, distributing our products and services in geographies where we do not have a physical presence and distributing our products and services where they are considered complementary to other products of the partner or third-party products distributed by the partner.

Our distribution partners engage with us in a

number of ways, including assisting us to identify prospective customers, distributing our products and services in geographies where we do not have a physical presence and distributing our products and services where they are considered complementary to other products of the partner or third-party products distributed by the partner.

We believe that our future success depends in part upon our ability to develop, maintain and expand strategic, long-term and profitable partnerships and reseller relationships.

If we are unable to do so for any reason, including as a result of any change in the leadership of our distribution partners, or if any existing or future distribution partners fail to successfully market, resell, implement or support our products for their customers, or if distribution partners represent multiple providers and devote greater resources to market, resell, implement and support competing products and services, our future revenue growth could be impeded.

Our failure to develop, maintain and expand relationships with systems integrators could harm our business.

We sometimes rely on systems integrators to recommend our products to their customers and to install and support our products for their customers.

We likewise depend on broad market acceptance by these system integrators of our product and service offerings.

Our agreements generally do not prohibit competitive offerings and systems integrators may develop market or recommend software applications that compete with our products.

Moreover, if these firms fail to implement our products successfully for their customers, we may not have the resources to implement our products on the schedule required by their customers.

To the extent we devote resources to these relationships and the partnerships do not proceed

as anticipated or provide revenue or other results as anticipated, our business may be harmed.

We sometimes rely on distribution partners to recommend our products to their customers.

We likewise depend on broad market acceptance by these distribution partners of our product and service offerings.

Our agreements generally do not prohibit competitive offerings and our distribution partners may develop market or recommend software applications that compete with our products.

To the extent we devote resources to these relationships and the partnerships do not proceed as anticipated or provide revenue or other results as anticipated, our business may be harmed.

Once partnerships are forged, there can be no guarantee that such relationships will be renewed in the future or available on acceptable terms.

9 unchanged sentences

If new or existing customers cancel or have difficulty deploying our products or require significant amounts of our professional services, support, or customized features, revenue recognition could be cancelled or further delayed and our costs could increase, causing increased variability in our operating results.

Implementation services may be performed by our own staff, by a third-party partner or by a combination of the two.

Our strategy is to work with partners to increase the breadth of capability and depth of capacity for delivery of these services to our customers, and we expect the number of our partner-led implementations to continue to increase over time.

If a customer is not satisfied with the quality of work performed by us or a partner or with the type of professional services or functionality delivered, even if we are not contractually responsible for the partner services, then we could incur additional costs to address the situation, the profitability of that work might be impaired and the customer’s dissatisfaction with our or our partner’s services could damage our ability to expand the scope of functionality subscribed to by that customer.

In addition, negative publicity related to our customer relationships, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers.

We conduct a significant portion of our business and operations outside of the United States, which exposes us to additional risks that may not exist in the United States.

These risks in turn could cause our operating results and financial condition to suffer.

We derived 38% and 44% of our revenue from international sales during the fiscal years ended June 30, 2020 and 2019, respectively.

We derived 31% and 38% our revenue from international sales during the fiscal years ended June 30, 2021 and 2020, respectively.

In addition to those discussed elsewhere in this section, our international sales operations are subject to a number of specific risks, such as:

7 unchanged sentences

● hostilities in various parts of the world;

● the fragmentation of longstanding regulatory frameworks caused by Brexit;

● reduced intellectual property protections in some countries.

Any of the above risks could adversely affect our international operations, reduce our revenue from customers outside of the United States or increase our operating costs, each of which could adversely affect our business, results of operations, financial condition, and growth prospects.

As of June 30, 2021 approximately 45% of our workforce was employed in India.

4 unchanged sentences

Our reliance on our workforce in India makes us particularly susceptible to disruptions in the business environment in that region.

In particular, sophisticated telecommunications links, high-speed data communications with other eGain offices and customers, and overall consistency and stability of our business infrastructure are vital to our day-to-day operations, and any impairment of such

infrastructure will cause our financial condition and results to suffer.

In addition, the maintenance of stable political relations between the United States, the European Union and India are also of great importance to our operations.

In addition, the maintenance of stable political relations between the United States, the European Union (EU) and India are also of great importance to our operations.

Any of these risks could have a significant impact on our product development, customer support, or professional services.

To the extent the benefit of maintaining these operations abroad does not exceed the expense of establishing and maintaining such activities, our operating results and financial condition will suffer.

Unplanned system interruptions and capacity constraints and failure to effect efficient transmission of customer communications and data over the Internet could harm our business and reputation.

Our customers have in the past experienced some interruptions with eGain cloud operations.

Unplanned system interruptions , delays in service or inability to increase capacity, including internationally, at our third-party data center facilities could impair the use or functionality of our cloud operations and harm our business .

Our customers have in the past experienced some interruptions with our cloud operations.

We believe that these interruptions will continue to occur from time to time.

3 unchanged sentences

If this were to continue to happen, our business and reputation could be seriously harmed.

The growth in the use of the Internet has caused interruptions and delays in accessing the Internet and transmitting data over the Internet.

Interruptions also occur due to systems burdens brought on by unsolicited bulk email or “Spam,” malicious service attacks, denial of service attacks and hacking into operating systems, viruses, worms and a “Trojan” horse, the proliferation of which is beyond our control and may seriously impact our and our customers’ businesses.

Because we provide cloud-based software, interruptions or delays in Internet transmissions will harm our customers’ ability to receive and respond to online interactions.

Therefore, our market depends on ongoing improvements being made to the entire Internet infrastructure to alleviate overloading and congestion.

Our success largely depends on the efficient and uninterrupted operation of our computer and communications hardware and network systems.

A significant amount of our computer and communications systems are located in Sunnyvale, California.

Due to our location, our systems and operations are vulnerable to damage or interruption from fire, earthquake, power loss, telecommunications failure and similar events.

We currently serve our customers from third-party data center facilities operated by third parties in the United Stataes and other international locations.

Any damage to, or failure of, our systems generally could interrupt service or impair the use or functionality of our cloud operations .

In addition, as we continue to increase the number of customers and users on our cloud operations , we will need to increase the capacity of our data center infrastructure.

If we do not increase our capacity in a timely manner, customers could experience interruptions or delays in access to our cloud operations.

Customer data that we store in third party data centers may also be vulnerable to damage or interruption from floods, fires, earthquake, power loss, telecommunications failures and similar events.

Any damage to, or failure of, our systems generally could result in interruptions in our service.

Interruptions in our service may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers.

Any damage to, or failure of, our

systems, or those of our third-party data centers, could result in impairment of or interruptions in our service.

Impairment or interruptions in our service may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions and adversely affect our renewal rate and our ability to attract new customers.

Our business will also be harmed if our customers and potential customers believe our cloud operations are unreliable.

We maintain a business continuity plan for our customers in the event of an outage.

4 unchanged sentences

Our premium disaster recovery service provides for an alternative data center and a return to operations within one business day.

We have entered into service agreements with some of our customers that require minimum performance standards, including standards regarding the availability and response time of our remote management services.

If we fail to meet these standards, our customers could terminate their relationships with us, and we could be subject to contractual refunds and service credits to, and exposure to claims for losses by, customers.

Any unplanned interruption of services may harm our ability to attract and retain customers.

We have entered into support obligations with our customers that require minimum performance standards, including standards regarding the response time of our support services.

If we fail to meet these standards, our customers could terminate their relationships with us, and we could be subject to contractual refunds, and exposure to claims for losses by, customers.

Software errors could be costly and time-consuming for us to correct, and could harm our reputation and impair our ability to sell our solutions.

8 unchanged sentences

We have invested, and expect to continue to invest, substantial resources to expand, market, implement and refine our cloud offerings.

Our subscription services have generally generated much lower short-term gross margins than our traditional perpetual license sales.

If we are unable to increase the volume of our subscription business to offset the lower margins, we may not be able to achieve sustained profitability.

If we are unable to increase the volume of our subscription business, we may not be able to achieve sustained profitability.

Factors that could harm our ability to improve our gross margins, which may affect our operating profitability, include:

22 unchanged sentences

● enhance the features and performance of our services;

● develop and offer new services that are valuable to companies doing business online as well as Internet users;

● develop and offer new services that are valuable to companies;

● respond to technological advances and emerging industry standards and practices in a cost-effective and timely manner.

