Intellectual Property
Our intellectual property and proprietary rights are important to our business. In our efforts to safeguard them, we rely on a combination of copyrights, trade secrets, trademarks and other proprietary rights in several jurisdictions in which we conduct our business, including Brazil, the United States, Latin America, India, the United Kingdom and certain European countries. We also control access to our intellectual property and confidential information through internal and external controls. We rely on confidentiality and/or license agreements with employees, contractors, customers, vendors, distributors and other third parties, which limit access to and use of our proprietary intellectual property. We also require our employees and independent contractors to enter agreements assigning to us any inventions, trade secrets, works of authorship and other technology and intellectual property created for us. Though we rely, in part, upon these legal and contractual protections, we believe that factors such as the skills and ingenuity of our employees, as well as the functionality and frequent enhancements to our platform, make our intellectual property difficult to replicate.
As of December 31, 2022, we have been issued trademark registrations in Brazil covering trademarks including “VTEX”, “VTEX Day”, “TETRIX”, “Bora Vender”, “#BoraVender”, “Go Commerce”, “Bora Varejo”, “Bora Doar”, “Smartcheckout”, “True Cloud Commerce”, “Ciashop”, “Integrando-se”, “Loja Integrada”, “Xtech Commerce”, “Commerce Society”, “Time to Revenue”, “Indeva” and “Hiring Coders”. We have also been issued trademark registrations in the United States of America covering trademarks including “VTEX”, “Smart QR”, “Work Area” and “Workarea”. We have also been issued trademark registrations in Mexico, Argentina, Colombia, Chile, India, Peru, United Kingdom and Europe covering certain of our trademarks and have additional trademarks applications pending in several of these jurisdictions.
Regulatory Considerations
Data protection and privacy
The customer data that our platform uses, collects, stores, transmits and processes to run our business is an integral part of our business model. As a result, our compliance with federal, state and foreign laws and regulations dealing with the use, collection, storage, transmission, disclosure, disposal and other processing of personal data is core to the operation of our business. Regulators around the world have adopted or proposed requirements regarding the collection, use, transfer, security, storage, destruction, and other processing of personal data. The applicability of these laws and regulations to us, and their scope and interpretation, are constantly evolving, often uncertain, and may conflict between jurisdictions, and we anticipate the number of data privacy laws and the scope of individual data privacy and protection rights will increase, and as a result, the associated compliance burdens and costs could increase in the future. It may be costly to implement security or other measures designed to comply with these laws and regulations, as well as any new or updated laws or regulations. Any actual or perceived failure to safeguard data adequately, destroy data securely, or otherwise comply with the requirements of these laws and regulations, may subject us to litigation, regulatory investigations or enforcement actions under federal, state or foreign data security, unfair practices or consumer protection laws and contractual penalties, and result in monetary damages, damage to our reputation or adversely affect our ability to retain customers or attract new customers.
A number of the jurisdictions in which we operate have adopted or are considering adopting data protection and privacy laws and regulations, including, among others, Brazil, the United States, the European Union and the United Kingdom.
Brazil
In September 2020, Brazilian Federal Law No. 13,709/2018, the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais), or LGPD, came into effect to regulate the processing of personal data in Brazil. The LGPD establishes general principles, obligations and detailed rules to be observed by individuals or public or private companies in operations involving processing of personal data in Brazil, including the collection, use, processing and storage of personal data, which affects all economic sectors, including the relationship between customers and suppliers of goods and services, employees and employers and other relationships in which personal data is processed, whether in a digital or physical environment. The LGPD provides for, among others, the rights of holders of personal data, the legal bases applicable to the processing of personal data, the requisites to obtain consent, the obligations and requisites related to security incidents and leakages and transfers of data, either Brazilian or international, as well as the creation of the National Authority for Data Protection (Autoridade Nacional de Proteção de Dados), or ANPD, responsible for the inspection, promotion, disclosure, regulation, establishment of guidelines and application of the law.
75