thredUP (TDUP) Risk Factors

The markets for secondhand and resale items are highly competitive. We compete with vendors of new and secondhand items, including branded goods stores, local, national and global department stores, traditional brick-and-mortar consignment and thrift stores, specialty retailers, direct-to-consumer, retailers, discount chains, independent retail stores, the online offerings of traditional retail competitors, resale players focused on niche or single categories, as well as technology-enabled marketplaces that may offer the same or similar goods and services that we offer. We believe our ability to compete depends on many factors, many of which are beyond our control, including: - cost effectively attracting and retaining buyers and sellers and increasing the volume of secondhand items they buy and sell;- further developing our data science and automation capabilities;- maintaining favorable brand recognition;- effectively delivering our marketplaces to buyers and sellers;- identifying and delivering authentic, high-quality secondhand items;- maintaining and increasing the amount, diversity and quality of brands and secondhand items that we offer;- our ability to expand the means through which we acquire and offer secondhand items for resale;- the price at which secondhand items accepted onto our marketplaces are offered;- fluctuations in inventories held by primary sellers and related fluctuations in promotional activities and merchandise discounting;- the speed and cost at which we can process and make available secondhand items and deliver purchased secondhand items to our buyers; and - the ease with which our buyers and sellers can supply, purchase and return secondhand items. As our market evolves and we begin to compete with new market entrants, we expect competition to intensify in the future. Established companies may not only develop their own platforms and competing lines of business, but also acquire or establish cooperative relationships with our current competitors or provide meaningful incentives to third parties to favor their offerings over our marketplaces. Many of our existing competitors have, and some of our potential competitors or potential alliances among competitors could have, substantial competitive advantages such as greater brand name recognition and longer operating histories, larger fulfillment infrastructures, greater technical capabilities, faster shipping times, lower cost shipping, broader supply, established relationships with a larger existing buyer and/or seller base, superior or more desirable secondhand items for sale or resale, greater customer service resources, greater financial, marketing, institutional and other resources than we do, greater resources to make acquisitions, lower labor and development costs, larger and more mature intellectual property portfolios, and substantially greater financial, technical and other resources than we do. Such competitors with greater financial and operating resources may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements and derive greater revenue and profits from their existing buyer bases, adopt more aggressive pricing policies to build larger buyer or seller bases, or respond more quickly than we can to new or emerging technologies, such as artificial intelligence and machine learning and changes in consumer shopping behavior. Potential buyers may also prefer to purchase retail items from larger online or brick-and-mortar competitors that they currently shop from, rather than a newer marketplace, regardless of offerings. These larger competitors often have broader supply and market focus and will therefore not be as susceptible to downturns in a particular market. If such competitors have excess inventory and choose to discount their merchandise or increase promotional activities, potential buyers could increase their relative purchases from such competitors. If we are unsuccessful in establishing or maintaining our relationships with third parties, or if they partner with our competitors and devote greater resources to implement and support the platforms or retail items of our competitors, our ability to compete in the marketplace, or to grow our revenue, could be impaired, and our results of operations may suffer. Even if these partnerships and any future partnerships we undertake are successful, we cannot assure you that these relationships will result in increased buying and selling through our marketplaces or increased revenue. Conditions in our market could also change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation, and it is uncertain how our market will evolve. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer buyers and sellers, reduced revenue, gross profit, and gross margins, increased net losses and loss of market share. Any failure to meet and address these factors could harm our business, results of operations and financial condition.

Seasonality in our core marketplace does not necessarily follow that of traditional retailers, such as typical concentration of revenue in the holiday quarter, and we have seen a relatively linear revenue pattern throughout the year compared to traditional retailers. However, our business has in the past, and may in the future be adversely affected by unseasonable weather conditions, including those resulting from climate change in both our U.S. and EU markets. For example, we have observed that periods of unseasonably warm weather in the fall and winter may lead to reduced consumer spending on winter apparel that tends to have a higher average selling price, which negatively impacts our business. The effects of unseasonably warm weather are particularly pronounced on our Remix platform, which unlike our core marketplace, tends to see an increased concentration of revenue in winter months due to increased sales of winter apparel. As the effects of climate change increase, we expect the frequency and impact of weather and climate related events and conditions to increase as well. Any and all of these risks may materially and adversely affect our financial condition, results of operations and cash flows.

