What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2020-11-10 compared with 2020-08-06 · 22 added, 19 removed, 68 unchanged (38% of the section changed)

14 unchanged sentences

• Customers may be less likely to pay us on-time or at all.

For the fiscal year ended December 31, 2019 and the six months ended June 30, 2020, 99% of our revenue was from subscriptions.

For the fiscal year ended December 31, 2019 and the nine months ended September 30, 2020, 99% of our revenue was from subscriptions.

Customers under economic stress from COVID-19 may be less willing or may be unable to pay our invoices as they become due.

This could, in-turn, cause a decrease in our revenue, an increase in our account receivables and the aging of our accounts receivables.

In the six months ended June 30, 2020, compared to the same period ended June 30, 2019, we increased our bad debt expense by $0.7 million due to our assessment of the potential COVID-19 impact on customer’s ability to pay.

In the nine months ended September 30, 2020, compared to the same period ended September 30, 2019, we increased our bad debt expense by $0.7 million due to our assessment of the potential COVID-19 impact on customer’s ability to pay.

It is possible that the impact of COVID-19 may further increase our bad debt expense.

3 unchanged sentences

This has caused extreme fluctuations in the market price of our Class A common stock.

We cannot predict if and when

these fluctuations will decrease or increase.

We cannot predict if and

when these fluctuations will decrease or increase.

In addition to general market conditions, the market price of our Class A common stock could be volatile or decline due to actual or anticipated impact of COVID-19 on our financial condition and results of operations or if our results of operations do not meet the expectations of the investor community or one or more of the analysts who cover our company change their recommendations regarding our company.

3 unchanged sentences

Changing regulations and increased awareness relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information and harm our brand.

We receive, store and otherwise process personal information and other data from and about our customers and our employees.

We receive, store and otherwise process personal information and other data from and about our customers, employees and from other stakeholders like our vendors.

We also receive personal information and other data about our customers’ consumers or other social media audiences.

There are numerous federal, state, local and international laws and regulations regarding privacy, data protection, information security and the storing, sharing, use, processing, transfer, disclosure, retention and protection of personal information and other content, the scope of which is rapidly changing, subject to differing interpretations and may be inconsistent among countries and states, or conflict with other rules.

We are also subject to the terms of our privacy policies and contractual obligations to third parties related to privacy, data protection and information security.

regions, countries and states, or conflict with other legal requirements.

We are also subject to contractual obligations from our customers and other third parties related to privacy, data protection and information security, and disclosures and commitments made in our privacy policies.

We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security.

1 unchanged sentence

We also expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions.

The United States, the European Union, or EU, and other countries in which we operate are increasingly adopting or revising privacy, information security and data protection laws and regulations that could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of customer, consumer and/or employee information, as well as any other third-party information we receive, and some of our current or planned business activities.

The United States, the European Union, or EU, the United Kingdom and other countries in which we operate are increasingly adopting or revising privacy, information security and data protection laws and regulations that could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of customer, consumer and/or employee information, as well as any other third-party information we receive, and some of our current or planned business activities.

New and changing laws, regulations, and industry standards concerning privacy, data protection and information security may also impact the social media platforms and data providers we utilize, and thereby indirectly impact our business.

In the United States, this includes increased privacy-related regulations and enforcement activity at both the federal level and state levels that impose requirements on the personal information we collect in the course of our business activities.

In the EU, this includes the General Data Protection Regulation, or GDPR, which came into effect in May 2018.

In the EU and the United Kingdom, this includes the General Data Protection Regulation, or GDPR, which came into effect in May 2018.

While we have taken measures to comply with applicable requirements contained in the GDPR, we may need to continue to make adjustments as more clarification and guidance on the requirements of the GDPR and how to comply with such requirements becomes available.

Further, Brexit has created uncertainty with regard to the regulation of data protection in the United Kingdom.

In particular, although the United Kingdom enacted a Data Protection Act in May 2018 that is designed to be consistent with the GDPR, uncertainty remains regarding how data transfers to and from the United Kingdom will be regulated.

In particular, although the United Kingdom intends to give continuing effect to the GDPR in the United Kingdom by means of the UK GDPR, which is

designed to be consistent with the GDPR, uncertainty remains regarding how data transfers to and from the United Kingdom will be regulated and the extent to which data protection standards under the UK GDPR will depart from the EU GDPR in the longer term.

Uncertainty in the laws and regulations affecting cross border transfers of personal data may affect the demand and functionality of our services.

2 unchanged sentences

Privacy Shield Framework (the “Privacy Shield”), which established a means for legitimizing the transfer of personal data from the European Economic Area (“EEA”) to the United States.

On July 16, 2020, the Court of Justice of the European Union invalidated the Privacy Shield.

As a result, we may need to establish alternate legitimate means of transferring personal data from the EEA to the United States.

The legitimacy of these alternate means are subject to differing interpretations among various European jurisdictions and may result in different European data protection regulators applying differing standards for the transfer of personal data.

On July 16, 2020, the Court of Justice of the European Union invalidated the Privacy Shield as a mechanism for lawfully transferring personal data from the EEA.

As a result, we will need to establish alternate lawful means of transferring personal data from the EEA to the United States.

This may include entering into standard contractual clauses approved by the European Commission with customers.

Further, different European data protection regulators may impose additional requirements or apply differing standards for the transfer of personal data or even prohibit data transfers to certain non-EEA countries, like the U.S.

Such standards may be particularly targeted at the social media companies with whom we work.

This creates significant additional uncertainty regarding our ability to lawfully transfer certain personal data from the EEA to the United States and we may need to implement substantial changes to our information technology infrastructure as a result, which could take time and be costly.

It is unclear if this ruling will also affect the U.S.

Switzerland Privacy Shield Framework.

Following the Court of Justice of the European Union’s ruling, the Swiss-U.S Privacy Shield Framework has also been invalidated by the Swiss data protection regulator, meaning that we also need to put in place an alternative data transfer mechanism for transferring data from Switzerland to the U.S.

California also recently enacted legislation, the California Consumer Privacy Act of 2018, or CCPA, that affords consumers expanded privacy protections and control over the collection, use and sharing of their personal information.

8 unchanged sentences

In addition, any failure or perceived failure by us to comply with our privacy policies, our privacy-, data protection- or information security-related obligations to customers, users or other third parties or any of our other legal obligations relating to privacy, data protection or information security may result in governmental investigations or enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others, and could result in significant liability, loss of relationships with key third parties including social media networks and other data providers, or cause our users to lose trust in us, which could have an adverse effect on our reputation and business.

Companies like ours in the social media industry are under particular scrutiny from EU regulators as well as individuals seeking to bring claims for alleged non-compliance.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform.

Additionally, if the third parties we work with, such as vendors or developers, violate applicable laws or regulations or our policies, such violations may also put our customers’ and their users’ and consumers’ or other social media audiences’ content at risk and could in turn have an adverse effect on our business.

Any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of such content, or regarding the manner in which the express or implied consent of such persons for the collection, use, retention or disclosure of such content is obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process user

data or develop new services and features.

All of these implications could adversely affect our revenue, results of operations, business and financial condition.

4 unchanged sentences

32.2* Certifications of Chief Financial Officer Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002.

The following information from our Quarterly Report on Form 10-Q for the quarter ended June 30, 2020, formatted in Inline XBRL:

101 The following information from our Quarterly Report on Form 10-Q for the quarter ended September 30, 2020, formatted in Inline XBRL:

(i) Condensed Consolidated Balance Sheets, (ii) Condensed Consolidated Statements of Operations and Comprehensive Loss, (iii) Condensed Consolidated Statements of Convertible Preferred Stock and Stockholders’ Equity, (iv) Condensed Consolidated Statements of Cash Flows and (v) Notes to Condensed Consolidated Financial Statements

5 unchanged sentences

Sprout Social, Inc.

August 6, 2020

November 10, 2020 By:

/s/ Joe Del Preto

2 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors