Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, software, hardware, softwarecomputers, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (data, including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three and (3ii) years there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityremedied, nor any incidents currently under internal review or investigations relating to the same; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and (c) Parent except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall applicable judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal DataData collected, and to stored, processed, transferred, disclosed or used by the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation Company or modificationits subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systemscomputer systems and assets, networks, hardware, software, websites, applications applications, databases (including all Personal Data, and databases owned sensitive, confidential or used regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by Parent or any on behalf of its Subsidiaries them), equipment or technology (collectively, “Parent IT SystemsSystems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, andthe General Disclosure Package and the Prospectus, (x) to the knowledge of Parent during Company’s knowledge, the past three (3) years there have been no breachesCompany has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without or other material cost compromise of or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to any of the same; Company’s or its subsidiaries’ IT Systems and Data, and (cy) Parent the Company and its Subsidiaries subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable technical and organizational controls, policies, procedures procedures, and safeguards designed to (i) maintain and protect their material Personal Data and sensitive, proprietary, confidential information or regulated data (collectively, the “Confidential Data”) from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access and (ii) maintain and protect the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed Confidential Data used in connection with their businesses. Except as would not, andindividually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages outages, security incidents, or violations of any Privacy Requirements in relation to Confidential Data, or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person person, government authority or entitysupervisory body, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have cause a Parent Material Adverse Effect: , (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent their IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; and (iii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries’ IT Systems. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of their IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. The Company and its subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business respective businesses of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed consistent with industry standards and practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent its IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential data (“Parent Personal Data”)regulated data) collected, used, stored used or processed held for use in connection with their businessesrespective businesses (collectively, and, to the knowledge of Parent during the past three (3) years there “Data”). There have been no breaches, violations, outages or outages, unauthorized uses of or accesses to samethe IT Systems or Data, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost a Material Adverse Effect. Except in each case as would not, individually or liability or in the duty aggregate, reasonably be expected to notify any other person or entityhave a Material Adverse Effect, nor any incidents under internal review or investigations relating to (i) the same; and (c) Parent Company and its Subsidiaries subsidiaries have complied, and are presently in compliance in all material respects compliance, with all applicable Laws laws, statutes, judgments, orders, rules and Ordersregulations of any court or arbitrator or other governmental or regulatory authority and all privacy policies, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, industry standards relating to the privacy and security of Parent the IT Systems or the collection, use, transfer, import, export, storage, protection, disposal and Parent Personal Datadisclosure of Data (“Data Security Obligations”) and (ii) there is no action, and suit, investigation or proceeding by or before any court, governmental agency, authority or body or other third party pending or, to the protection knowledge of such Parent IT Systems and Parent Personal the Company, threatened against the Company or any of its subsidiaries alleging non-compliance with any Data from unauthorized use, access, misappropriation or modificationSecurity Obligation,.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (ai) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (ciii) Parent the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except, with respect to each of clauses (i) and (iii), as would not, individually or in the aggregate, have a Material Adverse Effect. The Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability as soon they take effect.

Cybersecurity; Data Protection. Except (A) To the knowledge of the Company, the Operating Partnership and each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s, the Operating Partnership or their respective subsidiaries’ information technology and computer systems, networks, hardware, software, data and databases (including the data and information of their respective tenants, customers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and any such data processed or stored by third parties on behalf of the Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT Systems and Data”); (B) none of the Company, the Operating Partnership or their respective subsidiaries have been notified of, and have no knowledge of any event or condition that would result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT Systems and Data and (C) the Company, the Operating Partnership and their respective subsidiaries have implemented controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of their IT Systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, except with respect to clauses (A) and (B), for any such security breach or incident, unauthorized access or disclosure, or other compromises, that have been remedied without material cost or liability or as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , or with respect to clause (a) C), where the information technology assets failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Operating Partnership and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries respective subsidiaries are presently in material compliance in all material respects with all applicable Laws laws and Ordersstatutes and all judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business respective businesses of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed consistent with industry standards and practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent its IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential data (“Parent Personal Data”)regulated data) collected, used, stored used or processed held for use in connection with their businessesrespective businesses (collectively, and, to the knowledge of Parent during the past three (3) years there “Data”). There have been no breaches, violations, outages or outages, unauthorized uses of or accesses to samethe IT Systems or Data, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost a Material Adverse Effect. Except in each case as would not, individually or liability or in the duty aggregate, reasonably be expected to notify any other person or entityhave a Material Adverse Effect, nor any incidents under internal review or investigations relating to (i) the same; and (c) Parent Company and its Subsidiaries subsidiaries have complied, and are presently in compliance in all material respects compliance, with all applicable Laws laws, statutes, judgments, orders, rules and Ordersregulations of any court or arbitrator or other governmental or regulatory authority and all privacy policies, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, industry standards relating to the privacy and security of Parent the IT Systems or the collection, use, transfer, import, export, storage, protection, disposal and Parent Personal Datadisclosure of Data (“Data Security Obligations”) and (ii) there is no action, and suit, investigation or proceeding by or before any court, governmental agency, authority or body or other third party pending or, to the protection knowledge of such Parent IT Systems and Parent Personal the Company, threatened against the Company or any of its subsidiaries alleging non-compliance with any Data from unauthorized use, access, misappropriation or modificationSecurity Obligation.

Cybersecurity; Data Protection. Except as would notnot be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, data and databases owned (including the data and information of their respective clients, employees, suppliers, vendors and any third party data maintained, processed or used stored by Parent the Company and its subsidiaries, and any such data processed or any stored by third parties on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and all personal data (including all personaland sensitive, personally identifiable, sensitive confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, andthe “Confidential Data”), and (ii) to the knowledge of Parent during the past three (3) years Company, there have been no, and no event or condition exists that would result in, breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person person. Except as could not be expected, individually or entityin the aggregate, nor any incidents under internal review or investigations relating to have a Material Adverse Effect, to the same; and (c) Parent knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and all judgments, Orders, as well as applicable rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of Parent the Company and its Subsidiariessubsidiaries, relating to governing the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material respects in conformance with their functional specifications and have not materially malfunctioned or failed during the past three (3) years. To the Company’s knowledge, the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (b) Parent , in each case that could have a material impact on the business or operations of the Company and its Subsidiaries subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries are presently and at all times have been in full compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent the Company or any of its Subsidiaries subsidiaries (collectively, “Parent IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have complied with and are presently in compliance in all material respects with all applicable Laws laws or statutes (including without limitation, to the extent applicable, the Health Insurance Portability and OrdersAccountability Act of 1996, as well as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation (the “GDPR”) and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent the collection, use, transfer, import, export, storage, disposal and disclosure of Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligations”). Neither the Company nor any of its subsidiaries have received any notification of or complaint regarding non-compliance with any Data Security Obligation, and there is no pending or, to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have made all disclosures as required by applicable laws and regulatory rules or requirements in connection with such Data Security Obligations, and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the GDPR and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures procedures, and safeguards designed consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential data regulated data) (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their businessesbusiness, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost a Material Adverse Effect. There are no privacy or liability or the duty to notify any other person or entity, nor any security incidents under internal review or investigations relating to the samesame that would, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws, statutes, judgments, orders, rules and regulations of any court, arbitrator, governmental or regulatory authority; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent obligations, each (i) and its Subsidiaries, (ii) relating to the privacy and security of Parent IT Systems and Parent Personal Company Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except (i) as described in Registration Statement, the Pricing Disclosure Package and the Prospectus or (ii) as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (aA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bB) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential, or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; (C) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entitygovernmental or regulatory authority, nor any and there are no incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same; and (cD) Parent the Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; (E) the Company and its subsidiaries have at all times taken all reasonable steps to safeguard that any Personal Data of the Company and its subsidiaries collected or handled by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (F) the Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon as they took effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalpersonal data and sensitive, personally identifiable, sensitive confidential or confidential regulated data (collectively, the “Parent Personal Confidential Data”)) collected, used, stored or processed used in connection with their businesses. Except as would not, andindividually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, same nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries Subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (collectively, “Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, the Company and its Subsidiaries have used commercially reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its Subsidiaries’ businesses (“Breach”) and, to the knowledge Knowledge of Parent during the past three (3) years Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent such Breach. The Company and its Subsidiaries are presently have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach. This representation is limited in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating each case to the privacy and security of Parent IT Systems and Parent Personal Dataextent that such breach or non-compliance would not reasonably be expected to have a Material Adverse Effect, and to except as otherwise disclosed in the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation Registration Statement or modificationthe Prospectus.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any the Company and to the Knowledge of the Company, its Subsidiaries as currently conducted, subsidiaries are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (collectively, “Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries are presently in compliance in all material respects subsidiaries have used reasonable efforts to establish, maintain, implement and comply with all applicable Laws reasonable information technology, information security, cyber security and Ordersdata protection controls, as well as applicable internal policies and contractual obligations of Parent procedures, including oversight, access controls, encryption, technological and its Subsidiaries, relating to the privacy physical safeguards and business continuity/disaster recovery and security of Parent IT Systems plans that are designed to protect against and Parent Personal Dataprevent breach, and to the protection of such Parent IT Systems and Parent Personal Data from destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”) and, there has been no such Breach. The Company and its subsidiaries have not been notified of and have no Knowledge of any event or condition that would reasonably be expected to result in, any such Breach. This representation is limited in each case to the extent that such breach or noncompliance would not reasonably be expected to have a Material Adverse Effect, and except as otherwise disclosed in the Registration Statement or the Prospectus.

Cybersecurity; Data Protection. Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (aA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, for and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bB) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, household, confidential or confidential regulated data or information collected, stored or processed by the Company or its subsidiaries (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to businesses and have contractual commitments from third parties who process Personal Data on their behalf regarding the knowledge of Parent during the past three same; (3C) years there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to samethe IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person or entitygovernmental or regulatory authority, nor any and there are no incidents or, to Company’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same; and (cD) Parent the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, loss, access, processing, misappropriation or modification, including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and all other laws and regulations with respect to Personal Data applicable to the Company or its subsidiaries (“Privacy Laws”); (E) the Company and its subsidiaries have not received notice of any actual or potential violation of any Privacy Laws and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened against the Company or its subsidiaries alleging non-compliance with Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken commercially reasonable steps to require that any Personal Data of the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected material to have the Company and its subsidiaries, taken as a Parent Material Adverse Effect: whole, (aA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and (B), to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . (bA) Parent The Company and its Subsidiaries subsidiaries have implemented and maintained controls, procedures, and safeguards that are commercially reasonable controls, policies, procedures and safeguards designed for its industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data collected or processed by the Company or its subsidiaries in connection with their businesses (“Parent Personal Data”), and except as otherwise disclosed in the Time of Sale Information and the Offering Memorandum, and except as otherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (B) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company’s knowledge, there have been no breaches, violations, outages breaches or unauthorized uses of or accesses to samesuch IT Systems or Personal Data. Except as would not, except for those that individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or a Material Adverse Effect, the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes, all applicable judgments, orders, rules and Ordersregulations of any court or arbitrator or governmental or regulatory authority, as well as and all of the Company’s and its subsidiaries’ applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three and (3ii) years there have been no breaches, violations, outages or unauthorized uses of, accesses to, encryptions of or accesses to compromises of same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries are presently subsidiaries have been for the past five (5) years in compliance in all material respects with all applicable Laws laws or statutes, binding guidance and Ordersstandards (including the Payment Card Industry Data Security Standard) and all judgments, as well as applicable internal orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification. There are no pending or, to the knowledge of the Company, threatened Actions in relation to the matters of this Section 3(jj).

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries Subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (collectively, “Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, the Company and its Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its Subsidiaries’ businesses (“Breach”) and, to the knowledge Knowledge of Parent during the past three (3) years Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent such Breach. The Company and its Subsidiaries are presently have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach. This representation is limited in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating each case to the privacy and security of Parent IT Systems and Parent Personal Dataextent that such breach or non-compliance would not reasonably be expected to have a Material Adverse Effect, and to except as otherwise disclosed in the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationCommission Documents.

Cybersecurity; Data Protection. Except as would not(i) The Company and its subsidiaries have complied, and are presently in compliance, in all material respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority and any legal obligations regarding the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company and its subsidiaries of Data (“Data Security Obligations”); (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and are aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have taken steps reasonably necessary in accordance with industry standard practices to protect such information against loss and against unauthorized access, use, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to have a Parent Material Adverse Effect: (a) Effect on the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent Company and its Subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to taken as a whole. To the knowledge of Parent during the past three (3) years Company, except as disclosed in the Registration Statement, the Disclosure Package and the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there have has been no breaches, violations, outages unauthorized access to such information. The Company and its subsidiaries have taken or unauthorized uses of or accesses will take all necessary actions to same, except for those comply with all applicable laws and regulations with respect to Personal Data that have been remedied without material cost or liability or announced as of the duty date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to notify any other person or entity, nor any incidents under internal review or investigations relating to have a Material Adverse Effect on the same; and (c) Parent Company and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orderssubsidiaries, taken as a whole, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationsoon they take effect.