If any of our new services, including upgrades to our current services, do not meet our customers’ or Internet users’ expectations, our business may be harmed.

If any of our new services, including upgrades to our current services, do not meet our customers’ expectations, our business may be harmed.

Updating our technology may require significant additional capital expenditures and could materially and adversely affect our business, results of operations and financial condition.

2 unchanged sentences

Our failure to expand our operations in an efficient manner could cause our expenses to grow, our revenue to decline or grow more slowly than expected and could otherwise have a material adverse effect on our business, results of operations and financial condition.

We may need to license third-party technologies and may be unable to do so on commercially reasonable terms or in a timely manner.

We employ third-party technologies for use in or with our platform and the inability to license such technologies on commercially reasonable terms or the inability to maintain these licenses or errors in the software we license could result in increased costs, or reduced service levels, which could adversely affect our business .

Our platform incorporates certain third-party software obtained under licenses from other companies, and we use third-party software development tools as we continue to develop and enhance our platform.

We anticipate that we will continue to rely on such third-party software in the future.

Although we believe that there are commercially reasonable alternatives to the third-party software we currently license, this may not always be the case, or it may be difficult or costly to replace such software.

In addition, integration of the software used in our platform with new third-party software may require significant work and require substantial investment of our time and resources.

Also, to the extent that our platform depends upon the successful operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software could prevent the deployment or impair the functionality of our platform, delay new feature introductions, result in a failure of our functionality, and injure our reputation.

Our use of additional or alternative third-party software would require us to enter into license agreements with third parties.

To the extent we need to license third-party technologies, we may be unable to do so on commercially reasonable terms or at all.

In addition, we may fail to successfully integrate any licensed technology into our products or services.

Third-party licenses may expose us to increased risks, including risks associated with the integration of new technology, the diversion of resources from the development of our own proprietary technology, and our inability to generate revenue from new technology sufficient to offset associated acquisition and maintenance costs.

Our inability to obtain and successfully integrate any of these licenses could delay product and service development until equivalent technology can be identified, licensed and integrated.

This in turn would harm our business and operating results.

We may be unable to respond to the rapid technological change and changing customer preferences in the online sales, marketing, customer service, and/or online consumer services industries and this may cause our business to suffer.

If we are unable, for technological, legal, financial or other reasons, to adapt in a timely manner to changing market conditions in the online sales, marketing, customer service and/or e-commerce industry or our customers’ or Internet users’ requirements or preferences, our business, results of operations and financial condition would be materially and adversely affected.

Business on the Internet is characterized by rapid technological change.

In addition, the market for online sales, marketing, customer service and expert advice solutions is relatively new.

Changes in customer and Internet user requirements and preferences, frequent new product and service introductions embodying new technologies and the emergence of new industry standards and practices such as but not limited to security standards could render our services and our proprietary technology and systems obsolete.

The rapid evolution of these products and services will require that we continually improve the performance, features and reliability of our services.

Our success will depend, in part, on our ability to:

● enhance the features and performance of our services;

● develop and offer new services that are valuable to companies doing business online as well as Internet users;

● respond to technological advances and emerging industry standards and practices in a cost-effective and timely manner.

If any of our new services, including upgrades to our current services, do not meet our customers’ or Internet users’ expectations, our business may be harmed.

Updating our technology may require significant additional capital expenditures and could materially and adversely affect our business, results of operations and financial condition.

If new services require us to grow rapidly, this could place a significant strain on our managerial, operational, technical and financial resources.

In order to manage our growth, we could be required to implement new or upgraded operating and financial systems, procedures and controls.

In the event that we are not able to maintain our licenses to third-party software, or cannot obtain licenses to new software as needed, or in the event third-party software used in conjunction with our platform contains errors or defects, our business, operating results, and financial condition may be adversely affected.

Our offshore product development, support and professional services may prove difficult to manage or may not allow us to realize our cost reduction goals, produce effective new solutions and provide professional services to drive growth.

6 unchanged sentences

The loss of the services of any of our senior management or other key personnel, including our Chief Executive Officer and co-founder, Ashutosh Roy, could harm our business.

Additionally, attrition in the Indian workforce on which we rely for research and development could have significant negative effects on us and our results of operations.

If we cannot hire and retain qualified personnel, our ability to expand our business would be impaired and our results of operations would suffer.

Additionally, in the technology industry, there is substantial and continuous competition for highly skilled business, product development, technical and other personnel.

We may also experience increased compensation costs that are not offset by either improved productivity or higher sales.

Our failure to recruit new personnel and to retain and motivate existing personnel could have significant negative effects on us, including impairing our ability to expand our business, and our results of operations could suffer.

We may not be able to realize the benefits of offering the limited, free “Innovation in 30 days” version of our service.

46 unchanged sentences

In addition, domestic and foreign legislation has been proposed that could prohibit or impose liability for the transmission over the Internet of certain types of information.

defense of any of these actions could be costly and involve significant time and attention of our management and other resources.

Our defense of any of these actions could be costly and involve significant time and attention of our management and other resources.

The Digital Millennium Copyright Act (DMCA) is intended, among other things, to reduce the liability of online service providers for listing or linking to third-party web properties that include materials that infringe copyrights or rights of others.

4 unchanged sentences

If our cybersecurity systems or the systems of our vendors, partners and suppliers are breached and unauthorized access is obtained to a customer’s data or our data or IT systems, our service may be perceived as not being secure, customers may curtail or stop using our service and we may incur significant legal and financial exposure and liabilities.

Our service involves the storage and transmission of customers’ proprietary information, and security breaches could expose us to a risk of loss of this information, loss of access, litigation and possible liability.

These security measures may be breached as a result of third-party action, including intentional misconduct by computer hackers (which may involve nation states and individuals sponsored by them), employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our customers’ data or our data, including our intellectual property and other confidential business information, or our IT systems.

Additionally, third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our customers’ data or our data or IT systems.

Security incidents have become more prevalent across industries and may occur on our systems.

Our service involves the storage and transmission of customers’ proprietary information, and security incidents could expose us to a risk of loss of this information, loss of access, litigation and possible liability.

The techniques used to effect unauthorized penetration of computer systems are constantly evolving and have been increasing in sophistication.

While we have security measures in place that are designed to protect customer information and prevent data loss and other security breaches, these security measures may be breached as a result of third-party action, including intentional misconduct by computer hackers (which may involve nation states and individuals sponsored by them), employee error, malfeasance or otherwise and result in someone obtaining unauthorized access to our customers’ data or our data, including our intellectual property and other confidential business information, or our IT systems.

Additionally, third parties may attempt to fraudulently induce

employees or customers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our customers’ data or our data or IT systems.

Employees or contractors have introduced vulnerabilities in, and enabled the exploitation of, our IT environments in the past and may do so in the future.

7 unchanged sentences

A successful cybersecurity attack involving our data center, network or software products could also negatively impact the market perception of the effectiveness of our products or lead to contractual disputes, litigation or government regulatory action against us, any of which could materially adversely affect our business, reputation and resulting operations.

We may also experience disruptions, outages, and other performance problems on our systems due to service attacks, unauthorized access, or other security-related incidents.

For example, third parties may conduct attacks designed to temporarily deny customers access to our services.

Any successful denial of service attack could result in a loss of customer confidence in the security of our platform and damage to our brand.

Our platform involves the storage and transmission of our customers’ information, which may including their business and financial data.

As a result, unauthorized access to customer data or security breaches could result in the loss, or unauthorized dissemination, of such data, which could seriously harm our or our customers’ businesses and reputations.

Any of these security incidents could negatively affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions, result in reputational damage or subject us to third-party lawsuits, regulatory fines, or other action or liability, which could adversely affect our operating results.

Any insurance coverage we may have related to security and privacy damages may not be adequate for liabilities actually incurred and we cannot be certain that insurance will continue to be available to us on economically reasonable terms, or at all.

These risks are likely to increase as we continue to grow the scale and functionality of our platform and process, store, and transmit increasingly large amounts of our customers’ information and data, which may include proprietary or confidential data or personal or identifying information.

Changes in the European regulatory environment regarding privacy and data protection regulations, such as the European Union’s General Data Protection Regulation (GDPR), could expose us to risks of noncompliance and costs associated with compliance.

We have in the past relied on adherence to the U.S.

Department of Commerce’s Safe Harbor Privacy Principles and compliance with the U.S.-European Union (EU) and U.S.

- Swiss Safe Harbor Frameworks as agreed to and set forth by the U.S.

Department of Commerce’s Safe Harbor Privacy Principles, the U.S.-European Union (EU) and U.S.

- Swiss Safe Harbor Frameworks, and their successors, the EU-U.S.

and Swiss-U.S.

Privacy Shield Frameworks, as agreed to and set forth by the U.S.

Department of Commerce, and the EU and Switzerland, which established a means for legitimating the transfer of personally identifiable information (PII) by U.S.

companies doing business in Europe from the European Economic Area (EEA) to the U.S.

As a result of the October 6, 2015 EU Court of Justice (ECJ), opinion in Case C-362/14 (Schrems

Data Protection Commissioner) regarding the adequacy of the U.S.-EU Safe Harbor Framework, the U.S.

– EU Safe Harbor Framework is no longer deemed to be a valid method of compliance with restrictions set forth in European law regarding the transfer of data outside of the EEA requiring us to rely on alternative mechanisms permitted under European law, such as consent and EU-specified standard contractual clauses.

- EU Safe Harbor was replaced with the EU-U.S.

Privacy Shield (Privacy Shield) in July 2016 and, starting on August 1, 2016, the Privacy Shield was made available to companies for self-certification.

We have self-certified with the Privacy Shield.

Nevertheless, some of the mechanisms permitting transfer of data from the EU to the U.S.

have been subject to challenges, whose outcomes remain uncertain.

Furthermore, on May 25, 2018, the EU’s GDPR became enforceable, imposing new obligations directly on us as both a data controller and a data processor, as well as on many of our customers.

It is possible that these new laws may be interpreted or applied in a manner that is adverse to us, unforeseen, or otherwise inconsistent with our practices or that we may not adequately adapt our internal policies and/or procedures to evolving regulations, any of which could result in litigation, regulatory investigations and potential legal liability (including potential liability exposure through higher potential penalties for non-compliance), require us to make changes to our services to enable us and/or our customers to meet the new legal requirements, in case we have to change locations of data centers to meet privacy laws, increased requirements for customers to buy add-ons to meet additional requirements imposed by new laws, require us to change our practices in a manner adverse to our business or limit access to our products and services in certain countries.

Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under GDPR) and regulations can be costly;

companies doing business in Europe from the European Economic Area (EEA) and Switzerland to the U.S.

However, as a result of the October 6, 2015 EU Court of Justice (ECJ), opinion in Case C-362/14 (Schrems v.

Data Protection Commissioner) regarding the adequacy of the U.S.-EU Safe Harbor Framework, and the July 16, 2020 ECJ judgment in Case C-311/18 (Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems) regarding the adequacy of the Privacy Shield Framework, both frameworks are no longer deemed to constitute a valid method of compliance with restrictions set forth in European law regarding the transfer of data outside of the EEA.

We are therefore required to rely on alternative mechanisms permitted under European law, such as consent and approved standard contractual clauses.

The standard contractual clauses approved by the European Commission for these purposes have recently been replaced and a

significant repapering exercise is therefore required.

The UK is also currently consulting on its own updated version of the standard contractual clauses and the result of this may be that different standard contractual clauses are needed depending on the origin of the PII.

On May 25, 2018, the EU’s GDPR became enforceable, imposing new obligations directly on us as both a data controller and a data processor, as well as on many of our customers.

Following the UK's exit from the EU (Brexit) the UK adopted a UK version of the GDPR.

While the UK GDPR is currently aligned with the EU GDPR, Brexit has created the opportunity for the UK to develop its own data protection regime which may diverge from the European standard (as is the case with the standard contractual clauses, discussed above).

It is possible that these new legal developments may evolve in a manner that is adverse to us, unforeseen, or otherwise inconsistent with our practices or that we may not adequately adapt our internal policies and/or procedures to evolving regulations, any of which could result in litigation, regulatory investigations and potential legal liability (including potential liability exposure through higher potential penalties for non-compliance), require us to make changes to our services to enable us and/or our customers to meet the new legal requirements, in case we have to change locations of data centers to meet privacy laws, increased requirements for customers to buy add-ons to meet additional requirements imposed by new laws, require us to change our practices in a manner adverse to our business or limit access to our products and services in certain countries.

Compliance with existing, proposed and recently enacted laws and regulations can be costly, particularly if we are subject to differing or conflicting requirements in the different countries in which we operate;

any failure to comply with these regulatory standards could subject us to legal and reputational risks.

We may be unsuccessful in establishing legitimate means of transferring data from the EEA, we may experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our services due to the potential risk exposure to such customers as a result of the ECJ ruling or the implementation of GDPR, and we and our customers are at risk of enforcement actions taken by an EU data protection authority until such point in time that we ensure that all data transfers to us from the EEA are legitimized.

We may find it necessary to establish systems to maintain EU-origin data in the EEA, which may involve substantial expense and distraction from other aspects of our business.

While we have sought to implement appropriate transfer mechanisms following the invalidation of the Safe Harbor and Privacy Shield frameworks, owing to the significant changes that are ongoing in this area, we may be unsuccessful in establishing legitimate means of transferring data from the EEA or UK to the U.S.

Moreover, further challenges may be raised against the transfer mechanisms that we have adopted which may require future adaptation.

We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use our services due to the potential risk exposure to such customers as a result of the international legal developments.

We and our customers are at risk of enforcement actions taken by an EU or UK data protection authority until such point in time that we ensure that all data transfers to us from the EEA and UK are legitimized.

We may find it necessary to establish systems to maintain EU/UK-origin data in the EEA or UK, which may involve substantial expense and distraction from other aspects of our business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of PII.

Our publication of our privacy policy and other statements we publish that provide promises and assurances about privacy and security can subject us to potential governmental action if they are found to be deceptive or misrepresentative of our practices.

Our publication of our privacy policy and other public statements that provide promises and assurances about privacy and security can subject us to potential governmental action if they are found to be deceptive or misrepresentative of our practices.

Further, t he costs of compliance with, and other burdens imposed by, such laws, regulations and policies that are applicable to us may limit the use and adoption of our products and solutions and could have a material adverse impact on our results of operations.

Privacy concerns and laws, evolving regulation of cloud computing, cross-border data transfer restrictions and other domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business.

Regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information.

Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU’s e-Privacy Directive (which is set to be replaced in the coming months by a new EU e-Privacy Regulation which will have a “direct effect” in each EU Member State), and the country-specific regulations that implement that directive.

A recent decision by the European Court of Justice invalidated the US-EU Privacy Shield program as a protection for cross-border data transfers out of the European Union.

Such laws, decisions, and regulations are subject to differing interpretations and may be inconsistent among jurisdictions.

Privacy concerns and laws, evolving regulation of cloud computing and other domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business.

Further to the above, regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information.

Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU’s e-Privacy Directive (which is set to be replaced by a new EU e-Privacy Regulation which will have a “direct effect” in each EU Member State), and the country-specific regulations that implement that directive.

These and other requirements could reduce demand for our solutions or restrict our ability to store and process data or, in some cases, impact our ability to offer our services and solutions in certain locations.

2 unchanged sentences

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which became effective March 2020 and requires companies with data relating to New Yorkers to adopt

comprehensive cybersecurity programs.

New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which became effective March 2020 and requires companies with data relating to New Yorkers to adopt comprehensive cybersecurity programs.

These statutes may increase our compliance costs and potential liability.

Some observers have noted that the CCPA and the SHIELD Act could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business.

observers have noted that the CCPA and the SHIELD Act could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business.

Furthermore, India has recently proposed enacting its own data protection legislation although the specifics of this are yet to be decided.

In addition to government activity, privacy advocacy and other industry groups have established or may establish new self-regulatory standards that may place additional burdens on us.

4 unchanged sentences

Even the perception that the privacy of personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our products or services, and could limit adoption of our subscription solution.

Moreover, as our customers face increased scrutiny for data privacy breaches, they may elect to transfer the risk to us through contractual provisions which may subject us to increasing levels of contractual liability for data privacy breaches.

Anti-corruption, anti-bribery, and similar laws, and failure to comply with these laws, could subject us to criminal penalties or significant fines and harm our business and reputation.

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S.

Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S.

domestic bribery statute contained in 18 U.S.C.

§ 201, the U.S.

Travel Act, the USA PATRIOT Act, the U.K.

Bribery Act 2010, and other anti-corruption, anti-bribery, and anti-money laundering laws in countries in which we conduct activities.

Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly and prohibit companies and their employees and agents from promising, authorizing, making or offering improper payments, or other benefits to government officials and others in the private sector.

As we increase our international sales and business, our risks under these laws may increase.

Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, and other consequences.

Any investigations, actions, or sanctions could harm our business, operating results, and financial condition.

Industry-specific regulation is evolving and unfavorable industry-specific laws, regulations or interpretive positions could limit our ability to provide services and harm our business .

17 unchanged sentences

In March 2017, the UK served notice to the European Council under Article 50 of the Treaty of Lisbon to withdraw membership from the EU.

Such exit (Brexit) could cause disruptions to, and create uncertainty surrounding, our business in the UK and EU, including affecting our relationships with our existing and future customers, suppliers, and employees.

Brexit could cause disruptions to, and create uncertainty surrounding, our business in the UK and EU, including affecting our relationships with our existing and future customers, suppliers, and employees.

As a result, Brexit could have an adverse effect on our future business, financial results, and operations.

The UK formally left the EU on January 31, 2020, and is now in a transition period through December 31, 2020.

Although the UK will remain in the EU single market and customs union during the transition period, the long-term nature of the UK’s relationship with the EU is unclear and there is considerable uncertainty about whether any agreement will be reached and implemented.

The political and economic instability created by Brexit has caused and may continue to cause significant volatility in global financial markets and uncertainty regarding the regulation of data protection in the UK.

In particular, although the UK enacted a Data Protection Act in May 2018 that is consistent with the EU General Data Protection Regulation, uncertainty remains regarding how data transfers to and from the UK will be regulated.

Brexit could also have the effect of disrupting the free movement of goods, services, and people between the UK, the EU, and elsewhere.

Brexit could lead to legal uncertainty and potentially divergent national laws and regulations as the UK determines which EU laws to replace or replicate.

The UK formally left the EU on January 31, 2020, although it was subject to a transition period through December 31, 2020.

While the transition period has now ended, and a deal was reached between the EU and the UK (avoiding a so called "hard Brexit"), the long-term nature of the UK’s relationship with the EU is still relatively unclear.

The political and economic instability created by Brexit has caused and may continue to cause significant volatility in global financial markets.

Brexit has also had the effect of disrupting the free movement of goods, services, and people between the UK, the EU, and elsewhere.

Brexit could lead to legal uncertainty and potentially divergent national laws and regulations as the UK determines which EU laws to repeal or replace.

Further, uncertainty around these and related issues could lead to adverse effects on the economy of the UK and the other economies in which we operate.

There can be no assurance that any or all of these events will not have a material adverse effect on our business operations, results of operations and financial condition.

Further, Brexit has created uncertainty with regard to the future regulation of data protection in the United Kingdom.

We may experience reluctance or refusal by current or prospective customers in Europe, including the United Kingdom, to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of European residents.

The regulatory environment applicable to the handling of European residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.

Risks Related to Intellectual Property

3 unchanged sentences

The software and Internet industries are characterized by the existence of a large number of patents, trademarks and copyrights and by frequent litigation based on allegations of infringement or other violations of intellectual property rights.

We have received and may receive in the future communications from third parties claiming that we or our customers have infringed the intellectual property rights of others.

We have received and may receive in the future communications from third parties claiming that we or our customers have

infringed the intellectual property rights of others.

In addition, we have been, and may in the future be, sued by third parties for alleged infringement of their claimed proprietary rights.

26 unchanged sentences

These royalty or license agreements, if required, may not be available on acceptable terms, if at all, in the event of a successful claim of infringement.

Risks Related to Our Common Stock

General Risk Factors

Our stock price has demonstrated volatility and continued market conditions may cause declines or fluctuations.

14 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors