Phunware (PHUN) Risk Factors

The markets in which we operate are highly competitive, with relatively low barriers to entry for some software, product or service organizations. Some customers may be hesitant to switch vendors or to adopt cloud-based software such as ours and prefer to maintain their existing relationships. Some of our competitors are larger and have greater name recognition, much longer operating histories, larger marketing budgets and significantly greater resources than we do. We also face competition from custom-built software vendors and from vendors of specific applications, some of which offer cloud-based solutions. We may also face competition from a variety of vendors of software and products that address only a portion of our platform. In addition, other companies that provide cloud-based software in different target markets may develop software or acquire companies that operate in our target markets, and some potential customers may elect to develop their own internal software. With the introduction of new technologies and market entrants, we expect this competition to intensify in the future. Many of our competitors are able to devote greater resources to the development, promotion and sale of their products and services. Furthermore, our current or potential competitors may be acquired by third parties with greater available resources and the ability to initiate or withstand substantial price competition. In addition, many of our competitors have established marketing relationships, access to larger customer bases and major distribution agreements with consultants, system integrators and resellers. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their product offerings or resources. If our technology, products and services do not become more accepted relative to those of our competitors, or if our competitors are successful in bringing their products or services to market earlier than ours, or if the products or services of our competitors are more technologically capable than ours, then our revenues could be adversely affected. In addition, some of our competitors may offer their products and services at lower prices. If we are unable to achieve our target pricing levels, our operating results may be negatively affected. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

Although international revenue currently represents a small portion of our revenue, our business from outside of the United States may expand in the future as we expand our international presence, including but not limited to our subscription, application transaction, services and digital asset offerings. As a result, we may be subject to risks inherently associated with international operations, including risks associated with foreign currency exchange rate fluctuations, difficulties in enforcing intellectual property and/or contractual rights, the burdens of complying with a wide variety of foreign laws and regulations, potentially adverse tax consequences, tariffs, quotas and other barriers, potential difficulties in collecting accounts receivable, international hostilities, terrorism and natural disasters. Expansion of international operations also increases the likelihood of potential or actual violations of domestic and international anti-corruption laws, such as the Foreign Corrupt Practices Act, or of U.S. and international export control and sanctions regulations. We may also face difficulties integrating any new facilities in different countries into our existing operations, as well as integrating employees that we hire in different countries into our existing corporate culture. If we are unable to manage the risks of our global operations, our business, results of operations, or financial condition could be adversely affected.

Our systems and operations are vulnerable to damage or interruption from earthquakes, fires, floods, power losses, telecommunications failures, terrorist attacks, acts of war, human errors, break-ins and similar events. For example, a significant natural disaster, such as a tornado, earthquake, hurricane, mudslides, fire, flood, snow, ice or extreme temperatures could have a material adverse effect on our business, results of operations and financial condition and our insurance coverage may be insufficient to compensate us for losses that may occur. We have an office and at least one data center located in California, a region known for earthquakes and mudslides. A significant amount of our development and ad operations work is also located in California. We also have corporate offices in Texas, which is susceptible to floods, extreme temperatures, heavy winds, ice, snow and tornadoes. In addition, acts of terrorism, which may be targeted at metropolitan areas that have higher population density than rural areas, could cause disruptions in our or our advertisers' businesses or the economy as a whole. Our servers may also be vulnerable to computer viruses, break-ins, denial-of-service attacks and similar disruptions from unauthorized tampering with our computer systems, which could lead to interruptions, delays, loss of critical data. We may not have sufficient protection or recovery plans in some circumstances, such as natural disasters affecting California or Texas. As we rely heavily on our data centers, computer and communications systems and the internet to conduct our business and provide high-quality customer service, such disruptions could negatively impact our ability to run our business and either directly or indirectly disrupt our customers' business, which could have a material adverse effect on our business, results of operations and financial condition.

We, along with certain of our former executive officers and certain former board members, are parties to litigation with Wild Basin Investments, LLC as further described on our Current Report on Form 8-K filed with the SEC on January 10, 2020. We, along with our officers and directors, may also become subject to other legal proceedings in our ordinary course of business. We cannot predict with certainty the outcome of this legal proceeding. The outcome of this or future legal proceeding could require us to take, or refrain from taking, actions which could negatively affect our operations. Such legal proceedings involve substantial costs, including the costs associated with investigation, litigation and possible settlement, judgment, penalty, or fine. As a smaller company, the collective costs of litigation proceedings represent a drain on our cash resources, and require an inordinate amount of our management's time and attention. An adverse ruling with respect to our current or any other litigation could have a material adverse effect on our results of operations and financial condition. Negative publicity surrounding such legal proceedings may also harm our reputation and adversely impact our business and results.

In the course of providing our solutions, we collect, transmit and store information related to and seeking to correlate internet-connected devices, user activity and the ads we place. Federal, state and international laws and regulations govern the collection, use, processing, retention, sharing and security of data that we collect across our advertising solutions. We strive to comply with all applicable laws, regulations, policies and legal obligations relating to privacy and data collection, processing use and disclosure. However, the applicability of specific laws may be unclear in some cases and domestic and foreign government regulation and enforcement of data practices and data tracking technologies is expansive, not clearly defined and rapidly evolving. In addition, it is possible that these requirements may be interpreted and applied in a manner that is new or inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any actual or perceived failure by us or our customers or partners to comply with U.S. federal, state or international laws, including laws and regulations regulating privacy, data, security or consumer protection, or disclosure or unauthorized access by third parties to this information, could result in investigations, proceedings or actions against us by governmental entities, competitors, private parties or others. Any investigations, proceedings or actions against us alleging violations of consumer or data protection laws or asserting privacy-related theories could hurt our reputation, force us to spend significant amounts in defense of these proceedings, distract our management, increase our costs of doing business, adversely affect the demand for our solutions and ultimately result in the imposition of monetary liability. We may also be contractually liable to indemnify and hold harmless our customers from the costs or consequences of litigation resulting from using our solutions or from the unauthorized disclosure of confidential information, which could damage our reputation among our current and potential customers, require significant expenditures of capital and other resources and cause us to lose business and revenue. The regulatory framework for privacy issues is evolving worldwide. It is possible that new laws and regulations will be adopted in the United States and internationally, or existing laws and regulations may be interpreted in new ways, that could affect our business, particularly with regard to collection or use of data to target ads and communication with consumers and the international transfer of data from Europe to the U.S. In particular, the GDPR extends the jurisdictional scope of European data protection law. As a result, we are subject to the GDPR when we provide our targeting services in Europe. The GDPR imposes stricter data protection requirements that may necessitate changes to our services and business practices. Potential penalties for non-compliance with the GDPR include administrative fines of up to 4% of annual worldwide revenue. While we have not collected data that is traditionally considered identifiable personal data, such as name, email address, physical address, phone numbers or social security numbers, we typically collect and store IP addresses, geolocation information and device or other persistent identifiers that are or may be considered personal data in some jurisdictions or otherwise may be subject to applicable laws or regulations. For example, some jurisdictions in the EU regard IP addresses as personal data and certain regulators have advocated for including IP addresses, GPS-level geolocation data and unique device identifiers as personal data. Moreover, with the effectiveness of the CCPA in California on January 1, 2020, the use of geolocation gathering in California should be approached with care to ensure compliance. Furthermore, the GDPR makes clear that online identifiers (such as IP addresses and other device identifiers) will be treated as "personal data" going forward and therefore subject to stricter data protection rules. Evolving definitions of personal data within the United States, European Union and elsewhere, especially relating to the classification of IP addresses, machine or device identifiers, geolocation data and other such information, may cause us to change our business practices, diminish the quality of our data and the value of our solution and hamper our ability to expand our offerings. Complying with any new legal requirements relating to privacy and data protection could force us to incur substantial costs or require us to change our business practices in a manner that could reduce our revenue or compromise our ability to effectively pursue our growth strategy. Our failure to comply with evolving interpretations of applicable laws and regulations relating to privacy and data protection, or to adequately protect personal data, could result in enforcement action against us or reputational harm, which could have a material adverse impact on our business, financial condition and results of operations. In addition to compliance with applicable laws and regulations, we voluntarily participate in trade associations and industry self-regulatory groups that promulgate best practices or codes of conduct addressing the provision of internet advertising. We could be adversely affected by changes to these guidelines and codes in ways that are inconsistent with our practices or in conflict with the laws and regulations of U.S. or international regulatory authorities. For instance, new guidelines, codes, or interpretations, by self-regulatory organizations or government agencies, may require additional disclosures, or additional consumer consents, such as "opt-in" permissions to share, link or use data, such as health data obtained from third parties, in certain ways. If we fail to abide by, or are perceived as not operating in accordance with, industry best practices or any industry guidelines or codes with regard to privacy, our reputation may suffer and we could lose relationships with advertisers and digital media partners.