What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-03-21 compared with 2023-03-28 · 100 added, 53 removed, 301 unchanged (34% of the section changed)

6 unchanged sentences

We rely on social media, as one of our marketing strategies, to have a positive impact on both our brand value and reputation.

Our brand and reputation could

be adversely affected if we fail to achieve these objectives, if our public image was to be tarnished by negative publicity, which could be amplified by social media, if we fail to deliver innovative and high quality products acceptable to our guests, or if we face or mishandle a product recall.

Our brand and reputation could be adversely affected if we fail to achieve these objectives, if our public image was to be tarnished by negative publicity, which could be amplified by social media, if we fail to deliver innovative and high quality products acceptable to our guests, or if we face or mishandle a product recall.

Our reputation could also be impacted by adverse publicity, whether or not valid, regarding allegations that we, or persons associated with us or formerly associated with us, have violated applicable laws or regulations, including but not limited to those related to safety, employment, discrimination, harassment, whistle-blowing, privacy, corporate citizenship, improper business practices, or cybersecurity.

3 unchanged sentences

Changes in consumer shopping preferences, and shifts in distribution channels could materially impact our results of operations.

We sell our products through a variety of channels, with a significant portion through traditional brick-and-mortar retail channels.

As strong e-commerce channels emerge and develop, we are evolving towards an omni-channel approach to support the shopping behavior of our guests.

This involves country and region-specific websites, social media, product notification emails, mobile apps, including mobile apps on in-store devices that allow demand to be fulfilled via our distribution centers, and online order fulfillment through stores.

We operate an omni-channel retail model and aim to efficiently and effectively serve our guests in the ways most convenient to them.

We operate a combination of physical retail locations and e-commerce services via our websites, other region-specific websites, digital marketplaces, and mobile apps.

Our physical retail locations remain a key part of our growth strategy and we view them as a valuable tool in helping us build our brand and product line as well as enabling our omni-channel capabilities.

We plan to continue to expand square footage and open new company-operated stores to support our growth objectives.

The diversion of sales from our company-operated stores could adversely impact our return on investment and could lead to impairment charges and store closures, including lease exit costs.

We could have difficulty in recreating the in-store experience through direct channels.

Our failure to successfully integrate our digital and physical channels and respond to these risks might adversely impact our business and results of operations, as well as damage our reputation and brands.

If any of our products have manufacturing or design defects or are otherwise unacceptable to us or our guests, our business could be harmed.

16 unchanged sentences

Because of the fragmented nature of the industry, we also compete with other apparel sellers, including those specializing in yoga apparel and other activewear.

Many of our competitors have significant competitive advantages, including longer operating histories, larger and broader customer bases, more established relationships with a broader set of suppliers, greater brand recognition and greater financial, research and development, store development,

marketing, distribution, and other resources than we do.

Our competitors may be able to achieve and maintain brand awareness and market share more quickly and effectively than we can.

13 unchanged sentences

Even if we are successful in anticipating consumer preferences, our ability to adequately react to and address those preferences will in part depend upon our continued ability to develop and introduce innovative, high-quality products.

Our failure to effectively introduce new products that are accepted by consumers could result in a decrease in net revenue and excess inventory levels, which could have a material adverse effect on our financial condition.

Our failure to effectively introduce new products that are accepted by consumers could

result in a decrease in net revenue and excess inventory levels, which could have a material adverse effect on our financial condition.

Our results of operations could be materially harmed if we are unable to accurately forecast guest demand for our products.

5 unchanged sentences

Our limited operating experience and limited brand recognition in new international markets and new product categories may limit our expansion and cause our business and growth to suffer.

Our future growth depends in part on our expansion efforts outside of North America.

Our future growth depends in part on our expansion efforts outside of the Americas.

We have limited experience with regulatory environments and market practices internationally, and we may not be able to penetrate or successfully operate in any new market.

In connection with our expansion efforts we may encounter obstacles we did not face in North America, including cultural and linguistic differences, differences in regulatory environments, labor practices and market practices, difficulties in keeping abreast of market, business and technical developments, and international guests' tastes and preferences.

In connection with our expansion efforts we may encounter obstacles we did not face in the Americas, including cultural and linguistic differences, differences in regulatory environments, labor practices and market practices, difficulties in keeping abreast of market, business and technical developments, and international guests' tastes and preferences.

