Zoomcar Holdings (ZCAR) Risk Factors

The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal information by companies operating over the internet have recently come under increased public scrutiny. The European Union's privacy and data security regulation, the General Data Protection Regulation ("GDPR"), that went into effect in May 2018, requires companies to implement and remain compliant with regulations regarding the handling of personal data, including its use, protection and the ability of persons whose data is stored to correct or delete such data about themselves. Other countries in Asia, Europe and Latin America have passed or are considering similar privacy regulations, resulting in additional compliance burdens and uncertainty as to how some of these laws will be interpreted. We receive, collect and store a large volume of personally identifiable data by processing car sharing transactions on our platform. This data is increasingly subject to legislation and regulations in numerous jurisdictions around the world. For example, the Indian Information Technology Act, 2000, as amended, would subject us to civil liability to compensate for wrongful loss or gain arising from any negligence by us in implementing and maintaining reasonable security practices and procedures with respect to sensitive personal data or information that we possess in our computer systems, networks, databases and software. India has also implemented privacy laws, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which impose limitations and restrictions on the collection, use and disclosure of personal information. The Digital Personal Data Protection Act, 2023 has been introduced in August of 2023 which has significant impact on the current regulatory environment with respect to the lawful use of digital personal data, cross border data transfers and additional compliances that may be invoked for organizations collecting and/or processing personal data. Since the legislation is fairly new and going through the phases of implementation right now, it may affect us in ways that we are currently unable to predict. Any liability we may incur for violation of such laws and regulations and related costs of compliance and other burdens may adversely affect our business and profitability. We could be adversely affected if legislation or regulations are expanded to require changes in our business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business, results of operations or financial condition.

We collaborate with third-party suppliers who regularly provide products and services, including but not limited to IoT devices and software integrations, to us. We do not have long term purchase agreements in place with our current suppliers of the IoT devices that we program and advise our Hosts to install in the vehicles that they register to our platform and our suppliers could reduce the quantity of or discontinue providing IoT devices suitable for our needs. Given that the Hosts now have an option to install/not install these devices, we do not currently anticipate material challenges to identifying replacement suppliers if shortages of IoT devices occur, we are reliant on third parties to provide such devices and unanticipated shortages or an inability to identify new suppliers if our existing suppliers cease to be willing or able to provide the IoT devices on terms and at costs acceptable to Zoomcar may occur. Any such shortages, reductions or terminations in IoT device supply arrangements may indirectly lead up to an adverse impact on our revenues, profits and financial condition. Additionally, if the market prices for IoT devices that are suitable for our needs goes up, we may need to purchase the devices at a comparatively higher price, which may adversely affect our business, financial condition and results of operations. We have limited control over the operations of our suppliers and other business partners and any significant interruption in their operations may have an adverse impact on our operations. For example, a significant interruption in the operations of our supplier's production facilities could cause delay or termination of shipment of the IoT devices to us, which may, in turn, reduce or delay our ability to pre-program and distribute such devices to Hosts which may in turn  affect the retention of Hosts who are more inclined towards installing the devices leading to a lower availability of inventory on our Platform. As our operations continue to scale and grow, we anticipate needing an increased number of IoT devices, and our demand therefore may exceed the capabilities of our existing suppliers. If our suppliers cease to supply adequate numbers of IoT devices to us, or if we need alternative sources of supply for any other reason, those devices may not be immediately available to us. If alternative suppliers are not immediately available, we will have to identify and qualify alternative suppliers, and the installation of such devices on vehicles which Hosts wish to add to our platform may be delayed. We may not be able to find adequate alternative or additional suppliers in a reasonable period of time or on commercially acceptable terms, if at all. An inability to obtain sufficient supply of IoT devices which we can program for platform use may delay installation of such devices on vehicles that would otherwise become registered or more promptly registered to our platform, harm our relationships with Hosts, which could adversely affect our business and operations.

To continue to retain and attract Hosts and Guests to our platform, we will need to continue to introduce new or upgraded features, functions and technologies that add value for Hosts and Guests that differentiate us from our competitors. Developing and delivering these new or upgraded features, functions and technologies is costly, and the success of such features, functions and technologies depends on several factors, including the timely completion, introduction, and market acceptance of such features, functions and technologies. Moreover, any such new or upgraded features, functions and technologies may not work as intended or may not provide intended value to Hosts and Guests. If we are unable to continue to develop new or upgraded features, functions and technologies, or if Hosts and Guests do not perceive value in such new or upgraded features, functions and technologies, Hosts and Guests may choose not to use our platform, which would adversely affect our operating results. We have made substantial investments to develop new or upgraded features, functions and technologies, and we intend to continue investing significant resources in developing new technologies, tools, features, services and other platform offerings. If we are unable to attract/retain and pay qualified technical staff required to continue our platform feature development efforts, we may not realize the expected benefits of our developments. There can be no assurance that the new developments will exist or be sustained at the levels that we expect, or that any of these new developments will gain sufficient traction or market acceptance to generate enough revenue to offset any new expenses or liabilities associated with these new investments. Our development efforts with respect to new features, functions and technologies on our platform could distract management from current operations and will divert capital and other resources from our more established functions and technologies. Even if we are successful in developing new features, functions or technologies, or otherwise update or upgrade our platform, regulatory authorities may subject us to new rules or restrictions in response to our innovations that could increase our expenses or prevent us from successfully commercializing the new features, functions, technologies, updates or upgrades of our platform. If we are unable to adapt in a cost-effective and timely manner in response to the changing market conditions or platform users' preferences, either for technical, legal, financial or other reasons, our business, financial condition and results of operations may be materially and adversely affected.

In the regular course of our business, we collect, use, store, transmit, and process data and information about Hosts, Guests, employees, and others, some of which may be sensitive, personal, or confidential and make us an attractive target and potentially vulnerable to cyberattacks, computer viruses, electronic break-ins or similar disruptions. Any actual or perceived unauthorized access to or use of such data and information, or breach of our security measures or those of our third-party service providers, could adversely affect our business, operations, and future prospects. While we have taken steps to mitigate our cyberattack risks and protect the confidential information that we have access to, including but not limited to installation and periodical updates of antivirus software and backup of information on our computer systems, our security measures could be breached. Because techniques used to sabotage or obtain unauthorized access to systems change frequently and generally are not recognized until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. Any cybersecurity incident, accidental or willful security breaches or other unauthorized access to our systems could cause confidential information to be stolen and used for criminal purposes. Cybersecurity incidents, security breaches or unauthorized access to confidential information could also expose us to liability related to the loss of the information, time-consuming and expensive litigation and negative publicity. If security measures are breached because of third-party action, employee error, malfeasance or otherwise, or if design flaws in our technology infrastructure are exposed and exploited, our relationships with our Hosts and Guests could be severely damaged, we could incur significant liability, and our business and operations could be adversely affected. Additionally, if we fail to protect confidential information, we may be susceptible to potential claims such as breach of contract, negligence or other claims. Such claims will require considerable time and resources to defend and there can be no assurances that favorable final outcomes will be obtained. An increasing number of organizations, including large online and offline merchants and businesses, other large Internet companies, financial institutions, and government institutions have disclosed breaches of their information security systems and other information security incidents, some of which have involved sophisticated and highly targeted attacks. In addition, users on our platform could have vulnerabilities on their own mobile devices that are entirely unrelated to our systems and platform, but which could mistakenly be attributed to us and our system and platform. Further, breaches experienced by other companies may also be leveraged against us. For example, credential stuffing and ransomware attacks are becoming increasingly common, and sophisticated actors can mask their attacks, making them increasingly difficult to identify and prevent. Certain efforts may be state-sponsored or supported by significant financial and technological resources, making them even more difficult to detect. If a third party or employee circumvents any of our security measures or those of our third-party service providers, they may access, misappropriate, delete, alter, publish, or modify this information, which could cause interruptions in our business and operations, fraud or loss to third parties, regulatory enforcement actions, litigation, indemnity obligations, competitive harm, and other possible liabilities, as well as negative publicity. Widespread negative publicity may also result from real, threatened, or perceived security compromises (or lack of adequate security measures) of our industry, competitors, Hosts, and Guests. Concerns regarding privacy and data security could cause some Hosts and Guests to stop using our services, and for employees to be less satisfied with their employment with us and potentially leave the Company or institute claims against us. This discontinuance in use and the potential failure to acquire new Hosts and Guests, and similar personnel issues, could substantially harm our business, results of operations, financial condition, and future prospects. Our information technology systems, internal computer systems, cloud-based computing services, and those of our current and any future third-party service providers are vulnerable to interruption and intrusion. Cyberattacks and other malicious internet-based activity, such as insider threats, computer malware, hacking, and phishing attempts continue to increase. Any cybersecurity incident or material disruption or slowdown of our systems could cause outages or delays in our services, which could harm our brand and adversely affect our operating results. Our failure to implement adequate cybersecurity protections could subject us to claims for any breach of security, particularly if it results in disclosure of information relating to our Hosts or Guests. If changes in technology cause our systems to become obsolete, or if our systems are inadequate to facilitate our growth, we could lose Hosts or Guests, and our business and operating results could be adversely affected. From time to time, and especially in 2018, we have experienced security incidents or attempted attacks, and in some instances, individuals have had their personal information compromised. We conduct investigations when we become aware of such incidents and/or attempted attacks (although our investigations may not be able to determine the method of attack) and may notify affected persons, as necessary. In addition to traditional computer "hackers" employing malicious code (such as viruses, worms, and ransomware) to breach our systems and platform, we are susceptible to and monitor for social engineering, cyber extortion, and personnel theft or misuse. We may also be the subject of denial-of-service attacks, server malfunction, software or hardware failures, loss of data or other computer assets, adware, or other similar issues. Threat actors, nation states, and nation state-supported actors engage in cyberattacks, including for geopolitical reasons, continued opportunistic monetary reasons, and in connection with military conflicts and operations. During times of war and other major conflicts, we and our third-party service providers may be vulnerable to these attacks, including cyberattacks that could materially disrupt our systems, platform and operations. While we have security measures in place to protect customer information and prevent data loss, service interruption, and other security breaches, we cannot guarantee that our security measures or our third-party service providers' security measures will be sufficient to protect against unauthorized access to, or other compromise of, personal information, confidential information, or proprietary information or of disruptions or damage to our systems. The techniques used to sabotage or to obtain unauthorized access to our platform, systems, networks, and/or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to anticipate such techniques or implement adequate preventative measures or stop security breaches that may arise from such techniques. As a result, our safeguards and preventive measures may not be adequate to prevent current or future cyberattacks and security incidents, including security breaches that may remain undetected for extended periods of time, which can substantially increase the potential for a material and adverse impact resulting from the breach. We are required to comply with laws, rules, industry standards, and regulations that require us to maintain the security of personal information in India. We may also have contractual and other legal obligations to notify relevant stakeholders of security breaches. Failure to prevent or mitigate cyberattacks could result and has in the past resulted in unauthorized access to such data, including personal information. India has enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data. In addition, our agreements with certain partners may require us to notify them in the event of a security breach. Such disclosures are and could be costly, could lead to negative publicity, may cause Hosts and Guests to lose confidence in the effectiveness of our security measures and to not use our services, and may require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach. In addition, the costs to respond to a cybersecurity event or to mitigate any identified security vulnerabilities could be significant, including costs for remediating the effects of such an event, paying a ransom, restoring data from backups, and conducting data analysis to determine what data may have been affected by the breach. In addition, our efforts to contain or remediate a security breach or any system vulnerability may be unsuccessful, and our efforts and any related failures to contain or remediate any breach or vulnerabilities could result in interruptions, delays, loss in customer trust, harm to our reputation, and increases in our insurance premiums. We do not currently have insurance coverage for security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees, and other impacts that arise out of incidents or breaches. While we may obtain cyber liability insurance in the future, we cannot assure you that such insurance coverage will adequately cover liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. The successful assertion against us of one or more large claims that exceeds available insurance coverage, or that results in changes to insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. Our risks are likely to increase as we continue to expand, grow our Host and Guest base, and process, store, and transmit increasingly substantial amounts of confidential, proprietary and sensitive data.

We face and expect to continue to face competition from ride sharing companies, car rental and taxi companies. The car sharing market in particular is intensely competitive and is characterized by rapid changes in technology, shifting guest needs and preferences, and frequent introductions of new services and offerings. We expect competition to increase, both from existing competitors and new entrants in the markets in which we operate or plan to operate, and such competitors may be well-established and enjoy greater resources or other strategic advantages. If Zoomcar is unable to anticipate or successfully react to these competitive challenges in a timely manner, Zoomcar's competitive position could weaken, or fail to improve, and Zoomcar could experience a decline in revenue or growth stagnation that could adversely affect Zoomcar's business, financial condition and operating results. Certain of our current and potential competitors may have greater financial, technical, marketing, research and development skills and other resources, greater name recognition, longer operating histories or a larger global user base than we do. Such competitors may be able to devote greater resources to the development, promotion and sale of offerings, and they may be able to offer lower prices in certain markets than we do, which could adversely affect our business, financial condition and operating results. These and other factors may allow our competitors to derive greater revenue and profits from their existing user bases, attract and retain Hosts and Guests at lower costs or respond more quickly to new and emerging technologies and trends. Current and potential competitors may also establish cooperative or strategic relationships, or consolidate, amongst themselves or with third parties, which may further enhance their resources and offerings relative to ours. We believe that our ability to compete effectively depends upon many factors both within and beyond our control, including but not limited to: - acceptance of car-sharing and the use of our platform to solve transportation needs in the emerging markets in which we operate;- our ability to attract and retain Guests and Hosts to use our platform;- the popularity and perceived utility, ease of use, performance and reliability of our platform;- our brand strength and recognition;- our pricing models and the prices of our offerings;- our ability to manage our business and operations during a pandemic and related travel restrictions if and when imposed upon outbreak of a pandemic;- our ability to continue developing platform features which appeal to changing customer preferences;- our ability to continue leveraging and enhancing our data collection and analytics capabilities;- our ability to establish and maintain relationships with strategic partners and third-party suppliers or providers;- changes mandated by legislation, regulatory authorities or litigation, including settlements, judgments, injunctions and consent decrees, as well as changes that we may elect to make ourselves in the face of potential litigation, legislation, or regulatory scrutiny;- our ability to attract, retain and motivate talented employees; and - our ability to raise additional capital. If we are unable to compete successfully, our business, financial condition and operating results could be adversely affected.

To continue growing our business, we plan, in the future, to strengthen our operations and presence in India and to expand into other emerging markets, which may include, without limitation, markets in Southeast Asia, Middle East/North Africa, and Latin America. We have limited experience operating in jurisdictions outside India and plan to continue our efforts to expand into other jurisdictions. Business operations in multiple jurisdictions and markets is difficult, time consuming and expensive, and any international expansion efforts that we may undertake may not be successful. In addition, conducting international operations subjects us to risks associated with operating in emerging markets, including but not limited to the following: - operational and compliance challenges caused by distance, language, and cultural differences, including but not limited to the additional cost and resources required to localize our services, the translation of our mobile app, website and platform into foreign languages, and the adaptation of our operations to local cultures and practices, and any changes in such cultures and practices;- unexpected and more restrictive laws and regulations, as amended from time to time, including those laws and regulations governing internet activities, peer-to-peer car sharing platforms, leasing or renting cars, insurance requirements, licensing and usage of vehicles, employment, tax, licensing and permitting, identify verification and screening, email and text messaging, collection and use of personal information, privacy and data protection, payment processing, currency regulation, auto insurance scores, or other third-party data sources for trust and safety screening purposes, and other activities important to our online business practices;- differing levels of technological compatibility with our platform and social acceptance of our brand and platform, and competition with companies that understand the local market better than we do or that have preexisting relationships with potential Hosts and Guests in those markets;- legal uncertainty regarding our liability for the actions of Hosts and Guests, including uncertainty resulting from unique local laws or a lack of clear precedent of applicable law;- dependency on third-party suppliers for the provision of essential business products/services including but not limited to IoT devices and software integrations in different jurisdictions. - fluctuations in currency exchange rates;- higher levels of credit risk and payment fraud;- potentially adverse tax consequences, including the complexities of foreign value added tax systems and restrictions on the repatriation of earnings;- increased financial accounting and reporting burdens, in addition to complexities and difficulties relating to the implementation and maintenance of adequate internal controls;- difficulties in implementing and maintaining the financial systems and processes needed to enable compliance across multiple offerings and jurisdictions;- public health concerns or emergencies, such as pandemic and other highly communicable diseases or viruses, outbreaks of which have from time to time occurred in various parts of the world in which we operate;- managing operations in markets in which cash transactions are favored over credit or debit cards;- political, social, and economic instability abroad;- terrorist attacks, including data breaches and security concerns;- breakdowns in infrastructure, utilities, and other services;- exposure to a business culture in which improper business practices may be prevalent;- compliance with various anti-bribery laws; and - reduced or varied protection of intellectual property rights in some countries. While we believe that the present regulatory environment in our target markets is generally favorable, this could and may change over time. If the regulatory environment in our target markets becomes more unfavorable for car sharing businesses, this could have a negative impact on our operations in these markets and could adversely impact our ability to achieve sustainable profitability in these markets.

The occurrence of one or more natural disasters, including and not limited to tornadoes, hurricanes, fires, floods and earthquakes, unusual weather conditions, pandemics and endemic outbreaks, terrorist attacks or disruptive political events in certain regions where our facilities are located, or where our third-party contractors' and suppliers' facilities are located, could adversely affect our business. Natural disasters including tornados, hurricanes, floods and earthquakes may damage our facilities or those of our suppliers, which could have a material adverse effect on our business, financial condition and results of operations. Terrorist attacks, actual or threatened acts of war or the escalation of current hostilities, or any other military or trade disruptions impacting our domestic or foreign suppliers of components of our products, may impact our operations by, among other things, causing supply chain disruptions and increases in commodity prices, which could adversely affect our raw materials or transportation costs. These events also could cause or act to prolong an economic recession in the United States or abroad. In addition, the disaster recovery and business continuity plans we have in place currently are limited and are unlikely to prove adequate in the event of a serious disaster or similar event. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans and, more generally, any of these events could cause consumer/ member confidence and spending to decrease, which could adversely impact our operations.

All of our business is transacted and/or denominated in foreign currencies, and fluctuations in currency exchange rates could have a significant impact on our results of operations, financial condition and cash flows. Increased currency volatility, particularly in the Indian Rupee, could also positively or negatively impact our foreign-currency-denominated costs, assets and liabilities. In addition, any devaluation of the Rupee relative to other foreign currencies could increase our operating expenses, adversely affecting the results of our operations. Any of these factors could adversely affect our financial condition and the results of our operations in the future.