contexts such as when signing up for certain services, utilizing certain of our offerings, registering for seminars, participating in a survey, connecting with other users and Hadoop, NiFi and Metron experts in our forums, participating in Hortonworks University classes, participating in polls or signing up to receivee-mail newsletters.
Within the United States, various federal and state laws and regulations govern the collection, use, retention, sharing and security of the data we receive from and about employees and users. Outside of the United States, various jurisdictions actively regulate and enforce laws regarding the collection, retention, transfer and use (including loss and unauthorized access) of data and personal information. Privacy advocates and government bodies have increasingly scrutinized the ways in which companies link personal identities and data associated with particular users or devices with data collected through the internet, and we expect such scrutiny to continue to increase. In 2016, the European Commission adopted a new framework, theEU-U.S. Privacy Shield, which provides a mechanism for companies to transfer data from EU member states to the United States. This and other mechanisms may be reviewed by European courts, which may lead to uncertainty about transfers of personal data from EU member states to the United States. Also in 2016, the EU adopted a new law governing data practices and privacy called the General Data Protection Regulation (the “GDPR”), which became effective in May 2018. We have assessed the impact of the GDPR on our operations and have undertaken remedial activities to comply with the requirements, but there can be no assurance that our remedial activities will avoid or mitigate potential violations of the GDPR. Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.
Security and privacy breaches may hurt our business.
Any security breach, unauthorized access, unauthorized usage, virus or similar breach or disruption could result in the loss of confidential information, loss of confidence in the security of our services, damage to our reputation, early termination of our contracts, litigation, regulatory investigations, disruption of our business or other liabilities. If our, our customers’, our partners’, our third-party data center hosting facilities’ or cloud computing platform providers’ security measures are breached as a result of third-party action, employee error, malfeasance or otherwise and, as a result, someone obtains unauthorized access to data, our reputation will be damaged, our business may suffer and we could incur significant liability.
Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate these techniques or to implement adequate preventative measures. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers. Any significant violations of data privacy could result in the loss of business, litigation and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition. Moreover, if a high-profile security breach occurs with respect to software from an open source project that we include in our product offerings, our customers and potential customers may lose trust in the security of our solutions generally, which could adversely impact our ability to retain existing customers or attract new ones.
Industry-specific regulations, standards and other requirements are evolving, and unfavorable industry-specific regulations, standards or other requirements could harm our customers and our business.
Our customers and potential customers conduct business in a variety of industries, including financial services, healthcare, telecommunications and the public sector. Regulators in certain industries have adopted and may in the future adopt regulations or interpretive positions regarding the use of cloud-based solutions. The costs of compliance with, and other burdens imposed by, industry-specific laws, regulations and interpretive positions may limit our customers’ use and adoption of our services. Compliance with these regulations may also require us to devote greater resources to support certain customers, which may increase costs and lengthen sales cycles. Further, if we are unable to comply with these regulations, our business may be harmed. In addition, an inability to satisfy the standards of certain voluntary third-party certification bodies that our customers may expect could have an adverse impact on our business and results. In some cases, industry-specific laws, regulations, standards or interpretive positions may also apply directly to us as a service provider. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business.
Prolonged economic uncertainties or downturns could harm our business.
Economic downturns or negative conditions in the general economy both in the United States and abroad could harm our business and results of operations and cause a decrease in corporate spending on enterprise software in general.
General worldwide economic conditions have experienced, and in the future may experience, significant downturns. Fluctuations in economic conditions make it extremely difficult for our customers and us to forecast and plan future business activities accurately, and they could cause our customers to reevaluate their decision to purchase our offerings, which could delay and lengthen our sales cycles or result in cancellations of planned purchases. Furthermore, during challenging economic times our customers may face issues in gaining timely access to sufficient credit, which could impair their ability to make timely payments to us. If that were to occur, we may be required to increase our allowance for doubtful accounts, which would harm our results of operations.
49
