Travelzoo 2015 Annual Report Download - page 68

25
In addition, we may acquire personal or confidential information, including credit card information, from users of our
websites and mobile applications, related to our Local Deals, Getaway and planned hotel booking platform. Our existing
security measures may not be successful in preventing security breaches. For example, outside parties may attempt to
fraudulently induce employees, merchants or customers to disclose sensitive information in order to gain access to our secure
systems and networks. A party (whether internal, external, an affiliate or unrelated third party) that is able to circumvent our
security systems could steal consumer information or transaction data or other proprietary information. In the last few years,
several major companies, such as Target, have experienced high-profile security breaches that exposed their customers'
personal information. While we strive to use commercially acceptable means to protect customer personal information, no
method of transmission over the Internet, or method of electronic storage, is 100% secure. Further, because the techniques used
to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized
until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative
measures. Security breaches or the unauthorized disclosure of customer personal information could result in negative publicity,
damage our reputation, expose us to risk of loss or litigation and possible liability and subject us to regulatory penalties and
sanctions. Any failure or perceived failure by us, or our service providers, to comply with the privacy policies, privacy-related
obligations to users or other third parties, or privacy related legal obligations, or any compromise of security that results in the
unauthorized release or transfer of personally identifiable information or other user data, may result in governmental
enforcement actions, litigation or public statements against the company by consumer advocacy groups or others and could
cause our customers and members to lose trust in the Company, which could have an adverse effect on our business. If our
security measures are breached, or if our services are subject to attacks that degrade or deny the ability of users to access our
products and services, our products and services may be perceived as not being secure, users and customers may curtail or stop
using our products and services, and we may incur significant legal and financial exposure.
We could also be adversely affected if legislation or regulations are expanded to require changes in our business practices
or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business,
results of operations or financial condition. For example, we, like many online companies, have been utilizing the U.S.- E.U.
Safe Harbor framework and relying on this method to ensure the appropriate transfer of data between the U.S. and Europe.
However, on October 6, 2015, the European Court of Justice ruled that this 15-year old Safe Harbor pact is no longer valid.
While we are evaluating and implementing alternatives, it is difficult at this point to know whether this ruling will have an
impact on our business. To the extent that European regulatory authorities impose fines on the Company or require changes to
the Company's business practices, the Company's business and results of operations could be materially and adversely affected.
We also could be adversely affected if legislation or regulations are expanded to require changes in our business practices or if
governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business, results
of operations or financial condition.
Claims have been asserted against us relating to shares not issued in our 2002 merger.
The Company was formed as a result of a combination and merger of entities founded by the Company’s principal
stockholder, Ralph Bartel. In 2002, Travelzoo.com Corporation was merged into Travelzoo Inc. Under and subject to the terms
of the merger agreement, holders of promotional shares of Travelzoo.com Corporation (“Netsurfers”) who established that they
had satisfied certain prerequisite qualifications were allowed a period of 2 years following the effective date of the merger to
receive one share of Travelzoo Inc. in exchange for each share of common stock of Travelzoo.com Corporation. In 2004, two
years following the effective date of the merger, certain promotional shares remained unexchanged. As the right to exchange
these promotional shares expired, no additional shares were reserved for issuance. Thereafter, the Company began to offer a
voluntary cash program for those who established that they had satisfied certain prerequisite qualifications for Netsurfer
promotional shares as further described below.
Beginning in 2010, the Company became subject to unclaimed property audits of various states in the United States
related to the above unexchanged promotional shares. The Company recorded charges for the estimated settlements with these
states of $20.0 million , $3.0 million and $22.0 million in 2011, 2012 and 2013, respectively. In 2014, the Company released
$7.6 million of the reserve related to the completion of settlements with the states.