Cybersecurity; Data Protection. Except as would not, individually or described in the aggregateRegistration Statement, reasonably be expected to have a Parent Material Adverse Effect: (a) the Offering Materials and the Prospectus, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned by, or used by Parent leased or licensed to, the Company or any of its Subsidiaries subsidiaries (collectively, “Parent IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; to the knowledge of Parent during the past three (3) years Company, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the sameCompany’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and (c) Parent the Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority and internal policies policies, procedures and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and information technology equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) (i) are adequate in capacity and level of performance for, and operate and perform as required in connection with with, the operation of the business businesses of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, (ii) in the past five years have not malfunctioned or failed and (iii) to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants; , including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems. Except as would not, individually or in the aggregate, have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have in the past five years implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed consistent with applicable regulatory requirements and customary industry practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data and information (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) and information of their respective customers, employees, suppliers, vendors or other third parties collected, used, stored stored, maintained or otherwise processed in connection with by or on behalf of the Company or any of its subsidiaries (collectively, “Data”) within their businessespossession or operational control, and, to the knowledge of Parent during the past three (3ii) years there have been no breachesbreaches of the security of, violationsoutages, outages destructions, losses, misappropriations, misuses or unauthorized uses uses, modifications or disclosures of or unauthorized accesses to samesame (each, a “Breach”), except for those that have been remedied without material cost or liability or the duty to notify any other person person; and (iii) the Company and its subsidiaries have not been notified of, and have no knowledge of, any event or entitycondition that would reasonably be expected to result in any Breach, nor or any incidents under internal review or investigations relating to the same; and . Except as would not have a Material Adverse Effect, during the past five years (ci) Parent the Company and its Subsidiaries subsidiaries have complied and are presently in compliance in all material respects with all applicable Laws laws and Ordersstatutes and all rules, as well as regulations, industry standards and statutes, judgments and orders of any applicable court or arbitrator or governmental or regulatory authority, the Company’s and its subsidiaries’ internal and external policies and contractual obligations of Parent and its Subsidiariesother legal obligations, in each case, relating to privacy, data protection or cybersecurity with respect to the use, protection, and security of IT Systems and the collection, use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of Parent IT Systems and Parent Personal DataData (collectively, the “Data Security Obligations”) and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized usea Breach; (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding its, accessor is aware of any other facts that, misappropriation individually or modificationin the aggregate, would reasonably indicate its non-compliance with any Data Security Obligation, and there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries; and (iii) the Company and its subsidiaries have implemented reasonable backup and disaster recovery technology consistent with applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. Except as would not, individually or described in the aggregateRegistration Statement and the Prospectus, reasonably be expected to have a Parent Material Adverse Effect: (a) the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned by, or used by Parent leased or licensed to, the Company or any of its Subsidiaries subsidiaries (collectively, “Parent IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of them (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; to the knowledge of Parent during the past three (3) years Company, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the sameCompany’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and (c) Parent the Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority and internal policies policies, procedures and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses, disabling code and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businessesthe business of the Company and its subsidiaries as currently conducted, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that, individually or in the aggregate, would not reasonably be expected to have a Material Adverse Effect or that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor have there been any incidents under internal review or investigations relating related to the same; and (c) Parent , except for any such incidents or investigations as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except for such failures as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except (i) Except, in each case, as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (a“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (collectively, “IT Systems”) through which any such Personal Data is collected or used processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its subsidiaries has received written notice asserting a violation by Parent the Company or any of its Subsidiaries subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its subsidiaries is (collectivelyi) currently conducting or paying for, “Parent in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems”) Systems are adequate for, and operate and perform in all respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have . The Company has implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed Data used in connection with their its businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaires’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures procedures, and safeguards designed consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalPersonal Data, personally identifiable, sensitive sensitive, confidential or confidential data regulated data) (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their respective businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been remedied without material cost in compliance with all (i) applicable laws, statutes, judgments, orders, rules and regulations of any court, arbitrator, governmental or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the sameregulatory authority; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent obligations, each (i) and its Subsidiaries, (ii) relating to the privacy and security of Parent IT Systems and Parent Personal Company Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or disclosed in the aggregateRegistration Statement, reasonably be expected to have a Parent Material Adverse Effect: the Pricing Disclosure Package and the Prospectus, (ai) the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants that could reasonably be expected to have a Material Adverse Effect; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for (x) those that did not or would not reasonably be expected to result in a Material Adverse Effect and (y) those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any material incidents under internal review or investigations relating to investigation; (iii) the same; and (c) Parent Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes (including the European Union General Data Protection Regulation to the extent applicable) and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, have a Material Adverse Effect; and (iv) the Company and its subsidiaries have initiated steps reasonably necessary to prepare to timely comply with applicable requirements under the California Consumer Privacy Act of 2018.

Cybersecurity; Data Protection. Except (i) Except, in each case, as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (a“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (collectively, “IT Systems”) through which any such Personal Data is collected or used processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its Subsidiaries has received written notice asserting a violation by Parent the Company or any of its subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its Subsidiaries is (collectivelyi) currently conducting or paying for, “Parent in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems”) Systems are adequate for, and operate and perform in all respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have . The Company has implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed Data used in connection with their its businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the Company Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of its the Company Parties and their Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent corruptants except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its their Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive identifiable or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to . To the knowledge of Parent during the past three (3) years Company Parties, there have been no breaches, violations, outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; same and (c) Parent the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and their Subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification. The Company Parties and their Subsidiaries have used reasonable best efforts to implement backup and disaster recovery technology consistent with industry standards and practices in all material respects.

Cybersecurity; Data Protection. Except as would nothas not had or could not reasonably be expected to have, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent corruptants designed to permit unauthorized access or activity. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person or entityperson, nor are there any incidents under internal review or investigations relating to such IT Systems or Personal Data and the same; and (c) Parent Company and its Subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would notnot be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and all personal data (including all personaland sensitive, personally identifiable, sensitive confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, andthe “Confidential Data”), and (ii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person person. Except as would not be expected, individually or entityin the aggregate, nor any incidents under internal review or investigations relating to have a Material Adverse Effect, the same; and (c) Parent Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of Parent the Company and its Subsidiariessubsidiaries, relating to governing the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by any officer or other authorized signatory of the Company and delivered to the Underwriters or to counsel for the Underwriters shall be deemed a representation and warranty by the Company to the Underwriters as to the matters covered thereby.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not, not individually or in the aggregate, reasonably be expected to aggregate have a Parent Material Adverse Effect: (a) Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not have, individually or in the aggregate, a Material Adverse Effect or as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus, the Company and its Subsidiaries subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive household, sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, andthe Company and its subsidiaries have used commercially reasonable efforts to establish and maintain and have established, maintained, implemented and complied with, except as would not have, individually or in the aggregate, a Material Adverse Effect or as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, to the knowledge of Parent during the past three (3) years Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (ai) the Each SDC Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, except as would not, individually or in the aggregate, be material to each SDC Party and its subsidiaries, taken as a whole, (ii) to the knowledge of the SDC Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except as would not, individually or in the aggregate, be material to each SDC Party and its subsidiaries, taken as a whole; (biii) Parent the SDC Parties and its Subsidiaries subsidiaries have implemented and maintained controls, procedures, and safeguards that are commercially reasonable controls, policies, procedures and safeguards designed for their industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive regulated (including Protected Health Information under HIPAA) or confidential data (“Parent Personal Data”)) collected, used, stored collected or processed by the Company or its subsidiaries in connection with their businessesbusinesses (“Personal Data”) and (iv) except as otherwise disclosed in the Registration Statement, andthe Pricing Disclosure Package and the Prospectus, and except as otherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of Parent during the past three (3) years Company’s knowledge, there have been no breaches, violations, outages breaches or unauthorized uses of or accesses to samesuch IT Systems or Personal Data. Except as would not, except for those that individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or a Material Adverse Effect, the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes, payment card industry data security standards, judgments, orders, rules and Ordersregulations of any court or arbitrator or governmental or regulatory authority, as well as and all the Company’s and its subsidiaries’ applicable internal and customer-facing policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification. No SDC Party or any of their subsidiaries is under investigation by any Governmental Authority or has received any oral, written or other claim, complaint, inquiry, or notice from any third party or any Governmental Authority related to whether the Company’s collection, processing, use, storage, security and/or disclosure of Personal Data is in violation of any applicable laws or privacy policies, or otherwise constitutes an unfair, deceptive or misleading trade practice.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except in each case, as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to and in the knowledge of Parent during the past last three (3) years there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any material incidents under internal review or or, to the knowledge of the Company and its subsidiaries, investigations relating related to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except in each case, as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries Subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (collectively, “Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, the Company and its Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its Subsidiaries’ businesses (“Breach”) and, to the knowledge Knowledge of Parent during the past three (3) years Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent such Breach. The Company and its Subsidiaries are presently have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach. This representation is limited in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating each case to the privacy and security of Parent IT Systems and Parent Personal Dataextent that such breach or non-compliance would not reasonably be expected to have a Material Adverse Effect, and to except as otherwise disclosed in the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation Registration Statement or modificationthe Prospectus.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures procedures, and safeguards designed consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalPersonal Data, personally identifiable, sensitive sensitive, confidential or confidential data regulated data) (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their respective businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been remedied without material cost in compliance with all (i) applicable laws, statutes, judgments, orders, rules and regulations of any court, arbitrator, governmental or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the sameregulatory authority; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent obligations, each (i) and its Subsidiaries, (ii) relating to the privacy and security of Parent IT Systems and Parent Personal Company Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or disclosed in the aggregateRegistration Statement and the Prospectus, or except as would not reasonably be expected to have result in a Parent Material Adverse Effect: material adverse effect, (ai) the Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, technology, data and databases owned (including confidential information, trade secrets or used by Parent other data of the Company or any of its Subsidiaries subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “Parent IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free conducted and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented complied, and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws laws and Ordersstatutes and any judgments, as well as applicable orders, rules or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations of Parent and its Subsidiariesany other legal obligations, in each case, relating to the privacy and security of Parent IT Systems and Parent Personal DataData (collectively, the “Data Security Obligations”). Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expected to result in a material adverse effect, (i) the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures to the protection protect against and prevent security breaches of, unauthorized access to and other similar compromises of such Parent IT Systems and Parent Personal Data from in accordance with industry practices and as required by applicable regulatory standards, (ii) the Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized useaccess or other similar compromise to their IT Systems and Data (“Breach”), access(iii) the Company and its subsidiaries have not received notification of, misappropriation and have no knowledge of, any event or modificationcondition that would reasonably be expected to result in a Breach to their IT Systems and Data, (iv) neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries and (v) there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened in writing alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries. Any certificate signed by any officer of the Company and delivered to the Managers or to counsel for the Managers in connection with this Agreement or any Terms Agreement shall be deemed a representation and warranty by the Company, as to matters covered thereby, to the Managers.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company’s information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries the Company as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries , except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company has at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures procedures, and safeguards designed consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalPersonal Data, personally identifiable, sensitive sensitive, confidential or confidential data regulated data) (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their businessesits business, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company is presently and, at all times, has been remedied without material cost in compliance with all (i) applicable laws, statutes, judgments, orders, rules and regulations of any court, arbitrator, governmental or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the sameregulatory authority; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent obligations, each (i) and its Subsidiaries, (ii) relating to the privacy and security of Parent IT Systems and Parent Personal Company Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as otherwise disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus or except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform as reasonably required in connection with with, the operation of the business of Parent nor any the Company and its subsidiaries and, to the knowledge of its Subsidiaries as currently conductedthe Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses; (iii) without limiting the foregoing, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries are presently in compliance in all material respects subsidiaries have used reasonable efforts to establish, maintain, implement and comply with all applicable Laws reasonable information technology, information security, cyber security and Ordersdata protection controls, as well as applicable internal policies and contractual obligations of Parent procedures, including oversight, access controls, encryption, technological and its Subsidiaries, relating to the privacy physical safeguards and business continuity/disaster recovery and security of Parent IT Systems plans that are designed to protect against and Parent Personal Dataprevent breach, and to the protection of such Parent IT Systems and Parent Personal Data from destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any of the Company’s or its subsidiaries’ information technology system or Data (“Breach”) and there has been no such Breach; and (iv) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or disclosed in the aggregateRegistration Statement, reasonably be expected to have a Parent Material Adverse Effect: (a) in the Prospectus and in the Pricing Disclosure Package, the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, andand except as disclosed in the Registration Statement, to in the knowledge of Parent during Prospectus and in the past three (3) years Pricing Disclosure Package and except as would not, individually or in the aggregate, have a Material Adverse Change, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; . Except as disclosed in the Registration Statement, in the Prospectus and (c) Parent in the Pricing Disclosure Package, the Company and its the Subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, have a Material Adverse Change.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, software, hardware, softwarecomputers, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (data, including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three and (3ii) years there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents currently under internal review or investigations relating to the same; . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and (c) Parent except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall applicable judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal DataData collected, and to stored, processed, transferred, disclosed or used by the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation Company or modificationits subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material the Prospectus, and (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptants; (b) Parent harmful code. The Company and its Subsidiaries have implemented subsidiaries taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries, taken as a whole, are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent , except as would not, individually or in the aggregate, be reasonably expected to result in a Material Adverse Change. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material Personal Data, confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those such controls, policies, procedures and safeguards the failure to maintain, or such breaches, violations, outages or unauthorized uses or accesses that would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other person or entitya Material Adverse Change, nor any incidents under internal review or investigations relating to the same. Except where non-compliance would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Change, the Company and each of its subsidiaries are in compliance with all applicable data privacy and security and data protection laws and regulations regarding the collection, use, transfer, storage, protection, disposal or disclosure of Personal Data (as defined below) processed, stored or collected by the Company and its subsidiaries (collectively, the “Privacy Laws”). “Personal Data” means personally identifiable information, protected health information, financial information, “personal data” as defined by the EU General Data Protection Regulations (EU 2016 679) and all other information subject to Privacy Laws. The Company and its subsidiaries have policies and procedures reasonably designed to (i) ensure compliance with Privacy Laws and its privacy policies on its website or other consumer facing communications; and (cii) Parent reasonably protect the security and its Subsidiaries are presently in compliance in confidentiality of all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data. Neither the Company nor any subsidiary has received written notice of any actual or potential material liability under or relating to, and to or actual or potential material violation of, any of the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationPrivacy Laws.

Cybersecurity; Data Protection. (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: Effect on the Company and its subsidiaries, taken as a whole, (ax) the information technology assets Company and equipment, computers, its subsidiaries own or have a valid right to access and use all computer systems, networks, hardware, software, websitestechnical databases, applications websites and databases owned or equipment used by Parent or any of to process, store, maintain and operate data, information and functions used in connection with the Company’s and its Subsidiaries subsidiaries’ businesses (collectively, the “Parent Company IT Systems”), and (y) the Company IT Systems are adequate for, and operate and perform as required in connection with with, the operation of the business of Parent nor any of Company’s and its Subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (bii) Parent Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its Subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries, policiestaken as a whole, procedures and safeguards designed to maintain and protect their material confidential information and neither the integrity, continuous operation, redundancy and security Company nor any of all Parent IT Systems and data its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, but not limited to the knowledge MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in any manner that requires or has required, with respect to any proprietary software authored and owned by or on behalf of Parent during the past three Company or its subsidiaries, any such software code to be (3x) years there disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or a Material Adverse Effect on the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries, taken as a whole, (x) the Company and each of its subsidiaries are presently in compliance in all material respects with all internal and external privacy policies, applicable Laws contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and Ordersregulations of any court or arbitrator or other governmental or regulatory authority and any other legal obligations, as well as applicable internal policies and contractual obligations of Parent and its Subsidiariesin each case, relating to privacy or security with respect to the privacy collection, use, transfer, import, export, storage, protection, disposal and security disclosure by the Company or any of Parent IT Systems its subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, sensitive, confidential or regulated data (“Data Security Obligations,” and Parent Personal such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, (i) the Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (ii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures that are designed to the protection of such Parent IT Systems protect against and Parent Personal Data from prevent breach, destruction, loss, unauthorized distribution, use, accessdisablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, data and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Disclosure Package, and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have established, implemented and maintained commercially reasonable and appropriate controls, policies, procedures procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and material data (including all personal, personally identifiable, sensitive household, sensitive, confidential or confidential regulated data or information (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their businesses, and, to in compliance with all applicable laws and regulatory standards in all material respects. To the knowledge of Parent during the past three (3) years Company, there have been no material breaches, violations, outages outages, security incidents or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company Data. The Company and its Subsidiaries are presently in compliance subsidiaries own or have a valid right to access and use all IT Systems and Company Data, and have complied in all material respects and are presently in material compliance with all applicable Laws laws and Ordersstatutes, as well as applicable judgments, rules and regulations of any court or other governmental authority, binding industry standards, internal and external policies and notices, contractual obligations of Parent and its Subsidiariesany other legal obligations, in each case relating to the privacy and security collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing by or on behalf of Parent IT Systems and Parent Personal Datathe Company or any of its subsidiaries of Company Data (“Data Security Obligations”). Neither the Company nor any of its subsidiaries have received any notification of or complaint regarding, and or otherwise have knowledge of any facts that would indicate, any material non-compliance by the Company or any of its subsidiaries with any Data Security Obligation. There is no action, suit, investigation or proceeding against the Company or any of its subsidiaries by or before any court or governmental agency, authority or body pending or, to the protection knowledge of such Parent IT Systems and Parent Personal the Company, threatened, against the Company or any of its subsidiaries alleging material non-compliance with any Data from unauthorized use, access, misappropriation Security Obligations by the Company or modificationany of its subsidiaries.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed contained on the IT Systems and used in connection with their businesses. Without limiting the foregoing, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries are presently in compliance in all material respects with all applicable Laws subsidiaries have used commercially reasonable efforts to establish and Ordersmaintain, as well as applicable internal and have established, maintained, implemented and complied with, reasonable information technology, information security, cybersecurity and data protection controls, policies and contractual obligations of Parent procedures, including oversight, access controls, encryption, technological and its Subsidiariesphysical safeguards and business continuity, relating to the privacy disaster recovery and security of Parent IT Systems plans that are designed to protect against and Parent Personal Dataprevent any breach, and to the protection of such Parent IT Systems and Parent Personal Data from destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of, or security incident relating to, any IT Systems or Data used in connection with the operation of the respective businesses of the Company and its subsidiaries (“Breach”). To the knowledge of the Company, there has been no Breach, and the Company and its subsidiaries have not been notified of any event or condition that would reasonably be expected to result in any Breach, in each case, that would reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or used by Parent on behalf of the Company or any of its Subsidiaries subsidiaries ) (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (including protected health information) (“Parent Personal Data”)) collected, used, stored or otherwise processed in connection with their businesses, andand except as would not, individually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries are presently presently, and since formation have been, in compliance in all material respects with all applicable Laws laws or statutes (including without limitation, the Health Insurance Portability and OrdersAccountability Act of 1996, as well as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external privacy policies, applicable internal policies industry standards and contractual obligations of Parent and its Subsidiariesobligations, in each case, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification or the collection, use, transfer, import, export, storage, disposal, disclosure or other processing by the Company and its subsidiaries of Personal Data (“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have made all disclosures to users or customers required by the Data Protection Obligations, including applicable laws and regulatory rules or requirements, and no such disclosures have been inaccurate or in violation of any such Data Protection Obligations, applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. Except as would notTo the Company’s Knowledge, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned by, or used by Parent leased or licensed to, the Company or any of its Subsidiaries (collectively, “Parent IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, and to the Company’s Knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of them (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; to the knowledge of Parent during the past three (3) years Company’s Knowledge, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its Subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the sameCompany’s or any of its Subsidiaries’ Personal Data or IT Systems and the Company and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its Subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and (c) Parent the Company and its Subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority and internal policies policies, procedures and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and all personal data (including all personaland sensitive, personally identifiable, sensitive confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, andthe “Confidential Data”), and (ii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person person. Except as would not reasonably be expected, individually or entityin the aggregate, nor any incidents under internal review or investigations relating to have a Material Adverse Effect, to the same; and (c) Parent knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of Parent the Company and its Subsidiariessubsidiaries, relating to governing the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to Virtu, or to counsel for Virtu, pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the Company to Virtu as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have result in a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate in capacity and operation for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data collected, used or otherwise processed by it or on its behalf in connection with their businesses (“Parent Personal Data”)) collected, usedin each case except as would not, stored individually or processed in connection with their businessesthe aggregate, andresult in a Material Adverse Effect. Except as would not, to individually or in the knowledge of Parent during the past three (3) years aggregate, result in a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of of, or accesses to sameto, except for those that have been remedied without material cost such IT Systems or liability Personal Data. Except as would not, individually or in the duty to notify any other person or entityaggregate, nor any incidents under internal review or investigations relating to result in a Material Adverse Effect, the same; and (c) Parent and its Subsidiaries are Company is presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall applicable and binding judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and with all of the Company’s internal policies and contractual obligations of Parent and its Subsidiariesobligations, in each case, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification. Neither the Company nor any of its subsidiaries (i) is subject to any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the CSRC, or any other relevant governmental authority of the PRC, or (ii) has received notice of any pending or, to the knowledge of the Company, threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental or regulatory authorities of the PRC on the Company, its subsidiaries or any of their respective directors, officers and employees.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected to have, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Issuer’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries the Issuer as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have . The Issuer has implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (including protected health information) (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, andand except as would not reasonably be expected to have, to individually or in the knowledge of Parent during the past three (3) years aggregate, a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; . Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, the Issuer has been for the past three (3) years and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws or statutes (including the Health Insurance Portability and OrdersAccountability Act of 1996, as well as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external privacy policies, applicable internal policies industry standards and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, use, transfer, import, export, storage, disposal and disclosure by the Issuer of Personal Data (“Data Protection Obligations”). The Issuer has not received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Issuer, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Issuer has taken commercially reasonable steps in accordance with industry standard practices (including implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Issuer. Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, the Issuer has made all disclosures to users or customers required by applicable Laws and regulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable Laws or regulatory rules and requirements.

Cybersecurity; Data Protection. (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: Effect on the Company and its subsidiaries, taken as a whole, (ax) the information technology assets Company and equipment, computers, its subsidiaries own or have a valid right to access and use all computer systems, networks, hardware, software, websitestechnical databases, applications websites and databases owned or equipment used by Parent or any of to process, store, maintain and operate data, information and functions used in connection with the Company’s and its Subsidiaries subsidiaries’ businesses (collectively, the “Parent Company IT Systems”), and (y) the Company IT Systems are adequate for, and operate and perform as required in connection with with, the operation of the business of Parent nor any of Company’s and its Subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (bii) Parent Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its Subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries, policiestaken as a whole, procedures and safeguards designed to maintain and protect their material confidential information and neither the integrity, continuous operation, redundancy and security Company nor any of all Parent IT Systems and data its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, but not limited to the knowledge MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in any manner that requires or has required, with respect to any proprietary software authored and owned by or on behalf of Parent during the past three Company or its subsidiaries, any such software code to be (3x) years there disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or a Material Adverse Effect on the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries, taken as a whole, (x) the Company and each of its subsidiaries are presently in compliance in all material respects with all internal and external privacy policies, applicable Laws contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and Ordersregulations of any court or arbitrator or other governmental or regulatory authority and any other legal obligations, as well as applicable internal policies and contractual obligations of Parent and its Subsidiariesin each case, relating to privacy or security with respect to the privacy collection, use, transfer, import, export, storage, protection, disposal and security disclosure by the Company or any of Parent IT Systems and Parent Personal Dataits subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, sensitive, confidential or regulated data (“Data Security Obligations”, and such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, (i) the Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (ii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection of such Parent IT Systems controls, policies and Parent Personal Data from procedures that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, accessdisablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material respects in conformance with their functional specifications and have not materially malfunctioned or failed during the past three (3) years. To the Company’s knowledge, the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants; (b) Parent , in each case that could have a material impact on the business or operations of the Company and its Subsidiaries subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent same . The Company and its Subsidiaries subsidiaries are presently and at all times have been in full compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.

Cybersecurity; Data Protection. Except as described in the Registration Statement and the Prospectus or would notnot be reasonably expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its subsidiary’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiary) (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conductedsubsidiary, free and clear of all material bugs, errors, defects, known Trojan horses, time bombs, malware and other corruptants; and (bii) Parent the Company and its Subsidiaries subsidiary have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, andexcept as would not reasonably be excepted to result in a Material Adverse Effect. Without limiting the foregoing, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries are presently in compliance in all material respects with all applicable Laws have used commercially reasonable efforts to establish and Ordersmaintain, as well as applicable internal and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and contractual obligations of Parent procedures, including oversight, access controls, encryption, technological and its Subsidiaries, relating to the privacy physical safeguards and business continuity/disaster recovery and security of Parent IT Systems plans that are designed to protect against and Parent Personal Dataprevent breach, and to the protection of such Parent IT Systems and Parent Personal Data from destruction, loss, unauthorized usedistribution, misuse, unauthorized access, disablement, misappropriation or modification, or other compromise of the IT Systems or Data used in connection with the operation of the Company’s and its Subsidiaries’ businesses (“Breach”). To the knowledge of the Company, there has been no Breach and the Company has not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, any such Breach.

Cybersecurity; Data Protection. Except as would not, individually or described in the aggregateRegistration Statement, reasonably be expected to have a Parent Material Adverse Effect: the Pricing Disclosure Package and the Prospectus, (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; (iii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages outages, or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (civ) Parent the Company and its Subsidiaries subsidiaries have complied and are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of Personal Data (collectively, the “Data Security Obligations”), except, in the case of each clause above, as would not reasonably be expected to have a Material Adverse Effect. Except as would not reasonably be expected to have a Material Adverse Effect, (i) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and is unaware of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and (ii) there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending, or to the Company’s knowledge, threatened, alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (bi) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and all personal data (including all personaland sensitive, personally identifiable, sensitive confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored maintained or processed by the Company and its subsidiaries in connection with their businessesbusinesses (collectively, andthe “Confidential Data”), and (ii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person person. Except as would not reasonably be expected, individually or entityin the aggregate, nor any incidents under internal review or investigations relating to have a Material Adverse Effect, to the same; and (c) Parent knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of Parent the Company and its Subsidiariessubsidiaries, relating to governing the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to the Agents, or to counsel for the Agents, pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the Company to the Agents as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (ai) the Each Company Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of such Company Party and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent each Company Party and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (ciii) Parent each Company Party and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (aA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, for and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bB) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, household or confidential regulated data or information collected, stored or processed by the Company or its subsidiaries (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; (C) to the best knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to samethe IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person or entitygovernmental or regulatory authority, nor any and there are no incidents or, to Company’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same; and (cD) Parent the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, loss, access, processing, misappropriation or modification, including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and all other laws and regulations with respect to Personal Data applicable to the Company or its subsidiaries (“Privacy Laws”); (E) the Company and its subsidiaries have not received notice of any actual or potential violation of any Privacy Laws and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened against the Company or its subsidiaries alleging non-compliance with Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken commercially reasonable steps to require that any Personal Data of the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material the Prospectus, and (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptants; (b) Parent harmful code. The Company and its Subsidiaries have implemented subsidiaries taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries, taken as a whole, are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as reasonably required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and confidential data (including all personal, personally identifiable, personal data and sensitive or confidential regulated data (collectively, the “Parent Personal Confidential Data”)) collected, used, stored or processed used in connection with their businesses. Except as would not, andindividually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, same nor any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent the Company or any of its Subsidiaries subsidiaries (collectively, “Parent IT Systems”) are reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent corruptants that would cause a material disruption to the operation of the business of the Company and its Subsidiaries subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect the secrecy of their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data in the Company’s possession or control (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, in each case, except for those that as have been remedied without material cost not had, and would not reasonably be expected to have, individually or liability or in the duty to notify any other person or entityaggregate, a Material Adverse Effect, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, in each case, except as have not had, and would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not, not individually or in the aggregate, reasonably be expected to