Savers Value Village Inc. (SVV) Risk Factors

In the ordinary course of business, we have in the past and may in the future be involved in and subject to litigation for a variety of claims or disputes and receive regulatory inquiries. These claims, lawsuits and proceedings could include labor and employment, wage and hour, commercial, consumer protection, regulatory, antitrust, alleged securities law violations or other investor claims, intellectual property infringement and other matters. The number and significance of these potential claims and disputes may increase as our business expands. Further, our general liability insurance may not cover all potential claims made against us or be sufficient to indemnify us for all liability that may be imposed. Any claim against us, regardless of its merit, could be costly, divert management's attention and operational resources, and harm our reputation. Our directors and executive officers may also be subject to litigation. We indemnify our directors and officers to the fullest extent permitted by Delaware law, which may discourage derivative litigation and stockholder fiduciary duty lawsuits, even though an action, if successful, might benefit us and other stockholders. Further, a stockholder's investment may be harmed to the extent that we pay the costs of litigation and resolution against our directors and executive officers as required by our indemnification obligations. Our insurance policies may not cover all potential claims made against our directors and executive officers, may not be available to us in the future at a reasonable rate and may not be adequate to indemnify us for all costs and liability that may be imposed. As litigation is inherently unpredictable, we cannot assure you that any potential claims or disputes will not harm our business, results of operations and financial condition.

The Tax Cuts and Jobs Act, (the "Tax Act"), among other things, introduced significant changes to corporate taxation, including reduction of the corporate tax rate from a top marginal rate of 35% to a flat rate of 21%, limitation of the tax deduction for interest expense to 30% of "adjusted earnings" (roughly defined as earnings before interest and taxes ), limitation of the deduction for net operating losses to 80% of current year taxable income and elimination of net operating loss carrybacks, one time taxation of offshore earnings at reduced rates regardless of whether they are repatriated, elimination of U.S. tax on foreign earnings (subject to certain important exceptions), immediate deductions for certain new investments instead of deductions for depreciation expense over time, and modifying or repealing many business deductions and credits. The most significant impacts of the Tax Act on our financial results to date have included lowering of the U.S. federal corporate income tax rate and remeasurement of our net deferred tax liabilities. Furthermore, the Inflation Reduction Act of 2022 introduced, among other changes, a 15% corporate minimum tax on certain United States corporations and a 1% excise tax on certain stock redemptions by United States corporations. The U.S. government may enact further significant changes to the taxation of business entities, including, among other changes, an increase in the U.S. taxation of international business operations. The likelihood of these changes being enacted or implemented is unclear. We are currently unable to predict the ultimate impact of the Inflation Reduction Act or any such further changes on our business.

We collect, maintain and otherwise process significant amounts of personal information and other data relating to our customers, employees and other individuals. We are subject to the terms of our privacy policies and notices and may be bound by contractual requirements applicable to our collection, use, processing, security and disclosure of personal information, and may be bound by or alleged to be subject to, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. Additionally, numerous state, federal and international laws and rules and regulations govern the collection, use and protection of this information. Such requirements are constantly evolving, and we expect that there will continue to be new proposed requirements relating to privacy, data protection and information security in the United States, Canada and other jurisdictions, or changes in the interpretation of existing privacy requirements. For example, the California Consumer Privacy Act ("CCPA", effective January 1, 2020) broadly defines personal information, imposes stringent consumer data protection requirements, gives California residents expanded privacy rights, provides for civil penalties for violations and introduces a private right of action for data breaches, and the California Privacy Rights Act ("CPRA", effective January 1, 2023) creates additional obligations relating to personal information. Other states have also proposed or enacted similar laws and regulations relating to privacy. For example, the Virginia Consumer Data Protection Act ("VCDPA", effective on January 1, 2023); the Connecticut Data Privacy Act ("CDPA", effective July 1, 2023), and the Utah Consumer Privacy Act ("UCPA", effective December 31, 2023) share similarities with the CCPA, the CPRA, and legislation proposed in other states. We have significant operations in Canada and Australia, and must also comply with data privacy laws in those jurisdictions. In Canada, our collection, use, disclosure and management of personal information must comply with both federal and provincial privacy laws. The Personal Information Protection and Electronic Documents Act ("PIPEDA") applies in all Canadian provinces except, in certain contexts, Alberta, British Columbia and Québec, as well as to the transfer of personal information across provincial or international borders. PIPEDA imposes stringent personal information protection obligations, requires privacy breach reporting, and limits the purposes for which organizations may collect, use and disclose personal information, which includes consumer data. A bill for a replacement to PIPEDA has been tabled and is currently working its way through the Canadian federal legislative process. The provinces of Alberta, British Columbia, and Québec have enacted separate data privacy laws that are substantially similar to PIPEDA, but, among other differences, all three additionally apply to our handling of our own employees' personal data within their respective provinces. As of September 22, 2023, Québec's privacy act took effect, which includes transparency and data impact assessments requirements and also imposes severe financial penalties for certain offenses like unlawful use of personal information and failure to report confidentiality incidents. We may incur additional costs and expenses related to compliance with these laws. We are also subject to Canada's anti-spam legislation ("CASL") when sending commercial electronic messages and can be held liable for violations. In Australia, the Privacy Act 1988 and the Australian Privacy Principles ("APPs") regulate the handling of personal information, gives the Australian Information Commissioner the power to conduct investigations, and contains civil penalties for breach. Updates to the Privacy Act in 2023 increased the civil penalties available for serious and repeated breach events. Additional changes are expected in the next year. To the extent our operations further expand internationally, we may become subject to additional laws and regulations relating to privacy and data protection. Any failure or perceived failure by us or any third parties with which we do business to comply with these privacy requirements, with our posted privacy policies or with other similar obligations may result in investigations or governmental enforcement actions, private claims, public statements against us by consumer advocacy groups or others and fines, penalties or other liabilities. For example, California consumers whose information has been subject to a security incident may bring civil suits under the CCPA for statutory damages between $100 and $750 per consumer. In Canada, we may be subject to regulatory investigations, fines or class action suits stemming from violations of PIPEDA, provincial data privacy laws or CASL. Any such action would be expensive to defend, likely would damage our reputation and market position, could result in substantial liability and could adversely affect our business and results of operations. Additionally, our efforts to comply with these laws may impose significant costs and challenges that are likely to increase over time, and we cannot fully predict the impact on our business or operations of certain unclear aspects of recent laws, future requirements, or changes in the interpretation of existing requirements.

We rely on a combination of intellectual property rights, contractual protections and other practices to protect our brands, proprietary information, technologies and processes. Our trademarks are valuable assets that support our brands and customers' perception of our services and merchandise. We primarily rely on copyright and trade secret laws and exclusive licenses-in to protect our proprietary technologies and processes, including the automated operations systems and machine learning technology we use. Although we enter into confidentiality and/or invention assignment agreements with our employees, consultants and other parties with whom we have strategic relationships, no assurance can be given that these agreements will be effective. Further, these agreements do not prevent our competitors from independently developing similar technologies. To monitor and protect our intellectual property rights, we may be required to spend significant resources, and we may not be able to detect infringement by third parties. Litigation may be necessary but could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Additionally, if we are unable to protect our trademarks or domain names, our brand recognition and reputation would suffer, we would incur significant expense establishing new brands and our results of operations would be adversely impacted. We have been in the past and may be accused in the future of infringing intellectual property or other proprietary rights of third parties, such as infringement of a state trademark or violating the right of publicity. For example, although we prohibit our employees from using the proprietary information of others, we may become subject to a claim that an employee has divulged or used the proprietary information of a former employer. In addition, our employees or third parties acting at our direction may knowingly or inadvertently make use of social media in ways that could lead to the loss or infringement of intellectual property, as well as the public disclosure of proprietary, confidential or sensitive personal information of our business, employees, customers or others. Supporting any litigation or disputes related to these claims can be expensive and distracting, and we cannot provide assurances that we will achieve a favorable outcome. If any such claim is valid, we may be compelled to cease our use of such intellectual property or other proprietary rights and pay damages, which could adversely affect our business and results of operations.

In the ordinary course of our business, we collect, process and store certain personal information and other data, such as customer payment card data and employee information. We also maintain other confidential business information such as financial information, operating statistics and metrics, trade secrets and third-party confidential information. Like other large retailers, we rely substantially on commercially available systems, software, tools and monitoring to provide security for our processing, transmission and storage of such information. Cybercriminals may attempt to gain access to our information systems to misappropriate sensitive information or data or to deprive us from access to necessary business information and to disrupt our operations, as part of so-called "ransomware" extortion activity or otherwise. We have been in the past and could be in the future the subject of attacks. For example, in July 2020, we suffered a ransomware attack that caused the loss of some of our data and caused some temporary operational disruptions. In addition, our employees, NPPs, service providers or other third parties with whom we do business may purposefully or inadvertently release or compromise such data, including through inadequate security practices or attacks on their networks. Despite security measures we have in place, and our efforts to prevent, monitor, and mitigate attacks and errors, our facilities, systems and confidential information may be vulnerable to attacks. The techniques used by cybercriminals change frequently, cybercriminals are increasingly sophisticated, and we continue to see advances in computer capabilities and remote access by employees. We expect to incur ongoing costs associated with the detection and prevention of security incidents and may incur additional costs in the event of a breach. Any actual or perceived compromise of our systems or data security measures or those of third parties with whom we do business, or any failure to prevent or mitigate the loss of confidential information and delays in detecting or providing notice of any such loss could disrupt our operations, damage our reputation, impact our sales and subject us to litigation, government action, increased transaction fees, regulatory fines or penalties or other additional costs and liabilities that could adversely affect our business, results of operations and financial condition. Furthermore, our insurance coverage may not be adequate for related losses and may not continue to be available to us on economically reasonable terms, or at all. An insurer may also deny coverage as to a future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our business, results of operations, financial condition and reputation.

Our success depends largely upon the continued services of our executive officers and other key technical, operational and sales employees. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business. Our employment agreements with our executive officers or other key personnel do not require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. The loss of one or more of our executive officers, especially our Chief Executive Officer, or other executive officers or key technical, operational and sales employees could harm our business. Volatility or lack of appreciation in the stock price of our common stock may also affect our ability to attract and retain our executive officers and key technical, operational and sales employees. Many of our senior personnel and other key technical, operational and sales employees have become, or will soon become, vested in a substantial amount of stock or stock options. Employees may be more likely to leave us if the shares they own or the shares underlying their vested options have significantly appreciated in value relative to the original purchase price of the shares or the exercise price of the options, or conversely, if the exercise price of the options that they hold are significantly above the market price of our common stock. If we do not maintain and continue to develop our corporate culture as we grow and evolve, it could harm our ability to foster the innovation, craftsmanship, teamwork, curiosity and diversity that we believe we need to support our continued growth.

We rely on software, technologies and services sourced or licensed from third parties to operate critical functions of our business, including payment processing services, certain aspects of CPC automation and customer relationship and management services, We also use services such as Microsoft for our business emails, file storage on internal communications. If any of the third-party software or services we utilize, or the functional equivalents thereof, were unavailable for extended periods due to outages or interruptions or because they are no longer available on commercially reasonable terms, our business would experience significant operational disruptions. In each case, we would be required to develop such software ourselves or seek similar software licenses or services from other parties and reshape our business and operations to function with such new software or services. These alternatives could require a significant capital investment, take an extended period of time to implement, and divert management's attention from our other business concerns, which could adversely affect our business and results of operations.

We have in the past incurred and may in the future incur losses from various types of fraudulent transactions, including the use of stolen credit card numbers, and claims that a customer did not authorize a purchase. In addition, as part of the payment processing process, our customers' credit and debit card information is transmitted to our third-party payment processors, and we may in the future become subject to lawsuits or other proceedings for purportedly fraudulent transactions arising out of the actual or alleged theft of our customers' credit or debit card information if the security of our third-party credit card payment processors are breached. We and our third-party credit card payment processors are also subject to payment card association operating rules, certification requirements and rules governing electronic funds transfers, which could change or be reinterpreted to make it difficult or impossible for us to comply. If we or our third-party credit card payment processors fail to comply with these rules or requirements, we may be subject to fines and higher transaction fees and lose our ability to accept credit and debit card payments from our customers. Further, we could violate or be alleged to have violated applicable laws, regulations, contractual obligations or other obligations, including those regulating to privacy, data protection and data security. Any of these could damage our reputation and market position, result in claims, litigation or regulatory investigations and proceedings or lead to expenses that could harm our business, results of operations and financial condition.