To conduct its business, the Company relies extensively on information technology systems, many of which are managed, hosted, provided and/or used by third-parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, vendors, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements. Furthermore, the Company sells certain of its natural personal care products, vitamins, minerals, supplements and other products directly to consumers online and through websites, mobile apps and connected devices, and the Company also engages in online activities, including promotions, rebates and customer loyalty and other programs, through which it may receive personal information. Through the use of any of these information technology systems or processes, the Company or its vendors have in the past and could in the future again experience cyber-attacks, privacy breaches, data breaches or other incidents that may result in unauthorized access, disclosure and misuse of consumer, customer, employee, vendor or Company information, especially as the Company shifts to a hybrid working model under which employees will continue accessing its technology infrastructure remotely. In addition to upgrading the Company’s enterprise resource planning system, it also uses various hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of security breaches, system failures and disruptions. Any such upgrade could take time, oversight and be costly to the Company. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly, or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, adversely impact the Company’s results of operations and cash flows. Despite the security measures the Company has in place, the information technology systems, including those of our customers, vendors, suppliers and other third-party service providers with whom we have contracted, have, in the past, and may, in the future, be vulnerable to cyber-threats such as computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks and other disruptions from employee error, unauthorized uses, system failures, including Internet outages, unintentional or malicious actions of employees or contractors or cyber-attacks by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. The Company’s information technology systems and its third-party providers’ systems, have been, and will likely continue to be, subject to cyber-threats such as computer viruses or other malicious codes, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, social engineering, hacking and other cyberattacks attempting to exploit vulnerabilities. The Company has seen and may continue to see an increase in the number of such attacks as the Company shifts to a hybrid working model under which employees will continue working remotely and accessing its technology infrastructure remotely. In addition, while we have purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of our cybersecurity policy. As cyberattacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as appropriate for our operations. To date, the Company is not aware that its business or operations have been materially impacted by these attacks. However, the Company’s security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company’s, or its third-party service providers’, databases or systems. In addition, if the Company or its third-party providers are unable to effectively resolve such breaches or breakdowns on a timely basis, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, and litigation and remediation expenses. In addition, such incidents could result in unauthorized disclosure and misuse of material confidential information, including personal information. Cyber threats are becoming more sophisticated, are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. We have incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm our business. In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, vendor or employee information or related data, including the European Union’s General Data Protection Regulation (“GDPR”), which went into effect in May 2018, and the California Consumer Privacy Act of 2018 (“CCPA”), which went into effect in January 2020. These laws and regulations change frequently, and new legislation continues to be introduced and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. For example, the California Privacy Rights Act (“CPRA”), which was effective on January 1, 2022, modifies the CCPA significantly. Several other states have introduced or passed similar legislation to the CCPA and CPRA, which may impose varying standards and requirements on our data collection, use and processing activities. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and they subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data. A breach or other breakdown in the Company’s technology, including a cyber-attack, privacy breach, data breach or other incident involving the Company or any of the Company's third-party service providers or vendors, that results in unauthorized disclosure or significant unavailability of business, financial, personal or stakeholder information could adversely affect the Company’s financial condition and results of operations. In addition, if the Company’s service providers, suppliers or customers experience a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected, which may result in a disruption in the Company’s supply chain or reduced customer orders or other business operations, which would adversely affect the Company. These risks also may be present to the extent any of our partners, distributors, joint venture partners or suppliers using separate information systems, not integrated with the information systems of the Company, suffers a cybersecurity incident and could result in increased costs related to our involvement in investigations or notifications conducted by these third parties. These risks may also be present to the extent a business we have acquired that does not use our information systems, experiences a system shutdown, service disruption, or cybersecurity incident. Due to the conflict in Ukraine, there is a possibility that the escalation of tensions could result in cyberattacks that could either directly or indirectly affect our operations. In addition, we are in the process of a multi-year phased upgrade to our digital and productivity capabilities, including replacing our enterprise resource planning system to enhance operating efficiencies and provide more effective management of our business operations. The upgrade poses several challenges, including training of personnel, migration of data and the potential instability of the new system. If we do not allocate and effectively manage the resources necessary to build and sustain the upgraded technology infrastructure, or if we fail to achieve the expected benefits from this enhancement or it does not operate as designed, our business could be adversely affected.