Rover Group (ROVR) Risk Analysis

We receive, transmit and store a large volume of personal information and other data relating to users on our platform, as well as personal information and other data relating to individuals such as our employees. Numerous local, municipal, state, federal and international laws and regulations address privacy and the collection, storing, sharing, use, disclosure and protection of certain types of data, including the California Online Privacy Protection Act, Canada's Personal Information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, Canada's Anti-Spam Legislation, the EU ePrivacy Directive, the EU General Data Protection Regulation, or GDPR, the Telephone Consumer Protection Act (restricting telemarketing and the use of automated SMS text messaging), Section 5 of the Federal Trade Commission Act and the California Consumer Privacy Act, or the CCPA, and the California Privacy Rights and Enforcement Act of 2020, or the CPRA. These laws, rules and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation and changes in enforcement and may be inconsistent from one jurisdiction to another. For example, the GDPR, which became effective on May 25, 2018, has resulted and will continue to result in significant compliance burdens and costs for companies like ours. The GDPR regulates our collection, use, and other processing of personal data of European Union residents, referred to as personal data, and imposes stringent data protection requirements with significant penalties and the risk of civil litigation, for noncompliance. Failure to comply with the GDPR may result in fines of up to 20 million Euros or up to 4% of annual global revenue, whichever is greater. It may also lead to civil litigation, with the risks of damages or injunctive relief, or regulatory orders adversely impacting the ways in which our business can use personal data. In addition, the United Kingdom has implemented legislation similar to the GDPR, referred to as the UK GDPR, which provides for fines of up to the greater of 17.5 million British Pounds and 4% of global turnover. The relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear, and these changes will lead to additional costs and increase our risk exposure. On June 28, 2021, the European Commission announced a decision of "adequacy" concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, providing some relief regarding the legality of continued personal data flows from the European Economic Area, or EEA, to the United Kingdom. This adequacy determination must be renewed after four years and may be modified or revoked in the interim. Additionally, we are or may become subject to laws, rules and regulations regarding cross-border transfers of personal data, including those relating to transfer of personal data outside the EEA, Switzerland, and the United Kingdom. Recent legal developments have created complexity and uncertainty regarding transfers of personal data from these regions to the United States and other jurisdictions; for example, on July 16, 2020, the Court of Justice of the European Union, or CJEU, invalidated the EU-U.S. Privacy Shield Framework, or the Privacy Shield, under which personal data could be transferred from the EEA to U.S. entities that had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism), it noted that reliance on them may not necessarily be sufficient in all circumstances. In addition to other mechanisms (particularly standard contractual clauses), in limited circumstances we may rely on Privacy Shield certifications of third parties (for example, vendors and partners). On June 4, 2021, the European Commission issued new SCCs that are required to be implemented, and on February 2, 2022, the United Kingdom's Information Commissioner's Office issued new standard contractual clauses to support personal data transfers from the United Kingdom. Continually evolving requirements have created uncertainty and increased the risk around our international operations. We may, in addition to other impacts, be required to review and amend the legal mechanisms by which we make or receive personal data transfers to the United States and other jurisdictions, to engage in new contract negotiations with third parties that aid in processing personal data on our behalf or localize certain personal data, to localize certain personal data, and to incur additional costs associated with increased compliance burdens. Further, in the EEA, the Austrian and the French data protection authorities recently indicated that use of Google Analytics by European website operators involves the unlawful transfer of personal data to the United States. As the enforcement landscape further develops, and depending on the impacts of these rulings, we could suffer additional costs, complaints and/or regulatory investigations or fines, have to stop using certain tools and vendors and make other operational changes and/or if we are otherwise unable to transfer personal information between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could materially adversely affect our business, results of operations and financial condition. The CCPA, which went into effect on January 1, 2020, among other things, requires covered companies to provide disclosures to California consumers and affords such consumers abilities to opt out of certain sharing and sales of personal information. The law also prohibits covered businesses from discriminating against consumers for exercising their CCPA rights. The CCPA imposes severe statutory damages as well as a private right of action for certain data breaches. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. In November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020, or the CPRA. The CPRA further expands the CCPA with additional data privacy compliance requirements that may impact our business and establishes a regulatory agency dedicated to enforcing those requirements. In addition, on March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act, or VCDPA, which will take effect on January 1, 2023, and the Colorado Privacy Act, passed on June 8, 2021, will take effect July 1, 2023. Both laws emulate the CCPA and the CPRA in many respects but include their own compliance requirements. Aspects of the interpretation and enforcement of these laws remain uncertain. Comprehensive privacy laws have also been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States, with potentially greater penalties and more rigorous compliance requirements relevant to our business. The effects of such laws are significant and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. Additionally, many laws and regulations relating to privacy and the collection, storing, sharing, use, disclosure, protection, and other processing of certain types of data are subject to varying degrees of enforcement and new and changing interpretations by courts. Current or new laws or regulations, or evolving interpretations of their requirements, may require significant changes to our operations and our platform, or prevent us from providing our platform in jurisdictions in which we currently operate and in which we may operate in the future. Additionally, we have incurred and may continue to incur significant expenses in an effort to comply with privacy, data protection and information security standards and protocols imposed by law, regulation, industry standards, or contractual obligations. For example, increased regulation and regulatory scrutiny could force us to change how we use cookies and other tracking technologies, limit the effectiveness of our marketing activities, divert technology personnel resources, increase costs, and subject us to additional liabilities. Furthermore, publication of our privacy statement and other policies regarding privacy, data protection and data security may subject us to investigation or enforcement actions by regulators if those statements or policies are found to be deficient, lacking transparency, deceptive, unfair, or misrepresentative of our practices. We are also bound by contractual obligations related to privacy, data protection and data security and our efforts to comply with such obligations may not be successful or may have other negative consequences. Such efforts may not be successful or may have other negative consequences. In particular, with such laws and regulations imposing new and relatively burdensome obligations and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. Despite our efforts to comply, it is possible that our interpretations of the law, practices, or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, applicable laws, regulations, or obligations. Our failure, or the failure by our third-party providers, pet parents, or pet care providers on our platform, or consequences associated with our efforts to comply with applicable laws or regulations or any other obligations relating to privacy, data protection, or information security, or any compromise of security that results in unauthorized access to, or use or release of data relating to service providers, pet parents. or other individuals, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing service providers and pet parents from using our platform, or result in fines, investigations, or proceedings by governmental agencies and private claims and litigation, any of which could adversely affect our business, financial condition and operating results. Even if not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and adversely affect our business, financial condition and operating results.

We plan to invest in new offerings that differentiate us from our competitors. For example, we introduced, then later deactivated, an on-demand dog walking offering and a grooming offering, and have increased investment in The Dog People, our pet-related blog, and The Rover Store, which offers Rover-branded merchandise for sale alongside third-party merchandise. Developing new offerings increases our expenses and organizational complexity and we have and may continue to experience difficulties in developing these new offerings. Our new offerings have a high degree of risk, as they may involve unproven businesses with which we have limited or no prior development or operating experience. There can be no assurance that consumer demand for such offerings will exist or be sustained at the levels that we anticipate, that we will be able to successfully manage the development and delivery of such offerings, or that any of these offerings will gain sufficient market acceptance to generate sufficient revenue to offset associated expenses or liabilities. It is also possible that offerings developed by others will render our offerings noncompetitive or obsolete. Even if we are successful in developing new offerings, regulatory authorities may subject us or our pet care providers and pet parents to new rules, taxes, or restrictions or more aggressively enforce existing rules, taxes, or restrictions, that could increase our expenses or prevent us from successfully commercializing these initiatives. If we do not realize the expected benefits of our investments, we may fail to grow and our business, operating results and financial condition would be materially adversely affected.

Our business involves the collection, storage, processing and transmission of personal data and other sensitive and proprietary data of pet parents and pet care providers. Additionally, we maintain, and third party service providers on our behalf maintain, sensitive and proprietary information relating to our business, such as our own proprietary information, other confidential information and personal data relating to individuals such as our employees. An increasing number of organizations have disclosed breaches of their information security systems and other information security incidents, some of which have involved sophisticated and highly targeted attacks. We, and our third party service providers, have experienced and may in the future experience such attacks. In addition, these incidents can originate on our vendors' websites, which can then be leveraged to access our website, further preventing our ability to successfully identify and mitigate the attack. Because techniques used to obtain unauthorized access to or to sabotage information systems change frequently and may not be known until launched against us, we may be unable to anticipate or prevent these attacks, react in a timely manner, or implement adequate preventive measures and we may face delays in our detection or remediation of, or other responses to, security breaches and other privacy-, data protection- and security-related incidents. In addition, users on our platform could have vulnerabilities on their own devices that are unrelated to our systems and platform but could mistakenly be attributed to us. Further, breaches experienced by other companies may also be leveraged against us. For example, credential stuffing attacks are becoming increasingly common and sophisticated actors can mask their attacks, making them increasingly difficult to identify and prevent. We have previously experienced incidents of fraud on our platform that we believe involved credential stuffing attacks and which we were unable to detect or prevent. Although we have developed systems and processes that are designed to protect data of pet parents and pet care providers that use our platform, protect our systems and the proprietary, sensitive and confidential information we maintain, prevent data loss, and prevent other security breaches and security incidents, these security measures have not fully protected against such matters in the past and cannot guarantee security in the future. The IT and infrastructure used in our business may be vulnerable to cyberattacks or security breaches and data, including personal data and other sensitive and proprietary data of pet parents and pet care providers, our employees' personal data, or our other sensitive, confidential or proprietary data that it maintains or that otherwise is accessible through those systems may be rendered unavailable or subject to loss, compromise, or unauthorized use, disclosure, or other processing. Employee error, malfeasance, or other errors in the storage, use, or transmission of any of these types of data could result in an actual or perceived privacy, data protection, or security breach or other security incident. We also face the risk of computer viruses, ransomware, or other malware being introduced to such IT and infrastructure. Although we have policies restricting access to the personal information we store, there is a risk that these policies may not be effective in all cases. Any actual or perceived breach of privacy or data protection, or any actual or perceived security breach or other incident that impacts our platform or systems, other IT and infrastructure used in our business, or data maintained or processed in our business, could interrupt our operations, result in our platform being unavailable, result in loss or unavailability of, or improper access to, or acquisition, disclosure, or other processing of, data, result in fraudulent transfer of funds, harm our reputation, brand and competitive position, damage our relationships with third-party partners, result in significant claims, litigation, regulatory investigations and proceedings (including ongoing monitoring by regulators), fines, penalties, and increased credit card processing fees and other costs and liabilities, or result in the loss of pet parents' and pet care providers' confidence in, or decreased use of, our platform, any of which could adversely affect our business, financial condition and operating results. Any actual or perceived breach of privacy, data protection or security, or other security incident, impacting any entities with which we share or disclose data (including, for example, our third-party technology providers) could have similar effects. Further, any cyberattacks or actual or perceived security, privacy or data protection breaches and other incidents directed at, or suffered by, our competitors could reduce confidence in our industry and, as a result, reduce confidence in us. We expect to incur significant costs in an effort to detect and prevent privacy, data protection and security breaches and other privacy-, data protection- and security-related incidents and we may face increased costs and requirements to expend substantial resources if an actual or perceived privacy, data protection, or security breach or other incident occurs. While we maintain cyber insurance that may help provide coverage for these types of incidents, our insurance may not adequately cover costs and liabilities related to any incidents, and may not continue to be available to us on economically reasonable terms, or at all, and any insurer may deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our business, reputation, results of operations and financial condition.

We operate in a highly competitive environment and face significant competition in attracting pet care providers and pet parents. Pet parents have a range of options to find and book pet care offerings, both online and offline. We believe that our competitors include: - friends, family and neighbors that pet parents go to for pet care within their personal networks;- local independent operators;- large, commercial providers such as kennels and daycares;- online aggregators and directories, such as Craigslist, Nextdoor, and Yelp; and - other digital marketplaces, such as Wag and the pet care offerings on Care.com in the United States and small operators such as Gudog and Pawshake outside of the United States. We believe that our ability to compete effectively depends upon many factors both within and beyond our control, including: - the popularity and adoption of online marketplaces to obtain services from individual pet care providers;- the popularity, utility, ease of use, performance and reliability of our offerings compared to those of our competitors;- our reputation and brand strength relative to our competitors;- the prices of offerings and the fees we charge pet care providers on our platform;- our ability to attract and retain qualified pet care providers;- the perceived safety and cleanliness of offerings on our platform, especially throughout the COVID-19 pandemic;- cancellation policies, especially throughout the COVID-19 pandemic;- our ability, and the ability of our competitors, to develop new offerings;- our ability to establish and maintain relationships with partners;- changes mandated by, or that we elect to make to address, legislation, regulatory authorities or litigation, including settlements, judgments, injunctions and consent decrees;- our ability to attract, retain and motivate talented employees;- our ability to raise additional capital; and - acquisitions or consolidation within our industry. Currently, our primary competition is from the friends, family and neighbors to whom pet parents often turn for pet services within their personal networks. Given that online marketplaces offering pet services are a relatively nascent business model and are rapidly evolving, reliance on personal networks is still prevalent. Current and potential competitors (including any new entrants into the market) may enjoy substantial competitive advantages over us, such as greater name recognition, longer operating histories, greater category share in certain markets, market-specific knowledge, established relationships with local pet parents and pet care providers and larger existing user bases in certain markets, more successful marketing capabilities and substantially greater financial, technical and other resources than we have. Competitors may be able to provide pet parents with a better or more complete experience and respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, or pet care provider and pet parent requirements or preferences. The pet care industry also may experience significant consolidation or the entrance of new players. Some of our competitors could adopt aspects of our business model, which could affect our ability to differentiate our offerings from competitors. Increased competition could result in reduced demand for our platform from pet care providers and pet parents, slow our growth and materially adversely affect our business, operating results and financial condition. Consolidation among our competitors could give them increased scale and may enhance their capacity, abilities and resources and lower their cost structures. In addition, emerging start-ups may be able to innovate and focus on developing a new product or service faster than we can or may foresee consumer need for new offerings or technologies before we do.

Maintaining and enhancing our brand reputation is critical to our ability to attract pet care providers, pet parents and employees, to compete effectively, to preserve and deepen the engagement of our existing pet care providers, pet parents and employees, to maintain and improve our standing in the communities where our pet care providers operate, including our standing with community leaders and regulatory bodies, and to mitigate legislative or regulatory scrutiny, litigation and government investigations. We are heavily dependent on the perceptions of pet care providers and pet parents who use our platform to help make word-of-mouth recommendations that contribute to our growth. Negative perception of our platform or company may harm our reputation, brand and local network effects and could potentially lead to increased regulatory or litigation exposure, including as a result of: - complaints or negative publicity (media reports, social media posts, and blogs) about us, our platform, pet parents, pet care providers, our third-party background check provider, third-party verification provider, or our policies and guidelines;- illegal, negligent, reckless, or otherwise inappropriate behavior by pet care providers, pet parents or third parties;- injuries or other safety-related issues involving pets;- actual or rumored incidents involving the safety or security of pets, pet care providers, pet parents, or other members of the public, including incidents that are mistakenly attributed to us and any resulting media coverage;- a pandemic or an outbreak of disease, such as the COVID-19 pandemic, in which constituents of our network become infected;- fraudulent activity and transactions;- cancellations by pet care providers;- actual or perceived disruptions or defects in our platform, such as site outages, payment disruptions, privacy or data security breaches, other security incidents, or other actual or perceived incidents that may impact the reliability of our services;- litigation over, or investigations by regulators into, our platform;- users' lack of awareness of, or compliance with, our policies;- changes to our platform policies that users or others perceive as overly restrictive, permissive, unclear, or inconsistent with our values or mission;- an actual or perceived failure to comply with legal, tax and regulatory requirements;- a failure, or perceived failure, to act responsibly in a number of areas, including animal welfare, safety, data security, privacy and data protection, diversity and non-discrimination, concerns relating to the "gig" economy, litigation and response to regulatory activity and local communities;- our current and future business partners;- our involvement with companies in which we may have minority investments;- a failure to enforce our policies in a manner that users perceive as effective, fair and transparent;- a failure to operate our business in a way that is consistent with our values and mission;- inadequate, untimely or unsatisfactory user support experiences or resolutions;- illegal or otherwise inappropriate behavior by our management team or other employees or contractors;- negative responses by pet parents or pet care providers to new services on our platform;- a failure to register our trademarks and prevent or defend against misappropriation or third-party challenges to our existing or new trademarks;- negative perception of our treatment of employees, pet parents, pet care providers, or of our response to employee, pet parents and pet care provider sentiment related to political or social causes or actions of management; or - any of the foregoing with respect to our competitors, to the extent such resulting negative perception affects the public's perception of us or our industry. For example, as a result of past complaints and negative publicity, some pet care providers and pet parents have refrained from, and may in the future refrain from, offering services through our platform or using our platform. In addition, we rely on pet parents to provide trustworthy reviews and ratings that other pet parents may rely upon to help decide whether or not to book a particular offering. We rely on these reviews to further strengthen trust among members of our community. Users of our platform may be less likely to rely on reviews and ratings if they believe that our review system does not generate trustworthy reviews and ratings. We have procedures in place to combat fraud or abuse of our review system, but cannot guarantee that these procedures are or will be effective. An actual or perceived failure of our review system could reduce trust within our community and damage our brand reputation and could materially adversely affect our business, operating results and financial condition.

We have started expanding our presence internationally. We opened our platform in Canada in 2017 and in the United Kingdom and Western Europe in 2018 and we may continue to expand our international operations. We are a growing platform with pet care providers in over 24,000 neighborhoods. Operating outside of the United States may require significant management attention to oversee operations over a broad geographic area with varying cultural norms and customs, in addition to placing strain on our finance, analytics, compliance, legal, engineering and operations teams. We may incur significant operating expenses and may not be successful in our international expansion for a variety of reasons, including: - recruiting and retaining talented and capable employees in foreign countries and maintaining our company culture across all of our offices;- an inability to attract pet care providers and pet parents;- competition from local incumbents that better understand the local market, may market and operate more effectively and may enjoy greater local affinity or awareness;- differing demand dynamics, which may make our platform less successful;- complying with varying laws and regulatory standards, including with respect to labor and employment, data privacy and data protection, tax and local regulatory restrictions;- obtaining any required government approvals, licenses, or other authorizations;- varying levels of Internet and mobile technology adoption and infrastructure;- currency exchange restrictions or costs and exchange rate fluctuations;- operating in jurisdictions that do not protect intellectual property rights in the same manner or to the same extent as the United States;- public health concerns or emergencies, such as the COVID-19 pandemic and other highly communicable diseases or viruses, outbreaks of which have from time to time occurred and which may occur, in various parts of the world in which we operate or may operate in the future; and - limitations on the repatriation and investment of funds as well as foreign currency exchange restrictions. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake may not be successful. If we invest substantial time and resources to expand our operations internationally and are unable to manage these risks effectively, our business, financial condition and operating results could be materially adversely affected. International expansion also may increase our risks in complying with various laws and standards, including with respect to anti-corruption, anti-bribery, export controls and trade and economic sanctions.