In the ordinary course of our business, we collect, process and store certain personal information and other data relating to individuals, such as our buyers, sellers and employees. We also maintain other information, such as our trade secrets and confidential business information and certain confidential information of third parties, that is sensitive and that we seek to protect. We rely substantially on commercially available systems, software, tools and monitoring to provide security for our processing, transmission and storage of personal information and other confidential information. We or our vendors have been in the past and could be in the future the subject of hacking, social engineering, phishing, ransomware or other attacks. Due to these or other causes, we or our vendors have in the past and may in the future suffer a data breach or other security incident. These incidents have allowed, and may in the future continue to allow, hackers or other unauthorized parties to gain access to personal information or other data, source code, payment card data or confidential business information, and we might not discover such issues for an extended period. The techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target. As a result, we and our vendors may be unable to anticipate these techniques or to implement adequate preventative measures. In addition, our employees, contractors, vendors or other third parties with whom we do business may attempt to circumvent security measures in order to misappropriate such personal information, confidential information or other data, or may inadvertently release or compromise such data. We expect to incur ongoing and increasing costs associated with the detection and prevention of security breaches and other security-related incidents. We may incur additional costs in the event of a security breach or other security-related incident. Any actual or perceived compromise of our systems or data security measures or those of third parties with whom we do business, or any failure to prevent or mitigate the loss of personal or other confidential information and delays in detecting or providing notice of any such compromise or loss could disrupt our operations, harm the perception of our security measures, damage our reputation, cause some participants to decrease or stop their use of our marketplaces and subject us to litigation, government action, increased transaction fees, regulatory fines or penalties or other additional costs and liabilities that could adversely affect our business, results of operations and financial condition. With some of our employees and contractors now working remotely or on a hybrid schedule, and as our vendors and other business partners have also moved to permanent or hybrid remote work, we and our vendors may be more vulnerable to cyberattacks. We are taking steps to monitor and enhance the security of our systems, information technology infrastructure, networks, and data, including with respect to remote access to systems and data. However, the increased scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard all systems, information technology infrastructure, networks and data upon which we rely. Further, due to political uncertainty and military actions associated with Russia's invasion of Ukraine, we and our vendors and service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches from or affiliated with nation-state actors. We cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our business, results of operations, financial condition and reputation.

We store the majority of the secondhand items we offer through our marketplaces in our current processing and distribution centers in Arizona, Georgia, Pennsylvania and Texas. Our processing and distribution centers, as well as our headquarters, are located in areas that have a history of natural disasters, including severe weather events, rendering our distribution centers vulnerable to damage. Any large-scale damage to or catastrophic loss of secondhand and resale items stored in one of our distribution centers, due to natural disasters or man-made disasters such as arson, theft or otherwise would result in liability to our sellers for the expected payout commission liability for the lost items, reduction in the value of our inventory and a significant disruption to our business. Additionally, given the nature of the unique selection of secondhand and resale items we offer on our marketplaces, our ability to restore such secondhand items on our marketplaces would take time and would result in a limitation and delay of available supply for buyers, which would negatively impact our revenue and results of operations. Further, natural disasters, such as earthquakes, hurricanes, tornadoes, fires, floods and other adverse weather and climate conditions; unforeseen public health crises, such as pandemics and epidemics; political crises, such as Russia's invasion of Ukraine and the Israel-Hamas war, terrorist attacks, war and other political instability; or other catastrophic events, whether occurring in the United States or internationally, could disrupt our operations in any of our offices and distribution centers or the operations of one or more of our third-party providers or vendors. Further, while we carry insurance for the secondhand and resale items in our distribution centers, the number of carriers which provide for such insurance has declined, which has resulted in increased premiums and deductibles. The insurance we do carry may not continue to be available on commercially reasonable terms and, in any event, may not be adequate to cover all possible losses that our business could suffer. In the event that we suffer a catastrophic loss of any or all of our distribution centers and the secondhand items in such facilities, our liabilities may exceed the maximum insurance coverage amount, which would harm our business and results of operations.

In the ordinary course of business, we have in the past and may in the future be involved in and subject to litigation for a variety of claims or disputes and receive regulatory inquiries. These claims, lawsuits and proceedings could include labor and employment, wage and hour, commercial, antitrust, alleged securities law violations or other investor claims, claims that our employees have wrongfully disclosed or we have wrongfully used proprietary information of our employees' former employers and other matters. The number and significance of these potential claims and disputes may increase as our business expands. Further, our general liability insurance may not cover all potential claims made against us or be sufficient to indemnify us for all liability that may be imposed. Any claim against us, regardless of its merit, could be costly, divert management's attention and operational resources, and harm our reputation. Our directors and executive officers may also be subject to litigation. The limitation of liability and indemnification provisions that are included in our amended and restated certificate of incorporation, our amended and restated bylaws and indemnification agreements that we entered into with our directors and executive officers provide that we will indemnify our directors and officers to the fullest extent permitted by Delaware law and may discourage stockholders from bringing a lawsuit against our directors and executive officers for breach of their fiduciary duties. Such provisions may also reduce the likelihood of derivative litigation against our directors and executive officers, even though an action, if successful, might benefit us and other stockholders. Further, a stockholder's investment may be harmed to the extent that we pay the costs of settlement and damage awards against our directors and executive officers as required by these indemnification provisions. We have obtained insurance policies under which, subject to the limitations of the policies, coverage is provided to our directors and executive officers against loss arising from claims made by reason of breach of fiduciary duty or other wrongful acts as a director or executive officer, including claims relating to public securities matters, and to us with respect to payments that may be made by us to these directors and executive officers pursuant to our indemnification obligations or otherwise as a matter of law. These insurance policies may not cover all potential claims made against our directors and executive officers, may not be available to us in the future at a reasonable rate and may not be adequate to indemnify us for all liability that may be imposed. As litigation is inherently unpredictable, we cannot assure you that any potential claims or disputes will not harm our business, results of operations and financial condition.

We collect, maintain and otherwise process significant amounts of personal information and other data relating to our buyers, sellers, clients and employees. Numerous state, federal and international laws, rules and regulations govern the collection, use and protection of personal information and other types of data we collect, use, disclose and otherwise process. Such requirements are constantly evolving, and we expect that there will continue to be new proposed requirements relating to privacy, data protection and information security in the United States and other jurisdictions, or changes in the interpretation of existing privacy requirements. For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (the "CCPA") broadly defines personal information, imposes stringent consumer data protection requirements, gives California residents expanded privacy rights, provides for civil penalties for violations and introduces a private right of action for certain data breaches. The CCPA is already the subject of active enforcement by the California Attorney General, who may independently bring administrative actions for civil penalties of $2,500 per violation, or up to $7,500 per violation if intentional, and is also enforced by the new California Privacy Protection Agency. We will continue to monitor developments related to the CCPA and anticipate additional costs and expenses associated with CCPA compliance. Additionally, the CCPA has prompted other states, including Virginia, Colorado, Connecticut and Utah to propose and enact similar laws and regulations relating to privacy. Aspects of these state privacy laws, and their interpretation, remain unclear, and we cannot yet fully predict the impact of these laws or regulations on our business or operations. Further, as our operations expand internationally, including as a result of acquisitions, we may become subject to additional laws and regulations relating to privacy and data protection. Regulatory authorities in the European Economic Area, United Kingdom and Switzerland, for example, traditionally have imposed stricter obligations under laws and regulations relating to privacy and data protection. For example, in Europe, the collection and use of personal information is governed by the European Union's General Data Protection Regulation and the United Kingdom's implementation of the same (collectively, the "GDPR"). The GDPR requires companies to meet stringent requirements regarding the handling, protection, and cross-border transfers of personal data of individuals in the relevant jurisdictions. The GDPR provides for substantial penalties for non-compliance, which may result in monetary penalties of up to 20 million Euros or 4% of a company's worldwide turnover, whichever is greater. Aspects of data protection laws and regulations in Europe, including those relating to cross-border data transfer and the use of cookies, are evolving rapidly and remain subject to substantial uncertainty. Additionally, many other international jurisdictions have laws, regulations, or other requirements relating to privacy, data protection, information security, and localized storage of data, and new countries and territories are adopting such legislation or other obligations with increasing frequency. There is no harmonized approach to these laws and regulations globally. Consequently, international expansion, including as a result of acquisitions, increases our risk of non-compliance with applicable foreign data protection laws and regulations. Future requirements, or changes in the interpretation of existing requirements, relating to privacy, data protection and information security may require us to implement, enhance or modify privacy and security policies, provide certain types of notices, grant certain rights to individuals, inform individuals of security breaches, and, in some cases, obtain individuals' consent to use personal data for certain purposes. These requirements may be inconsistent from one jurisdiction to another, subject to differing interpretations and may be interpreted to conflict with our practices. We cannot yet fully determine the impact that such future requirements may have on our business or operations. Additionally, we are subject to the terms of our privacy policies and notices and may be bound by contractual requirements applicable to our collection, use, processing, security and disclosure of personal information, and may be bound by or alleged to be subject to, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. Any failure or perceived failure by us or any third parties with which we do business to comply with these privacy requirements, with our posted privacy policies or with other obligations to which we or such third parties are or may become subject relating to privacy, data protection or information security, may result in investigations or enforcement actions against us by governmental entities, private claims, public statements against us by consumer advocacy groups or others, and fines, penalties or other liabilities. For example, California consumers whose information has been subject to certain security incidents may bring civil suits under the CCPA, for statutory damages between $100 and $750 per consumer. Any such action would be expensive to defend, likely would damage our reputation and market position, could result in substantial liability and could adversely affect our business and results of operations. Further, in view of new or modified requirements relating to privacy, data protection or information security, contractual obligations and other legal obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices, and to expend significant resources to adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new features could be limited. Privacy, data protection and information security concerns, whether valid or not valid, may inhibit the use and growth of our RaaS product offerings and marketplace, particularly in certain foreign countries. Additionally, public scrutiny of or complaints about technology companies or their data practices, even if unrelated to our business, industry, or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.

On March 10, March 12 and May 1 of 2023, the Federal Deposit Insurance Corporation (the "FDIC") took control and was appointed receiver of Silicon Valley Bank, Signature Bank and First Republic Bank, respectively, after each bank was unable to continue their operations. These events exposed vulnerabilities in the regional banking sector, including liquidity constraints, contagion and solvency risk and other legal uncertainties and caused significant volatility in the market prices of the common stock of certain other regional banks. Although we do not have any deposits with any of the banks that have been placed into receivership to date, if any of our banking partners, lenders, or counterparties to certain financial instruments were to be placed into receivership, we may be unable to access such funds. For example, our loan and security agreement is with Western Alliance Bank, a regional bank, and while our amended and restated loan and security agreement requires that we maintain minimum cash deposits with Western Alliance Bank that exceed the FDIC insurance limits, we utilize an insured cash sweep program to extend FDIC insurance to this balance. Further, while we maintain the contractual minimum cash deposits with Western Alliance Bank, most of our cash is invested in managed assets outside of Western Alliance Bank. If Western Alliance Bank or other financial institutions with which we have relationships were to enter into receivership or become insolvent, our ability to access the cash and cash equivalents that we hold at such institutions, as well as our ability to draw on our credit facility, may be impacted. In such an event, it could become more difficult for us to access sufficient liquidity or acquire financing on commercially reasonable terms or at all. Any such event could adversely impact our ability to meet our operating expenses, financial obligations or fulfill our other obligations, which could result in breaches of our financial and other contractual obligations, any of which could materially and adversely impact our business, results of operations and financial condition.