Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

432 paragraphs · Services-Computer Programming, Data Processing, Etc. show all sectors

We transfer personal data relating to our employees, clients and their users from the European Economic Area (“EEA”), the United Kingdom, Switzerland, and other jurisdictions to the United States and other countries. Following the invalidation of the EU-U.S. and Swiss-U.S. Privacy Shield frameworks by the Court of Justice of the European Union in 2020 and the imposition of additional requirements regarding the use of standard contractual clauses (“SCCs”), cross-border data transfer mechanisms

Read in the 10-K filed Feb 19, 2026 ↗

have been subject to heightened regulatory scrutiny, evolving guidance, and legal challenge. The European Commission adopted updated SCCs in 2021, and the United Kingdom has implemented its own contractual transfer mechanisms, which have increased compliance complexity and costs. In July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), and related frameworks for the United Kingdom and Switzerland subsequently became effective. We are certified under these frameworks, where applicable; however, they are subject to ongoing review and potential legal challenge and may be modified, suspended, or invalidated in the future. Regulators in certain European jurisdictions have also taken the position that specific data transfer practices, including the use of certain analytics tools, may result in unlawful transfers of personal data to the United States. If existing data transfer mechanisms are restricted or invalidated, or if additional measures are required, we and our business partners and service providers may need to implement alternative or supplemental safeguards, renegotiate contracts, or modify our operations, which could increase costs, limit our ability to process personal data, disrupt our advertising solutions or other offerings, and expose us and our customers to regulatory investigations or enforcement actions. Similar cross-border data transfer restrictions under other current or future laws such as Brazil’s General Data Protection Law and China’s Personal Information Protection Law may further increase compliance burdens and adversely affect our business, financial condition, and results of operations.

Read in the 10-K filed Feb 19, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to digital assets, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. Emerging risks, such as AI-driven cyberattacks and the potential for quantum computing, could introduce new vulnerabilities in our systems, potentially rendering traditional cryptographic techniques less effective and exposing us to more sophisticated forms of cyberattacks. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Novel methods, such as those utilizing AI or quantum computing, may be even more difficult to detect and defend against. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with geopolitical conflicts, such as the ongoing Russia-Ukraine conflict, including potential proliferation of malware into systems unrelated to such conflicts. As of the date of this Annual Report, neither we nor any of our service providers has experienced a security breach or cyberattack that has materially impacted our digital asset holdings, financial condition or operating results; however, any future breach of our operations or those of our service providers or others in the digital asset industry could materially and adversely affect our business.

Read in the 10-K filed Feb 27, 2026 ↗