We may also encounter difficulty expanding into new international markets because of limited brand recognition leading to delayed acceptance of our technical athletic apparel by guests in these new international markets.

2 unchanged sentences

We may not be able to successfully manage integration of new product categories or the new product lines with our existing products.

Selling new product categories and lines will require our management to learn different strategies in order to be successful.

Selling new product categories and lines will require our management to test and develop different strategies in order to be successful.

We may be unsuccessful in entering new product categories and developing or launching new product lines, which requires management of new suppliers, potential new customers, and new business models.

18 unchanged sentences

We also lease the majority of our distribution centers and our inability to secure appropriate real estate or lease terms could impact our ability to deliver our products to the market.

Our future success is substantially dependent on the service of our senior management and other key employees.

Our future success is substantially dependent on the service of our senior management and our ability to maintain our culture and to attract, manage, and retain highly qualified individuals.

The performance of our senior management team and other key employees may not meet our needs and expectations.

1 unchanged sentence

Such disruption could have a material adverse impact on our financial performance, financial condition, and the market price of our stock.

If we are unable to successfully maintain and evolve our unique corporate culture, offer competitive compensation and benefits, and a desirable work model, we may be unable to attract and retain highly qualified individuals to support our business and continued growth.

If we are unable to successfully maintain and evolve our unique culture, offer competitive compensation and benefits, and a desirable work model, we may be unable to attract and retain highly qualified individuals to support our business and continued growth.

Our work model may not meet the needs and expectations of our employees and may not be perceived as favorable compared to other companies.

We also face risks related to employee engagement and productivity.

Unionization efforts or other employee organizing activities could lead to higher people costs or reduce our flexibility to manage our employees which may negatively disrupt our operations.

We also face risks related to employee engagement and productivity which could result in increased headcount and lead to increased labor costs.

Our business is affected by seasonality, which could result in fluctuations in our operating results.

7 unchanged sentences

We rely on international suppliers and any significant disruption to our supply chain could impair our ability to procure or distribute our products.

We do not manufacture our products or raw materials and rely on suppliers and manufacturers located predominantly in the Asia Pacific region, including the PRC.

We do not manufacture our products or raw materials and rely on suppliers and manufacturers located predominantly in APAC and China Mainland.

We also source other materials used in our products, including items such as content labels, elastics, buttons, clasps, and drawcords, from suppliers located primarily in this region.

Based on cost, during 2023:

• Approximately 39% of our products were manufactured in Vietnam, 14% in Cambodia, 12% in Sri Lanka, 8% in Bangladesh, and 7% in Indonesia, and the remainder in other regions.

• Approximately 42% of our products were manufactured in Vietnam, 16% in Cambodia, 11% in Sri Lanka, 10% in Indonesia, and 8% in Bangladesh, and the remainder in other regions.

• Approximately 40% of the fabric used in our products originated from Taiwan, 26% from China Mainland, 12% from Sri Lanka, and the remainder from other regions.

34 unchanged sentences

A significant portion of our products are produced in South Asia and South East Asia and increases in the costs of labor and other costs of doing business in the countries in this area could significantly increase our costs to produce our products and could have a negative impact on our operations and earnings.

Factors that could negatively affect our business include

labor shortages and increases in labor costs, labor disputes, pandemics, the impacts of climate change, difficulties and additional costs in transporting products manufactured from these countries to our distribution centers and significant revaluation of the currencies used in these countries, which may result in an increase in the cost of producing products.

Factors that could negatively affect our business include labor shortages and increases in labor costs, labor disputes, pandemics, the impacts of climate change, difficulties and additional costs in transporting products manufactured from these countries to our distribution centers and significant revaluation of the currencies used in these countries, which may result in an increase in the cost of producing products.

Also, the imposition of trade sanctions or other regulations against products imported by us from, or the loss of "normal trade relations" status with any country in which our products are manufactured, could significantly increase our cost of products and harm our business.

11 unchanged sentences

Measures we implement to protect against cyber-attacks may also have the potential to impact our customers' shopping experience or decrease activity on our websites by making them more difficult to use.

Data and security breaches can also occur as a result of non-technical issues including intentional or inadvertent breach by employees or persons with whom we have commercial relationships that result in the unauthorized release of personal or confidential information.

confidential information.

Any compromise or breach of our security could result in a violation of applicable privacy and other laws, significant legal and financial exposure, and damage to our brand and reputation or other harm to our business.

4 unchanged sentences

We are subject to a variety of privacy and data protection laws and regulations that change frequently and have requirements that vary from jurisdiction to jurisdiction.

For example, we are subject to significant compliance obligations under privacy laws such as the General Data Privacy Regulation ("GDPR") in the European Union, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in Canada, the California Consumer Privacy Act ("CCPA") modified by the California Privacy Rights Act (“CPRA”), and the Personal Information Protection Law (“PIPL”) in the PRC.

Some privacy laws prohibit the transfer of personal information to certain other jurisdictions.

6 unchanged sentences

The failure of our technology systems to operate properly or effectively, problems with transitioning to upgraded or replacement systems, or difficulty in integrating new systems, could adversely affect our business.

we have e-commerce websites in the United States, Canada, and internationally.

In addition, we have e-commerce websites in the United States, Canada, and internationally.

Our technology systems, websites, and operations of third parties on whom we rely, may encounter damage or disruption or slowdown caused by a failure to successfully upgrade systems, system failures, viruses, computer "hackers", natural disasters, or other causes.

These could cause information, including data related to guest orders, to be lost or delayed which could, especially if the disruption or slowdown occurred during the holiday season, result in delays in the delivery of products to our stores and guests or lost sales, which could reduce demand for our products and cause our sales to decline.

The concentration of our primary offices, two of our distribution centers, and a number of our stores along the west coast of North America could amplify the impact of a natural disaster occurring in that area to our business, including to our technology systems.

The concentration of our primary offices, several of our distribution centers, and a number of our stores along the west coast of North America could amplify the impact of a natural disaster occurring in that area to our business, including to our technology systems.

In addition, if changes in technology cause our information systems to become obsolete, or if our information systems are inadequate to handle our growth, we could lose guests.

5 unchanged sentences

We are increasingly using social media and proprietary mobile apps to interact with our customers and as a means to enhance their shopping experience.

Any failure on our part to provide attractive, effective, reliable, user-friendly e-commerce platforms that offer a wide assortment of merchandise with rapid delivery options and that continually meet the changing expectations of online shoppers could place us at a competitive disadvantage, result in the loss of e-commerce and other sales, harm our reputation with customers, have a material adverse impact on the growth of our e-commerce business globally and could have a material adverse impact on our business and results of operations.

(6) PRC includes China Mainland, Hong Kong SAR, Taiwan, and Macau SAR.

reputation with customers, have a material adverse impact on the growth of our e-commerce business globally and could have a material adverse impact on our business and results of operations.

Risks related to environmental, social, and governance issues

9 unchanged sentences

Increased scrutiny from investors and others regarding our environmental, social, governance, or sustainability, responsibilities could result in additional costs or risks and adversely impact our reputation, employee retention, and willingness of customers and suppliers to do business with us.

Investor advocacy groups, certain institutional investors, investment funds, other market participants, stockholders, and customers have focused increasingly on the environmental, social and governance ("ESG") or “sustainability” practices of companies, including those associated with climate change.

Investor and political advocacy groups, certain institutional investors, investment funds, other market participants, stockholders, and customers have focused increasingly on the environmental, social and governance ("ESG") practices of companies, including those associated with climate change and social responsibility.

These parties have placed increased importance on the implications of the social cost of their investments.

If our ESG practices do not meet investor or other industry stakeholder expectations and standards, which continue to evolve, our brand, reputation and employee retention may be negatively impacted based on an assessment of our ESG practices.

Any sustainability report that we publish or other sustainability disclosures we make may include our policies and practices on a variety of social and ethical matters, including corporate governance, environmental compliance, employee health and safety practices, human capital management, product quality, supply chain management, and workforce inclusion and diversity.

It is possible that stakeholders may not be satisfied with our ESG practices or the speed of their adoption.

We could also incur additional costs and require additional resources to monitor,

report, and comply with various ESG practices.

If our ESG practices do not meet customer, investor, employee, or other stakeholder expectations or do not align with their opinions or values, our brand, reputation, employee retention, and business may be negatively impacted.

Any sustainability report that we publish or other ESG disclosures we make may include our policies and practices on a variety of social and ethical matters, including corporate governance, environmental compliance, employee health and safety practices, human capital management, product quality, supply chain management, and workforce inclusion and diversity.

It is possible that stakeholders may not be satisfied with our ESG policies or practices, including if we overstate the impact of our ESG practices, and this could reduce demand for our products and lead to regulatory enforcement that could restrict our ability to market and sell our products.

We could also incur additional costs and require additional resources to monitor, report, and comply with various ESG practices.

Also, our failure, or perceived failure, to meet the standards included in any sustainability disclosure could negatively impact our reputation, employee retention, and the willingness of our customers and suppliers to do business with us.

4 unchanged sentences

Global economic conditions are uncertain and volatile, due in part to the potential impacts of increasing inflation, the potential impacts of geopolitical uncertainties, and any potential sanctions, restrictions or responses to those conditions.

As global economic conditions continue to be volatile or economic uncertainty remains, trends in consumer discretionary spending also remain unpredictable and subject to reductions due to credit constraints and uncertainties about the future.

For example, the PRC market presents a number of risks, including changes in laws and regulations, currency fluctuations, increased competition, and changes in economic conditions, including the risk of an economic downturn or recession, trade embargoes, restrictions or other barriers, as well as other conditions that may adversely impact consumer spending, any of which could cause us to fail to achieve anticipated growth.

As global economic conditions continue to be volatile or economic uncertainty remains, trends in consumer discretionary

spending also remain unpredictable and subject to reductions due to credit constraints and uncertainties about the future.

Unfavorable economic conditions may lead consumers to delay or reduce purchases of our products.

2 unchanged sentences

Our financial condition could be adversely affected by global or regional health events such as the COVID-19 pandemic and related government, private sector, and individual consumer responsive actions.

The recent COVID-19 pandemic negatively impacted the global economy, disrupted consumer spending and global supply chains, and created significant volatility and disruption of financial markets.

The COVID-19 pandemic negatively impacted the global economy, disrupted consumer spending and global supply chains, and created significant volatility and disruption of financial markets.

The COVID-19 pandemic and related government, private sector, and individual consumer responsive actions negatively impacted our business operations, store traffic, employee availability, supply chain, financial condition, liquidity, and cash flows.

11 unchanged sentences

The results of any audits or related disputes regarding these restrictions or regulations could have an adverse effect on our financial statements for the period or periods for which the applicable final determinations are made.

Countries impose,

modify, and remove tariffs and other trade restrictions in response to a diverse array of factors, including global and national economic and political conditions, which make it impossible for us to predict future developments regarding tariffs and other trade restrictions.

Countries impose, modify, and remove tariffs and other trade restrictions in response to a diverse array of factors, including global and national economic and political conditions, which make it impossible for us to predict future developments regarding tariffs and other trade restrictions.

Trade restrictions, including tariffs, quotas, embargoes, safeguards, and customs restrictions, could increase the cost or reduce the supply of products available to us, could increase shipping times, or may require us to modify our supply chain organization or other current business practices, any of which could harm our business, financial condition, and results of operations.

2 unchanged sentences

Adverse changes in, or withdrawal from, trade agreements or political relationships between the United States and the PRC, Canada, or other countries where we sell or source our products, could negatively impact our results of operations or cash flows.

Any tariffs imposed between the United States and the PRC could increase the costs of our products.

General geopolitical instability and the responses to it, such as the possibility of sanctions, trade restrictions, and changes in tariffs, including recent sanctions against the PRC, tariffs imposed by the United States and the PRC, and the possibility of additional tariffs or other trade restrictions between the United States and Mexico, could adversely impact our business.

General geopolitical instability and the responses to it, such as the possibility of sanctions, trade restrictions, and changes in tariffs, including sanctions against the PRC, tariffs imposed by the United States and the PRC, and the possibility of additional tariffs or other trade restrictions, could adversely impact our business.

It is possible that further tariffs may be introduced, or increased.

Such changes could adversely impact our business and could increase the costs of sourcing our products from the PRC, or could require us to source more of our products from other countries.

Such changes could adversely impact our business and could increase the costs of sourcing our

products from the PRC as well as other countries, or could require us to source our products from different countries.

The Uyghur Forced Labor Prevention Act and other similar legislation may lead to greater supply chain compliance costs and delays to us and to our vendors.

There could be changes in economic conditions in the United Kingdom ("UK") or European Union ("EU"), including due to the UK's withdrawal from the EU, foreign currency exchange rates, and consumer markets.

Our business could be adversely affected by these changes, including by additional duties on the importation of our products into the UK from the EU and as a result of shipping delays or congestion.

Changes in tax laws or unanticipated tax liabilities could adversely affect our effective income tax rate and profitability.

4 unchanged sentences

The extent to which the accumulated earnings of our Canadian subsidiaries can be repatriated as a return of capital is dependent on, among other things, the amount of paid-up-capital in our Canadian subsidiaries and transactions undertaken by our exchangeable shareholders.

Generally, exchange transactions by our exchangeable shareholders result in an increase in the amount of paid-up-capital in our Canadian subsidiaries and so increase the amount which can be repatriated free of Canadian withholding taxes.

Prior to 2022, we had not accrued for Canadian withholding taxes because the accumulated earnings of, or 'net investment' in, our Canadian subsidiaries was either indefinitely reinvested or could be repatriated as a return of capital without payment of withholding tax.

During 2022, the net investment in our Canadian subsidiaries, which was not indefinitely reinvested, exceeded the paid-up capital and therefore we have accrued for Canadian withholding taxes on the portion of our net investment which we expect to be unable to repatriate free of withholding tax.

Absent any transactions by our exchangeable shareholders or any changes to the permanently reinvested amounts, and if our Canadian subsidiaries continues to accumulate profits, we will record additional deferred tax liabilities for Canadian withholding taxes on the amount in excess of the paid-up capital balance, and our effective tax rate will increase.

As a result, we expect the effective tax rate to increase in 2023.

Since 2022, the net investment in our Canadian subsidiaries, which was not indefinitely reinvested, exceeded the paid-up capital and therefore we recognized Canadian withholding taxes on the portion of our net investment which we are unable to repatriate free of withholding tax.

In 2024, assuming there are no exchange transactions by our exchangeable shareholders, we will continue to recognize Canadian withholding taxes on the accumulated earnings of our Canadian subsidiaries which are not indefinitely reinvested.

We engage in a number of intercompany transactions across multiple tax jurisdictions.

1 unchanged sentence

At the end of 2020, our Advance Pricing Arrangement ("APA") with the Internal Revenue Service and the Canada Revenue Agency expired.

stipulated the allocation of certain profits between the U.S.

This APA stipulated the allocation of certain profits between the U.S.

We are currently in the process of negotiating the renewal of this arrangement and the final agreed upon terms and conditions thereof could impact our effective tax rate.

2 unchanged sentences

Tax Cuts and Jobs Act, and in 2020 with the passage of the Coronavirus Aid, Relief, and Economic Security Act.

Certain provisions of the recently enacted Inflation Reduction Act, including a 15% corporate alternative minimum tax, as well as the similar 15% global minimum tax under the Organization for Economic Cooperation and Development's Pillar Two Global Anti-Base Erosion Rules, may impact our income tax expense, profitability, and capital allocation decisions.

Certain provisions of the Inflation Reduction Act passed in 2022, including a 15% corporate alternative minimum tax, as well as the similar 15% global minimum tax under the Organization for Economic Cooperation and Development's Pillar Two Global Anti-Base Erosion Rules, may impact our income tax expense, profitability, and capital allocation decisions.

Our failure to comply with trade and other regulations could lead to investigations or actions by government regulators and negative publicity.

The labeling, distribution, importation, marketing, and sale of our products are subject to extensive regulation by various federal agencies, including the Federal Trade Commission, Consumer Product Safety Commission and state attorneys general in the United States, the Competition Bureau and Health Canada in Canada, the State Administration for Market Regulation of the PRC, General Administration of Customs of the PRC, as well as by various other federal, state, provincial, local, and international regulatory authorities in the countries in which our products are distributed or sold.

The labeling, distribution, importation, marketing, and sale of our products, as well as components of our products, including chemicals, are subject to extensive regulation by various regulatory bodies.

These include federal agencies such as the Federal Trade Commission, Consumer Product Safety Commission and state attorneys general in the United States, the Competition Bureau and Health Canada in Canada, the State Administration for Market Regulation of the PRC, General Administration of Customs of the PRC, as well as other federal, state, provincial, local, and international regulatory authorities in the countries in which our products are distributed or sold.

If we fail to comply with any of these regulations, we could become subject to enforcement actions or the imposition of significant penalties or claims, which could harm our results of operations or our ability to conduct our business.

1 unchanged sentence

An unfavorable outcome of any particular proceeding could have an adverse impact on our business, financial condition, and results of operations.

In addition, the adoption of new regulations or changes in the interpretation of existing regulations may result in significant compliance costs or discontinuation of product sales and could impair the marketing of our products, resulting in significant loss of net revenue.

In addition, the adoption of new regulations

or changes in the interpretation of existing regulations may result in significant compliance costs or discontinuation of product sales and could impair the marketing of our products, resulting in significant loss of net revenue.

Our international operations are also subject to compliance with the U.S.

Foreign Corrupt Practices Act, or FCPA, and other anti-bribery laws applicable to our operations.

Foreign Corrupt Practices Act ("FCPA") and other anti-bribery laws applicable to our operations.

In many countries, particularly in those with developing economies, it may be a local custom that businesses operating in such countries engage in business practices that are prohibited by the FCPA or other U.S.

and international laws and regulations applicable to us.

As we expand our operations across multiple jurisdictions, we could be subject to conflicting laws, or differing consumer sentiment on application of laws, that could lead to non-compliance which could have an adverse effect on our operations.

Although we have implemented procedures designed to ensure compliance with the FCPA and similar laws, some of our employees, agents, or other partners, as well as those companies to which we outsource certain of our business operations, could take actions in violation of our policies.

Any such violation could have a material and adverse effect on our business.

As we expand internationally, we are subject to complex employee regulations, and if we fail to comply with these regulations, we could be subject to enforcement actions or negative employee relations which could harm our results of operations.

Because a significant portion of our net revenue and expenses are generated in countries other than the United States, fluctuations in foreign currency exchange rates have affected our results of operations and may continue to do so in the future.

24 unchanged sentences

The steps we take to protect our intellectual property rights may not be adequate to prevent infringement of these rights by others, including imitation of our products and misappropriation of our brand.

In addition, any of our intellectual property rights may be challenged, which could result in them being narrowed in scope or declared invalid or unenforceable, or our intellectual property protection may be unavailable or limited in some international countries where laws or law enforcement practices may not protect our intellectual property rights as fully as in the United States or Canada, and it may be more difficult for us to successfully challenge the use of our intellectual property rights by other parties in these countries.

In addition, any of our intellectual

property rights may be challenged, which could result in them being narrowed in scope or declared invalid or unenforceable, or our intellectual property protection may be unavailable or limited in some international countries where laws or law enforcement practices may not protect our intellectual property rights as fully as in the United States or Canada, and it may be more difficult for us to successfully challenge the use of our intellectual property rights by other parties in these countries.

If we fail to protect and maintain our intellectual property rights, the value of our brand could be diminished, and our competitive position may suffer.

19 unchanged sentences

We expect that the occurrence of infringement claims is likely to grow as the market for fitness products and services grows and as we introduce new and updated products and offerings.

Accordingly, our exposure to damages resulting from infringement claims

could increase and this could further exhaust our financial and management resources.

Accordingly, our exposure to damages resulting from infringement claims could increase and this could further exhaust our financial and management resources.

Any of the foregoing could prevent us from competing effectively and could have an adverse effect on our business, financial condition, and operating results.

7 unchanged sentences

We may be subject to actions or proposals from stockholders or others that may not align with our business strategies or the interests of our other stockholders.

Responding to such actions can be costly and time-consuming, disrupt our business and operations, and divert the attention of our board of directors, management, and employees from the pursuit of our business strategies.

Responding to such actions can be costly and time-consuming, disrupt our business

and operations, and divert the attention of our board of directors, management, and employees from the pursuit of our business strategies.

Such activities could interfere with our ability to execute our strategic plan.

14 unchanged sentences

Section 203 could have the effect of delaying, deferring, or preventing a change in control that our stockholders might consider to be in their best interests.

CYBERSECURITY

Risk Management and Strategy

Our business operations and relationships with customers and suppliers are heavily reliant on technology.

We operate a cybersecurity program designed to assess our security risks and threats, to manage those risks and protect our technology systems and data, and to detect and respond to cybersecurity incidents.

We manage strategic risks, including cybersecurity risk, through our Enterprise Risk Management program which has direct involvement from the board of directors, the audit committee, and senior management.

Through this process, we have identified cybersecurity as a risk management priority.

Our board of directors provides oversight of cybersecurity risks and has delegated primary responsibility to the audit committee, which is responsible for overseeing our enterprise risk assessments and management policies, procedures, and practices (including regarding those risks related to information security, cybersecurity, and data protection).

The audit committee maintains a cybersecurity sub-committee that is comprised of our Chief Information Officer ("CIO"), our Chief Information Security Officer ("CISO"), and representatives from the audit committee and board of directors that have knowledge and experience in cybersecurity matters.

The cybersecurity sub-committee reviews our cybersecurity

risk assessments and the steps being taken to monitor, control, and report on those risks as well as discusses regulatory and market developments.

They also review our process for identifying and responding to cybersecurity incidents in a timely manner, and details of cybersecurity attacks or incidents which have occurred.

Management generally meets with, and provides reports to, the cybersecurity sub-committee on a quarterly basis.

Our CIO and CISO also meet with and provide reports to the audit committee at least quarterly.

The board of directors receives periodic reports regarding the activities of the cybersecurity sub-committee.

These reports and meetings are designed to inform the board of directors and committees about the current state of our information security program including cybersecurity risks, the nature, timing, and extent of cybersecurity incidents, if any, and the resolution of such matters.

Cybersecurity Program and Incident Response

Our CISO is responsible for our cybersecurity program, including risk assessments, information security activities, and controls.

The CISO is responsible for establishing and maintaining corporate information security policies and overseeing our risk management activities, which prioritize vulnerability management, risk reduction, and prevention.

Our CISO also leads our Cyber Defense and Incident Response (“CDIR”) team which identifies, assesses, escalates, and remediates cybersecurity incidents.

Our current CISO has over 25 years of experience in information security across different industries in the US, Europe, and South and Central America.

Our current CISO is a member of the Information Systems Audit and Control Association and brings extensive experience and knowledge of cybersecurity risk management.

The CDIR team identifies, tracks, reviews, assesses, and takes actions over key cybersecurity risks including but not limited to:

(i) third parties/vendors, (ii) cloud security, (iii) malicious code, (iv) our digital e-commerce channels and systems, and (v) our store technology.

The CDIR team also undertakes enterprise architecture reviews, considers cyber defense and incident response findings, performs vulnerability scans, and assesses threats and performs landscape intelligence analysis.

As part of our cybersecurity program, we conduct cybersecurity awareness training including phishing simulations and supplemental campaigns as well as mandatory e-learning for all our employees.

Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns.

We work with third-party cybersecurity advisors to undertake assessments of our critical systems and to remediate any high-risk vulnerabilities identified.

We also engage third parties to perform penetration testing on our key systems to identify potential weaknesses.

As part of our cyber incident response plan, we utilize an established framework to assess the severity of cybersecurity incidents.

Under the plan, incidents are escalated to relevant senior management, and the board of directors, as appropriate, based on their severity.

Our disclosure committee assesses the materiality of severe incidents including both quantitative and qualitative factors.

Third Parties

We utilize third-party service providers as a normal part of our business operations.

To address cybersecurity risks arising from our relationships with third-party service providers, we employ a vendor risk program.

We monitor risks relating to potential compromises of sensitive information at our third-party service providers and re-evaluate the risks associated with our partners periodically.

Prior to exchanging our data with third-party service providers, they are required to go through a vendor risk assessment.

We also conduct third-party security reviews and evaluate their network, processes, and systems.

In addition, we obtain annual attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.

Impact of Cybersecurity Risks on Strategy and Results

Based on the information available as of the date of this Annual Report, we have not been materially affected by any previous cybersecurity incidents.

However, we continue to experience cyber-attacks, including phishing, and other attempts to break or gain unauthorized access to our systems that could materially affect us in the future.

For further information, see “Risks related to information security and technology” included in Item 1A.

Risk Factors of this Annual Report.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors