Sportradar Group AG (SRAD) Risk Factors

There have been attempts by regulatory authorities, state licensees and incumbent operators, including monopoly operators, in certain Member States to apply their domestic criminal and administrative laws to prevent, or attempt to prevent, sports betting operators licensed in other Member States from operating in or providing services to customers within their territories. Although certain Member States are subject to infringement proceedings initiated by the European Commission in relation to the laws that they apply to betting as being contrary to the EU law principles of free movement of services, the application and enforcement of these principles by the CJEU, the domestic courts and regulatory authorities in various Member States, remains subject to continuing clarification. There have been a considerable number of relevant proceedings before the domestic courts of various Member States and the CJEU. If the jurisprudence of the CJEU continues to recognize that Member States may, subject to certain conditions, establish or maintain exclusive licensing regimes that restrict the offering of sports betting services by operators licensed in other Member States, our sports betting operator clients' ability to allow their customers in a given Member State to access one or more of their sports betting services and to engage in certain types of marketing activities and customer contact may be impacted. Depending on the national courts' or competent authorities' interpretation of the EU law, our clients may have to submit to local licensing, regulation and/or taxation in more Member States and/or exclude customers in certain Member States, either entirely or from certain product offerings. Any such consequences could potentially indirectly reduce our revenue in the European Union.

As part of our business, we collect personal information, personal data and other potentially sensitive and/or regulated data from our customers and employees and other parties, including bank account numbers, social security numbers, credit and debit card information, identification numbers and images of government identification cards. Laws and regulations in the United States and around the world restrict and regulate how personal information is collected, processed, stored, used and disclosed, including by setting standards for its security, implementing notice requirements regarding privacy practices, and providing individuals with certain rights regarding the use, storage, disclosure and sale of their protected personal information. In the United Kingdom, as well as the European Union and Switzerland, we are subject to laws and regulations that are more restrictive in certain respects than those in the United States. In the event of a data breach, we are also subject to data breach notification laws in the jurisdictions in which we operate and the risk of litigation and regulatory enforcement actions. These laws and regulations are constantly evolving and it is possible that they may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules?may be unsuccessful. We must devote significant resources to understanding and complying with this changing landscape. Restrictions on the collection, use, sharing or disclosure of personal information or personal data or additional requirements and liability for security and data protection could require us to modify our products and services, possibly in a material manner, could limit our ability to develop new products and services and could subject us to increased compliance obligations and regulatory scrutiny. Current and proposed regulation addressing privacy and data protection could also increase our costs of operations. Further, we make public statements about our use and disclosure of personal information through our privacy notice, information provided on our website and press statements. Although we endeavor to ensure that our public statements are complete, accurate and fully implemented, we may at times fail to do so or be alleged to have failed to do so. We may be subject to potential regulatory or other legal action if such notices or statements are found to be deceptive, unfair or misrepresentative of our actual practices If our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to litigation, regulatory investigations and fines, enforcement notices requiring us to change the way we use personal data or our marketing practices, and significant costs for remediation. For example, under the EU General Data Protection Regulation ("GDPR") we may be subject to fines of up to €20.0?million or up to 4% of the total worldwide annual group turnover of the preceding financial?year (whichever is higher). We may also be subject to other liabilities, such as civil litigation claims by data subjects, as well as negative publicity and a potential loss of business, business partners, consumer trust and market confidence. Since December?2020, third- parties, including a group of United Kingdom football players, issued data subject access requests under the GDPR to various participants in the sports data and sports betting industries, including us. If these requests develop into legal action, it could significantly alter the way we collect and use sports data relating to players, could subject us to fees or other damages and could materially affect the sports data industry as whole. Under the terms of our existing contractual arrangements, any adverse judgments could impact the validity of such contractual arrangements which may force us to alter our business strategy and have an adverse effect on our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity. Any of the foregoing may have a material adverse effect on our business, financial condition and results of operations.

Our patents, trademarks, trade names, trade secrets, know-how, proprietary technology and other intellectual property rights are important to our success. While it is our policy to vigorously protect and defend our intellectual property rights, we cannot predict whether the steps we take to obtain, maintain, protect and enforce our intellectual property will be adequate to prevent infringement, misappropriation, dilution or other potential violations of our intellectual property rights. We may not be able to register our intellectual property rights in all jurisdictions where we do business, and in certain circumstances, we may determine that it is not commercially desirable to obtain registered protection for our products, software, databases or other technology. In such situations, we must rely on laws governing the protection of unregistered intellectual property rights, and contractual confidentiality and/ or exclusivity provisions to protect our data and technology, which may limit the remedies available to us in the event of unauthorized use by third parties. If we are unable to protect our proprietary offerings, technology and features via relevant laws or contractual exclusivity, competitors may copy them. Even if we seek to register our intellectual property rights, third parties may contest our applications, and even if we are able to obtain registrations, third parties may challenge the validity or enforceability of the registered intellectual property. Further, we cannot guarantee that our patents, registered trademarks or other intellectual property will be of sufficient scope or strength to provide us with meaningful protection or competitive advantage. We also cannot guarantee that others will not use our intellectual property without our consent or independently develop technology with the same or similar functions to any proprietary technology we rely on to conduct our business and differentiate ourselves from our competitors. Unauthorized parties may attempt to reverse engineer our technology to develop applications with the same or similar functionality as our solutions, and competitors and other third parties may also adopt trade names or trademarks similar to ours. Further, competitors and other third parties have in the past and may in the future attempt to make unauthorized use of our data. Monitoring and policing unauthorized use of our data, technology and intellectual property rights is difficult and may not be effective, and we cannot assure you that we will have adequate resources to police and enforce our intellectual property rights. Uncertainty may also result from changes to intellectual property laws or to the interpretation of those laws by applicable courts and agencies. For example, the legal position in all jurisdictions in relation to the ownership and permitted use of sports data and databases is subject to change. This area may receive focus in the United States following the lifting of the PASPA ban. As such, we cannot be certain that our current uses of data from publicly available sources or otherwise, which are not known to infringe, misappropriate or otherwise violate third-party intellectual property today, will not result in claims for infringement, misappropriation or other violations of third-party intellectual property in the future. If we are unable to maintain the proprietary nature of our technologies, our business, financial condition and results of operations could be materially adversely affected. Any litigation to enforce our intellectual property rights or defend ourselves against oppositions or other proceedings regarding our registered or applied-for intellectual property could be costly, divert attention of management and may not ultimately be resolved in our favor. We attempt to protect our intellectual property and proprietary information by (i) implementing industry-standard administrative, technical and physical practices, including source code access controls, to secure our proprietary information, and (ii) requiring all of our employees and consultants and certain of our contractors to execute confidentiality and invention assignment agreements. However, we may not be able to obtain these agreements in all circumstances. Furthermore, we cannot guarantee that all employees, consultants and contractors will comply with the terms of these agreements, or that the agreements will effectively protect our proprietary information or protect our ownership of our intellectual property rights. Accordingly, we may not be able to prevent the unauthorized disclosure or use of our technical know-how or other trade secrets by the parties to these agreements despite the existence generally of confidentiality agreements, access controls, industry standard practices and other contractual restrictions. Monitoring unauthorized uses and disclosures is difficult and costly, and we do not know whether the steps we have taken to protect our proprietary technologies and information will be effective. In addition, courts outside the United States are sometimes less willing to protect trade secrets, know-how and other proprietary information. We also may be forced to bring claims against third parties, or defend claims that they may bring against us, to determine the ownership of what we regard as our intellectual property. Further, our commercial success depends on our ability to develop and commercialize our products and services and use our technology without infringing, misappropriating or otherwise violating the intellectual property or similar proprietary rights of third parties. Whether merited or not, we have faced, and may in the future face, claims of infringement, misappropriation or other violation of third-party intellectual property or similar proprietary rights that could interfere with our ability to market and promote our brands, products and services. This could include claims that the content made available through our products and services violates individuals' (including athletes') rights of publicity or privacy or utilizes without authorization, infringes upon, dilutes or otherwise violates third-party trademarks or brand names. Any litigation to defend ourselves against claims of infringement, misappropriation or other violation of third-party intellectual property or similar proprietary rights could be costly, divert attention of management and may not ultimately be resolved in our favor. Moreover, failure to successfully settle or defend against claims that we have infringed, misappropriated or otherwise violated the intellectual property or similar proprietary rights of others may require us to stop using certain intellectual property or commercializing certain products and services, obtain licenses, modify our services and technology while we develop non-infringing substitutes, incur substantial damages or settlement costs, or face a temporary or permanent injunction prohibiting us from marketing or providing the affected products and services. If we require a third-party license, it may not be available on reasonable terms or at all, and we may have to pay substantial royalties and upfront or ongoing fees. Such licenses may also be non-exclusive, which could allow competitors and other parties to use the subject technology in competition with us. We may also have to redesign our services and technologies so they do not infringe, misappropriate or otherwise violate third-party intellectual property or similar proprietary rights, which may not be possible or may require substantial monetary expenditures and time, during which our technology may not be available for commercialization or use. Any of the foregoing could materially adversely affect our business, financial condition and results of operations. We employ individuals who were previously employed at other companies in our field, including our competitors or potential competitors. Although we try to ensure that our employees, independent contractors and consultants do not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or our employees, consultants or independent contractors have inadvertently or otherwise used or disclosed intellectual property, including trade secrets or other proprietary information, of a former employer or other third parties. Litigation may be necessary to defend against these claims. If we are unsuccessful in defending any such claims, we may be liable for damages, and we may also be prevented from using certain intellectual property, which in turn could materially adversely affect our business, financial condition or results of operations. Even if we are successful in defending against such claims, litigation could result in substantial costs and be a distraction to management and other employees. Any of the foregoing may have a material adverse effect on our business, financial condition and results of operations.

Our ability to provide fast, secure and validated products and services largely depends on the efficient and uninterrupted operation of our business processes, computer information systems and infrastructure. For example in 2021, one of our cloud service providers experienced interruptions caused by an air conditioning issue in its data center. As we continue to use hosting partners, interruptions like this may cause instability in a number of our applications for a prolonged period of time. To prepare for more cases like this, we have dedicated more effort to deploy services in more regions to add additional resiliency as a risk mitigation activity. Any significant interruptions could harm our business and reputation and result in a loss of business. These systems, processes, operations and infrastructure could be exposed to damage, interruption or operational challenges from unauthorized entry and computer viruses and computer denial-of-service-attacks as discussed in this "Risk Factors" section under the caption "Our inability to protect our systems and data from continually evolving cybersecurity risks, security breaches or other technological risks could affect our reputation among our customers, consumers, and regulators, and may expose us to liability," human error, hardware or software defects or malfunctions, data loss, earthquakes, floods, fires, natural disaster, pandemics, power loss, telecommunications failure, military conflicts or terrorism, vendor failure, geopolitical events, foreign state attacks, disruptions in our workforce, system breakdowns of our informational technology or cloud infrastructure, fraud or other causes, many of which may be beyond our control. We currently maintain a disaster recovery and business continuity process, however, this may not adequately protect us from such delays and interruptions. While we also maintain business interruption insurance, our coverage may be insufficient to compensate us for all losses that may result from interruptions in our service as a result of system failures and similar events. Further, we have been and continue to be the subject of cyber-attacks, including routine port scanning by external parties. These attackers and attacks, which may even be initiated by nation-states, have continued to become more sophisticated and are primarily aimed at interrupting our business, exposing us to financial losses, or exploiting information security vulnerabilities. Historically, none of these attacks or breaches has individually or in the aggregate resulted in any material liability to us or any material damage to our reputation, or caused any material disruption to our business. The safeguards we have designed to help prevent future security incidents and systems disruptions and comply with applicable contractual, regulatory and other legal requirements may not be successful, and we may experience material security incidents, disruptions or other problems in the future. We also may experience software defects, development delays and other systems problems, which could harm our business and reputation and expose us to potential liability, which may not be fully covered by our business interruption insurance. In addition, hardware, software or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. These applications may not be sufficient to address technological advances, regulatory requirements, changing market conditions or other developments. Additionally, if our customer base and engagement continue to grow, and the amount and types of services and product offerings continue to grow and evolve, we will need an increasing amount of technical infrastructure, including network capacity and computing power, to continue to satisfy our users' needs. Such infrastructure expansion may be complex, and unanticipated delays in completing these projects or availability of components may lead to increased project costs, operational inefficiencies, or interruptions in the delivery or degradation of the quality of our services or product offerings. In addition, there may be issues related to this infrastructure that are not identified during the testing phases of design and implementation, which may become evident only after we have started to fully use the underlying equipment or software, that could further degrade the user experience or increase our costs. As such, we could fail to continue to effectively scale and grow our technical infrastructure to accommodate increased demands.

The competitive position of our XML and application programming interface ("API") feeds depends in part on their ability to integrate, operate and share data with the visualization tools, software and technology infrastructure of our customers. As such, we must continuously modify and enhance our XML and API feeds to adapt to changes in website applications and mobile apps and to ensure efficiency, speed and scale. If the interoperability of our XML and API feeds with our customers' decreases, we could become less attractive to users of our products, lose market share or be required to spend more costs to enhance compatibility. We intend to facilitate the compatibility of our XML and API feeds with various third-party software and infrastructure by maintaining and expanding our business and technical relationships. If we are not successful in achieving this goal, our business, financial condition or results of operations could be adversely affected.

We must continually retain existing customers and expand existing customers' usage of our products and services, as well as increase our penetration and service offerings within our existing markets of operation to grow our business. For the fiscal years ended December 31, 2023 and 2022, we generated 5.8% and 6.5% of total revenue from a single customer, respectively, and 26.1% and 25.5% of total revenue from our top ten customers combined, respectively. Our ability to retain our significant customers largely depends on whether we can enhance our products and services, and our overall customer experience and keep pace with changes in technology and our competitors. Our product quality must maintain the consistent level of low-latency and high accuracy to fulfill our customers' requirements. Once our products are deployed and integrated with our customers' existing information technology investments and data, our customers depend on our customer service to resolve any issues relating to our products. Increasingly, our products have been deployed in large-scale, complex technology environments, and we believe our future success will depend on our ability to increase sales of our products for use in such deployments. Further, our ability to provide effective ongoing support, or to provide such support in a timely, efficient or scalable manner, may depend in part on our customers' willingness and ability to upgrade to the latest versions of our products and participate in our centralized product management and services. In addition, our ability to provide effective customer services is largely dependent on our ability to attract, train and retain qualified personnel with experience in supporting customers globally at scale. While our goal is to provide high quality support 24 hours a day, we may be unable to respond quickly enough to accommodate short-term increases in customer demand for our support services. Increased customer demand for support, without corresponding revenue, could increase costs and negatively affect our business and results of operations. In addition, our services teams may face additional challenges, including those associated with operating the platforms and delivering support, training and documentation in different languages and providing services across expanded time-zones. If we are unable to provide efficient customer service globally at scale, our ability to grow our operations may be harmed, and we may need to hire additional services personnel, which could negatively impact our business, financial condition or results of operations. Our customers may need training in the proper use of and the variety of benefits that can be derived from some of our products to maximize their potential. If we do not effectively deploy, update or upgrade our products, succeed in helping our customers quickly resolve post-deployment issues and provide effective ongoing services, our ability to sell additional products and services to existing customers could be adversely affected, we may face negative publicity and our reputation with potential customers could be damaged. Many enterprise and government customers require higher levels of services than smaller customers. If we fail to meet the requirements of the larger customers, it may be more difficult to execute on our strategy to increase our penetration with larger customers. As a result, our failure to maintain high quality services may have a material adverse effect on our business, financial condition or results of operations.

Customer confidence in our brands and product quality, and the ability to provide fast, secure and validated data and content are critical to our success. A number of factors could erode our customers' confidence in our business, or in the sports media, entertainment and betting industries generally, many of which are beyond our control and could have an adverse impact on our results of operations. Our business model is based on our ability to provide rapid, reliable and customizable products and services, and customer confidence in our business largely depends on the quality of our service and product experience and our ability to meet evolving customer needs and preferences. If we fail to maintain high quality service, or if there are pervasive customer complaints or negative publicity about our products or services, the confidence and trust customers have in our brands and business may decrease. Other factors include, but are not limited to, delays between the live event in the stadium and the visualization at the customer's end, as well as any significant interruption in our systems, including as a result of unauthorized entry and computer viruses, fire, natural disaster, power loss, data loss, software vulnerabilities, systems breakdowns of information technology or infrastructure, telecommunications failure, military conflicts or terrorism, vendor failure or disruptions in our workforce, including as a result of pandemics and any breach, or reported breach, of our computer systems or other data storage facilities, or of certain of our third-party providers, resulting in a compromise of personal or other data.

Doing business on a worldwide basis requires us to comply with anti-corruption laws and regulations imposed by governments around the world with jurisdiction over our operations, which may include the U.S. Foreign Corrupt Practices Act ("FCPA"), the U.K. Bribery Act 2010 ("U.K. Bribery Act"), as well as the laws of the other countries and territories where we do business. The FCPA, the U.K. Bribery Act, and other applicable laws prohibit us and our officers, directors, employees and business partners acting on our behalf, including agents and representatives, from corruptly offering, promising, authorizing or providing anything of value to "foreign officials" for the purposes of influencing their decision making or obtaining or retaining business or otherwise obtaining favorable treatment. The U.K. Bribery Act also prohibits non-governmental "commercial" bribery and accepting bribes. We are subject to the jurisdiction of various governments and regulatory agencies around the world, which may bring our personnel and representatives into contact with "foreign officials," including those responsible for issuing or renewing permits, licenses or approvals or for enforcing other governmental regulations. In addition, some of the international locations in which we operate lack a developed legal system and have elevated levels of corruption; accordingly, it is necessary that we have proper controls in place to ensure proper conduct is maintained even in jurisdictions with less developed regulatory frameworks. Our business must be conducted in compliance with applicable anti-money laundering ("AML"), counter-terrorism financing ("CTF"), economic and trade sanctions laws and regulations, such as those administered and enforced by the U.S. Department of Treasury's Office of Foreign Assets Control, the U.S. Department of State, the U.S. Department of Commerce, the United Nations Security Council, the Swiss State Secretariat For Economic Affairs ("SECO"), the European Union, Member States, and HM's Treasury of the United Kingdom, and other relevant sanctions authorities. Changes in these laws or regulations, or shifts in the approach to their enforcement, could impact our ability to deliver products and/or services to existing or potential customers. In particular, sanctions imposed by the U.S, EU, U.K. and other jurisdictions in response to Russian activities in Ukraine, and any counter-sanctions enacted in response, could restrict our ability to operate, generate or collect revenue in certain countries, such as Russia, Belarus and specific regions of Ukraine, which could adversely affect our business. Our international operations expose us to the risk of violating, or being accused of violating, anti-corruption, AML, CTF, economic sanctions and export control laws and regulations. Our failure to successfully comply with these laws and regulations may expose us to reputational harm, as well as significant sanctions, including criminal fines, imprisonment, civil penalties, disgorgement of profits, injunctions and debarment from government contracts, as well as other remedial measures. Investigations of alleged violations can be expensive and disruptive. We have policies and procedures designed to comply with applicable anti-corruption, economic sanctions and export control laws and regulations. However, there can be no guarantee that our policies and procedures will effectively prevent violations by our employees or business partners acting on our behalf, for which we may be held responsible, and any such violation could adversely affect our reputation, business, financial condition and results of operations.

Some services relating to our business, such as cloud-based software service providers, software application support, data centers, parts of development, hosting and maintenance of our operating systems, providing player tracking services, call center services and other operating activities are outsourced to third-party vendors. Any changes to or failures in these systems that degrade the functionality of our products and services, impose additional costs or requirements or give preferential treatment to competitors' services, including their own services, could materially and adversely affect usage of our products and services. If our agreements with third-party vendors are terminated, or if we cannot renew contracts on terms favorable to us, or at all, or if we cannot find alternative sources of such services or otherwise replace these third-party vendors quickly, we may experience a disruption in our services, and our business and operations could be adversely affected. Further, if our third-party vendors do not comply with applicable laws, including restrictions on the collection, use, sharing or disclosure of personal information or personal data, our reputation and the willingness of customers and partners to do business with us could be harmed, which could have a materially adverse effect on our business operations, financial conditions or results of operations. The failure of our third-party vendors to perform their obligations and provide the products and services we obtain from them in a timely manner for any reason, including as a result of damage or interruption from, among other things, fire, natural disaster, pandemics, power loss, telecommunications failure, unauthorized entry, computer viruses, denial-of-service attacks, military conflicts, acts of terrorism, human error, vandalism or sabotage, financial insolvency, bankruptcy and similar events, could adversely affect our operations and profitability due to, among other consequences: - loss of revenue;- loss of customers;- loss of customer data;- loss of sports league partnerships;- harm to our business or reputation resulting from negative publicity;- exposure to fraud, losses or other liabilities;- additional operating and development costs; or - diversion of management, technical and other resources.