XML 53 R36.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management and Strategy Cybersecurity is an important element of the Company’s overall enterprise risk management program. The Company has a multilayered system to assess, identify, and manage cybersecurity risks. The system is designed to help protect the Company’s information assets and operations from internal and external cyber threats. The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company’s networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company’s enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee. The Company devotes significant resources to help protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company’s cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company’s cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the “Framework”). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage. The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company’s independent assessor provides a periodic assessment of the Company’s risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company’s adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company’s applicable technological environment. The Company has engaged an independent security assessor to evaluate the Company’s cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center (“RH-ISAC”) where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity. To help oversee and identify risks from cybersecurity threats associated with the Company’s use of third-party service providers, the Company has a third-party information risk management program intended to minimize the likelihood of misuse of Choice data by third parties and business partners and requires that third-party service providers complete a periodic security risk assessment. Depending upon the identified risk, actions such as obligating the third party to remediate the identified deficiencies or termination of the relationship may occur. Also, depending upon the nature of the relationship and data, third party agreements include security and privacy provisions that oblige third parties to abide with applicable regulations and employ reasonable security controls. The Company’s Board of Directors does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Cybersecurity is an important element of the Company’s overall enterprise risk management program. The Company has a multilayered system to assess, identify, and manage cybersecurity risks. The system is designed to help protect the Company’s information assets and operations from internal and external cyber threats. The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company’s networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company’s enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Audit Committee of the Company’s Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans. The Company has a Chief Information Security Officer (“CISO”) whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks. The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC. The Company has also established a cross-functional cybersecurity oversight committee led by our CISO serving as the chair and consisting of executive-level leaders, that is responsible for the Company’s cybersecurity, disaster recovery, and business continuity programs. The Company’s internal audit team also provides independent assurance on the functional components of the Company’s cybersecurity program and reports the results of these audits in its quarterly reports to the Audit Committee. In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company has a Chief Information Security Officer (“CISO”) whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.
Cybersecurity Risk Role of Management [Text Block] | The Company has a Chief Information Security Officer (“CISO”) whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks. The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC. The Company has also established a cross-functional cybersecurity oversight committee led by our CISO serving as the chair and consisting of executive-level leaders, that is responsible for the Company’s cybersecurity, disaster recovery, and business continuity programs. The Company’s internal audit team also provides independent assurance on the functional components of the Company’s cybersecurity program and reports the results of these audits in its quarterly reports to the Audit Committee. In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Company has a Chief Information Security Officer (“CISO”) whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration