Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their respective businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts thatexcept where such non-compliance would not, individually or in the aggregate, would reasonably indicate material be expected to have a Material Adverse Effect. The Company and its subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, the same would be reasonably likely to the knowledge of the Company, threatened alleging create a material liability) as soon they take effect except where such non-compliance with any Data Security Obligationwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data (collectively, the “Personal Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; same and (iii) except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company has not received any written notification of or written complaint regardingand its subsidiaries, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiariesControlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its subsidiaries Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its subsidiaries Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used collected or processed by the Company or the Controlled Entities in connection with their businesses, and and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are reasonably believed by the Company to be adequate in all material respects for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businessesthe business of the Company and its subsidiaries as currently conducted, and and, to the knowledge of the Company, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept for such failures as would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; corruptants (ii) collectively, “Bugs”), except where such Bugs would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards as are generally maintained by similarly situated companies and which the Company and its subsidiaries believe are reasonably adequate to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. Without limiting the foregoing, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes have used commercially reasonable efforts to establish and all judgmentsmaintain, ordersand have established, rules maintained, implemented and regulations of any court or arbitrator or governmental or regulatory authoritycomplied with, internal reasonable information technology, information security, cyber security and data protection controls, policies and contractual obligations relating to the privacy procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security of IT Systems plans as are generally maintained by similarly situated companies that are designed to protect against and Personal Data and to the protection of such IT Systems and Personal Data from prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Data Security ObligationsBreach”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to To the knowledge of the Company, threatened alleging non-compliance with there has been no such Breach. The Company and its subsidiaries have not been notified of and have no knowledge of any Data Security Obligationevent or condition that would reasonably be expected to result in, any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company The Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are reasonably believed by the Company to be adequate in all material respects for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal IT Data”)) used in connection with their businessesthe business of the Company and its subsidiaries as currently conducted, and and, to the knowledge of the Company, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal IT Data and to the protection of such IT Systems and Personal IT Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept for such failures as could not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or described in the aggregateRegistration Statement, reasonably be expected to have a Material Adverse Effectthe Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them (“Personal Data”)) used in connection with their businesses; to the knowledge of the Company, and there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the sameCompany’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and (iii) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. (i) Except as would not, individually or in the aggregate, not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented and maintained or are in the process of implementing commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businessesthe operation of the business of the Company and its subsidiaries as currently conducted; (iii) except as would not reasonably be expected to have a Material Adverse Effect, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iiiiv) except as would not reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. (i) Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in capacity and operation for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement and the Prospectus, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; and (ii) the Company and its subsidiaries have at all times in the past three (3) years implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the confidentiality, integrity, availability, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data used in its business (“Personal Company Data”)) used in connection with their businesses, and (iii) to the knowledge of the Company, except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to sameIT Systems and Company Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; IT Systems and (iii) the Company Data. The Company and each of its subsidiaries are presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Personal Company Data and to the protection of such IT Systems and Personal Company Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received modification, except to the extent that any written notification of or written complaint regarding, and is unaware of any other facts thatnon-compliance would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Each SDH Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are are: (i) adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company each SDH Party and its subsidiaries as currently conducted, and (ii) to the knowledge of the SDH Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company . Each SDH Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all owned IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. To the knowledge of the SDH Parties, and there have been no breaches, violations, outages or unauthorized uses of or accesses to sameany such IT Systems or data, except for those that have been remedied without material cost or liability or the duty to notify any governmental or regulatory authority or any other personPerson, nor any incidents under internal review or investigations investigation relating to the same; and (iii) the Company . Each SDH Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all statutes, judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies published policies, and contractual obligations obligations, in each case, relating to the privacy and security of IT Systems and Personal Data and to (collectively, the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company None of the SDH Parties has not received any written notification of or written complaint regarding, and or is unaware aware of any other facts that, individually or in the aggregate, would reasonably indicate indicate, material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the CompanySDH Parties, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would notcould not be expected, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Partnership’s and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company Partnership and its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Partnership, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (iii) the Company Partnership and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data (“Personal Data”)) used maintained or processed by the Partnership and its Subsidiaries in connection with their businessesbusinesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Partnership, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same; and (iii) knowledge of the Company Partnership, the Partnership and its subsidiaries Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Partnership and its Subsidiaries, governing the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have result in a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or for any such breaches, violations, outages or unauthorized uses or accesses to the same that would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants; (ii) , except as would not individually or in the aggregate have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no, and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in any, breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personsame (“Breach”), nor are there any incidents under internal review or investigations relating to any Breach. Neither the same; Company nor its subsidiaries has received any notice, claim, complaint, demand or letter from any person or governmental agency in respect of their businesses under applicable data protection laws, regulations and (iii) standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiaries’ businesses. Neither the Company nor its subsidiaries have been obligated to notify any third party, including, without limitation, any individual or data protection authority, of any Breach. The Company and its subsidiaries have complied at all times and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security ObligationsObligation”), except as would not individually or in the aggregate have a Material Adverse Effect. The Company has not and its subsidiaries have taken all necessary actions to comply with any Data Security Obligation, including the European Union General Data Protection Regulation, the Health Insurance Portability and Accountability Act, and the California Consumer Privacy Act. Neither the Company nor its subsidiaries have received any written notice, claim, complaint, demand, letter, notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with with, any Data Security Obligation, Obligation and there is no pending or threatened action, suit suit, investigation or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) , except in each case as would not, individually or in the aggregate, reasonably be expected to have Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The modification; and the Company has not received any written notification of or written complaint regarding, implemented backup and is unaware of any other facts that, individually or in the aggregate, would disaster recovery technology reasonably indicate material non-compliance consistent with any Data Security Obligation, industry standards and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationpractices.

Cybersecurity; Data Protection. Except as would nothas not had or could not reasonably be expected to have, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Company’s and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the corruptants designed to permit unauthorized access or activity. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person, nor are there any incidents under internal review or investigations relating to the same; such IT Systems or Personal Data and (iii) the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are designed to be adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses; (iii) to the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iiiiv) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes (including, for the avoidance of doubt, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act; the European Union General Data Protection Regulation (EU 2016/679); and the California Consumer Privacy Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the protection, collection, use, disclosure, transfer, storage, disposal, confidentiality, integrity, privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification modification; and (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingv) the execution, delivery, and is unaware performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach or violation of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security ObligationPrivacy Law.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data and information of their respective users, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards safeguards, including commercially reasonable disaster recovery and security plans, procedures and facilities for their respective businesses, including, without limitation, for their IT Systems and data held or used by or for the Company or any of its subsidiaries, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses access to samesuch IT Systems and data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the including Personal Data. The Company and its subsidiaries are presently presently, and since their inception have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, “Data Security Privacy Obligations”). To ensure compliance with the Privacy Obligations, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). To the Company’s knowledge, it has at all times made all disclosures to users, employees or other applicable persons required by Privacy Obligations, and no such disclosures made or contained in any external written Policies have been materially inaccurate or in violation of any Privacy Obligations. The Company has and its subsidiaries (i) have not received any written notification notice of or written complaint regarding, and is unaware of any other facts that, individually regarding or in the aggregate, would reasonably indicate material indicating non-compliance with with, or any Data Security Obligationactual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Obligations, and there is no actionhas not been any event or condition that would reasonably be expected to result in any such notice; (ii) are not currently conducting or paying for, suit in whole or proceeding by in part, any investigation, remediation, or before other corrective action pursuant to any court Privacy Obligations; and (iii) are not party to any governmental order, decree, or governmental agency, authority agreement that imposes any obligation or body pending or, liability under any Privacy Obligations. The Company and its subsidiaries have taken all necessary actions to the knowledge prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the Companydate hereof as becoming effective within 12 months after the date hereof, threatened alleging non-compliance and for which any noncompliance with any Data Security Obligationsame would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, safeguards and safeguards backup and disaster recovery technology processes to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and the collection, use, storage, disclosure, processing or data security of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge As of the Companydate hereof, no claims have been asserted or threatened against the Company or any of its subsidiaries alleging non-compliance with any Data Security Obligationa violation of laws, regulation or policies relating to Personal Data.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, documented internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation and the California Consumer Privacy Act (and all other applicable laws and regulations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. Neither the Company nor any Data Security Obligationof its subsidiaries, (i) has received written notice of any actual or potential liability of the Company or its subsidiaries from any governmental or regulatory agencies or bodies (or, except as would not be material to the Company and there its subsidiaries, taken as a whole, any other person) under or relating to, or actual or potential violation by the Company or any of its subsidiaries of, any of such laws and regulations; (ii) is no actioncurrently conducting or paying for, suit in whole or proceeding in part, any investigation, remediation or other corrective action by or before mandated by any court governmental or governmental agency, authority regulatory agency or body pending orpursuant to any of such laws and regulations; or (iii) is a party to any order, to the knowledge of the Companydecree, threatened alleging non-compliance or agreement with any Data Security Obligationgovernmental or regulatory agency or body that imposed any obligation or liability under any of such laws and regulations.

Cybersecurity; Data Protection. Except as would not(A) There has been no security breach or incident, individually unauthorized access or in the aggregatedisclosure, reasonably be expected or other compromise of or relating to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including the data and information of their respective customers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries, Sensitive Data (defined below) and any such data processed or stored by third parties on behalf of the Company and its subsidiaries) collectively, “IT SystemsSystems and Data”); (B) The IT Systems and Data are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its the subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; and (iiC) the Company and its subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and administrative, technical, and physical safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data Data (including all personal, personally identifiablePersonal Data, sensitive, confidential or regulated data (“Personal Sensitive Data”)) used in connection reasonably consistent with their businesses, industry standards and there have been no breaches, violations, outages practices or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the as required by applicable regulatory standards. The Company and its subsidiaries have been and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material respects in conformance with their functional specifications and have not materially malfunctioned or failed during the past three (3) years. To the Company’s knowledge, the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (ii) , in each case that could have a material impact on the business or operations of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently and at all times have been in full compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security ObligationsProtection Requirements”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts thatexcept as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably indicate material non-compliance with be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Security ObligationProtection Requirement; or (iii) is a party to any order, and there is no actiondecree, suit or proceeding agreement that imposes any obligation or liability by any governmental or before any court or governmental agency, regulatory authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. Except as would not, individually may be described or incorporated by reference in the aggregateRegistration Statement, reasonably be expected to the Pricing Disclosure Package and the Prospectus or as would not have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its their respective subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company . The Company, Carnival plc and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and the Prospectus or those that have been or will be remedied without material cost or liability or the duty to notify any other person. The Company, nor any incidents under internal review or investigations relating to the same; Carnival plc and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, Disclosure Package and the Prospectus, or except as would not, individually or in the aggregate, reasonably be expected to have result in a Material Adverse Effect, (i) the Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations and any other legal obligations, in each case, relating to the privacy and security of IT Systems and Personal Data Data, and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data in accordance with industry practices and as required by applicable regulatory standards. Except as disclosed in the Registration Statement, Disclosure Package and the Prospectus, the Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has not received any written notification of or written complaint regarding, and is unaware has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body body, pending or, to the knowledge of the Company’s knowledge, threatened alleging non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; a Material Adverse Effect. The Company and (iii) the its subsidiaries have implemented business continuity / disaster recovery plans and technology consistent with industry standards and practice. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification including the Data Privacy and Security Laws (“Data Security ObligationsProtection Requirements”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts thatexcept as would not, individually or in the aggregate, would reasonably indicate material non-be expected to have a Material Adverse Effect. To ensure compliance with any the Data Security ObligationProtection Requirements, the Company and its subsidiaries have in place, comply with, and there is no actiontake appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, suit storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The Company and its subsidiaries have at all times made all material disclosures to patients or proceeding other individuals required by applicable Data Protection Requirements, and none of such disclosures made or before contained in any court or governmental agency, authority or body pending orPolicy have, to the knowledge of the Company, threatened alleging non-compliance with been inaccurate or in violation of any applicable Data Protection Requirements in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach or violation of any Data Security ObligationProtection Requirements or Policies, except where such breach or violation would not, individually or in the aggregate, have a Material Adverse Effect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental authority under any Data Protection Requirement.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company The Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are reasonably believed by the Company to be adequate in all material respects for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries subsidiaries, as applicable, as currently conductedconducted and, to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal IT Data”)) used in connection with their businessesthe business of the Company and its subsidiaries, and as applicable, as currently conducted, and, to the knowledge of the Company, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal IT Data and to the protection of such IT Systems and Personal IT Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept for such failures as could not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data (collectively, the “Personal Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; same and (iii) except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company has not received any written notification of or written complaint regardingand its subsidiaries, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and its subsidiaries (and all other applicable laws and regulations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. In addition, any Data Security Obligation, certificate signed by any executive officer of the Company and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, delivered to the knowledge Underwriters or counsel for the Underwriters in connection with the offering of the Securities shall be deemed to be a representation and warranty by the Company, threatened alleging non-compliance with any Data Security Obligationas to matters covered thereby, to each of the Underwriters.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are reasonably believed by the Company to be adequate in all material respects for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businessesthe business of the Company and its subsidiaries as currently conducted. To the knowledge of the Company, and there have been no material breaches, violations, outages or unauthorized uses of or accesses to samePersonal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) , except as otherwise disclosed in the Registration Statement, Time of Sale Information or the Prospectus. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept for such failures as would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would notThe Company, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Guarantors and its their respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate forfor the business of the Company, the Guarantors and their respective subsidiaries as currently conducted, and (ii) to the knowledge of the Company and the Guarantors, operate and perform in all material respects as required in connection with the operation of the business of the Company Company, the Guarantors and its their respective subsidiaries as currently conducted, conducted free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) . The Company, the Company Guarantors and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or or, the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; . The Company, the Guarantors and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Any certificate signed by an officer of the Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, delivered to the knowledge of Representative or to counsel for the Company, threatened alleging non-compliance with any Data Security ObligationInitial Purchasers shall be deemed to be a representation and warranty by the Company to each Initial Purchaser as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Each Sunnova Entity and its respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Sunnova Entity and its respective subsidiaries as currently conducted. To the knowledge of the Sunnova Entities, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company corruptants designed to permit unauthorized access or activity. Each Sunnova Entity and its respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of each Sunnova Entity, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company such IT Systems or Personal Data. Each Sunnova Entity and its respective subsidiaries are presently in material compliance with all applicable laws or statutes applicable to the Sunnova Entity and its respective subsidiaries and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Sunnova Entity and its respective subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or used by the Company or its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used collected, used, stored or processed in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or entity, nor any incidents under internal review or investigations relating to the same; and (iii) . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries have complied with and are presently in compliance with all applicable laws or statutes (including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation (the “GDPR”) and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, and contractual obligations relating to the privacy and security of IT Systems and the collection, use, transfer, import, export, storage, disposal and disclosure of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Neither the Company has not nor any of its subsidiaries have received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material regarding non-compliance with any Data Security Obligation, and there is no pending or, to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have made all disclosures as required by applicable laws and regulatory rules or requirements in connection with such Data Security Obligations, and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the GDPR and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data and information of their respective users, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards safeguards, including commercially reasonable disaster recovery and security plans, procedures and facilities for their respective businesses, including, without limitation, for their IT Systems and data held or used by or for the Company or any of its subsidiaries, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses access to samesuch IT Systems and data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the including Personal Data. The Company and its subsidiaries are presently presently, and since their inception have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, “Data Security Privacy Obligations”). To ensure compliance with the Privacy Obligations, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). To the Company’s knowledge, it has at all times made all disclosures to users, employees or other applicable persons required by Privacy Obligations, and no such disclosures made or contained in any external written Policies have been materially inaccurate or in violation of any Privacy Obligations. The Company has and its subsidiaries (i) have not received any written notification notice of or written complaint regarding, and is unaware of any other facts that, individually regarding or in the aggregate, would reasonably indicate material indicating non-compliance with with, or any Data Security Obligationactual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Obligations, and there is no actionhas not been any event or condition that would reasonably be expected to result in any such notice; (ii) are not currently conducting or paying for, suit in whole or proceeding by in part, any investigation, remediation, or before other corrective action pursuant to any court Privacy Obligations; and (iii) are not party to any governmental order, decree, or governmental agency, authority agreement that imposes any obligation or body pending or, liability under any Privacy Obligations. The Company and its subsidiaries have taken all commercially reasonable actions to the knowledge prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the Companydate hereof as becoming effective within 12 months after the date hereof, threatened alleging non-compliance and for which any noncompliance with any Data Security Obligationsame would create a material liability, as soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ The information technology assets and equipment, computers, systems, networks, servers, hardware, software, websites, applications, and databases used in the Company’s and its subsidiaries’ business (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the such business of the Company and its subsidiaries as currently conducted, and such IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operationoperation (including commercially reasonable disaster recovery), redundancy and security of all IT Systems and data (including all personalany personally identifiable information and regulated data) maintained, personally identifiableprocessed or stored by the Company or its subsidiaries, sensitiveand any such data processed or stored by third parties on behalf of the Company or its subsidiaries (collectively, confidential or regulated data (“Personal Company Data”)) used in connection with their businesses, and there have been no breaches, incidents, violations, outages or unauthorized uses of use, access or accesses disclosure or other compromise to samethe IT Systems or the Company Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the liability. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal or publicly posted policies of the Company and its subsidiaries, and contractual obligations obligations, in each case, relating to the privacy and privacy, protection or security of IT Systems and Personal or Company Data and (“Privacy Legal Obligations”) or to the protection collection, processing, sharing, transfer, usage, disposal or storage of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)Company Data. The Neither the Company nor any of its subsidiaries has not received any written notification notice, request or other communication from any governmental or regulatory authority or claim from any person, or has been subject to any enforcement action, in each case, relating to a breach or alleged breach of or written complaint regardingPrivacy Legal Obligations, and is unaware of any other facts thatexcept as would not, individually individual or in the aggregate, would aggregate reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon they take effect, except as has not and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, would not reasonably be expected to result in liability material to the knowledge of the CompanyCompany and its subsidiaries, threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or ​ otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the , in each case that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data data) (“Personal Company Data”)) used in connection with their businesses, and there its business. There have been no material breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any such actual or reasonably suspected incidents under internal review or investigations relating to the same; and (iii) . The Company has no knowledge of any event, circumstances, or condition that would reasonably be expected to result in such breach, violation, outage, compromise, or unlawful or unauthorized acquisition of, disclosure of, use of or access to the Company Data. The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, internal policies and (iii) contractual obligations obligations, each (i) -(iii) relating to the privacy and security of IT Systems and Personal Company Data and to the protection of such IT Systems and Personal Company Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company The Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; . To the Company’s knowledge, no claims have been asserted or threatened against the Company or its subsidiaries alleging a violation relating to Personal Data or data rights and (iii) the consummation of the transactions contemplated hereby will not breach or otherwise cause any violation of any law related to privacy, data protection, or the collection and use of Personal Data collected, used, or held for use by the Company or its subsidiaries in the conduct of their businesses, except where any such breach or violation would not reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the collection and use of Personal Data, privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries own the IT Systems free from encumbrances and other third party rights, or in the case of any IT Systems not owned by the Company or its subsidiaries, have a valid license to use the IT Systems; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and (iv) there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or supervisory authority, nor any incidents under internal review or investigations relating to the same; and (iiiv) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification modification, including Data Protection Laws (as defined below). Neither the Company nor its subsidiaries have received written notification from a supervisory authority asserting a violation by the Company or its subsidiaries of the European Union General Data Protection Regulation (and all other applicable laws and regulations governing the privacy and security of Personal Data) (“Data Security ObligationsProtection Laws”). The Company has not , or have received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-relation with their compliance with any the Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security ObligationProtection Laws.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations in the European Union with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability) as soon as they take effect.

Cybersecurity; Data Protection. Except as would notThe Company, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company CTWS and its their respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, CTWS and its their respective subsidiaries as currently conducted, and, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company . The Company, CTWS and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; . The Company, CTWS and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“modification. To the Company’s knowledge, the Company, CTWS and their respective subsidiaries have taken all necessary actions, to the extent required to have been taken as of the date hereof, to prepare to comply with all other applicable laws and regulations with respect to Personal Data Security Obligations”). The Company has not received any written notification that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ The Company’s information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the SEC Filings free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data and all data that comes within a definition of “personal information,” “personal data” or other similar term under Data Protection Requirements) (collectively, “Personal Company Data”)) used in connection with their businessesbusiness, and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have been remedied without a material cost impact on the Company and its Subsidiary, considered as a whole. There are no privacy or liability or the duty to notify any other person, nor any security incidents under internal review or investigations relating to the same; and (iii) same that would, individually or in the aggregate, reasonably be expected to have a material impact on the Company and its subsidiaries are Subsidiary, considered as a whole. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company is presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Personal Company Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security ObligationsProtection Requirements”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data (“Personal Data”)) used maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as would not reasonably be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same; and (iii) knowledge of the Company, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Any certificate signed by an officer of the Company has not received any written notification of and delivered to the Agents, or written complaint regardingto counsel for the Agents, and is unaware of any other facts that, individually pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, Company to the knowledge of Agents as to the Company, threatened alleging non-compliance with any Data Security Obligationmatters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually may be described or incorporated by reference in the aggregateRegistration Statement, reasonably be expected to the Pricing Disclosure Package and the Prospectus or as would not have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its their respective subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company . The Company, Carnival plc and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for as may be described in or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and the Prospectus or those that have been or will be remedied without material cost or liability or the duty to notify any other person. The Company, nor any incidents under internal review or investigations relating to the same; Carnival plc and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectEffect and except as described in each of the Registration Statement, (i) the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, software, hardware, softwarecomputers, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (data, including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and (ii) there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents currently under internal review or investigations relating to the same; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and (iii) except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to collected, stored, processed, transferred, disclosed or used by the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation Company or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationits subsidiaries.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with, the operation of the respective businesses of the Company and its subsidiaries as currently conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained controls, policies, procedures and safeguards consistent with industry standards and practices for similarly-situated companies to maintain and protect their confidential information and the integrity, continuous operation, redundancy and security of its IT Systems and data (including personal, personally identifiable, sensitive, confidential or regulated data) used or held for use in connection with their respective businesses (collectively, “Data”). There have been no breaches, violations, outages, unauthorized uses or accesses to the IT Systems or Data, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applicationssubsidiaries have complied, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance compliance, with all applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and all privacy policies, internal policies and contractual obligations and industry standards relating to the privacy and security of the IT Systems and Personal Data and to or the protection of such IT Systems and Personal Data from unauthorized collection, use, accesstransfer, misappropriation or modification import, export, storage, protection, disposal and disclosure of Data (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, ) and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and (ii) there is no action, suit suit, investigation or proceeding by or before any court or court, governmental agency, authority or body or other third party pending or, to the knowledge of the Company, threatened against the Company or any of its subsidiaries alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would notTo the Company’s Knowledge, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its Subsidiaries (collectively, “IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, and to the Company’s Knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of them (“Personal Data”)) used in connection with their businesses; to the Company’s Knowledge, and there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its Subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the same; Company’s or any of its Subsidiaries’ Personal Data or IT Systems and (iii) the Company and its subsidiaries Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its Subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the , in each case that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data data) (“Personal Company Data”)) used in connection with their businesses, and there its business. There have been no material breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any such actual or reasonably suspected incidents under internal review or investigations relating to the same; and (iii) . The Company has no knowledge of any event, circumstances, or condition that would reasonably be expected to result in such breach, violation, outage, compromise, or unlawful or unauthorized acquisition of, disclosure of, use of or access to the Company Data. The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, internal policies and (iii) contractual obligations obligations, each (i) -(iii) relating to the privacy and security of IT Systems and Personal Company Data and to the protection of such IT Systems and Personal Company Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Disclosure Package, and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants; (ii) the . The Company and its subsidiaries have established, implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and material data (including all personal, personally identifiable, household, sensitive, confidential or regulated data or information (“Personal Company Data”)) used in connection with their businesses, in compliance with all applicable laws and regulatory standards in all material respects. To the knowledge of the Company, there have been no material breaches, violations, outages outages, security incidents or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company Data. The Company and its subsidiaries own or have a valid right to access and use all IT Systems and Company Data, and have complied in all material respects and are presently in material compliance with all applicable laws or statutes and all statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority, binding industry standards, internal and external policies and notices, contractual obligations and any other legal obligations, in each case relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal, disclosure or modification other processing by or on behalf of the Company or any of its subsidiaries of Company Data (“Data Security Obligations”). The Neither the Company has not nor any of its subsidiaries have received any written notification of or written complaint regarding, and is unaware or otherwise have knowledge of any other facts thatthat would indicate, individually or in the aggregate, would reasonably indicate any material non-compliance by the Company or any of its subsidiaries with any Data Security Obligation, and there . There is no action, suit suit, investigation or proceeding against the Company or any of its subsidiaries by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened threatened, against the Company or any of its subsidiaries alleging material non-compliance with any Data Security ObligationObligations by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all applicable internal policies and contractual obligations and any other legal obligations, in each case, relating to the privacy and security of IT Systems and Personal Data Data, and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures designed to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data as required by applicable regulatory standards. The Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has not received any written notification of or written complaint regarding, and is unaware has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body body, pending or, to the knowledge of the Company’s knowledge, threatened alleging non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) , except in each case, as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and in the last three years there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or or, to the knowledge of the Company and its subsidiaries, investigations relating related to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept in each case, as would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationresult in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would notThe Company, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Guarantors and its their respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate forfor the business of the Company, the Guarantors and their respective subsidiaries as currently conducted, and (ii) to the knowledge of the Company and the Guarantors, operate and perform in all material respects as required in connection with the operation of the business of the Company Company, the Guarantors and its their respective subsidiaries as currently conducted, conducted free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) . The Company, the Company Guarantors and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or or, other than with respect to Aerogrow International, Inc., the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; . The Company, the Guarantors and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Any certificate signed by an officer of the Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, delivered to the knowledge of Representative or to counsel for the Company, threatened alleging non-compliance with any Data Security ObligationInitial Purchasers shall be deemed to be a representation and warranty by the Company to each Initial Purchaser as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted. To the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the corruptants designed to permit unauthorized access or activity. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under [***] = Certain information has been excluded from this exhibit because it is both not material and would likely cause competitive harm to the company if publicly disclosed. internal review or investigations relating to the same; and (iii) the such IT Systems or Personal Data. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes applicable to the Company or its Subsidiaries and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ The Company’s information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus. The IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the , in each case that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data data) (“Personal Company Data”)) used in connection with their businesses, and there its business. There have been no material breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any such actual or reasonably suspected incidents under internal review or investigations relating to the same; and (iii) . The Company has no knowledge of any event, circumstances, or condition that would reasonably be expected to result in such breach, violation, outage, compromise, or unlawful or unauthorized acquisition of, disclosure of, use of or access to the Company Data. The Company is, and since its subsidiaries are presently inception has been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, internal policies and (iii) contractual obligations obligations, each (i) -(iii) relating to the privacy and security of IT Systems and Personal Company Data and to the protection of such IT Systems and Personal Company Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Material Adverse Effect, (iA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (iiB) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and ; (C) there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iiiD) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification modification; and (“E) the Company and its subsidiaries have taken all necessary actions to prepare to comply with all applicable laws and regulations with respect to Personal Data Security Obligations”). The Company has not received any written notification that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability as soon as they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform as in all material respects required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Disclosure Package, and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants; (ii) the . The Company and its subsidiaries have established, implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and material data (including all personal, personally identifiable, household, sensitive, confidential or regulated data or information (“Personal Company Data”)) used in connection with their businesses, in compliance with all applicable laws and regulatory standards in all material respects. To the knowledge of the Company, there have been no material breaches, violations, outages outages, security incidents or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company Data. The Company and its subsidiaries own or have a valid right to access and use all IT Systems and Company Data, and have complied in all material respects and are presently in material compliance with all applicable laws or statutes and all statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority, binding industry standards, internal and external policies and notices, contractual obligations and any other legal obligations, in each case relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal, disclosure or modification other processing by or on behalf of the Company or any of its subsidiaries of Company Data (“Data Security Obligations”). The Neither the Company has not nor any of its subsidiaries have received any written notification of or written complaint regarding, and is unaware or otherwise have knowledge of any other facts thatthat would indicate, individually or in the aggregate, would reasonably indicate any material non-compliance by the Company or any of its subsidiaries with any Data Security Obligation, and there . There is no action, suit suit, investigation or proceeding against the Company or any of its subsidiaries by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened threatened, against the Company or any of its subsidiaries alleging material non-compliance with any Data Security ObligationObligations by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material bugsthe Prospectus, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, malware, disabling code or other harmful code. The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries subsidiaries, taken as a whole, are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The modification; and the Company has not received and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any written notification of or written complaint regarding, and is unaware of any other facts thatinconsistency would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation each of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries have implemented complied and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any other legal obligations, internal policies and contractual obligations in each case, relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal and disclosure by the Company or modification any of its subsidiaries of personal, personally identifiable, household, sensitive, confidential or regulated data (“Data Security Obligations”, and such data, “Data”). The ; (ii) the Company has not received any written notification of or written complaint regarding, regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, ; and (iii) there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, or threatened alleging non-compliance with any Data Security Obligation. The Company and each of its subsidiaries have taken all technical and organizational measures necessary to protect the information technology systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses. Without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). There has been no such Breach, and the Company and its subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. Except as would not, and individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost the Company and its subsidiaries’ IT Systems or liability or the duty to notify any other persondata (including Personal Data), nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with (i) all applicable worldwide laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and (ii) their internal policies and contractual obligations obligations, in each case of (i) and (ii), relating to the privacy and security of IT Systems and Personal Data Data, including the creation, collection, receipt, acquisition, storage, maintenance, use, disclosure, transfer, transmission, disposition, retention, and processing of Personal Data, and to the security and protection of such IT Systems and Personal Data from unauthorized use, access, disclosure, acquisition, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts thatExcept as would not, individually or in the aggregate, would reasonably indicate material non-compliance be expected to have a Material Adverse Effect, the Company and its subsidiaries have taken all necessary actions to prepare to comply with any all applicable laws and regulations with respect to Personal Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge that have been announced as of the Company, threatened alleging non-compliance with any Data Security Obligationdate hereof as becoming effective within 12 months after the date hereof.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material respects in conformance with their functional specifications and have not materially malfunctioned or failed during the past three (3) years. To the Company’s knowledge, the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (ii) , in each case that could have a material impact on the business or operations of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the same . The Company and its subsidiaries are presently and at all times have been in full compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security ObligationsProtection Requirements”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts thatexcept as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably indicate material non-compliance with be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Security ObligationProtection Requirement; or (iii) is a party to any order, and there is no actiondecree, suit or proceeding agreement that imposes any obligation or liability by any governmental or before any court or governmental agency, regulatory authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data (“Personal Data”)) used maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as would not reasonably be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same; and (iii) knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Any certificate signed by an officer of the Company has not received any written notification of and delivered to Virtu, or written complaint regardingto counsel for Virtu, and is unaware of any other facts that, individually pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, Company to Virtu as to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmatters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiariesThe Delek Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with necessary for the operation of the business of the Company and its subsidiaries Delek Parties as currently conducted, free except as would not, individually or in the aggregate, have a Material Adverse Change. The Delek Parties conduct industry-standard scans of their IT Systems to detect and clear of all address material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries . The Delek Parties have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and sensitive data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Sensitive Data”)) used in connection with their businesses, and to the knowledge of the Delek Parties, there have been no breaches, violations, incidents, compromises, outages or unauthorized uses of or of, accesses to or disclosures of same, except for those that as would not, individually or in the aggregate, have been remedied without material cost or liability or a Material Adverse Change, and the Delek Parties have not had a duty to notify any other personperson of, nor are there any incidents under internal review or investigations investigation relating to, the same or any event or condition that would reasonably be expected to result in the same; and (iii) the Company and its subsidiaries . The Delek Parties are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating applicable to the privacy and security of its IT Systems and Personal Sensitive Data and to the protection of such IT Systems and Personal Sensitive Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or may be described in the aggregateRegistration Statement, reasonably be expected to the Pricing Disclosure Package and the Prospectus or as would not have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its their respective subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company . The Company, Carnival plc and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for those that have been remedied without material cost or liability or the duty to notify any other person. The Company, nor any incidents under internal review or investigations relating to the same; Carnival plc and (iii) the Company and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively “Data Security Privacy Obligations”), and no disclosures in any publicly posted privacy policy of the Company or any of its subsidiaries has been materially inaccurate, misleading or deceptive (including by containing any material omission). Neither the Company nor any of its subsidiaries has received any complaint alleging that it has improperly collected, received, created, processed, stored, maintained, used, disclosed, transmitted, secured, transferred, disposed of or destroyed or has received any notice or other communication from any governmental or regulatory authority or self-regulatory body regarding any actual or possible violation of, investigation (formal or informal) or failure to comply with any applicable Privacy Obligation. The Company has not received any written notification and its subsidiaries have taken all actions it reasonably believes necessary to prepare to comply with all other applicable Privacy Obligations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability) as soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and Personal Data (defined below) and the integrity, continuous operation, redundancy integrity and security of all material IT Systems and data (including Systems. As used herein, “Personal Data” shall refer to all personal, personally identifiable, sensitive, confidential personal or regulated data (“Personal Data”)) that relates to an identified or identifiable natural person according to applicable law that is maintained by the Company or any of its subsidiaries and used in connection with their the Company or its subsidiaries’ respective businesses. To the knowledge of the Company, and there have been no material breaches, violations, outages or unauthorized uses of or accesses access to samePersonal Data, except for those that have been remedied without material cost or liability or the duty to notify any other personliability, nor any related incidents under internal review investigation by a governmental or investigations relating to regulatory authority. To the same; and (iii) knowledge of the Company, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authoritylaws, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligationmodification, and there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any applicable laws, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data Security Obligationand to the protection of IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, and, except as would not, individually or in the aggregate, have a Material Adverse Effect, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and ; (iii) there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or those that would not otherwise, individually or in the duty to notify any other personaggregate, have a Material Adverse Effect, nor any incidents under internal review or investigations relating to the same; and (iiiiv) except for such non-compliance which would not, individually or in the aggregate, have a Material Adverse Effect, the Company and its subsidiaries Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no known breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost as would not, individually or liability or in the duty to notify any other personaggregate, result in a Material Adverse Change, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. Any certificate signed by any officer of the Company or any of its subsidiaries and delivered to the Underwriters or to counsel for the Underwriters in connection with the offering of the Offered Shares shall be deemed a representation and warranty by the Company or such subsidiary, as the case may be, to each Underwriter as to the matters covered thereby. The Company has not received any written notification acknowledges that the Underwriters and, for purposes of or written complaint regardingthe opinions to be delivered pursuant to Section 6 hereof, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, counsel to the knowledge Company and counsel to the Underwriters, will rely upon the accuracy and truthfulness of the Company, threatened alleging non-compliance with any Data Security Obligationforegoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Except as would not, individually or in (A) To the aggregate, reasonably be expected to have a Material Adverse Effect, (i) knowledge of the Company and its the Partnership, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company’s, the Partnership’s or their subsidiaries’ information technology assets and equipment, computers, computer systems, networks, hardware, software, websitesdata and databases (including the data and information of their respective customers, applicationsemployees, suppliers, vendors and any third party data maintained, processed or stored by the Company, the Partnership and their subsidiaries, and databases any such data processed or stored by third parties on behalf of the Company, the Partnership and their subsidiaries), equipment or technology (collectively, “IT SystemsSystems and Data”): (B) are adequate fornone of the Company, the Partnership nor their subsidiaries have been notified of, and operate have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT Systems and perform as required in connection with the operation of the business of the Company Data and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (iiC) the Company Company, the Partnership and its their subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and data (including all personalData reasonably consistent with industry standards and practices, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to sameas required by applicable regulatory standards, except for those that have been remedied without material cost or liability or as would not, in the duty case of each of (A) through (C), reasonably be expected to notify any other person, nor any incidents under internal review or investigations relating result in a Material Adverse Change with respect to the same; Company, the Partnership and (iii) their subsidiaries, considered as one entity. The Company, the Company Partnership and its their subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would nothas not had or could not reasonably be expected to have, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the corruptants designed to permit unauthorized access or activity. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person, nor are there any incidents under internal review or investigations relating to the same; such IT Systems or Personal Data and (iii) the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) . Except in connection with any breaches, violations, outages or unauthorized uses of or accesses to same described in the Registration Statement, the Pricing Disclosure Package or the Prospectus, the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect in all material respects their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data confidential information (including all personal, personal or personally identifiable, sensitive, confidential or regulated identifiable data (“Personal Data”)) used in connection with their businesses, and to the Company’s knowledge, except as described in the Registration Statement, the Pricing Disclosure Package or the Prospectus, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as described in the Registration Statement, nor any incidents under internal review the Pricing Disclosure Package or investigations relating to the same; and (iii) Prospectus, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes (including, but not limited to, the Israeli Privacy Protection Regulations, Information Security, 2017) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations obligations, each as relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently are, and have been in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (collectively, the “Data Security ObligationsPrivacy Laws”). The To the extent required by the Privacy Laws, the Company has not received any written notification of or written complaint regardingand its subsidiaries have in place, comply with, and is unaware take appropriate steps reasonably designed to ensure compliance in all material respects with Company policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, and handling, of any other facts thatPersonal Data (the “Policies”). In each case, individually except as would not reasonably be expected, singly or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligationto have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries have made all disclosures to individuals required by applicable Privacy Laws, and there is no action, suit none of such disclosures made or proceeding by or before contained in any court or governmental agency, authority or body pending orPolicy have, to the knowledge of the Company, threatened alleging non-compliance with been inaccurate or in violation of any Data Security Obligationapplicable Privacy Laws. Neither the Company nor any subsidiary: (i) has received written notice of any actual or alleged liability under or relating to, or actual or alleged violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such written notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action required pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Law.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are commercially reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all material IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and to the Company’s knowledge there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept as would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, aggregate have a Material Adverse Effect. Any certificate signed by an officer of the Company and there is no action, suit delivered to Xxxxx or proceeding to counsel for Xxxxx shall be deemed to be a representation and warranty by or before any court or governmental agency, authority or body pending or, the Company to Xxxxx as to the knowledge matters set forth therein. The Company acknowledges that Xxxxx and, for purposes of the Companyopinions to be delivered pursuant to Section 7 hereof, threatened alleging non-compliance with any Data Security Obligationcounsel to the Company and counsel to Xxxxx, will rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions, to the extent required to have been taken as of or written complaint regardingthe date hereof, to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have result in a Material Adverse EffectChange, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and except as has been disclosed in the Registration Statement and the Prospectus, there have been no breaches, violations, outages or known unauthorized uses of or known accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries have complied, and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all industry guidelines, standards, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification, except where the failure to be in compliance would not reasonably be expected to result in a Material Adverse Change. The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance its subsidiaries have implemented backup and disaster recovery technology consistent with any Data Security Obligation, industry standards and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationpractice.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and its subsidiaries have taken all necessary actions to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationas soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the knowledge of the Company are free and clear of all material bugs, errors, errors ,defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. Without limiting the foregoing, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance have used reasonable efforts to establish, maintain, implement and comply with all applicable laws or statutes reasonable information technology, information security, cyber security and all judgmentsdata protection controls, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security of IT Systems plans that are designed to protect against and Personal Data and to the protection of such IT Systems and Personal Data from prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Data Security ObligationsBreach”)) and there has been no such Breach. The Company has and its subsidiaries have not received any written notification been notified of or written complaint regarding, and is unaware have no knowledge of any other facts that, individually event or in the aggregate, condition that would reasonably indicate material non-compliance with be expected to result in, any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationsuch Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiariesthe Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries the Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries the Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification. The Company has not received any written notification and the Controlled Entities have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and the Controlled Entities (and all other applicable laws and regulations with respect to Personal Data that have been announced as of or written complaint regardingthe date hereof as becoming effective within 12 months after the date hereof, and is unaware of for which any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, same would be reasonably likely to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationcreate a material liability) as soon as they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ The Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in all material respects for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and to the knowledge of the Company, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are is presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification, except as would not reasonably be expected to have a Material Adverse Effect. Any certificate signed by any officer of the Company and delivered to any Underwriter or to counsel for the Underwriters in connection with the offering, or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has not received any written notification a reasonable basis for making each of or written complaint regardingthe representations set forth in this Section 1. The Company acknowledges that the Underwriters and, and is unaware for purposes of any other facts thatthe opinions to be delivered pursuant to Section 6 hereof, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, counsel to the knowledge Company and counsel to the Underwriters, will rely upon the accuracy and truthfulness of the Company, threatened alleging non-compliance with any Data Security Obligationforegoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ The information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or used by the Company or its subsidiaries (collectively, “IT Systems”) are reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) corruptants that would cause a material disruption to the operation of the business of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect the secrecy of their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in the Company’s possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used collected, used, stored or processed in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, in each case, except for those that as have been remedied without material cost not had, and would not reasonably be expected to have, individually or liability or in the duty to notify any other personaggregate, a Material Adverse Effect, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has modification, in each case, except as have not received any written notification of or written complaint regardinghad, and is unaware of any other facts thatwould not reasonably be expected to have, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. Except as would notTo the Company’s knowledge, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have at all times during the past three years implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiablePersonal Data, sensitive, confidential or regulated data (“Personal Confidential Data”)) used in connection with their businesses, and and, to the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor . Any certificate signed by any incidents under internal review officer or investigations relating representative of the Company or any of its subsidiaries and delivered to the same; Agent or counsel for the Agent in connection with an issuance of Shares shall be deemed a representation and (iiiwarranty by the Company to the Agent as to the matters covered thereby on the date of such certificate. The Company acknowledges that the Agent and, for purposes of the opinions to be delivered pursuant to Section 4(o) hereof, counsel to the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating counsel to the privacy Agent, will rely upon the accuracy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge truthfulness of the Company, threatened alleging non-compliance with any Data Security Obligationforegoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ subsidiary’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries subsidiary as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants; (ii) the . The Company and its subsidiaries subsidiary have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and there have been no, and the Company and its subsidiary have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in any, breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personsame (“Breach”), nor are there any incidents under internal review or investigations relating to any Breach. Neither the same; Company nor its subsidiary has received any notice, claim, complaint, demand or letter from any person or governmental agency in respect of their businesses under applicable data protection laws, regulations and (iii) standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiary’s businesses. Neither the Company nor its subsidiary have been obligated to notify any third party, including, without limitation, any individual or data protection authority, of any Breach. The Company and its subsidiaries subsidiary have complied at all times and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security ObligationsObligation”), except where the failure to so comply would not result in a Material Adverse Effect. The Company has not and its subsidiary have taken all necessary actions to comply with any Data Security Obligation, including the European Union General Data Protection Regulation, the Health Insurance Portability and Accountability Act, and the California Consumer Privacy Act. Neither the Company nor its subsidiary have received any written notice, claim, complaint, demand, letter, notification of or written complaint regarding, and is unaware the Company has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with with, any Data Security Obligation, Obligation and there is no pending or threatened action, suit suit, investigation or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted. To the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the corruptants designed to permit unauthorized access or activity. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the such IT Systems or Personal Data. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes applicable to the Company or its Subsidiaries and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.

Cybersecurity; Data Protection. Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not, individually or in the aggregate, not reasonably be expected to have a Material Adverse Effect, (iA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, for and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (iiB) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential household or regulated data or information collected, stored or processed by the Company or its subsidiaries (“Personal Data”)) used in connection with their businesses; (C) to the best knowledge of the Company, and there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to samethe IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or governmental or regulatory authority, nor any and there are no incidents or, to Company’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same; and (iiiD) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, loss, access, processing, misappropriation or modification modification, including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and all other laws and regulations with respect to Personal Data applicable to the Company or its subsidiaries (“Data Security ObligationsPrivacy Laws”). The ; (E) the Company has and its subsidiaries have not received any written notification of or written complaint regarding, and is unaware notice of any other facts that, individually actual or in the aggregate, would reasonably indicate material non-compliance with potential violation of any Data Security Obligation, Privacy Laws and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to or threatened against the knowledge of the Company, threatened Company or its subsidiaries alleging non-compliance with Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken commercially reasonable steps to require that any Personal Data Security Obligationof the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material bugsthe Prospectus, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, malware, disabling code or other harmful code. The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and and, to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the . The Company and its subsidiaries subsidiaries, taken as a whole, are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The modification; and the Company has not received and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any written notification of or written complaint regarding, and is unaware of any other facts thatinconsistency would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationhave a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) , except in each case, as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and in the last three years there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or or, to the knowledge of the Company and its subsidiaries, investigations relating related to the same; and (iii) the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regardingmodification, and is unaware of any other facts thatexcept in each case, as would not, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, be expected to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationresult in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not, not individually or in the aggregate, reasonably be expected to aggregate have a Material Adverse EffectEffect on the Company and its subsidiaries, (i) taken as a whole, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) . Except as would not have, individually or in the aggregate, a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, household, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. Without limiting the foregoing, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes have used commercially reasonable efforts to establish and all judgmentsmaintain and have established, ordersmaintained, rules implemented and regulations of any court or arbitrator or governmental or regulatory authoritycomplied with, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has except as would not received any written notification of or written complaint regarding, and is unaware of any other facts thathave, individually or in the aggregate, a Material Adverse Effect, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would reasonably indicate material non-compliance with any Data Security Obligationnot individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending ortaken as a whole, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationthere has been no such Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data (collectively, the “Personal Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; same and (iii) except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”)modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. Any certificate signed by any officer of the Company and delivered to any Underwriter or to counsel for the Underwriters in connection with the offering, or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has not received any written notification a reasonable basis for making each of or written complaint regardingthe representations set forth in this Section 1. The Company acknowledges that the Underwriters and, and is unaware for purposes of any other facts thatthe opinions to be delivered pursuant to Section 6 hereof, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, counsels to the knowledge Company and counsel to the Underwriters, will rely upon the accuracy and truthfulness of the Company, threatened alleging non-compliance with any Data Security Obligationforegoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. Except as would notdisclosed in each of the Registration Statement, individually or in the aggregatePricing Disclosure Package and the Prospectus, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (ii) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses, and, except as disclosed in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; and (iii) . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”). The Company has not received any written notification of or written complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate material non-compliance with any Data Security Obligation, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligationmodification.