VOXX International (VOXX) Risk Factors

We and our business partners maintain significant amounts of data electronically in locations around the world. This data relates to all aspects of our business, including current and future products and initiatives under development, and contains confidential, proprietary, non-public, and personal customer, consumer, supplier, partner, and employee data, which we collect, process, transmit, and, where appropriate, retain as part of our normal operations. We maintain systems, protocols, and processes designed to protect this data. Despite the security measures we and our partners have in place, our facilities and systems, and those of our third-party service providers and partners, are vulnerable to security breaches, cyber-attacks, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human error, or other similar events. In addition, threat actors attempt to breach our security systems to gain access to our data and infrastructure through various techniques, including phishing, ransomware, and other targeted attacks. The risk of such attacks includes attempted breaches not only of our systems, but also those of our business partners, customers, clients, and suppliers. The techniques used to obtain unauthorized access are constantly changing, are becoming increasingly more sophisticated, and often are not recognized until after an exploitation of information has occurred. Therefore, we may be unable to anticipate these techniques or implement sufficient preventative measures, which may have a material adverse effect on our Company. The Company has retained and, in the future, may retain third-party experts to assist with the containment of, and response to, security incidents and, in coordination with law enforcement, with the investigation of such incidents. The Company has incurred, and may continue to incur, costs to retain such third-party experts in connection with any such incidents. We may also find it necessary to make significant further investments to protect our information and our infrastructure. These investments, and the costs we incur in connection with security incidents, could be material. Our computer systems are subject to penetration and our security and data protection measures may not prevent unauthorized access. Threats to our systems and our associated third parties' systems can result from human error, fraud, or malice on the part of employees or third parties, as well as from accidental technological failure. Despite security measures, computer viruses, malware, and other "hacking" programs and devices may cause significant damage, delays or interruptions to our systems and operations, or to certain of the products we sell, resulting in damage to our reputation and brand names. The Company may suffer interruptions in its ability to manage or conduct its operations, which may adversely affect its business. The Company may need to expend additional resources in the future to continue to protect against, or to address problems caused by, any business interruptions or security breaches. Any business interruptions or data security breaches (including cybersecurity breaches resulting in private data disclosure) could result in lawsuits or regulatory proceedings, damage our reputation, or adversely impact our results of operations, cash flows, and financial condition.

Whether we outsource manufacturing or manufacture products directly for our customers, we provide warranties for all of our products, for which we have provided an estimated liability. Therefore, we are highly dependent on the quality of our suppliers' products. If we experience an increase in warranty claims, or if our costs associated with such warranty claims increase significantly, we will begin to incur liabilities for warranty claims after the sale of our products at levels that we have not previously incurred or anticipated. In addition, an increase in the frequency of our warranty claims or amount of warranty costs may harm our reputation and could have a material adverse effect on our financial condition and results of operations.

We have few long-term contracts with our suppliers. Most of our products and component parts are imported from suppliers under short-term purchase orders. Accordingly, we can give no assurance that: - our supplier relationships will continue as presently in effect;- our suppliers will be able to obtain the components necessary to produce high-quality, technologically advanced products for us;- we will be able to obtain adequate alternatives to our supply sources, should they be interrupted;- if obtained, alternatively sourced products of satisfactory quality would be delivered on a timely basis, competitively priced, comparably featured, or acceptable to our customers;- our suppliers have sufficient financial resources to fulfill their obligations;- our suppliers will be able to obtain raw materials and labor necessary for production;- shipments from our suppliers will not be affected by labor disputes within the shipping and transportation industries;- our suppliers would not be impacted by natural disasters directly or via their supply chains; and - as it relates to products we do not manufacture, our suppliers will not become our competitors. On occasion, our suppliers have not been able to produce the quantities of products or component parts that we desire. Our inability to manufacture and/or supply sufficient quantities of products that are in demand could reduce our profitability and have a material adverse effect on our relationships with our customers. If any of our supplier relationships were terminated or interrupted, we could experience an immediate or long-term supply shortage, which could have a material adverse effect on our business.

We always face the possibility of new governmental regulations which could have a substantial effect on our operations and profitability. The Dodd-Frank Wall Street Reform and Consumer Protection Act contains provisions to improve transparency and accountability concerning the supply of certain minerals, known as "conflict minerals," originating from the Democratic Republic of Congo and adjoining countries. There are costs associated with complying with these disclosure requirements, including for due diligence to determine the sources of conflict minerals used in our products and other potential changes to products, processes, or sources of supply as a consequence of such verification activities. These rules could adversely affect the sourcing, supply and pricing of materials used in our products. As there may be only a limited number of suppliers offering "conflict free" conflict minerals, we cannot be sure that we will be able to obtain necessary conflict minerals from such suppliers in sufficient quantities or at competitive prices. Also, we may face reputational challenges if we determine that certain of our products contain minerals not determined to be conflict free or if we are unable to sufficiently verify the origins for all conflict minerals used in our products through the procedures we implement.

Strict data privacy laws regulating the collection, transmission, storage, disclosure, and use of personal information are evolving in the United States, the European Union, the UK, Canada, and other jurisdictions in which we operate. Privacy laws, including the General Data Protection Regulations in the European Union and the UK and the California Consumer Privacy Act ("CCPA"), create new individual privacy rights and impose increased obligations on companies handling personal data. The CCPA, which became effective on January 1, 2020, grants individuals the right to access, request deletion of, and opt out of the sale of personal information and creates a private right of action for the unauthorized access and exfiltration, theft, or disclosure of certain types of personal information, including the right to seek statutory damages, among other things. In 2020, the Court of Justice for the European Union invalidated mechanisms for transferring personal information out of the European Union, leading to a wave of potential new barriers for data sharing between the European Union and other countries, including the United States. These changes in the legal and regulatory environments in the areas of customer and employee privacy, data security, and cross-border data flows could have a material adverse effect on our business, primarily through (i) the impairment of our transaction processing activities, (ii) the limitation on the types of information that we may collect, process and retain, (iii) the resulting costs of complying with such legal and regulatory requirements, and (iv) the potential monetary penalties for noncompliance. In addition, the federal privacy and security regulations issued under HIPAA require our facilities to comply with extensive requirements on the use and disclosure of protected health information, and implement and maintain administrative, physical, and technical safeguards to protect the security of such information. A change in applicable privacy or security laws or regulations could require us to devote significant management and operational resources, and expend significant additional financial resources, to upgrade the security measures that we employ to comply with such change. Consequently, we may incur significant costs related to ensuring compliance with applicable laws regarding the protection of personal information. The potential costs of non-compliance with these laws and regulations may include significant penalties. In addition, new and existing regulations and policies may affect the use of our products and services and could have a material adverse impact on our results of operations.