TABLE OF CONTENTS

1

i

ii3

PartPART I

INTRODUCTION

Forward-Looking Statements

This annual report on Form 20-F contains information that constitute forward-looking statements within the meaning of Section 27A of the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended, or Exchange Act, that are not based on historical facts and are not assurances of future results and as such, are subject to risks and uncertainties. Many of the forward-looking statements in this annual report on Form 20-F can be identified based on forward-looking words such as “aim,” “anticipate,” “believe,” “can,” “continue,” “estimate,” “expect,” “intend,” “likely,” “may,” “might,” “plan,” “potential,” “project,” “seek,” “should,” “target,” “would,” or the opposite of these terms or other similar expressions.

Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of the date on which they are made. There is no assurance that the expected events, trends or results will actually occur and we undertake no obligation to update publicly or revise any forward-looking statements and estimates whether as a result of new information, future events or otherwise.

Forward-looking statements include, but are not limited to, statements regarding our current belief or expectations as of the date of this annual report and estimates on future events and trends that affect or may affect our business, financial condition, results of operations, liquidity, prospects and the trading price of our Class A common shares. Although such forward-looking statements are based on assumptions and information currently available to us, which we believe to be reasonable, none of the forward-looking statements, whether expressed or implied, are indicative of or guarantee future results. Given such limitations, investors should not make any investment decision on the basis of the forward-looking statements contained herein.

1

Prospective investors are cautioned that any such forward-looking statements are not guarantees of future performance and involve risks and uncertainties, and that actual results may differ materially from those in the forward-looking statements. The accompanying information contained in this annual report on Form 20-F, including without limitation the information set forth under the heading “Item 5. Operating and Financial Review and Prospects,” identifies important factors that could cause such differences. In light of the risks, uncertainties and assumptions associated with forward-looking statements, investors should not place undue reliance on any forward-looking statements. Additional risks that we may currently deem immaterial or that are not presently known to us could also cause the forward-looking events discussed in this annual report on Form 20-F not to occur.

Our forward-looking statements speak only as of the date of this annual report on Form 20-F, and we do not undertake any obligation to update them in light of new information or future developments or to release publicly any revisions to these statements in order to reflect later events or circumstances or to reflect the occurrence of unanticipated events.

Certain Definitions

Unless otherwise indicated or the context otherwise requires, all references in this annual report to “VTEX” or the “Company,” “we,” “our,” “ours,” “us” or similar terms refer to VTEX.

The term “Brazil” refers to the Federative Republic of Brazil and the phrase “Brazilian government” refers to the federal government of Brazil. “Central Bank” refers to the Brazilian Central Bank (Banco Central do Brasil). References in the annual report to “real,” “reais” or “R$” refer to the Brazilian real, the official currency of Brazil and references to “U.S. dollar,” “U.S. dollars” or “US$” refer to U.S. dollars, the official currency of the United States.

Active online stores means the number of unique domains generating gross merchandise value.

APIs means application programming interfaces, a set of clearly defined methods of communication between different software components, which, together with our SDKs and other tools, enables third parties to create applications that can easily connect and integrate with our technology platform;

ARR means annual recurring revenue, calculated as subscription revenue in the most recent quarter multiplied by four;

2

Black November means the commercial sale season introduced by Brazilian ecommerce websites in 2010, that is the long equivalent of Black Friday;

BNDES means the Brazilian Economic and Social Development Bank (Banco Nacional de Desenvolvimento Econômico e Social);

Brick-and-mortar means a business that operates physically in a building or other structure;

Business to business (“B2B”) means a form of transaction where businesses sell products to other businesses;

Business to consumer (“B2C”) means a form of transaction where businesses sell products to end consumers or individuals;

CCPA means the California Consumer Privacy Act;

CDI means the Brazilian interbank deposit (certificado de deposito interbancário) rate, which is an average of interbank overnight rates in Brazil;

CPG means consumer packaged goods that require routine replacement or replenishment, such as food, beverages, clothes, tobacco, makeup and household products;

Digitally native brands (“DNBs”) means businesses that have only existed in the digital world primarily or entirely selling its products through an online channel;

Cohort means a group of customers that received the first invoice of our VTEX platform in the prior year;preceding 18 months, to account for average implementation and ramp-up times;.

Collaborative Commerce means an innovative approach that embraces digital collaboration with suppliers and partners enabling our customers to integrate their own proprietary software with our software and our deep network of solutions from best-of-breed partners and digital marketplaces;

Composable Commerce means our low-code development platform with a customizable and flexible back-end, decoupled storefront and pre-built integrations;

Consumers means our customers’ clients;

Content Management System (“CMS”) means a software that enables businesses to create, edit and publish digital website content without writing any code.

Conversational Commerce means ecommerce done via various means of conversation, such as live support on ecommerce websites, online chat using messaging apps, chatbots on messaging apps or websites, voice assistants.

Customer acquisition costs (“CAC”) means the total sales and marketing expenses incurred during the four quarters preceding the quarter in which the calculation is made;

Customer relationship management (“CRM”) means the technology for managing a company’s relationships and interactions with existing and potential new customers;

Customers means companies ranging from small and medium-sized businesses to larger enterprises that pay to use VTEX’s platform;

3

FX neutral means a way of using the average monthly exchange rates for each month during the previous year, adjusted by inflation in countries with hyper-inflation, and applying them to the corresponding months of the current year, so as to calculate what results would have been had exchange rates remained stable from one year to the next;

GDPR means General Data Protection Regulation, a law enacted in 2016 on data protection and privacy in the European Union and the European Economic Area;

Graphical user interface (“GUI”) means a computer program that enables a person to communicate with a computer through the use of symbols, visual metaphors, used by most modern operating systems.

Gross merchandise value (“GMV”) means the total value of the orders processed through our platform, including value-added taxes and shipping. Our GMV does not include the value of orders processed by our SMB platform customers or B2B transactions;

Headless means the decoupling of the front-end customer experiences from back-end commerce services giving companies the flexibility and freedom to build commerce experiences that are aligned with their business and end-consumer;

Hyperinflation means the rapid increase in monetary inflation;

Independent Software Vendor (“ISVs”) means business partners focused on developing, marketing, and selling software products independently of hardware or platform providers, creating applications, solutions, or services tailored to meet specific business or consumer needs;

Internet of Things (“IoT”) means the network of interrelated, internet-connected objects that are able to collect and transfer data over a wireless network without human intervention;

Live Shopping means the combination of video livestream, ecommerce and social media. It is interactive and shoppable content that allows merchants to bring the in-store experience online where brands can promote and sell products through livestreams on digital platforms.

Low-code development means a platform providing a development environment used to create application software through graphical user interfaces and configuration instead of traditional computer programming;

LTV means lifetime value, calculated as gross profit from new sales during the four quarters of any given period divided by the subscription churn rate of the last 12 months;

Marketplaces means online businesses that connect sellers with buyers and manage all transactions;

Multi-tenant architecture means software architecture in which a single instance of a software application serves multiple groups of customers that share a single codebase;

NRR means net revenue retention, calculated on a monthly basis by dividing the subscription revenue from our platform during the current period by the subscription revenue in the same period of the previous year for the same base of online stores that were active in the same period of the previous year;

Order management system (“OMS”) means the VTEX platform feature designed to provide a 360-degree view of inventory and orders, allowing a customer to orchestrate sellers, manage inventory and develop tailor-made shipping strategies across a series of fulfillment scenarios;

Partners means the VTEX’s ecosystem of technology businesses that embed our solutions into their own offerings allowing our customers to conduct commerce more conveniently and include providers for shipping, marketplaces, point-of-sale, omnichannel, marketing automation, search, merchandising, system integrators, agencies, payment solutions, anti-fraud and lending;

4

Payment solutions means businesses that offer technology needed to accept an end-consumer transaction on a customer’s website;

PCI acquirers means payment card industry acquirer, typically a financial institution, that processes payment card transactions for merchants and is defined by a payment brand as an acquirer;

SKUs mean stock keeping unit, a distinct type of item for sale such as a product or service;

Small-to-medium-sized businesses (“SMBs”) means businesses that utilize our Loja Integrada on-demand commerce platform;

SSS means same-store-sales calculated on a yearly basis by dividing the GMV of active online stores in the current period by the GMV of the same active online same stores in the prior period;

Subscription churn rate means the annual turnover of our customers;

Suppliers means businesses supplying materials to our customers;

System integrators (“SIs”) means business partners focused on optimizing back-end system performance;

Take rate means the percentage of the total value of the orders processed through our platform, including value-added taxes and shipping;

Two-factor authentication means a security process in which users provide two different authentication factors to verify themselves;

VTEX IO means our low-code server-less environment for our customers’ technology teams to extend our core components and build new components in an integrated environment with best-in-class scalability and security; and

VTEX Lab means our university partnership program that provides students with an immersive experience of continued learning.

Financial Information

VTEX was incorporated on July 25, 2018, as a Cayman Islands exempted company with limited liability duly registered with the Cayman Islands Registrar of Companies.

We maintain our books and records in U.S. dollars, the functional currency of our operations and the presentation currency for our financial statements. Unless otherwise noted, the financial information presented herein has been derived from our audited consolidated financial statements as of December 31, 20222023 and 20212022 and for the three years ended December 31, 2023, 2022 2021 and 2020,2021, together with the accompanying notes thereto, prepared in accordance with IFRS Accounting Standards as issued by IASB and included elsewhere in this annual report, or our consolidated financial statements

Certain amounts and percentages included in this annual report have been rounded for ease of presentation. Percentage figures included in this annual report have not been calculated in all cases on the basis of the rounded figures but on the basis of the original amounts prior to rounding. For this reason, certain percentage amounts in this annual report may vary from those obtained by performing the same calculations using the figures in our audited consolidated financial statements. The tables included in this annual report may not total due to rounding.

5

Free Cash Flow and FX Neutral measures have limitations as analytical tools, and you should not consider them in isolation or as substitutes for analysis of our results of operations presented in accordance with IFRS.IFRS Accounting Standards. Additionally, our calculations of Free Cash Flow and FX Neutral measures may be different from the calculation used by other companies, including our competitors, and therefore, our measures may not be comparable to those of other companies.

Free Cash Flow

We calculate Free Cash Flow as our net cash provided by (used in) operating activities minus acquisition of property and equipment and intangibles related to acquisitions. In the future, we will adjust Free Cash Flow also by the capitalization of internally developed software; however, currently we do not capitalize internally developed software. Free Cash Flow is a measure used by management to understand and evaluate our liquidity and to generate future operating plans. The reduction of capital expenditures facilitates comparisons of our liquidity on a period-to-period basis and excludes items that we do not consider to be indicative of our liquidity. We believe that Free Cash Flow is a measure of liquidity that provides useful information to investors and others in understanding and evaluating the strength of our liquidity and future ability to generate cash that can be used for strategic opportunities or investing in our business in the same manner as our management and board of directors. Further, our definition of Free Cash Flow may differ from the definitions used by other companies and therefore comparability may be limited. Investors should consider Free Cash Flow alongside our other IFRS-basedIFRS Accounting Standards-based financial performance measures, such as net cash provided by (used in) operating activities, and our other IFRS Accounting Standards financial results.

FX Neutral measures

We provide certain metrics on an FX Neutral basis to enhance overall understanding of our current financial performance and its prospects for the future, and we understand that this measure provides useful information to both our management and investors. In particular, we believe that those FX Neutral measures provide useful information to both our management and investors by excluding the foreign currency exchange rate impact that may not be indicative of our core operating results and business outlook.

The FX Neutral measures were calculated by using the average monthly exchange rates for each month during 2020, 2021, 2022 and 2022,2023, adjusted by inflation in countries with hyper-inflation, and applying them to the corresponding months in 20212022 and 2022,2023, as applicable, so as to calculate what our results would have been had exchange rates remained stable from one year to the next.

Market Data

This annual report contains data related to economic conditions in the market in which we operate. The information contained in this annual report concerning economic conditions is based on publicly available information from third-party sources that we believe to be reliable. Market data and certain industry forecast data used in this annual report were derived from our management’s knowledge and our experience in the industry, internal reports and studies, where appropriate, as well as estimates, market research, publicly available information and industry publications. We obtained the information included in this annual report relating to the Brazilian payment solutions markets, and more broadly, the industry in which we operate, as well as the estimates concerning market shares, through internal research, public information and publications on the industry prepared by official public sources, such as the Central Bank, Getúlio Vargas Foundation (Fundação Getúlio Vargas), or FGV, Brazilian Institute for Geography and Statistics (Instituto Brasileiro de Geografia e Estatística), or IBGE, International Data Corporation, or IDC MarketScape, Gartner, Inc., or Gartner, Insider Intelligence, Digital Commerce 360, Fitch, Statista, amongst others.

6

The sources of certain statistical data, estimates, and forecasts contained in this annual report are derived from the following independent industry publications or reports:

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to its research, including any warranties of merchantability or fitness for a particular purpose.

Gartner^®, Magic Quadrant and Peer Insights^™ are trademarks of Gartner, Inc. and/or its affiliates. All rights reserved. Gartner^® Peer InsightsInsightsTM content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to itsthis content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

Industry publications, governmental publications and other market sources, including those referred to above, generally state that the information they include has been obtained from sources believed to be reliable, but that the accuracy and completeness of such information is not guaranteed. We have no reason to believe any of this information or these reports are inaccurate in any material respect and believe and act as if they are reliable. We have not independently verified it and they are subject to change based on various factors, including those discussed in “Item 3. Key Information—D. Risk Factors.” Estimates of market and industry data are based on statistical models, key assumptions and limited data sampling, and actual market and industry data may differ significantly from estimated industry data. In addition, the data that we compile internally and our estimates have not been verified by an independent source. Information derived from management’s knowledge and our experience is presented on a reasonable, good faith basis. Except as disclosed in this annual report, none of the publications, reports or other published industry sources referred to in this annual report were commissioned by us or prepared at our request. Except as disclosed in this annual report, we have not sought or obtained the consent of any of these sources to include such market data in this annual report.

The information set forth herein derived from Fitch Solutions is subject to the Fitch Solutions Terms of Use available at: https://www.fitch.group/terms-of-use#Terms-Solutions. Information contained on this website is not incorporated by reference into this annual report, and investors should not consider the information contained on this website to be part of this annual report or in deciding whether to invest in our Class A common shares.

7

Emerging Growth Company Status

We are an “emerging growth company,” as defined in Section 2(a) of the Securities Act of 1933, as amended, or the Securities Act, as modified by the Jumpstart Our Business Startups Act of 2012, or the JOBS Act. We will remain an emerging growth company until the earlier of (1) the last day of the fiscal year (a) following the fifth anniversary of the date of our first sale of our common equity securities pursuant to an effective registration statement under the Securities Act, (b) in which we have total annual revenues of at least US$1.235 billion, or (c) in which we are deemed to be a large accelerated filer, which means the market value of our common shares that is held by non-affiliates exceeds US$700.0 million as of the prior June 30 (the end of our second fiscal quarter), and (2) the date on which we have issued more than US$1.0 billion in non-convertible debt during the prior three-year period. As an emerging growth company, we are eligible to take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including, but not limited to, exemptions from the auditor attestation requirements of Section 404 -bof the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, and any Public Company Accounting Oversight Board, or PCAOB, rules, including any future audit rule promulgated by the PCAOB (unless the SEC determines otherwise). Accordingly, the information about us available to investors will not be the same as, and may be more limited than, the information available to shareholders of a non-emerging growth company.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

8

Not applicable.

Certain Risks Relating to Our Business and Industry

Although we have experienced significant growth in recent periods, we have recorded net losses since 2019. We may record net losses for the foreseeable future as we continue to implement our growth strategy with a high-efficiency mindset. Consequently, we may not be able to generate sufficient revenue to achieve and sustain profitability; our recent levels of growth may not be indicative of our future growth and will depend on our ability to attract new customers, retain existing customers, and increase sales to both new and existing customers, particularly if theecommerce growth in ecommerce during the COVID-19 pandemic fails to continue after the COVID-19 pandemic endsceases or consumer spending is adversely impacted by a challenging macroeconomic environment or general economic downturns.

Since 2019, we have recorded a net loss, and we expect to continue to record a net loss for the foreseeable future as we continue to implement our growth strategy. Consequently, we may not be able to generate sufficient revenue to achieve and sustain profitability. We incurred a net loss of US$52.413.7 million, US$60.552.4 million and US$0.860.5 million in the years ended December 31, 2023, 2022 2021 and 2020,2021, respectively. However, we experienced

8

9

The COVID-19 pandemic could materially adversely affect our business, financial condition and results of operations.

The COVID-19 pandemic, the measures attempting to contain and mitigate the effects of the COVID-19 pandemic, including stay-at-home, business closure, and other restrictive orders, and the resulting changes in consumer behavior, have disrupted our normal operations and impacted our employees, suppliers, partners and customers. In response to the COVID-19 pandemic, we have taken a number of actions that have impacted, and continue to impact, our business, including transitioning employees across all our offices (including our corporate headquarters) to remote work-from-home arrangements and imposing travel and other related restrictions. Given the continued spread of the COVID-19 pandemic and the resulting personal, economic and governmental reactions, we may have to implement additional measures in the future that could harm our business, financial condition and results of operations. We continue to monitor the impacts of the COVID-19 pandemic and may adjust our current policies as more information and guidance become available. For instance, during the course of the pandemic we have taken several measures to monitor and mitigate the effects of COVID-19, such as safety and health measures for our directors and employees (such as social distancing and working from home).

In response to the COVID-19 pandemic, in 2020 and 2021, governments across the countries in which we operate have instituted lockdowns, social distancing, and similar measures to slow infection rates. These restrictions have prompted shifts in sales from traditional brick-and-mortar commerce to ecommerce, which has increased the usage of our services. Even though the online purchasing trend demonstrated to have staying power through 2021 and 2022, we started to see a mean reversion towards the pre-pandemic ecommerce levels of growth. Our customer’s online channels experienced a decrease in growth rates, which affected our business growth, financial condition, and operating results.

The full impact of the pandemic on our business will continue to depend on future developments, including but not limited to the emergence of new coronavirus variants, the duration of the pandemic, the actions undertaken to contain the virus or mitigate its impacts, including actions mandated by federal, state and local governments and health authorities, changing public health directives or restrictions, vaccine efficacy against COVID-19 variants, current or future travel restrictions, and how quickly and to what extent normal global economic and operating conditions can or will resume. All of these factors are rapidly evolving and are difficult to predict, and as a result, it is uncertain what the future holds for our business and the industry as a whole.

If we fail to improve, enhance or innovate the features, functionality, performance, reliability, design, security and scalability of our platform in a manner that responds to our customers’ evolving needs or preferences, our business may be adversely affected and we may become subject to performance or warranty claims, and we may incur significant costs. Our services must also integrate with a variety of operating systems, software, hardware and networks. If we are unable to ensure that our services or hardware interoperate with such operating systems, software, hardware and networks, our business may be materially and adversely affected.

The markets in which we compete are characterized by constant change and innovation, and we expect them to continue to evolve rapidly. Our success has been based primarily on our ability to identify and anticipate the needs of our customers and design a platform that provides them with the tools they need to operate and grow their businesses by giving them the ability to access our platform 24 hours a day, 7 days a week, without interruption or performance degradation. Our ability to attract new customers, retain existing customers and increase sales to both new and existing customers will depend in large part on our ability to continue to improve and enhance the functionality, performance, reliability, design, security and scalability of our platform, as well as offering new solutions that appeal to our customers as their business needs evolve.

Our platform must also integrate with a variety of third-party network, hardware, mobile, and software platforms and technologies. We need to continuously modify, enhance and introduce new features to our platform to adapt to changes and innovation in these technologies. Any changes in these systems or networks that degrade the functionality of our platform, impose additional costs or requirements on us, or give preferential treatment to competitive services, including their own services, could materially and adversely affect usage of our platform. If businesses widely adopt new ecommerce technologies, we would have to develop new functionalities for our platform to be compatible with those new technologies, which we may not be able to do in a timely and cost-effective manner. These development efforts may require significant engineering, marketing and sales resources, all of which would affect our business and operating results, and there can be no assurance that such efforts will be successful. Any failure of our platform to operate effectively with future technologies could reduce the demand for our platform. If we are unable to respond to these changes in a cost-effective manner, our platform may become less marketable and less competitive or obsolete, and our operating results may be negatively affected.

11

Furthermore, if we do not complete this maintenance according to schedule or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, customers could terminate their contracts, or delay or withhold payment to us, or cause us to issue credits, make refunds, or pay penalties. The costs incurred or delays resulting from the correction of defects or errors in our software or other performance problems may be substantial and could adversely affect our operating results.

In such events, we may also be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. In addition, we may not carry insurance sufficient to compensate us for any losses that may result from claims arising from defects or disruptions in our products. As a result, our reputation and our brand could be harmed, and our business, results of operations and financial condition may be adversely affected.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our platform. If we are not able to hire, develop and retain talented marketing personnel, or if our new marketing personnel are unable to develop and execute efficient inbound and branding marketing programs in a reasonable period of time, or if our sales and marketing strategies are not effective to generate traffic and build a top of mind brand, our ability to attract new customers may be impaired.

Our ability to increase our customer base and achieve broader market acceptance of our platform will depend on our ability to expand our marketing and sales operations. We plan to continue expanding our sales force and strategic business partners, both domestically and internationally. We may not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective. Our business and operating results may be adversely affected if our sales and marketing efforts do not generate a corresponding increase in revenue.

We also plan to dedicate significant resources to sales and marketing programs, including search engine and other online advertising with respect to our small and medium business, or SMB platform, online stores, which represented less than 7.0% of our revenues in the year ended December 31, 2022.2023. The effectiveness of our online advertising may continue to vary due to competition for key search terms, changes in search engine use, and changes in search algorithms used by major search engines and other digital marketing platforms. If the cost of marketing our platform over search engines or other digital marketing platforms increases, our business and operating results could be adversely affected. Competitors also may bid on the search terms that we use to drive traffic to our website. Such actions could increase our marketing costs and result in decreased traffic to our website

12

We face intense competition, especially from well-established companies offering solutions and related applications. We may lack sufficient financial or other resources to maintain or improve our competitive position, which may harm our ability to add new customers, retain existing customers and grow our business.

The market for ecommerce solutions is evolving and highly competitive. We expect competition to increase in the future from established competitors and new market entrants. WithWe expect competition to persist and intensify in the future with the introduction of new technologies (such as artificial intelligence) and the entry of new companies into the market, we expect competition to persist and intensify in the future.market. This could harm our ability to increase sales, maintain or increase renewals and maintain our prices. We face intense competition from other software companies that may offer related ecommerce platform software solutions and services. Our competitors include larger companies that have acquired ecommerce platform solution providers in recent years. We also compete with custom software internally developed within ecommerce businesses. Our primary competitors are SAP Hybris, Oracle Commerce, Magento (an Adobe company), Salesforce Commerce Cloud (formerly known as Demandware), and Shopify Plus. In addition, we face competition from niche companies that offer point products that attempt to address certain of the problems that our platform solves.

Many of our existing competitors have, and our potential competitors could have, substantial competitive advantages such as greater name recognition, longer operating histories, larger sales and marketing budgets and resources, greater customer support resources, lower labor and development costs, larger and more mature intellectual property portfolios, and substantially greater financial, technical and other resources.

Some of our larger competitors also have substantially broader product lines that may allow them to offer a broader suite of products to retailers than we can. Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors, or continuing market consolidation. New start-up companies that innovate, and large companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our platform.

Mergers and acquisition activity in the technology industry could increase the likelihood that we compete with other large technology companies. In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with agency partners, technology and application providers in complementary categories, or other parties. Furthermore, ecommerce on large online marketplaces could increase as a percentage of all ecommerce activity, thereby reducing customer traffic to individual customer websites. Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure, a loss of market share, or a smaller addressable share of the market. It could also result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete.

13

Given these factors, it is difficult to predict whether and when a sale will be completed, and when revenue from a sale will be recognized. Consequently, a shortfall in demand for our solutions and services or a decline in new or renewed contracts in a given period may not significantly reduce our revenue for that period but could negatively affect our revenue in future periods.

The estimates of market opportunity and forecasts of market growth included in this annual report may prove to be inaccurate. Even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all.

The market for ecommerce solutions is relatively new and will experience changes over time. Ecommerce market estimates and growth forecasts are uncertain and based on assumptions and estimates that may be inaccurate. Our addressable market depends on a number of factors, including businesses’ desire to differentiate themselves through ecommerce, partnership opportunities, changes in the competitive landscape, technological changes, data security or privacy concerns, customer budgetary constraints, changes in business practices, changes in the regulatory environment, and changes in economic conditions. Our estimates and forecasts relating to the size and expected growth of our market may prove to be inaccurate and our ability to produce accurate estimates and forecasts may in the future be impacted by the macroeconomic uncertainty. Even if the market in which we compete meets the size estimates and growth rates we forecast, our business could fail to grow at similar rates, if at all.

Our business is susceptible to risks associated with international sales and the use of our platform in various countries.

We currently have customers in 3843 countries. In the years ended December 31, 20222023 and 20212022 we generated 45.4%45.7% and 47.2%45.4% of our total revenue from customers outside Brazil. Besides Brazil, we currently have customers in Argentina, Chile, Colombia, France, Italy, Mexico, Peru, Portugal, Romania, Singapore, Spain, the United Kingdom and the United States, among other 2429 countries. We are continuing to adapt and develop strategies to address international markets, but such efforts may not be successful. In addition, the COVID-19 pandemic and related stay-at-home, business closures, and other restrictive orders and travel restrictions in some countries may pose additional challenges for international expansion and may impact our ability to launch into new regions and further expand geographically.

In addition, part of our growth strategy is to further expand our operations and customer base internationally. Business expansion and development in new jurisdictions may expose us to risk related to staffing and managing cross border operations, reduced brand awareness in new markets and lack of acceptance of our products and services, competition with established local competitors and increased costs and difficulty protecting intellectual property and sensitive data, tariffs and other trade barriers, differing and potentially adverse tax consequences, increased and conflicting regulatory compliance requirements (including with respect to privacy, security and labor), challenges caused by distance, language and cultural differences, exchange rate risk and political instability. Accordingly, our efforts to develop and expand the geographic footprint of our operations may not be successful, which could limit our ability to grow our business.

15

16

These factors may cause our international costs of doing business to exceed our comparable domestic costs and may also require significant management attention and financial resources. Our future expansion efforts that we undertake may not be successful. Our failure to manage any of these risks successfully could harm our international operations, and adversely affect our business, results of operations and financial condition. If we invest substantial time and resources to expand our international operations and are unable to do so successfully, our business and operating results will suffer.

In addition, our business involves interactions with various third parties, and our customers have international operations, being subject to the aforementioned risks. Third-party entities, including service providers, suppliers, and distributors, may encounter difficulties in delivering essential services, products, or technologies within stipulated timeframes, potentially causing disruptions that could adversely affect our business and reputation. These risks may also influence our customers’ demand for our products, services, and solutions. Moreover, a disturbance in global financial markets poses a potential threat to our banking partners, critical for our operational cash management and capital market transactions. Such disruptions could further have adverse consequences, potentially hindering our customers’ ability to fulfill payment obligations due to delays or limitations in accessing their existing cash reserves.

We provide service or experience level commitments under our customer agreements. If we fail to meet these contractual commitments, our business, results of operations and financial condition could be adversely affected.

Our agreements with customers typically provide for service or experience level commitments that contain guarantees on certain performance metrics, such as uptime starting from 99.7% and maximum latency. If we suffer extended periods of downtime for our products or platform and we are unable to meet these commitments, we are contractually obligated to provide our customer a service credit of up to 20% of the monthly fees payable to us by such customer. In addition, the performance and availability of our third-party service providers, including Amazon Web Services, or AWS, which provides our cloud infrastructures, is outside of our control and, therefore, we are not in full control of whether we can meet our service level commitments. Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to grow our customer base, subject us to contractual penalties in the form of service credits under our service level agreements, or SLAs, and otherwise harm our business, results of operations and financial condition.

If we fail to offer high-quality customer support, our business and reputation could suffer.

Our customers rely on our personnel for support related to their subscription and customer solutions. High-quality support is important for the renewal and expansion of our agreements with existing customers. The importance of high-quality support, including with respect to multiple cloud support, will increase as we expand our business and pursue new customers, particularly mid-market and large enterprise customers. If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to sell new software to existing and new customers could suffer and our reputation with existing or potential customers could be harmed.

17

As our operations expand, we will require additional engineering support staff to sustain the increased use of our platform and services. If we are unable to adequately and timely grow our engineering support team or the overall quality of our current team diminishes significantly, our resources may be diverted to fixing existing errors, defects, security vulnerabilities, service interruptions or software bugs, instead of providing additional services to customers. While we may enhance our offering through acquisitions, the overall quality and cohesiveness of our product may be impaired. Failure to properly integrate the engineering support staff and activities of any of our acquired companies may result in the diversion of attention of staff to migrations and integration issues rather than focusing on the continued improvement of our platform and services.

While we issue stock options or other equity awards as key components of our overall compensation and employee attraction and retention efforts, we are required under IFRS Accounting Standards to recognize compensation expense in our operating results for employee stock-based compensation under our equity grant programs, which may increase the pressure to limit stock-based compensation and jeopardize our ability to hire, retain and motivate qualified personnel.

The loss of our qualified personnel, as well as any difficulty to attract and replace them in a timely manner, may cause an adverse effect on our business and results of operations.

We are dependent on the continued services and performance of our senior management and other key employees, the loss of any of whom could adversely affect our business, operating results and financial condition.

Our future performance depends on the continued services and contributions of our senior management, including our Founders and Co-Chief Executive Officers, Geraldo do Carmo Thomaz Júnior and Mariano Gomide de Faria, and other key employees to execute on our business plan and to identify and pursue new opportunities and product innovations. The loss of one or more of our executive officers or key employees could have a serious adverse effect on our business causing significant delays or prevent the achievement of our strategic objectives. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period; therefore, they could terminate their employment with us at any time. In addition, some of the members of our current senior management team have only been working together for a short period of time, which could adversely impact our ability to achieve our goals. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. The loss of the services of one or more of our senior management or other key employees for any reason could adversely affect our business, financial condition and operating results and require significant amounts of time, training and resources to find suitable replacements and integrate them within our business, and could affect our corporate culture. In addition, if the perceived value of our stock awards declines, it may adversely affect our ability to recruit and retain highly skilled employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, it could adversely affect our business and future growth prospects.

18

Strategic technology partners and third parties may not be successful in building integrations, co-marketing our platform to provide a significant volume and quality of lead referrals, or continuing to work with us as their products evolve. Identifying, negotiating and documenting relationships with additional strategic technology of partners requires significant resources. Integrating third-party technology can be complex, costly and time-consuming, and third parties may be unwilling to build such necessary integrations. Consequently, we may be required to devote additional resources to develop integrations for business applications on our own. Providers of business applications with which we have integrations may decide to compete with us or enter into arrangements with our competitors, resulting in such providers withdrawing support for our integrations. Any failure of our platform to operate effectively with third-party business applications could reduce the demand for our platform, resulting in customer dissatisfaction and harm to our business. If we are unable to respond to these changes or failures in a cost-effective manner, our platform may become less marketable, less competitive, or obsolete, and our results of operations may be negatively impacted.

We also leverage the sales and referral resources of agency and referral partners through a variety of programs. If we are unable to effectively utilize, maintain and expand these relationships, our revenue growth would slow, we would need to devote additional resources to the development, sales and marketing of our platform, and our financial results and future growth prospects would be harmed. Our referral partners may also demand greater referral fees or commissions, which would increase our costs.

A cyberattack, security breach or other unauthorized access or interruption to our information technology systems or those of our third-party service providers could delay or interrupt service to our customers and their customers, harm our reputation or subject us to significant liability.

We collect, transmit, use, disclose, store and process personal information, including credit card information and other confidential information, of our employees, our business partners, our customers and their end-consumers. Third-party applications may also collect, transmit, use, disclose, store and process such personal information, credit card information and other confidential information. In addition, third-party applications may run arbitrary code within our infrastructure without our consent or knowledge to extend access to our platform. We cannot and do not proactively monitor the content that our customers upload or the information provided to us through the applications integrated with our ecommerce platform; therefore, we do not control the substance of the content on our servers, which may include personal information. Although we require users of our ecommerce platform to adopt and secure credentials in order to access it and use encryption and authentication technologies to secure the transmission and storage of data, these security measures may be compromised as a result of illegal activities by unauthorized persons, employee error, malfeasance, faulty credential management, or other irregularity which may cause unauthorized access to our customers’ - and their end consumers’ - data in our platform. Also, our employees customers, or customers contractors may inadvertently or be fraudulently instructed by third parties to disclose credentials, usernames, passwords or other access keys , which may, in turn, be used to access our ecommerce platform, commit identity theft or carry out other prohibited activities, including the irregular collection and use of personal information of our customers and their end-consumers.

19

nation-state and nation-state-supported actors. For example, in February 2021, our subsidiary, Ciashop Soluções para Comércio Eletrônico S.A., or Ciashop, was subject to a ransomware attack that corrupted certain operating system files. Ciashop’s site reliability engineering team was ultimately able to restore all services and applications and recover the corrupted data and Ciashop adopted a number of actions in an effort to prevent future incidents, including, among others, upgrading its antivirus software, a review of firewall rules of its production environment and a scan for vulnerabilities in its environment. While our platform was not affected as it is segregated from that of Ciashop’s, we cannot guarantee that any similar incidents may not occur again and adversely affect our operations.

Many companies that provide services similar to ours have also reported a significant increase in cyberattack activity since the beginning of the COVID-19 pandemic. In addition, in the past, some of our customers have been subject to distributed denial of service, or DDoS, attacks, a technique used by hackers to take an internet service offline by overloading its servers. Our platform may be subject to similar DDoS attacks in the future. In addition, because we leverage third-party partners and service providers, including cloud, software, data center and other critical technology vendors to deliver our solutions, we rely heavily on the data security practices and policies adopted by these third-party service providers. Our ability to monitor our third-party service providers’ data security is limited. A vulnerability in our third-party service providers’ software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions. In addition, we may also become liable in the event our third-party service providers and subprocessors are subject to security breaches, privacy breaches or other cybersecurity threats. For example, in May 2021, the server of one of our third-party service providers in Chile that stores, among other things, certain of our customer’s consumer personal information processed through our platform, was accidentally made publicly available on the internet and data of approximately 3,500 of one of our customer’s consumers became accessible without authorization. Although our customer is the data controller of its consumers’ data and ultimately responsible for any privacy or security breaches involving such personal data, as our customer’s data processor, we may be held jointly or severally liable if we (or our third-party service provider) are found to not have instituted adequate data security measures on our platform. As of the date of this annual report, we concluded the investigation regarding this incident and we confirmed that unauthorized third parties did not access the exposed consumer personal information. Additionally we adopted measures to address the security flaw with this third-party service provider. We cannot guarantee that any similar incidents may not occur again and adversely affect our operations. We and our third-party service providers and partners may be unable to anticipate or prevent techniques used in the present or in future to obtain unauthorized access or to sabotage systems and cannot guarantee that applicable recovery systems, security protocols, network protection mechanisms, authentication processes and other procedures are or will be adequate to prevent network and service interruption, system failure or data loss. Since techniques used to obtain unauthorized access change frequently and the sophistication and size of DDoS and other cybersecurity attacks is increasing, we may be unable to implement adequate preventative measures or stop the attacks while they are occurring. Any actual or perceived DDoS attack or other security breach or incident could delay or interrupt service to our customers and their customers, could result in loss, compromise, corruption or disclosure of confidential information, intellectual property and sensitive and personal data or data we rely on to provide our solutions, may deter consumers from visiting our customers’ shops, damage our reputation and brand, expose us to a risk of litigation, indemnity obligations and damages for breach of contract, cause us to incur significant liability and financial loss and be subject to regulatory scrutiny, investigations, proceedings and penalties, and require us to expend significant capital and other resources to alleviate problems caused by any such DDoS attack or other security breach or incident and implement additional security measures.

20

not be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. Our failure to comply with legal, contractual, or standards-based requirements around the security of personal information could lead to significant fines and penalties, as well as claims by our customers, their end-consumers, or other stakeholders. These proceedings or violations could force us to spend money in defense or settlement of these proceedings, result in the imposition of monetary liability or injunctive relief, divert management’s time and attention, increase our costs of doing business, and materially adversely affect our reputation and the demand for our platform.

We currently do not maintain cybersecurity insurance for limited clients in the US and for the EU subsidiaries, but not a global coverage, and in the event we were to seek to obtain such insurance coverage, it may not be available on acceptable terms or may not be available in sufficient amounts to cover one or more large claims in connection with cybersecurity liabilities. Insurers could also deny coverage as to any future claim. The successful assertion of one or more large claims against us, or changes in any insurance policies we may enter into, including premium increases or the imposition of large deductible or co-insurancecoinsurance requirements, could have an adverse effect on our business, financial condition and results of operations.

We are also subject to federal, state and foreign laws regarding cybersecurity and the protection of data. See “—Our business is subject to Brazilian,the APAC region, the European Union and United StatesKingdom, Latam and other foreign data privacy,the United States., data protection and information security laws, regulations, rules, standards, policies and contractual and other legal obligations, and our customers may also be subject to such laws and regulations. Any actual or perceived failure of our products to comply with or enable our customers to comply with such applicable laws and regulations would harm our business, results of operations and financial condition.condition.”

See “Item 16K. Cybersecurity—Cybersecurity Risk Management.”

We depend on third-party data hosting and transmission services. Increases in cost, interruptions or delays in service, latency, or poor service from our third-party data center or internet service providers could impair the functionality of our platform. This could result in customer or consumer dissatisfaction, damage to our reputation, loss of customers, limited growth and reduction in revenue.

We currently host the majority of our platform functions on third-party data center hosting facilities operated by AWS, located in the United States of America. Our ability to deliver our solutions also depends on the development and maintenance of internet infrastructure by third parties, including the maintenance of reliable networks with the necessary speed, data capacity and bandwidth. Our platform is deployed to multiple data centers primarily located in the United States in multiple locations, including some for the purpose of disaster recovery. However, despite precautions taken and disaster recovery arrangements we have in place at our data centers or those of our third-party service providers, natural disaster, acts of terrorism, vandalism, fraud, security attacks or sabotage, closure of a facility by public authorities without adequate notice, or other unanticipated problems could result in lengthy interruptions or performance degradation of our platform. Our third-party service providers are ultimately responsible for maintaining their own network security, disaster recovery and system management procedures, and our review processes for such providers may be insufficient to identify, prevent or mitigate adverse events. The owners and operators of our current and future hosting facilities do not guarantee that our customers’ access to our solutions will be uninterrupted, error-free or secure. Our operations depend, in part, on our third-party providers’

21

traffic or order processing and the failure of data centers, internet service providers or other third-party service providers to meet our capacity requirements could result in interruptions or delays in access to our platform and inhibit our ability to grow our business and scale our operations. Our failure to achieve or maintain sufficient and performant data transmission capacity could significantly reduce demand for our platform. In the future, we may be required to allocate resources, including spending substantial amounts of money, to build, purchase or lease additional data centers and equipment and upgrade our technology and network infrastructure in order to handle the increased load. If one of these third parties suffers from capacity constraints, our business may be adversely affected. In addition, because we and our customers generate a disproportionate amount of revenue in the fourth quarter as a result of customary seasonality, any disruption in our customers’ ability to process and fulfill customer orders in the fourth quarter could have a disproportionately negative effect on our operating results.

Furthermore, a significant portion of our operating cost is from our third-party data hosting and transmission services. If the costs for such services increase due to vendor consolidation, regulation, contract renegotiation or otherwise, we may not be able to increase the fees for our ecommerce platform or professional services to cover the changes. As a result, our operating results may be significantly worse than forecasted.

We rely on third-party and open source software for our platform. Our inability to obtain third-party licenses for such software, or obtain them on favorable terms, or any errors or failures caused by such software could adversely affect our business, results of operations and financial condition. In addition, our use of open source software could negatively affect our ability to sell our products and subject us to possible litigation.

Some of our offerings include software or other intellectual property licensed from third parties. It may be necessary in the future to renew our license agreements relating to various aspects of our offerings or to seek new licenses for existing or new offerings. Necessary licenses may not be available on acceptable terms that allow our platform and offerings to remain competitive, or at all. In addition, a third party may assert that we or our customers are in breach of the terms of a license, which could, among other things, give to such third party the right to terminate a license or seek damages from us, or both. Our inability to obtain certain licenses or other rights, or to obtain such licenses or rights on favorable terms, could result in delays in product releases until equivalent technology can be identified, licensed or developed, if at all, and integrated into our platform, which may have a material adverse effect on our business, results of operations and financial condition. In addition, we may be subject to liability if third-party software that we license is found to infringe, misappropriate or otherwise violate intellectual property rights of others. Third parties may also allege that we are infringing, violating or otherwise misappropriating their intellectual property rights and that additional licenses are required for our use of their software or intellectual property, and we may be unable to obtain such licenses on commercially reasonable terms or at all. The inclusion in our offerings of software or other intellectual property licensed from third parties on a non-exclusive basis could also limit our ability to differentiate our offerings from those of our competitors. To the extent that our platform depends upon the successful operation of third-party software, any undetected errors or defects in, or failures of, such third-party software could also impair the functionality of our platform, delay new feature introductions, result in a failure of our platform, and injure our reputation. Many third-party software providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to our customers that could harm our reputation and increase our operating costs.

22

expenses defending against such allegations and could be subject to significant damages, enjoined from generating revenue from customers using products that contained the open source software and required to comply with onerous conditions or restrictions on these products. In any of these events, we and our customers could be required to seek licenses from third parties in order to continue offering our products and platform and to re-engineer our products or platform or discontinue offering our products to customers in the event we cannot re-engineer them on a timely basis. Any of the foregoing could require us to devote additional research and development resources to re-engineer our products or platform, could result in customer dissatisfaction and may adversely affect our business, results of operations and financial condition. Additionally, the use of certain open source software can lead to greater risks that the use of third-party commercial software, as open source licensors generally make their open source software available “as-is” and do not provide updates, warranties, support, indemnities or other contractual protections regarding infringement claims or quality of the code.

We could incur substantial costs in maintaining, enforcing, protecting or defending our intellectual property and proprietary rights. Failure to adequately obtain, maintain, enforce and protect our intellectual property and proprietary rights could impair our competitive position and cause us to lose valuable assets, experience reduced revenue and incur costly litigation.

Our success is dependent, in part, upon obtaining, maintaining, protecting and enforcing our proprietary technology and other intellectual property. We rely on a combination of trade secret laws, contractual provisions with our employees, consultants, independent contractors and third parties with whom we have relationships, trademarks, service marks and copyrights in an effort to establish and protect our intellectual property and proprietary rights. However, the steps we take to protect our intellectual property and intellectual property laws may be inadequate, breached, may offer only limited protection and may not adequately permit us to gain or keep any competitive advantage. Despite our efforts, third parties have in the past and may in the future attempt to disclose, obtain, copy or use our intellectual property or other proprietary rights or technology without our authorization. To the extent we expand our international activities, our exposure to unauthorized copying and use of our platform and proprietary information may increase. Moreover, effective trademark, copyright, patent and trade secret protection may not be available or commercially feasible in every country in which we conduct business, as the laws of certain foreign countries may not protect intellectual property rights and technology to the same extent as the laws of the United States. Further, intellectual property law, including statutory and case law, is constantly developing and changes in, or unexpected interpretations of, intellectual property laws could make it harder for us to enforce our rights. Third parties may also legitimately and independently develop products, services and technology similar to or duplicative of our products and solutions.

23

rights, to lapse or to become abandoned if we determine that obtaining or maintaining the applicable registered intellectual property rights is not worthwhile. Despite our efforts to protect our intellectual property and proprietary rights, there can be no guarantee that such rights will be sufficient to protect against others offering products or services that are substantially similar to ours, independently developing similar products, duplicating any of our products, other adopting trade names similar to ours, competing with our business or attempting to copy aspects of our technology and using information that we consider proprietary, thereby impeding our ability to promote our platform and possibly leading to customer confusion.

In addition to registered intellectual property rights, we rely on non-registered proprietary information and technology. We make business decisions about when to seek patent protection for a particular technology and when to rely upon trade secret protection and the approach we select may ultimately prove to be inadequate. In order to protect our proprietary information and technology, we rely in part on invention assignment and confidentiality agreements with our employees, consultants and other parties who create intellectual property on our behalf and enter into confidentiality agreements with our employees, consultants, strategic and business partners and other parties who have access to our confidential information. However, these agreements may not be effective in controlling access to and distribution of our proprietary information and intellectual property, may not be self-executing, sufficient in scope or enforceable, and these agreements do not prevent our competitors or partners from independently developing technologies that are equivalent or superior to our platform. We also cannot guarantee that we have entered into such agreements with all parties who may have or have had access to our proprietary and confidential information or otherwise developed intellectual property for us or that the agreements we have entered into will not be breached. Enforcing a claim that a third party illegally disclosed or misappropriated our proprietary information is difficult, expensive and time-consuming, and the outcome is unpredictable. In addition, some courts inside and outside the United States are less willing or unwilling to protect trade secrets. If any of our trade secrets were to be unlawfully obtained or independently developed by a competitor or other third party, we would have no right to prevent them from using that technology or information to compete with us, which could harm our competitive position, business, financial condition, results of operations and prospects.

Despite our efforts to protect our intellectual property, third parties have in the past and may in the future infringe, misappropriate or otherwise violate our intellectual property and proprietary rights and we may be required to spend significant resources to monitor, protect and enforce our intellectual property rights. Policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be protective of intellectual property rights and where mechanisms for enforcement of intellectual property rights may be weak. We have in the past and may in the future also be subject to claims by third parties that we have infringed, misappropriated or otherwise violated their intellectual property. Litigation may be necessary to enforce our intellectual property rights and protect our trade secrets. Litigation brought to defend, protect or enforce our intellectual property rights could be costly, time-consuming and distracting to management, regardless of the outcome. Enforcement of our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property. Such litigation could result in the impairment or loss of portions of our intellectual property

24

Evolving global laws, regulations and standards, including data privacy regulations and data localization requirements, may limit the use and adoption of our services, expose us to liability, or otherwise adversely affect our business.

Federal, state, or foreign governmental bodies or agencies have in the past adopted, and may in the future adopt, laws and regulations affecting the use of the internet as a commercial medium. These laws and regulations could impact taxation, internet neutrality, tariffs, content, copyright protection, distribution, electronic contracts and other communications, consumer protection and data privacy, and the characteristics and quality of services we offer. Legislators and regulators may make legal and regulatory changes or apply existing laws in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices. Also, such laws and regulations are often inconsistent and may be subject to amendment or re-interpretation, which may cause us to incur significant costs and expend significant effort to ensure compliance. These laws and regulations and resulting increased compliance and operational costs could materially harm our business, results of operations and financial condition.

For instance, we continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. These regulations may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

As we expand into new industries and regions, we will likely need to comply with new requirements to compete effectively. The uncertainty and changes in the requirements of multiple jurisdictions may increase the cost of compliance, delay or reduce demand for our services, restrict our ability to offer services in certain locations, impact our customers’ ability to deploy our solutions in certain jurisdictions, or subject us to sanctions regulators, all of which could harm our business, financial condition and results of operations. Additionally, although we endeavor to have our products and platform comply with applicable laws and regulations, these and other obligations may be modified, they may be interpreted and applied in an inconsistent manner from one jurisdiction to another, and they may conflict with one another, other regulatory requirements, contractual commitments or our internal practices.

25

processing activities have the purpose of offering or supplying goods or services to data subjects located in Brazil. The LGPD establishes detailed rules for processing personal data, which includes the collection, use, transfer and storage of personal data and affects all economic sectors, including the relationship between clients and suppliers of goods and services, employees and employers and other relationships in which personal data is collected, whether in a digital or physical environment.

The LGPD requires us to adapt our data processing activities to comply with this regime, and we have implemented changes with respect to our policies and procedures designed to facilitate our compliance with the relevant requirements under the LGPD. However, the interpretation and application of the LGPD is still uncertain.

The penalties and fines for violations of the LGPD include: warnings, with the imposition of a deadline for the adoption of corrective measures; a daily fine, up to a maximum amount of R$50.0 million per violation; the restriction of access to the personal data to which the violation relates up to a six-month period, which can be extended until the processing activities are compliant with the regulation; and in case of repetition of the violation, a temporary block and/or deletion of the relevant personal data, and a partial or complete prohibition of processing activities and a fine of up to 2.0% of gross sales of the company or group of companies in violation, up to a maximum amount of R$50.0 million per violation. Pursuant to the LGPD, security breaches that may result in significant risk or damage to personal data must be reported to the National Data Protection Authority (Autoridade Nacional de Proteção de Dados), or ANPD, Brazil’s data protection regulatory body, within a reasonable time period. The notice to the ANPD must include a description of the nature of the personal data affected by the breach; the affected data subjects; the technical and security measures adopted by the impacted entity; the risks related to the breach; the reasons for any delays in reporting the breach, if applicable; and the measures adopted to revert or mitigate the effects of the damage caused by the breach. Moreover, the ANPD could establish additional obligations related to data protection in the future. The LGPD and any additional privacy laws or regulations enacted or approved in Brazil or in other jurisdictions in which we operate could significantly impact our business, financial condition or results of operations.

Similarly, many foreign countries and governmental bodies, including in the countries in which we currently operate, have laws and regulations concerning the collection, use and other processing of sensitive and personal data obtained from individuals located in their jurisdiction or by businesses operating within their jurisdiction. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, transmission, processing and security of personal data that identifies or may be used to identify an individual, such as names, telephone numbers, email addresses and, in some jurisdictions, IP addresses and other online identifiers. For example, the General Data Protection Regulation, or the GDPR, went into effect in May 2018 and implemented more stringent administrative requirements for controllers and processors of personal data of EU residents, including, for example, data breach notification requirements, limitations on retention of information, and rights for individuals over their personal data, and creates a range of new compliance obligations. The GDPR also provides that EU member states may make their own further laws and regulations limiting the processing of personal data. Ensuring compliance with the GDPR is an ongoing commitment that involves substantial costs, and despite our efforts, governmental authorities or others may assert that our business practices fail to comply with its

26

In the United States, California enacted the California Consumer Privacy Act, or CCPA, which took effect in January 2020 and imposes several obligations on companies that do business in California that are different from the obligations set forth in the GDPR. For example, the CCPA provides that covered companies must provide new disclosures to California consumers and afford such consumers new data privacy rights that include the right to request a copy from a covered company of the personal information collected about them, the right to request deletion of such personal information, and the right to request to opt-out of certain sales of such personal information. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties for violations. The CCPA also provides a private right of action for certain data breaches, which is expected to increase data breach litigation. Further, in November 2020, California voters passed the California Privacy Rights and Enforcement Act, or the CPRA. Effective beginning January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and will significantly modify the CCPA, including by expanding California residents’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and CPRA. It remains unclear how various provisions of the CCPA and CPRA will be interpreted and enforced, and we may be required to modify our data practices and policies and incur substantial costs in an effort to comply. Certain other state laws, including the recently enacted Virginia Consumer Data Protection Act, impose similar privacy obligations and all 50 states have laws including obligations to provide notification of certain security breaches to affected individuals, state officials and others.

In the APAC region, Data Protection Authorities have applied substantial penalties in case of privacy or security breaches. For example, the Australian Data Protection Authority (ACMA) collected approximately USD 6.6 million in fines for certain privacy violations (e.g. for unsolicited marketing emails) in 2023. In South Korea, there are multiple laws governing protection of personal data, cybersecurity infrastructure such as cloud computing, and cybersecurity measures. South Korean privacy laws provide not only administrative penalties up to 3% a company’s annual revenue, but also to criminal liability (maximum of 10 years of imprisonment) and punitive damages in the amount of five times the damages suffered by the data subject. Singapore has been going through several reforms on its data protection law and cybersecurity acts, adopting mandatory notification in case of breach and creating new types of privacy offenses, which can trigger penalties of up to 10% of a company’s annual turnover. As our operations grow in the region we may become increasingly more exposed to the regulatory reach of these authorities. In addition a number of countries in the APAC region have adopted rules for international data transfers from countries in the APAC region that resemble the framework of the GDPR in terms of requirements of adequacy decisions, proper legal basis and cross border security measures. In this heavily regulated scenario, any perceived lack of ability to comply with local laws may negatively affect our ability to attract new customers in the region.

We also may be bound by contractual obligations relating to our collection, use, processing and disclosure of personal, financial and other data or may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy or data protection-related organizations that require compliance with their rules pertaining to privacy and data protection.

While we strive to comply with all applicable privacy, data protection and information security laws and regulations, as well as our contractual obligations, posted privacy policies and applicable industry standards, such laws, regulations, obligations and standards continue to evolve and are becoming increasingly complex, and sometimes conflict among the various jurisdictions and countries in which we operate, which makes compliance challenging and expensive. We expect that there will continue to be new proposed laws, rules of self-regulatory bodies, regulations and industry standards concerning privacy, data protection and information security in Brazil and other jurisdictions, and we cannot yet determine the impact such future laws, rules, regulations and standards may have on our business. Moreover, existing Brazilian and foreign privacy and data protection-related laws and regulations are evolving and subject to potentially differing interpretations, and various legislative and regulatory bodies may expand current or enact new laws and regulations regarding privacy and data protection-related matters. Additionally, our customers may be subject to differing privacy laws, rules and legislation, which may mean that they require us to be bound by varying contractual requirements application to certain other jurisdictions. Because

27

evolve rapidly, it is possible that we or our products or platform may not be, or may not have been, compliant with each such applicable law, regulation and industry standard and compliance with such new laws or to changes to existing laws may impact our business and practices, require us to expend significant resources to adapt to these changes, or to stop offering our products in certain countries. These developments could adversely affect our business, results of operations and financial condition.

Any failure or perceived failure by us, or any third parties with whom we do business, to comply with laws, regulations, policies, industry standards or contractual or other legal obligations relating to privacy, data protection or information security may result in governmental investigations, inquiries, enforcement actions and prosecutions, private litigation, fines and penalties, adverse publicity or potential loss of business. Future restrictions on the collection, use, processing, storage, sharing or disclosure of sensitive or personal information could require us to incur additional costs or modify our platform, and could limit our ability to develop new functionality. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative or other developments. Any of the foregoing could adversely affect our business and operating results.

There are risks for which our insurance policies may not adequately cover or for which we have no insurance coverage. Insufficient insurance coverage or the materialization of such uninsured risks could adversely affect us.

Our insurance policies may not adequately cover all risks to which we are exposed. In addition, we cannot guarantee that we will be able to maintain our insurance policies in the future or that we will be able to renew them at reasonable prices or on acceptable terms, which may adversely affect our business and the trading price of our Class A common shares. Moreover, we are subject to risks for which we are uninsured, such as war, acts of God, including hurricanes, other force majeure events and breaches of the security of our systems by hackers. The occurrence of a significant loss that is not insured or compensable, or that is only partially insured or compensable, may require us to commit significant cash resources to cover such losses, which may adversely affect us.

Our operating results are subject to seasonal fluctuations.

Our subscription revenues are directly linked to the level of GMV that our customers process through our platform. Our customers historically have processed additional GMV during the holiday season. As a result, we have historically generated higher subscription revenues in the fourth quarter in each year compared to other quarters. While we believe that this seasonality has affected and will continue to affect our quarterly results, our rapid growth has largely masked seasonal trends to date. However, as a result of the continued growth of our subscription revenue offerings, we believe that our business may become more seasonal in the future and that historical patterns in our business may not be a reliable indicator of our future sales activity or performance. For further information “Item 5. Operating and Financial Review and Prospects—A. Operating Results—Seasonality and Quarterly Results of Operations.”

We face exposure to foreign currency exchange rate fluctuations, and such fluctuations could adversely affect our business, results of operations and financial condition.

As our international operations expand, our exposure to the effects of fluctuations in currency exchange rates grows. For example, global political events, including the conflict between Russia and Ukraine and the recent attack by Hamas on Israel from the Gaza Strip, trade tariff developments and other geopolitical events have caused global economic uncertainty and variability in foreign currency exchange rates. While we have primarily transacted with customers and business partners in Brazilian reais, in light of our international expansion we expect to transact with customers in Argentine pesos, Colombian pesos and British pounds, among others. We expect to significantly expand the number of transactions with customers that are denominated in foreign currencies in the future as we continue to expand our business internationally. We also incur expenses for some of our network service provider costs outside of Brazil in local currencies and for employee compensation and other operating expenses at our non-Brazil locations in the local currency for such locations. Fluctuations in the exchange rates between the Brazilian real and other currencies could result in an increase to the Brazilian equivalent of such expenses.

2827

In addition, our international subsidiaries may maintain net assets that are denominated in currencies other than the functional operating currencies of these entities. As we continue to expand our international operations, we become more exposed to the effects of fluctuations in currency exchange rates. The results of operations in the countries where we operate are exposed to foreign exchange rate fluctuations as the financial results of the applicable subsidiaries are translated from the local currency into U.S. dollars upon consolidation. If the U.S. dollar weakens against foreign currencies, the translation of these foreign-currency-denominated transactions will result in increased revenues, operating expenses and net income. Similarly, our revenues, operating expenses and net income will decrease if the U.S. dollar strengthens against foreign currencies. In the years ended December 31, 2023 and 2022, 20.3% and 2021, 15.6% and 17.3% of our revenues were denominated in, or linked to, U.S. dollars, respectively. Although total revenue in the years ended December 31, 2023 and 2022 grew 27.8% and 2021 grew 25.3% and 27.5% in U.S. dollars, our reporting and functional currency, and 22.3%23.7% and 29.8%22.3% on an FX neutral basis, the foreign currency exchange rates in 2023 relative to 2022 and 2022 relative to 2021 and 2021 relative to 2020 resulted in an increase of 2.4%3.3% and a decreasein an increase of 1.8%2.4% in our revenue growth, respectively.

Accordingly, changes in the value of foreign currencies relative to the U.S. dollar can affect our results of operations due to transactional and translational remeasurements. As a result of such foreign currency exchange rate fluctuations, it could be more difficult to detect underlying trends in our business and results of operations. In addition, to the extent that fluctuations in currency exchange rates cause our results of operations to differ from our expectations or the expectations of our investors and securities analysts who follow our stock, the trading price of our Class A common shares could be adversely affected.

We do not currently maintainAlthough we have implemented a program to hedge transaction exposures in some foreign currencies. However, in the future,currencies And we may useemploy derivative instruments such aslike foreign currency forward and option contracts to hedge certainspecific exposures to fluctuations in foreign currency exchange rates. Therates, the use of such hedging activities may not fully offset any or more than a portion of the adverse financial effects ofimpacts resulting from unfavorable movements in foreign exchange rates overwithin the limited time theduration of these hedges while they are in place.active. Moreover, the use of hedging instruments may introduce additional risks if we are unable to structure effective hedges with such instruments. See “—Certain Risks RelatedRelating to Latin America—America —Significant foreign currency exchange controls and currency devaluation in certain countries in which we operate which may have adverse effects on the economies of such countries, us and the price of our Class A common shares.shares.”

We rely on search engines and social networking sites to attract a meaningful portion of our SMB customers. If we are not able to generate traffic to our website through search engines and social networking sites, our ability to attract new SMB customers may be impaired. In addition, if our customers are not able to conclude their online store setup and generate traffic to their online stores through search engines and social networking sites, their ability to attract consumers may be impaired.

Many of our customers locate our website through internet search engines, such as Google, and advertisements on social networking sites, such as Facebook. The prominence of our website in response to internet searches is a critical factor in attracting potential customers to our platform. If we are listed less prominently or fail to appear in search results for any reason, visits to our website could decline significantly, and we may not be able to replace this traffic.

Similarly, many consumers locate our customers’ shops through internet search engines and advertisements on social networking sites. If our customers’ shops are listed less prominently or fail to appear in search results for any reason, visits to our customers’ shops could decline significantly. As a result, our customers’ businesses may suffer, which would affect the GMV that they process through our platform and could affect the ability of such customers to pay for our solutions.

Search engines revise their algorithms from time to time in an attempt to optimize their search results. If search engines modify their algorithms, our website and our customers’ shops may appear less prominently or not at all in search results, which could result in reduced traffic to our website and to our customers’ shops.

2928

Additionally, if the price of marketing our solutions over search engines or social networking sites increases, we may incur additional marketing expenses or may be required to allocate a larger portion of our marketing spend to search engine marketing and our business and operating results could be adversely affected. Furthermore, competitors may in the future bid on the search terms that we use to drive traffic to our website. Such actions could increase our marketing costs and result in decreased traffic to our website. In addition, search engines or social networking sites may change their advertising policies from time to time. If any change to these policies delays or prevents us from advertising through these channels, it could result in reduced traffic to our website and sales of our solutions. As well, new search engines or social networking sites may develop, particularly in specific jurisdictions, that reduce traffic on existing search engines and social networking sites, and if we are not able to achieve prominence through advertising or otherwise, we may not achieve significant traffic to our website through these new platforms and our business and operating results could be adversely affected.

We are dependent upon customers’ and their end-consumer willingness to use the internet for commerce.

Our success depends upon the general public’s continued willingness to use the internet as a means to pay for purchases, communicate, access social media, research and conduct commercial transactions, including through mobile devices. If customers and their consumers become unwilling or less willing to use the internet for commerce for any reason, including lack of access to high-speed communications equipment, congestion of traffic on the internet, internet outages or delays, disruptions or other damage to customers’ and end-consumers’ computers, increases in the cost of accessing the internet and security and privacy risks or the perception of such risks, our customers and prospective customers could be less inclined to adopt the services offered by a SaaS company like us, and our business prospects could be adversely affected.

In 2020, due to the restrictions imposed by the COVID-19 pandemic, ecommerce benefited from exponential growth. Both in 2021 and 2022, as the restrictions eased, consumers behavior shift towards online purchasing demonstrated staying power, with ecommerce penetration continuing to increase, though at a lower pace. We cannot assure this consumer trend will continue once the COVID-19 pandemic is sufficiently controlled, or if the macroeconomic environment worsens. For further information, see “—The COVID-19 pandemic could materially adversely affect our business, financial condition and results of operations.”

Activities of customers or the content of their shops could damage our brand, subject us to liability and harm our business and financial results.

Our terms of service prohibit our customers from using our platform to engage in illegal activities and our terms of service permit us to take down a customer’s online shop if we become aware of such illegal use. Customers may nonetheless engage in prohibited or illegal activities or upload store content in violation of applicable laws, which could subject us to liability. We could also be subject to liability under applicable law, which may not be fully mitigated by our terms of service. Any liability attributed to us could adversely affect our brand, reputation, ability to expand our subscriber base, and financial results. Furthermore, our brand may be negatively impacted by the actions of customers that are deemed to be hostile, offensive, inappropriate or illegal. We do not proactively monitor or review the appropriateness of the content of our customers’ shops and we do not have control over customer activities. The safeguards we have in place may not be sufficient for us to avoid liability or avoid harm to our brand, especially if such hostile, offensive, inappropriate or illegal use is high profile, which could adversely affect our business and financial results.

If we are unable to maintain our corporate culture as we grow, we could lose the innovation, teamwork, passion and focus on execution that we believe contribute to our success, and our business may be harmed.

We believe a critical component to our success has been our corporate culture. We have invested substantial time and resources in building our team. As we grow and develop our infrastructure as a public company, our operations may become increasingly complex. We may find it difficult to maintain these important aspects of our corporate culture. We maintain work-from-home arrangements for a growing number of our employees, which may impact our ability to preserve our corporate culture. Any failure to preserve our culture could negatively affect our future success, including our ability to retain and recruit personnel, and to effectively focus on and pursue our corporate objectives.

30

may choose not to work for us, their software may not be easily adapted to work with ours, or we may have difficulty retaining the customers of any acquired business due to changes in ownership, management, or otherwise. The anticipated benefits of any acquisition, investment, or business relationship may not be realized or we may be exposed to unknown risks or liabilities, such as:

In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations.

Acquisitions and investments may also result in dilutive issuances of equity securities, which could adversely affect our share price, or result in issuances of securities with superior rights and preferences to our Class A common shares or the incurrence of debt with restrictive covenants that limit our future uses of capital in pursuit of business opportunities.

31

Our holding company structure makes us dependent on the operations of our subsidiaries.

We are a Cayman Islands exempted company with limited liability. Our material assets are our direct and indirect equity interests in our subsidiaries. We are, therefore, dependent upon payments, dividends and distributions from our subsidiaries for funds to pay our holding company’s operating and other expenses and to pay future cash dividends or distributions, if any, to holders of our Class A common shares. The amount of any dividends or distributions which may be paid to us from time to time will depend on many factors including, for example, such subsidiaries results of operations and financial condition; limits on dividends under applicable law; its constitutional documents; documents governing any indebtedness; applicability of tax treaties; and other factors which may be outside our control. Furthermore, exchange rate fluctuation will affect the U.S. dollar value of any distributions our subsidiaries (which are currently mostly located in Brazil, Argentina and Colombia) make with respect to our equity interests in those subsidiaries. See “—Certain Risks RelatedRelating to Latin America—Significant foreign currency exchange controls and currency devaluation in certain countries in which we operate which may have adverse effects on the economies of such countries, us and the price of our Class A common shares,” “The“The ongoing economic uncertainty and political instability in Brazil and the other countries in which we operate may harm us and the price of our Class A common shares”shares” and “Dividends and Dividend Policy.”

We may require additional financing to support our future capital requirements. Our ability to timely raise capital in the future may be limited, or may be unavailable on acceptable terms, if at all. Our failure to raise capital when needed could harm our business, operating results and financial condition. Debt or equity issued to raise additional capital may reduce the value of our Class A common shares.

We have funded our operations since inception primarily through equity financings and payments by our customers for use of our platform and related services. We cannot be certain when or if our operations will generate sufficient cash to fund our ongoing operations or the growth of our business.

We intend to continue to make investments to support our business and may require additional funds. In particular, we may seek additional funds to develop new products and enhance our platform and existing products, expand our operations, including our sales and marketing organizations and our presence outside of Brazil, improve our infrastructure or acquire complementary businesses, technologies, services, products and other assets. Accordingly, we may need to engage in equity or debt financings to secure additional funds. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition. If we incur additional debt, the debt holders could have rights senior to holders of Class A common shares to make claims on our assets. If we raise additional funds through future issuances of equity or convertible debt securities, our shareholders may experience dilution, and the new equity securities could have rights senior to those of our Class A common shares. Because our decision to issue securities in the future offering will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing or nature of any future issuances of debt or equity securities. As a result, our shareholders bear the risk of future issuances of debt or equity securities reducing the value of our Class A common shares and diluting their interest.

32

Our subsidiary, Loja Integrada Tecnologia para Software LTDA, or Loja Integrada, utilizes our platform, which we believe currently complies with the PCI DSS, to process payments of its customers’ consumers. However, Loja Integrada does not use our platform to process payments of its customers’ subscription fees, and maintains its customers’ payment information in an encrypted database managed by Loja Integrada that is not compliant with PCI DSS. Loja Integrada is in the process of migrating its entire billing system to a PCI DSS compliant third-party payment processing service provider.

If we or any of our subsidiaries fail to migrate our billing system to a PCI DSS compliant third-party payment processing service provider, and/or otherwise fail to comply with applicable payment card network rules, including the PCI DSS, and those of each of the credit card brands, we could breach our contractual obligations to our payment processors, financial institutions, partners and customers. Such a failure may subject us to fines, penalties, damages, higher transaction fees, and civil liability and prevent us from processing or accepting payment cards or lead to a loss of payment processor partners, even if customer or end-consumer information has not been compromised. This would have an adverse effect on our business, financial condition and operating results.

We provide our ecommerce platform to businesses in highly regulated industries, which subjects us to a number of challenges and risks.

We provide our ecommerce platform to customers in highly regulated industries, such as pharmaceuticals, insurance, healthcare and life sciences, and we may have customers in other highly regulated industries in the future. Providing our ecommerce platform to such entities subjects us to a number of challenges and risks. Selling to such entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Customers in highly regulated industries may demand shorter subscription periods or other contract terms that differ from our standard arrangements, including terms that can lead those customers to obtain broader rights in our offerings than would be standard. Such entities may have statutory, contractual, or other legal rights to terminate contracts with us or our business partners due to a default or for other reasons. Any such termination may adversely affect our reputation, business, results of operations and financial condition. Additionally, due to the heightened regulatory environment in which they operate, potential customers in these industries may encounter additional difficulties when trying to move away from legacy ecommerce platforms to an open SaaS platform like the one we provide.

Our sales cycle with our customers can be long and unpredictable, and our sales efforts require considerable time and expense.

The timing of our sales with our customers and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for these customers. Mid-market and large enterprise customers, particularly those in highly regulated industries and those requiring customized applications, may have an even further lengthy sales cycle for the evaluation and implementation of our platform. This caused and may continue to cause a delay between increasing operating expenses for such sales efforts and, upon successful sales, the generation of corresponding revenue. We are often required to spend significant time and resources to better educate our potential customers and familiarize them with our platform. Our sales cycle for these customers, from initial evaluation to contract execution, is generally 8 to 12 months for large enterprise customers and 4 to 8 months for small and mid-market customers, but can vary substantially.

The challenging and uncertain macroeconomic environment influenced our customers’ planning and decision-making processes. Consequently, in 2022 our sales cycle has been at the high end of the sales cycle ranges, while we also experienced an increase in the average time to implement the VTEX platform and longer than usual ramp-up times from customers that recently implemented the VTEX platform.

Our sale cycle stabilized during the course of 2023 with marginal improvements in the implementation and ramp-up times compared to 2022. However our sale cycle remains inherently uncertain and challenging to predict and we cannot guarantee that the positive trends we experienced during 2023 will be maintained in the future.

32

As a result, a significant portion of our revenue is generated from the recognition of contract liabilities from contracts entered into with customers during prior periods. Customers often view our revenue sharing arrangements and subscription to our ecommerce platform and services as a strategic decision requiring significant investment. As a result, customers frequently require considerable time to evaluate, test and qualify our platform prior to entering into or expanding a subscription. During the sales cycle, we spend significant time and resources on sales and marketing and contract negotiation activities, which may not result in a sale. Additional factors that may influence the length and variability of our sales cycle include:

Due to these uncertainties, predicting the completion of a sale or revenue recognition timing remains challenging. While a decrease in current-period revenue might not be substantial, it could adversely influence future revenue if demand for our solutions and services or contract renewals declines.

Changes in tax laws or regulations or differing interpretations may be applied adversely to us or our customers. We may be subject to tax liability for past sales or become subject to tax laws or regulations that are applied adversely to us or our customers, which could harm our business.

New income, sales, use, or other tax laws, statutes, rules, regulations, or ordinances could be enacted at any time in the jurisdictions in which we operate. Any new taxes could adversely affect our domestic and international business operations and our business and financial performance. Existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, changed, modified or applied adversely to us. These events could require us or customers using our ecommerce platform to pay additional tax amounts on a prospective or retroactive basis. They could require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due. If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to continue to subscribe or elect not to subscribe to our ecommerce platform in the future. Additionally, new or modified tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our platform. Any or all of these events could adversely impact our business and financial performance.

33

In addition, we may be subject to additional obligations to collect and remit sales tax and other taxes. The jurisdictions in which we operate have differing rules and regulations governing sales, use, value-added and other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of such taxes to our ecommerce platform in various jurisdictions is unclear (especially with respect to taxes on digital services in jurisdictions where we do not have legal presence). These jurisdictions’ rules regarding tax nexus are complex and vary significantly. As a result, we could face tax assessments and audits. Our liability for these taxes and associated penalties could exceed our original estimates. Jurisdictions in which we have not historically collected or accrued sales, use, value-added, or other taxes could assert our liability for such taxes. This could result in substantial tax liabilities and related penalties for past sales. It could also discourage customers from using our platform or otherwise harm our business and operating results.

Our future effective tax rates could be subject to volatility or adversely affected by a number of factors, including:

We currently conduct activities in multiple jurisdictions through our subsidiaries pursuant to transfer pricing arrangements and may in the future conduct operations in other jurisdictions pursuant to similar arrangements. If two or more affiliated companies are located in different countries, the tax laws or regulations of each country generally will require that transfer prices be the same as those between unrelated companies dealing at arm’s length. While we believe that we operate in compliance with applicable transfer pricing laws and intend to continue to do so, our transfer pricing procedures are not binding on applicable tax authorities. If tax authorities in any of these countries were to successfully challenge our transfer prices as not reflecting arm’s length transactions, they could require us to adjust our transfer prices and thereby reallocate our income to reflect these revised transfer prices, which could result in a higher tax liability to us.

34

We are subject to anti-corruption, anti-bribery, anti-money laundering and similar laws. Non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

We are subject to the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the Brazilian Anticorruption Law, the UK Bribery Act of 2010, the UK Proceeds of Crime Act 2002, and other anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years. These laws are interpreted broadly to prohibit companies and their employees and third-party intermediaries from authorizing, promising, offering, or providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. As we increase our international sales and business and sales to the public sector, we may engage with partners and third-party intermediaries to market our services and to obtain necessary permits, licenses and other regulatory approvals. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities. We can be held liable for corrupt or other illegal activities of these third-party intermediaries, our employees, representatives, contractors, partners and agents, even if we do not explicitly authorize such activities.

While we have policies and procedures to address compliance with such laws, our employees and agents could violate our policies and applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.

Non-compliance with anti-corruption, anti-bribery, or anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations and financial condition could be materially harmed. Responding to any action will likely result in a materially significant diversion of management’s attention and resources and significant defense costs and other professional fees. Enforcement actions and sanctions could further harm our business, results of operations and financial condition.

35

In addition, until we cease to be an “emerging growth company” as such term is defined in the JOBS Act, which may not be until after five full fiscal years following the date of our initial public offering, our independent registered public accounting firm is not required to attest to and report on, and did not attest to and report on, the effectiveness of our internal control over financial reporting. In addition, our current reporting obligations as a SEC-reporting company may place a significant strain on our management, operational and financial resources, and systems for the foreseeable future. We mayThere can be unable to timely complete our evaluation testing and any required remediation. In addition, if we fail to maintain the adequacy of our internal control over financial reporting, as these standards are modified, supplemented, or amended from time to time, we may not be able to conclude on an ongoing basis that we have effective internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act of 2002. If we fail to achieve and maintain an effective internal control environment, we could suffer material misstatements in our financial statements, fail to meet our reporting obligations or fail to prevent fraud, which would likely cause investors to lose confidence in our reported financial information. This could, in turn, limit our access to capital markets, harm our results of operations and lead to a decline in the trading price of our Class A common shares. Additionally, ineffective internal control over financial reporting could expose us to increased risk of fraud or misuse of corporate assets and subject us to potential delisting from the New York Stock Exchange, or NYSE, regulatory investigations, and civil or criminal sanctions.

We identified a material weakness in our internal controls over financial reporting as of December 31, 2022. The material weakness identified relates to the failure to maintain controls over restricted access management procedures regarding granting, revoking, and reviewing access and segregation of duties. A material weakness is a deficiency, or combination of control deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. This material weakness did not result in a material misstatement of our consolidated financial statements. See “Item 15. Controls and Procedures — B. Management’s Annual Report on Internal Control Over Financial Reporting” for additional details.

The material weakness described above involves control deficiencies that could result in a misstatement of one or more account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected, and, accordingly, we determined that these control deficiencies constitute a material weakness.

Although we have adopted several measures that we expect will improve our internal control over financial reporting and address the underlying cause of this material weakness, we cannot assure that our efforts will be effective or prevent any future material weakness or significant deficiency in our internal control over financial reporting. For details of the remediation plan to address this material weakness, see “Item 15. Controls and Procedures — B. Management’s Annual Report on Internal Control Over Financial Reporting.”

36

We may be subject to various legal proceedings which could adversely affect our business, financial condition or results of operations.

We may be involved in various legal proceedings, investigations and similar matters from time to time arising from tax, civil and labor claims, amongst others. Such matters can be time-consuming, divert management’s attention and resources and cause us to incur significant expenses. Any insurance or indemnities that we may have may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. If we are unsuccessful in our defense in these legal proceedings, we may be forced to pay damages or fines, enter into consent decrees or change our business practices, any of which could adversely affect our business, financial condition or results of operations. In addition, certain legal proceedings may result in negative publicity or affect our reputation. We are currently a party to a legal proceeding relating to alleged misappropriation and/or retention of confidential and proprietary information. For further information “Item 8. Financial Information—A. Consolidated Statements and Other Financial Information—Legal and Administrative Proceedings.”

In addition, media coverage and public statements that insinuate improper actions by us or our subsidiaries, regardless of their factual accuracy or truthfulness, may result in negative publicity or legal proceedings. Addressing negative publicity and any resulting legal proceeding may distract management, increase costs and divert resources. Negative publicity may have an adverse impact on our reputation or the morale of our employees, which could adversely affect our business, financial condition and results of operations.

Certain Risks Related ToRelating to Latin America

Governments have a high degree of influence in Brazil and the other economies in which we operate. The effects of this influence and political and economic conditions in Brazil and Latin America could harm us and the trading price of our Class A common shares.shares.

Governments in many of the markets in which we currently, or may in the future, operate frequently exercise significant influence over their respective economies and occasionally make significant changes in policy and regulations. Government actions to control inflation and other policies and regulations have often involved, among other measures, increases or decreases in interest rates, changes in fiscal policies, wage and price controls, foreign exchange rate controls, blocking access to bank accounts, currency devaluations, capital controls and import and export restrictions. We have no control over and cannot predict what measures or policies governments may take in the future. We and the market price of our securities may be harmed by changes in government policies, as well as general economic factors, including, without limitation:

37