Build-A-Bear Workshop 2013 Annual Report Download - page 18

Our Web sites, primarily for children, allow social interaction
between users. We currently obtain and retain personal information
about our Web site users, store shoppers and loyalty program
members. In addition, we obtain personal information about our
guests as part of their registration in our Find-A-Bear® identification
system. Federal, state and foreign governments have enacted or
may enact laws or regulations regarding the collection and use of
personal information, with particular emphasis on the collection
of information regarding minors. Such regulation may also include
enforcement and redress provisions.
We have a stringent, comprehensive privacy policy covering the
information we collect from our guests and have established security
features to protect our guest database and Web sites. While we
have implemented programs and procedures designed to protect
the privacy of people, including children, from whom we collect
information, and our Web sites are designed to be fully compliant
with the Federal Children’s Online Privacy Protection Act, there can
be no assurance that such programs will conform to all applicable
laws or regulations. If we fail to fully comply, we may be subjected
to liability and damage to our reputation. In addition, because our
guest database primarily includes personal information of young
children and young children frequently interact with our Web sites,
we are potentially vulnerable to charges from parents, children’s
organizations, governmental entities, and the media of engaging in
inappropriate collection, distribution or other use of data collected
from children. Additionally, while we have security features and chat
monitoring, our security measures may not protect users’ identities
and our online safety measures may be questioned which may result
in negative publicity or a decrease in visitors to our site. If site users
act inappropriately or seek unauthorized contact with other users of
the site, it could harm our reputation and, therefore, our business and
we could be subject to liability.
Our business involves the storage and transmission of customers’
personal information, such as consumer preferences and credit card
information. We invest in industry-standard security technology
to protect the Company’s data and business processes against the
risk of data security breaches and cyber-attacks. Our data security
management program includes identity, trust, vulnerability and
threat management business processes, as well as enforcement of
standard data protection policies such as Payment Card Industry
compliance. We measure our data security effectiveness through
industry accepted methods and remediate critical findings.
Additionally, we certify our major technology suppliers and any
outsourced services through accepted security certification
measures. We maintain and routinely test backup systems and
disaster recovery, along with external network security penetration
testing by an independent third party as part of our business
continuity preparedness. Internet privacy is a rapidly changing area
and we may be subject to future requirements and legislation that are
costly to implement and negatively impact our results.
While we believe that our security technology and processes are
adequate in preventing security breaches and in reducing cyber
security risks, given the ever-increasing abilities of those intent on
breaching cyber security measures and given our reliance on the
security and other efforts of third-party vendors, the total security
effort at any point in time may not be completely effective, and
any such security breaches and cyber incidents could adversely
affect our business. Failure of our systems, including failures due to
cyber-attacks that would prevent the ability of systems to function
as intended, could cause transaction errors, loss of customers and
sales, and could have negative consequences to us, our employees,
and those with whom we do business. Any security breach involving
the misappropriation, loss, or other unauthorized disclosure of
confidential information by us could also severely damage our
reputation, expose us to the risks of litigation and liability, and harm
our business. While we carry insurance that would mitigate the losses
to an extent, such insurance may be insufficient to compensate us for
potentially significant losses.
Our strategy requires us to operate a significant number of stores
in the United States, Canada, the United Kingdom and Ireland, as
well as close, relocate and open store locations in these countries. If
we are not able to operate these stores or to effectively manage the
overall portfolio of our stores, it could adversely affect our ability to
grow and could significantly harm our profitability.
Our future results will largely depend on our ability to operate our
stores successfully in the United States, Canada, the United Kingdom
and Ireland and optimize store productivity and profitability by
closing select stores, relocating and downsizing other stores and
selectively upgrading stores with key features in conjunction with
lease renewals. In 2012, we announced a plan to reduce our store
count in North America. We closed 37 stores in 2013 in addition to
the 10 locations closed in 2012 and 12 locations closed in 2011. We
currently expect to close an additional 10 to 15 locations in 2014. Our
ability to manage our portfolio of stores in future years in desirable
locations and operate stores profitably, particularly in multi-store
markets, is a key factor in our ability to achieve sustainable profitable
growth. We cannot be certain when or whether desirable locations
will become available, the number of Build-A-Bear Workshop stores
that we can or will ultimately open, or whether any such new or
relocated stores can be profitably operated. We have not always
succeeded in identifying desirable locations or in operating our stores
successfully in those locations. We may decide to close other stores in
the future.
In July 2005, we opened a flagship store in New York City. Because this
store is much larger than our typical mall-based stores, it requires us
to generate revenues at a higher level to justify keeping the store open.
Closing this store could have an adverse impact on sales.
Increased demands on our operational, managerial and
administrative resources as a result of our store strategy could cause
us to operate our business less effectively, which in turn could cause
8 BUILD-A -BEAR WORKSHOP, INC. 2013 FORM 10-K