Sprout Social, Inc. 10-Q

Item 1A. Risk Factors Other than the risk factors set forth below, there have been no material changes from the risk factors disclosed in our Annual Report (under the heading “Risk Factors” ) in response to Part 1, Item 1A of the Form 10-K. The effects of the COVID-19 pandemic are unpredictable and may materially affect our customers and how we operate our business, and the duration and extent to which the pandemic continues (including any re-emergence of COVID-19) to threaten our future results of operations and overall financial performance remains uncertain . In December 2019, a novel coronavirus disease (“COVID-19”) was identified. On March 11, 2020, the World Health Organization characterized COVID-19 as a global pandemic. The pandemic has resulted in a widespread health crisis that has adversely affected businesses, economies and financial markets worldwide and has caused significant volatility in U.S. and international debt and equity markets. Examples of how COVID-19 may impact our business, results of operations and Class A common stock price include, but are not limited to: • COVID-19 may cause companies to decrease marketing and social media spending, or pause such spending altogether, making it more difficult for us to acquire new customers, as well as retain and upsell existing customers. A key factor in our ability to acquire a new customer and retain and increase the spending of an existing customer is the customer’s marketing or social media budget. The economic stress of COVID-19 may cause companies to decrease or freeze their marketing and social media budget and we cannot predict the length that such budgets will be impacted. This may prevent prospective customers from converting to paying customers and prevent existing customers from renewing an existing subscription or increasing their spending with us or cause our existing customers to terminate their subscriptions. We may experience longer sales cycles and greater uncertainty regarding our sales pipeline for a given quarter. In addition, the impact of COVID-19 could reduce interest in our webinars, blogs, thought leadership and social media engagement, thereby reducing traffic to our web properties and free trials. A reduction in volume or quality of our inbound marketing funnel could have an adverse impact on our business and results of operations. • Customers may be less likely to pay us on-time or at all. For the fiscal year ended December 31, 2019 and the nine months ended September 30, 2020, 99% of our revenue was from subscriptions. Customers under economic stress from COVID-19 may be less willing or may be unable to pay our invoices as they become due. This could, in-turn, cause a decrease in our revenue, an increase in our account receivables and the aging of our accounts receivables. In the nine months ended September 30, 2020, compared to the same period ended September 30, 2019, we increased our bad debt expense by $0.7 million due to our assessment of the potential COVID-19 impact on customer’s ability to pay. It is possible that the impact of COVID-19 may further increase our bad debt expense. • COVID-19 and related government responses to address the COVID-19 pandemic may cause sudden and extreme changes in our Class A common stock price. Since COVID-19 was first reported, the volatility of U.S. equity markets increased to historic levels. This has caused extreme fluctuations in the market price of our Class A common stock. We cannot predict if and 44 when these fluctuations will decrease or increase. In addition to general market conditions, the market price of our Class A common stock could be volatile or decline due to actual or anticipated impact of COVID-19 on our financial condition and results of operations or if our results of operations do not meet the expectations of the investor community or one or more of the analysts who cover our company change their recommendations regarding our company. The duration and extent of the impact on our business from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time (e.g., the severity and transmission rate of the virus, the extent and effectiveness of containment measures, and the impact of these and other factors on our employees, customers, vendors and partners, including their respective productivity). Furthermore, our limited operating history combined with the uncertainty created by the COVID-19 pandemic significantly increases the difficulty of forecasting operating results and of strategic planning. If we are unable to effectively predict and manage the impact of the COVID-19 pandemic on our business, our results of operations and financial condition may be negatively impacted. Changing regulations and increased awareness relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information and harm our brand. We receive, store and otherwise process personal information and other data from and about our customers, employees and from other stakeholders like our vendors. We also receive personal information and other data about our customers’ consumers or other social media audiences. There are numerous federal, state, local and international laws and regulations regarding privacy, data protection, information security and the storing, sharing, use, processing, transfer, disclosure, retention and protection of personal information and other content, the scope of which is rapidly changing, subject to differing interpretations and may be inconsistent among; regions, countries and states, or conflict with other legal requirements. We are also subject to contractual obligations from our customers and other third parties related to privacy, data protection and information security, and disclosures and commitments made in our privacy policies. We strive to comply with applicable laws, regulations, policies and other legal obligations relating to privacy, data protection and information security. However, the regulatory framework for privacy, data protection and information security worldwide is, and is likely to remain, uncertain for the foreseeable future, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. We also expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. The United States, the European Union, or EU, the United Kingdom and other countries in which we operate are increasingly adopting or revising privacy, information security and data protection laws and regulations that could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of customer, consumer and/or employee information, as well as any other third-party information we receive, and some of our current or planned business activities. New and changing laws, regulations, and industry standards concerning privacy, data protection and information security may also impact the social media platforms and data providers we utilize, and thereby indirectly impact our business. In the United States, this includes increased privacy-related regulations and enforcement activity at both the federal level and state levels that impose requirements on the personal information we collect in the course of our business activities. In the EU and the United Kingdom, this includes the General Data Protection Regulation, or GDPR, which came into effect in May 2018. While we have taken measures to comply with applicable requirements contained in the GDPR, we may need to continue to make adjustments as more clarification and guidance on the requirements of the GDPR and how to comply with such requirements becomes available. Further, Brexit has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, although the United Kingdom intends to give continuing effect to the GDPR in the United Kingdom by means of the UK GDPR, which is 45 designed to be consistent with the GDPR, uncertainty remains regarding how data transfers to and from the United Kingdom will be regulated and the extent to which data protection standards under the UK GDPR will depart from the EU GDPR in the longer term. Uncertainty in the laws and regulations affecting cross border transfers of personal data may affect the demand and functionality of our services. In the past we have self-certified adherence to the U.S. Department of Commerce’s EU-U.S. Privacy Shield Framework (the “Privacy Shield”), which established a means for legitimizing the transfer of personal data from the European Economic Area (“EEA”) to the United States. On July 16, 2020, the Court of Justice of the European Union invalidated the Privacy Shield as a mechanism for lawfully transferring personal data from the EEA. As a result, we will need to establish alternate lawful means of transferring personal data from the EEA to the United States. This may include entering into standard contractual clauses approved by the European Commission with customers. Further, different European data protection regulators may impose additional requirements or apply differing standards for the transfer of personal data or even prohibit data transfers to certain non-EEA countries, like the U.S. Such standards may be particularly targeted at the social media companies with whom we work. This creates significant additional uncertainty regarding our ability to lawfully transfer certain personal data from the EEA to the United States and we may need to implement substantial changes to our information technology infrastructure as a result, which could take time and be costly. Following the Court of Justice of the European Union’s ruling, the Swiss-U.S Privacy Shield Framework has also been invalidated by the Swiss data protection regulator, meaning that we also need to put in place an alternative data transfer mechanism for transferring data from Switzerland to the U.S. California also recently enacted legislation, the California Consumer Privacy Act of 2018, or CCPA, that affords consumers expanded privacy protections and control over the collection, use and sharing of their personal information. The CCPA went into effect on January 1, 2020. The potential effects of this legislation are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. For example, the CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The California State Attorney General began enforcing the CCPA on July 1, 2020; to the extent that we have not fully implemented the data processing practices and policies necessary to comply with the CCPA, the Attorney General may serve us with an enforcement notice under the CCPA and impose civil penalties for violations. The CCPA also provides for a private right of action for data breaches that may increase data breach litigation. With laws and regulations such as the GDPR in the EU and the CCPA in the United States imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices, and may incur significant costs and expenses in an effort to do so. For example, the increased consumer control over the sharing of their personal information afforded by CCPA may affect our customers’ ability to share such personal information with us or may require us to delete or remove consumer information from our records or data sets, which may create considerable costs for our organization. In addition, any failure or perceived failure by us to comply with our privacy policies, our privacy-, data protection- or information security-related obligations to customers, users or other third parties or any of our other legal obligations relating to privacy, data protection or information security may result in governmental investigations or enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others, and could result in significant liability, loss of relationships with key third parties including social media networks and other data providers, or cause our users to lose trust in us, which could have an adverse effect on our reputation and business. Companies like ours in the social media industry are under particular scrutiny from EU regulators as well as individuals seeking to bring claims for alleged non-compliance. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform. 46 Additionally, if the third parties we work with, such as vendors or developers, violate applicable laws or regulations or our policies, such violations may also put our customers’ and their users’ and consumers’ or other social media audiences’ content at risk and could in turn have an adverse effect on our business. Any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of such content, or regarding the manner in which the express or implied consent of such persons for the collection, use, retention or disclosure of such content is obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process user data or develop new services and features. All of these implications could adversely affect our revenue, results of operations, business and financial condition. 47 INDEX TO EXHIBITS 31.1 Certifications of Chief Executive Officer Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 31.2 Certifications of Chief Financial Officer Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 32.1* Certifications of Chief Executive Officer Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002. 32.2* Certifications of Chief Financial Officer Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002. 101 The following information from our Quarterly Report on Form 10-Q for the quarter ended September 30, 2020, formatted in Inline XBRL: (i) Condensed Consolidated Balance Sheets, (ii) Condensed Consolidated Statements of Operations and Comprehensive Loss, (iii) Condensed Consolidated Statements of Convertible Preferred Stock and Stockholders’ Equity, (iv) Condensed Consolidated Statements of Cash Flows and (v) Notes to Condensed Consolidated Financial Statements 104 The cover page from the Quarterly Report on Form 10-Q, formatted as Inline XBRL. ________________ * Furnished, not filed. *** 48 SIGNATURE Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned; thereunto duly authorized. Sprout Social, Inc. November 10, 2020 By: /s/ Joe Del Preto Joe Del Preto Chief Financial Officer and Treasurer (Principal Financial and Principal Accounting Officer) 49