XML 53 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact, that is aligned with the National Institute of Standards and Technology (“NIST”). This program is integrated into the Company’s overall Enterprise Risk Management and Resiliency process. We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company’s data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems. The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company’s incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting the Company’s information technology. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. The Company engages external parties, including consultants, computer security firms and risk management and governance experts, to enhance its cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with the Company’s use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards. While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under “Item 1A. Risk Factors,” specifically the risks titled “Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations,” the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | This program is integrated into the Company’s overall Enterprise Risk Management and Resiliency process.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Company’s Board of Directors has a mix of experiences, skills, qualifications and backgrounds to support strategy and risk oversight, including expertise in cybersecurity and oversight of cybersecurity matters. This oversight is achieved through the Company’s Finance and Risk Management (“F&RM”) Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity. The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, “Information Security”). At each regularly scheduled F&RM Committee meeting, management, through the Company’s Chief Information Security Officer (“CISO”), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents. The CISO, who reports to the Chief Technology Officer (“CTO”), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer (“CIO”), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company’s global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees. The CISO’s cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO’s Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company’s CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company’s CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers. To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company’s Board of Directors has a mix of experiences, skills, qualifications and backgrounds to support strategy and risk oversight, including expertise in cybersecurity and oversight of cybersecurity matters. This oversight is achieved through the Company’s Finance and Risk Management (“F&RM”) Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity. The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, “Information Security”). At each regularly scheduled F&RM Committee meeting, management, through the Company’s Chief Information Security Officer (“CISO”), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | At each regularly scheduled F&RM Committee meeting, management, through the Company’s Chief Information Security Officer (“CISO”), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.
Cybersecurity Risk Role of Management [Text Block] | The CISO, who reports to the Chief Technology Officer (“CTO”), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer (“CIO”), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company’s global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees. The CISO’s cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO’s Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company’s CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company’s CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers. To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The CISO, who reports to the Chief Technology Officer (“CTO”), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer (“CIO”), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company’s global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CISO’s cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO’s Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company’s CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company’s CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | At each regularly scheduled F&RM Committee meeting, management, through the Company’s Chief Information Security Officer (“CISO”), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration