The Company relies extensively on information technology (“IT”) systems, networks and services, including Internet sites, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third parties or their vendors, to assist in conducting business. The various uses of these IT systems, networks and services include, but are not limited to: •ordering and managing materials from suppliers; •converting materials to finished products; •shipping products to customers; •marketing and selling products to consumers; •collecting and storing customer, consumer, employee, investor and other stakeholder information and personal data, including data that may be subject to data privacy laws, including but not limited to the General Data Protection Regulation of the European Union (“GDPR”), the California Consumer Privacy Act (“CCPA”) or General Law for Protection of Personal Data (“LGPD”) of Brazil; •processing transactions; •summarizing and reporting results of operations; •hosting, processing and sharing confidential and proprietary research, business plans and financial information; •complying with regulatory, legal or tax requirements; •providing data security; and •handling other processes necessary to manage the Company’s business. Increased IT security threats and cyber-crime, including advanced persistent threats, computer viruses, ransomware, other types of malicious code, hacking, phishing and social engineering schemes designed to provide access to the Company’s networks or data, pose a potential risk to the security of the Company’s IT systems, networks and services, as well as the confidentiality, availability and integrity of the Company’s data. As an example, in 2021 a remote code execution vulnerability in Apache log4j was identified as affecting large amount of systems worldwide. Cyber threats are becoming more sophisticated, are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, increasing the difficulty of detecting and successfully defending against them. The Company deploys technical and organizational measures to protect and prevent unauthorized access to or loss of data, however, as techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, the Company may be unable to anticipate these techniques or implement preventive measures. Furthermore, the Company’s relationships with, and access provided to, third parties and their vendors may create difficulties in anticipating and implementing adequate preventive measures or fully mitigating harms after an attack or breach occurs. The Company cannot guarantee that its security efforts will prevent attacks and resulting breaches or breakdowns of the Company’s, or its third-party service providers’ databases or systems notwithstanding whether the Company takes reasonable steps to prevent such attacks. The Company’s operations, especially its retail operations, involve the storage and transmission of employees’, customers’ and consumers’ personal and sensitive information, such as credit card and bank account numbers. The Company’s payment services may be subject to credit card and other payment fraud schemes, including unauthorized use of credit cards, debit cards or bank account information, identity theft or merchant fraud. If the IT systems, networks or service providers relied upon fail to function properly, or if the Company suffers a loss or disclosure of customers’ and consumers’ data, business or stakeholder information, due to any number of causes, ranging from catastrophic events to power outages to security breaches, or the inability to effectively address these failures on a timely basis, the Company may suffer interruptions in its ability to manage operations, a risk of government enforcement action, litigation and possible liability, and reputational, competitive and/or business harm, which may adversely impact the Company’s results of operations and/or financial condition. In addition, if the Company’s service providers, suppliers or customers experience a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected, which may result in a disruption in the Company’s supply chain or reduced customer orders or other business operations, which would adversely affect the Company. The Company is subject to laws of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, vendor or employee information or related data, including the GDPR which went into effect in May 2018, the CCPA, which went into effect on January 1, 2020, and the LGPD which went into effect in August 2020. The changes introduced by the GDPR, CCPA, and LGPD increase the complexity of regulations enacted to protect business and personal data, subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices.