Pattern Group, Inc. Class A (PTRN) Risk Analysis

In connection with running our business, we receive, store, use and otherwise process information that relates to individuals and/or constitutes "personal data," "personal information," "personally identifiable information," or similar terms under applicable data privacy and security laws (collectively, "personal information"). The legislative and regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of personal information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Globally, several jurisdictions, including those in which we operate or collect personal information, have established their own data privacy and security frameworks with which we must comply. For example, in the United States, numerous federal and state laws and regulations, including state data breach notification laws, marketing/advertising laws, and federal and state consumer protection and data privacy and security laws (e.g., Section 5 of the Federal Trade Commission Act and the California Consumer Privacy Act ("CCPA") and similar laws in other states), that govern the collection, use, disclosure and protection of personal information, apply to our operations and the operations of our business partners and service providers. The CCPA, which went into effect on January 1, 2020, established a comprehensive privacy framework for covered businesses by creating an expanded definition of personal information, and, amongst other requirements, establishing robust data privacy rights for California residents, imposing significant transparency obligations on covered businesses and requiring CCPA-compliant contracts between covered businesses and their service providers. It also provides for civil penalties for violations, and allows for a private right of action for data breaches that is expected to increase data breach litigation. In addition to the CCPA, similar privacy and data security laws have been enacted or proposed in numerous other states as well as in the U.S. Congress. These laws impose similar, additional and, in some cases, more restrictive requirements than the CCPA created. Such legislation adds additional complexity, variation in requirements, restrictions and potential legal risk, requires additional investment of resources in compliance programs, impacts strategies and could result in increased compliance costs and/or changes in business practices and policies. Certain states have also passed laws regulating specific aspects of privacy. For example, the State of Washington passed a law regulating health information, including inferences about consumer health derived from non-sensitive information, and other states have passed stringent privacy laws addressing a wide range of topics, including data brokers, data about kids and teens, automated decision making, targeted advertising and the collection and use of biometric information. The existence of data privacy and security laws in different states in the country makes our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. These various data privacy and security laws may impact our business activities, including relationships with business partners and ultimately the marketing and distribution of our brand partners' products. State laws are changing rapidly, and there is discussion in the U.S. Congress of a new comprehensive federal data privacy law to which we may likely become subject, if enacted. Moreover, laws, regulations and standards covering marketing, advertising and other activities conducted by telephone, email, mobile devices and the internet may be or become applicable to our business, such as the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act and similar state consumer protection and communication privacy laws, such as California's Invasion of Privacy Act. There is also growing and significant litigation under such laws, which could impact us if our business is perceived to be out of compliance. In addition, brand partners utilize our platform to power their ecommerce acceleration across more than 100 countries and we must also address privacy and data protection requirements from other jurisdictions outside of the United States. Outside the United States, an increasing number of laws, regulations and industry standards apply to data privacy and security, including the EU's General Data Protection Regulation ("EU GDPR") and the United Kingdom's GDPR ("UK GDPR" and together with the EU GDPR, "GDPR"), which impose strict requirements for processing personal data. Violators of these laws face significant penalties. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under EU GDPR/17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In conducting our business, we may transfer personal information from the EU, the UK and other jurisdictions to the United States or other countries. The GDPR and other laws impose requirements on the transfer of personal information to other countries. In particular, the GDPR has significantly restricted the transfer of personal information to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions have adopted or may adopt similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal information to the United States under the GDPR, such as the EU GDPR's standard contractual clauses, the UK GDPR's International Data Transfer Agreement/Addendum and the EU-U.S. Data Privacy Framework ("Framework") and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States and other third countries. If there is no lawful manner for us to transfer personal information from various jurisdictions, including the EU and UK, to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information, as well as other adverse consequences. In particular we may be unable to import personal data to the United States and other third countries in which we operate, which could significantly and negatively impact our business operations. Additionally, companies that transfer personal information out of the EU and UK to other jurisdictions, particularly to the United States, may be subject to increased scrutiny from regulators, individual litigants and activist groups. Regulators and legislators in the U.S. are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Department of Justice's January 8, 2025, rule on "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions and may result in exclusion from participation in federal and state programs. Beyond the United States and Europe, we face challenges of privacy and data protection laws in numerous jurisdictions in which we operate, including China which has a stringent privacy, cyber and data protection regulation. Most notably, the Personal Information Protection Law of China ("PIPL") was adopted on August 20, 2021, and went into effect on November 1, 2021. Similar to the GDPR, the PIPL calls for extraterritorial application, data minimization, data localization and purpose limitation requirements, and obligations to provide certain notices and rights to citizens of China. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company's revenue in the prior year. In addition, the PIPL has certain requirements that must be met before data can be transferred across border. In addition to legislative and regulatory frameworks we are subject to governing the processing of personal information, we are also contractually subject to data privacy and security obligations. Moreover, we publish privacy policies, marketing materials and other statements regarding data privacy and security. If we fail to abide by our contractual obligations or these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. Legislative and regulatory, contractual and other obligations related to data privacy and security (and data privacy expectations from our business partners and constituencies) are quickly changing, becoming increasingly stringent and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our information technologies, systems and data processing practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by one of our third-party service providers to comply with applicable law, regulations or contractual obligations could result in adverse effects, including proceedings against us by governmental entities or others. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and even criminal penalties for company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class-action claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, including but not limited to, loss of brand partners or customers, interruptions or stoppages in our business operations, inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our solutions, expenditure of time and resources to defend any claim or inquiry, adverse publicity or revision or restructuring of our operations.

We face competition in various aspects of our business and we expect such competition to grow in the future. Ecommerce is highly competitive and brands have a number of options to execute their ecommerce strategy. Brands could grow their ecommerce business themselves, marketplaces could directly offer brands' products and existing tools and service providers could focus on implementing an ecommerce acceleration model. Other third-party sellers may secure better terms from our brand partners, adopt more aggressive pricing, undercut retail prices in an effort to increase their market share and devote more resources to technology, infrastructure, fulfillment, advertising and marketing. In addition, other third-party sellers may leverage their distribution networks, or brands could engage in direct sales on marketplaces, allowing them to implement more aggressive pricing strategies and offer more attractive sales terms. This could cause us to lose sales opportunities or force us to sell our inventory at lower prices. The internet facilitates competitive entry and comparison shopping, which enhances the ability of new, smaller or lesser-known businesses to compete against us. As a result, our potential competitors may be able to develop products and services that may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies or regulations. Our business model may not be successful, we may fail to gain or may lose business and we may be required to increase our spending or lower prices to remain competitive. If we cannot compete successfully against current and future competitors, our business, results of operations and financial condition could be negatively impacted. Competition continues to intensify, including with the development of new business models and the entry of new and well-funded competitors and as our competitors enter into business combinations or alliances and established companies in other market segments expand to become competitive with our business. Further, shifts in consumer trends away from ecommerce to brick-and-mortar could adversely affect our revenue and growth. In addition, new and enhanced technologies, including applications of AI and machine learning, may in the future influence brand partners to choose to develop their own solutions and no longer rely on us for distribution of their products.

We base our current and future inventory needs and expense levels on our operating forecasts and estimates of future consumer demand. To ensure adequate inventory supply, we must be able to forecast inventory needs and expenses and place orders sufficiently in advance with our brand partners based on our estimates of future consumer demand for the products we sell. Failure to accurately forecast demand may result in inefficient inventory supply or increased costs. This risk may be exacerbated by the fact that we may not carry a sufficient amount of inventory and may not be able to satisfy short-term demand increases. Accordingly, if we fail to accurately forecast customer demand, we may experience excess inventory levels, a shortage of products available for sale and loss of profits. Inventory levels in excess of customer demand may result in inventory write-downs or write-offs or the sale of excess inventory at suboptimal prices, which would cause our operating results to suffer. Conversely, if we underestimate customer demand, including as a result of unanticipated growth, our brand partners may not be able to deliver products to meet our requirements, and we may be subject to higher costs in order to secure the necessary production capacity or we may incur increased shipping costs. An inability to meet customer demand and delays in the delivery of our brand partners' products to our customers could result in reputational harm for our brand partners, damage our customer relationships and brand partner relationships, harm our cash flows and prospects for growth and have an adverse effect on our business, financial condition and results of operations. While we devote significant attention to forecasting efforts, the volume, timing and value of the orders we receive are inherently uncertain. In addition, we cannot be sure growth rates, trends and other key performance metrics are meaningful predictors of future growth. Our business, as well as our ability to forecast demand, is also affected by general global economic and business conditions and the degree of consumer confidence in future economic conditions, and we anticipate that our ability to forecast demand due to these types of factors will be increasingly affected by conditions in international markets.

We procure third-party insurance policies to cover various operations-related risks, including products liability, cargo liability, workers' compensation, cybersecurity and data breaches, directors' and officers' liability and general professional liability. For certain types of business risk, we may not be able to, or may choose not to, acquire insurance. In addition, we may not obtain enough insurance to adequately mitigate such operations-related risks, and we may have to pay high premiums, co-insurance, self-insured retentions or deductibles for the coverage we do obtain. We rely on a limited number of insurance providers, and should such providers discontinue or increase the cost of coverage, we cannot guarantee that we would be able to secure replacement coverage on reasonable terms or at all. If our insurance carriers change the terms of our policies in a manner not favorable to us, our insurance costs could increase. Further, if the insurance coverage we maintain is not adequate to cover losses that occur, or if we are required to purchase additional insurance for other aspects of our business, we could be liable for significant additional costs. Additionally, if any of our insurance providers becomes insolvent, it would be unable to pay any operations-related claims that we make. If the amount of one or more operations-related claims were to exceed our applicable aggregate coverage limits, we would bear the excess, in addition to amounts already incurred in connection with deductibles, self-insured retentions, co-insurance, high premiums or otherwise paid by our insurance policy. Insurance providers have raised premiums and deductibles for many businesses and may do so in the future. As a result, our insurance costs and claims expense could increase, or we may decide to raise our deductibles or self-insured retentions when our policies are renewed or replaced. Our business, financial condition and results of operations could be adversely affected if the cost per claim, premiums, the severity of claims or the number of claims significantly exceeds our historical experience and coverage limits, we experience a claim in excess of our coverage limits, our insurance providers fail to pay on our insurance claims, we experience a claim for which coverage is not provided or the severity or number of claims under our deductibles or self-insured retentions differs from historical averages. We are subject to local laws, rules and regulations relating to insurance coverage which could result in proceedings or actions against us by governmental entities or others. Any failure or perceived failure by us to comply with existing or future local laws, rules and regulations relating to insurance coverage could result in proceedings or actions against us by governmental entities or others. Additionally, anticipated or future local laws, rules and regulations relating to insurance coverage could require additional fees and costs. Compliance with these rules and any related lawsuits, proceedings or actions may subject us to significant penalties and negative publicity, require us to increase our insurance coverage, require us to amend our insurance policy disclosure, increase our costs and disrupt our business.

Political and economic instability, the financial instability of brand partners, brand partners' ability to meet our standards, labor problems experienced by brand partners, the availability of raw materials, merchandise quality issues, currency exchange rates, transport availability and cost, transport security, inflation and other factors relating to our brand partners are beyond our control and may affect our ability to efficiently obtain products from our brand partners, or to obtain those products at all. For example, in the past our in-stock rates were negatively affected due to increased shipping lead times and delays in importing goods into the United States due to disruptions in global shipping routes and labor strikes affecting ports. A decrease in the level of imports to and exports from China could have a material impact on our business, financial condition and results of operations. Rising trade and political tensions could reduce levels of trades, investments, technological exchanges and other economic activities between China and other countries, which would have an adverse effect on global economic conditions, the stability of global financial markets and international trade policies. It could also adversely affect the financial and economic conditions in the jurisdictions in which we operate, as well as our global expansion, our financial condition and results of operations. There is significant uncertainty as to the potential actions of the U.S. government with respect to international trade policy and the impact of tariffs, particularly with respect to trade between the United States and China. Changes to historical U.S. trade policy have increased tariffs on imports, in some cases significantly, and have altered historical U.S. trade arrangements. For example, in April 2025, the U.S. government imposed broad new tariffs, including a baseline tariff of 10% on all imports, plus additional country-specific tariffs. The European Union and certain countries, including China and Canada, have threatened or imposed retaliatory measures. The related geopolitical uncertainty between the United States and its trading partners, may cause decreased demand for the products we sell or increase the cost to us of our brand partners' products, which could have a material impact on our business, financial condition and results of operations. For example, consumers may respond to the imposition of tariffs or threat of tariffs on the products we sell by purchasing alternative products at a lower price. The resulting environment of retaliatory trade or other practices or additional trade restrictions or barriers, if implemented on a broader range of our brand partners' products, could harm our ability to sell brand partner products at prices consumers are willing to pay, which could have a material impact on our business, financial condition and results of operations. It remains unclear what additional, new or different actions, if any, will be taken by the United States, China or other governments with respect to international trade agreements, the imposition of tariffs, the erection of barriers to trade, tax policy related to international commerce or other trade matters. The imposition of tariffs and trade restrictions as a result of international trade disputes or changes in trade policies could materially impact our sales and profitability. Ongoing international trade disputes and changes in trade policies could also impact economic activity and lead to a general contraction of consumer demand. Future actions or escalations by either the United States or its trading partners that affect trade relations could also negatively affect our business and/or that of our brand partners, and we cannot provide any assurances as to whether such actions will occur or the form that they may take. We also are unable to predict whether any of the countries in which our brand partners' products are currently manufactured or may be manufactured in the future will be subject to trade restrictions imposed by the United States or foreign governments or the likelihood, type or effect of any such restrictions. Any event causing a disruption or delay of imports from suppliers with international manufacturing operations, including the imposition of additional import restrictions, restrictions on the transfer of funds or increased tariffs or quotas could increase the cost or reduce the supply of merchandise available to our customers and adversely affect our financial performance as well as our reputation and brand. Furthermore, some or all of our brand partners' foreign operations may be adversely affected by political and financial instability, resulting in the disruption of trade from exporting countries, restrictions on the transfer of funds or other trade disruptions. Additionally, we are subject to economic sanctions laws and regulations, including those administered by the U.S. Departments of State, Commerce, and Treasury. Economic sanctions could result in restrictions on shipment of our brand partners' products or otherwise on doing business with our brand partners or other persons, which could have a material adverse effect on our business. Recent U.S. laws restricting investment in Chinese companies or on personal data transfers to certain persons or entities, including Chinese companies, could adversely affect our business. Moreover, a determination by a government that we have failed to comply with trade sanctions, investment, anti-bribery, or other laws or regulations can result in penalties which may include fines, penalties, or seizure of products, or loss of reputation, any of which could have an adverse effect on our business.

Brand partners utilize our platform to power their ecommerce acceleration across more than 100 countries and we have offices across North America, Asia, Australia and Europe. International operations and further expansion subjects us to many challenges associated with supporting a rapidly growing business across a multitude of cultures, customs, monetary, legal and regulatory systems and commercial infrastructures. In certain international markets we have relatively limited operating history, and our ability to manage our business and conduct our operations internationally requires considerable attention and resources. In addition to risks described elsewhere in this section, our international sales and operations are subject to a number of risks, including: - local and political conditions;- restrictive governmental actions (such as trade protection measures, including export duties, economic sanctions, quotas, custom duties, tariffs, penalties, sanctions and restrictions around the import and export of certain products, technologies and components). For example, imposition of higher tariffs on goods imported to the United States, including from Mexico, Canada and China, could affect our growth;- Nationalization and restrictions on foreign ownership, including in China and Germany, could make expansion into those markets more difficult;- laws and regulations regarding privacy, data use, data protection, data security, data localization, network security, consumer protection, pricing, discounting, product labeling, environmental safety, payments, advertising, labor and competition;- business licensing or certification requirements, such as for imports, exports, web services and electronic devices;- restrictions on sales or distribution of certain products or services and uncertainty regarding liability for products, services and content, including uncertainty as a result of less internet-friendly legal systems, local laws, lack of legal precedent and varying rules, regulations and practices regarding the physical and digital distribution of media products and enforcement of intellectual property rights;- potential complications in enforcing contracts and collections;- shorter payable and longer receivable cycles and the resultant negative impact on cash flow;- limitations on the repatriation and investment of funds and foreign currency exchange restrictions;- difficulties in invoicing and collecting in foreign currencies and associated foreign currency exposure;- limited fulfillment and technology infrastructure;- lower levels of use of the internet;- lower levels of consumer spending and fewer opportunities for growth compared to the United States;- increased management, travel, infrastructure and legal compliance costs associated with having multiple international operations;- difficulty in staffing, developing and managing foreign operations as a result of distance, language and cultural differences;- different employee/employer relationships and the existence of works councils and labor unions;- varied labor and employment laws, including those relating to termination of employees. For example, stricter laws for foreign employers in India could make it difficult for us to provide scalable technical support;- compliance with the U.S. Foreign Corrupt Practices Act ("FCPA") and other applicable U.S. and foreign laws prohibiting corrupt payments to government officials and other third parties;- laws and policies of the United States and other jurisdictions affecting trade, foreign investment, loans and taxes for cross-border transactions;- increased costs of funding loss-making international subsidiaries;- increased administrative costs and risks associated with compliance with local laws and regulations, including relating to privacy and data security in China and the EU;- increased financial accounting and reporting burdens and complexities;- concerns regarding negative, unstable or changing economic conditions in the countries and regions where we operate;- administrative difficulties, costs and expenses related to various local languages, cultures and political nuances; and - terrorism, wars and geopolitical instability, including the Ukraine war, the continued uncertainty surrounding the conclusion of the Israel-Hamas war and the broader conflict in the Middle East.

Our operations and customer base are currently concentrated in the United States. Therefore, we currently have limited foreign currency diversification and exposure. However, our foreign currency diversification and exposure may increase as international sales of our brand partners' products increase over time. As a result, our revenue and profits generated by any non-U.S. operations may fluctuate from period to period as a result of changes in foreign currency exchange rates. In addition, we may become subject to exchange control regulations that restrict or prohibit the conversion of our other revenue currencies into U.S. dollars. Any of these factors could decrease the value of revenue and profits we derive from our non-U.S. operations and adversely affect our business. We may also seek to reduce our exposure to fluctuations in foreign currency exchange rates through the use of hedging arrangements. To the extent that we hedge our foreign currency exchange rate exposure, we forgo the benefits we would otherwise experience if foreign currency exchange rates changed in our favor. There can be no assurances that our hedging or other strategic techniques will mitigate the risks associated with such fluctuations, and our currency exchange rate risk management activities could expose us to substantial losses if such rates change materially from what we expect.