aggregate have a Parent Material Adverse Effect: (a) Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or used by Parent or any on behalf of the Company and its Subsidiaries subsidiaries) (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not have, individually or in the aggregate, a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive household, sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Without limiting the foregoing, andthe Company and its subsidiaries have used commercially reasonable efforts to establish and maintain and have established, maintained, implemented and complied with, except as would not have, individually or in the aggregate, a Material Adverse Effect, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, to the knowledge of Parent during the past three (3) years Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would notThe Company, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the Guarantor and their subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its the Company and the Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; , except in each case as would not, singly or in the aggregate, result in a Material Adverse Effect. The Company, the Guarantor and their subsidiaries (bi) Parent and its Subsidiaries (x) have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential identifiable data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three and (3y) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and (iii) have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect; except, with respect to each of the foregoing clauses (i), (ii) and (iii), as would not, singly or in the aggregate, result in a Material Adverse Effect. Any certificate signed by an officer of the Company or the Guarantor and delivered to the Representative or to counsel for the Initial Purchasers shall be deemed to be a representation and warranty by the Company and the Guarantor to each Initial Purchaser as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company’s information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of its Subsidiaries the Company as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have . The Company has at all times implemented and maintained commercially reasonable and appropriate controls, policies, procedures procedures, and safeguards designed consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalsensitive, personally identifiableconfidential or regulated data and all data that comes within a definition of “personal information,” “personal data” or other similar term under Data Protection Requirements) (collectively, sensitive or confidential data (“Parent Personal Company Data”)) collected, used, stored or processed used in connection with their businessesbusiness, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not, individually or in the aggregate, reasonably be expected to have been remedied without a material cost impact on the Company and its Subsidiary, considered as a whole. There are no privacy or liability or the duty to notify any other person or entity, nor any security incidents under internal review or investigations relating to the samesame that would, individually or in the aggregate, reasonably be expected to have a material impact on the Company and its Subsidiary, considered as a whole. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company is presently and, at all times, has been in compliance with all (i) applicable laws, statutes, judgments, orders, rules and regulations of any court, arbitrator, governmental or regulatory authority; and (cii) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws and Orders, as well as applicable internal policies and contractual obligations of Parent obligations, each (i) and its Subsidiaries, (ii) relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Company Data from unauthorized use, access, misappropriation or modification(“Data Protection Requirements”).

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and Brilliant Earth and their subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) (i) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business businesses of Parent nor any of its Subsidiaries the Company and Brilliant Earth and their subsidiaries as currently conducted, (ii) have not malfunctioned or failed and, (iii) to the Company’s or Brilliant Earth’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants; , including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems, in each case (bi) Parent – (iii), except as would not reasonably be expected to, individually or in the aggregate, have a material adverse effect on the Company and its Subsidiaries Brilliant Earth and their subsidiaries’, taken as a whole. The Company and Brilliant Earth and their subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards consistent with applicable regulatory standards and customary industry practices designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data and information (including all personal, personally identifiable, sensitive sensitive, confidential or regulated data and information of their respective customers, employees, suppliers, vendors or any other third-party data, to the extent such data is personal, personally identifiable, sensitive, confidential data (“Parent Personal Data”)) or regulated, collected, used, stored stored, maintained or otherwise processed by or on behalf of the Company or Brilliant Earth or any of their subsidiaries) (collectively, “Data”) used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company’s or Brilliant Earth’s knowledge, there have been no breaches, violations, outages outages, destructions, losses, misappropriations, modifications, misuses or unauthorized uses or disclosures of or accesses to samesame (each, a “Breach”), except for those that have been remedied without material cost or liability or the duty to notify any other person person. The Company and Brilliant Earth and their subsidiaries have not been notified of, and have no knowledge of, any event or entitycondition that would reasonably be expected to result in any Breach, nor or any incidents under internal review or investigations relating to the same; , except as would not reasonably be expected to, individually or in the aggregate, have a material adverse effect on the Company and (c) Parent Brilliant Earth and its Subsidiaries their subsidiaries’, taken as a whole. The Company and Brilliant Earth and their subsidiaries have complied and are presently in material compliance in all material respects with all applicable Laws laws, rules, regulations, industry standards and Ordersstatutes, as well as applicable internal judgments and orders of any court or arbitrator or governmental or regulatory authority, external policies and contractual obligations of Parent and its Subsidiariesobligations, in each case, relating to the collection, use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of Parent IT Systems and Parent Personal DataData (collectively, the “Data Security Obligations”) and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized usea Breach. Neither the Company nor Brilliant Earth nor any of their subsidiaries has received any written notification of or written complaint from any governmental or regulatory agency, accessauthority or body regarding, misappropriation or modificationis aware of any other facts that, individually or in the aggregate, that would reasonably indicate non-compliance with any Data Security Obligation and there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s or Brilliant Earth’s knowledge, threatened alleging non-compliance with any Data Security Obligation. The Company and Brilliant Earth and their subsidiaries have implemented reasonable backup and disaster recovery technology consistent with applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. Except (A) To the knowledge of the Company, the Operating Partnership and each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s, the Operating Partnership or their respective subsidiaries’ information technology and computer systems, networks, hardware, software, data and databases (including the data and information of their respective tenants, customers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and any such data processed or stored by third parties on behalf of the Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT Systems and Data”); (B) none of the Company, the Operating Partnership or their respective subsidiaries have been notified of, and have no knowledge of any event or condition that would result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT Systems and Data and (C) the Company, the Operating Partnership and their respective subsidiaries have implemented controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of their IT Systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, except with respect to clauses (A) and (B), for any such security breach or incident, unauthorized access or disclosure, or other compromises, as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , or with respect to clause (a) C), where the information technology assets failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Operating Partnership and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries respective subsidiaries are presently in material compliance in all material respects with all applicable Laws laws and Ordersstatutes and all judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, not reasonably be expected to have result in a Parent Material Adverse Effect: (a) Change, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, andand except as has been disclosed in the Registration Statement and the Prospectus, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or known unauthorized uses of or known accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries have complied, and are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all industry guidelines, standards, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification, except where the failure to be in compliance would not reasonably be expected to result in a Material Adverse Change. The Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practice.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (including protected health information) (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, andand except as would not reasonably be expected, individually or in the aggregate, to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries are presently presently, and since January 1, 2017 have been, in compliance in all material respects with all applicable Laws laws or statutes (including without limitation, the Health Insurance Portability and OrdersAccountability Act of 1996, as well as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external privacy policies, applicable internal policies industry standards and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, use, transfer, import, export, storage, disposal and disclosure by the Company and its subsidiaries of Personal Data (“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries have made all disclosures to users or customers required by applicable laws and regulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. Except To the Company and its subsidiaries’ knowledge, except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) (i) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business businesses of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Time of Sale Information and the Prospectus, (ii) have not malfunctioned or failed and (iii) are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, backdoors, drop dead devices, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent their material IT Systems and data and information (including all personal, personally identifiable, sensitive household, sensitive, confidential or confidential regulated data or information (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there including as processed and stored thereon. There have been no destructions, losses, breaches, violationsoutages, outages compromises or unauthorized or unlawful uses or disclosures of or accesses to samethe Company’s IT Systems, Personal Data maintained, processed or stored or processed thereon, or, to the Company and its subsidiaries’ knowledge any such data stored or processed by third parties for or on behalf of the Company or its subsidiaries (each, a “Breach”), except for those that as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have not been remedied without notified of, and have no knowledge of, any material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations investigation relating to the same; and (c) Parent to, any Breach. The Company and its Subsidiaries subsidiaries have complied with and are presently in compliance in all material respects with all applicable Laws laws and Ordersstatutes and all judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, contractual obligations of Parent obligations, binding industry standards and its Subsidiariesany other legal obligations, in each case, to the extent relating to (x) the privacy and security of Parent the IT Systems and Parent Personal Data, and to (y) the protection of such Parent IT Systems and Parent Personal Data from unauthorized any Breach, or (z) the collection, use, accesstransfer, misappropriation storage, protection, disposal, disclosure or modificationother processing by the Company or any of its subsidiaries of Personal Data, other than as would not reasonably be expected to result, individually or in the aggregate, in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, technology, data and databases owned (including confidential information, trade secrets or used by Parent other data of the Company or any of its Subsidiaries subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “Parent IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . The Company and its Subsidiaries subsidiaries have implemented complied, and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in compliance in all material respects with all applicable Laws laws and Ordersstatutes and any judgments, as well as orders, rules or regulations of any court or arbitrator or other governmental or regulatory authority, and all applicable internal policies and contractual obligations of Parent and its Subsidiariesany other legal obligations, in each case, relating to the privacy and security of Parent IT Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures designed to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data as required by applicable regulatory standards. The Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus or as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: , (ai) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, including in terms of functionality and performance, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and confidential data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data, including, without limitation, any data which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “Parent HIPAA”), “personal data” as defined by the European Union General Data Protection Regulation (EU 2016/679 or “GDPR”), and any other piece of information that allows the identification of a natural person, or his or her family, or data related to an identified person’s health or sexual orientation (collectively, “Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, ; (iii) to the knowledge of Parent during the past three (3) years Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other person or entityPersonal Data, nor any incidents under internal review or investigations relating to the same; same and (civ) Parent the Company and its Subsidiaries subsidiaries are presently and have been at all times in compliance in all material respects with all applicable Laws laws, directives or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or supragovernmental or regulatory authority, internal policies and policies, contractual obligations of Parent and its Subsidiaries, industry standards relating to the privacy and security of Parent IT Systems and Parent Personal Data, including, without limitation, the GDPR, the UK Data Protection ▇▇▇ ▇▇▇▇, EU Directive 2002/58/EC and all applicable national implementing legislation (“Data Protection Laws”) and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and (v) the Company and its subsidiaries have used commercially reasonable efforts to require their vendors, service providers or other third parties that have received access to any Personal Data from the Company or its subsidiaries to protect the privacy, security and confidentiality of such Personal Data.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected material to have the Company and its subsidiaries, taken as a Parent Material Adverse Effect: whole, (aA) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and (B), to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; . (bA) Parent The Company and its Subsidiaries subsidiaries have implemented and maintained controls, procedures, and safeguards that are commercially reasonable controls, policies, procedures and safeguards designed for its industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive or confidential data collected or processed by the Company or its subsidiaries in connection with their businesses (“Parent Personal Data”), and except as disclosed in the Time of Sale Memorandum and the Offering Memorandum or as otherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (B) collected, used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years Company’s knowledge, there have been no breaches, violations, outages breaches or unauthorized uses of or accesses to samesuch IT Systems or Personal Data. Except as would not, except for those that individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or a Material Adverse Effect, the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes, all applicable judgments, orders, rules and Ordersregulations of any court or arbitrator or governmental or regulatory authority, as well as and all of the Company’s and its subsidiaries’ applicable internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) the The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses. Except as would not, andindividually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost the Company and its subsidiaries’ IT Systems or liability or the duty to notify any other person or entitydata (including Personal Data), nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries subsidiaries are presently in material compliance in all material respects with (i) all applicable Laws worldwide laws and Ordersstatutes and all judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and (ii) their internal policies and contractual obligations obligations, in each case of Parent (i) and its Subsidiaries(ii), relating to the privacy and security of Parent IT Systems and Parent Personal Data, including the creation, collection, receipt, acquisition, storage, maintenance, use, disclosure, transfer, transmission, disposition, retention, and processing of Personal Data, and to the security and protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, disclosure, acquisition, misappropriation or modification. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have taken all necessary actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personalpersonal data and sensitive, personally identifiable, sensitive confidential or confidential regulated data (collectively, the “Parent Personal Confidential Data”)) collected, used, stored or processed used in connection with their businesses. Except as would not, andindividually or in the aggregate, reasonably be expected to the knowledge of Parent during the past three (3) years have a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, same nor any incidents under internal review or investigations relating to the same; and (c) Parent . The Company and its Subsidiaries are presently in material compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Confidential Data and to the protection of such Parent IT Systems and Parent Personal Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (ai) the Each Company Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of such Company Party and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (bii) Parent each Company Party and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Data”)) collected, used, stored or processed used in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entityperson, nor any incidents under internal review or investigations relating to the same; and (ciii) Parent each Company Party and its Subsidiaries subsidiaries are presently in compliance in all material respects with all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would notnot reasonably be expected, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications applications, and databases owned or used controlled by Parent or any of the Company and its Subsidiaries subsidiaries (collectively, “Parent IT Company Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business businesses of Parent nor any of the Company and its Subsidiaries subsidiaries as currently conducted, and are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable industry-standard controls, policies, procedures procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Company Systems and data stored therein (including all personal, personally identifiable, sensitive sensitive, confidential or confidential regulated data (“Parent Personal Private Data”)) collected), used, stored or processed in connection with their businesses, and, to the knowledge of Parent during the past three (3) years and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entitysuch Company Systems and Private Data, nor are there any incidents under internal review or investigations relating to the same; and (c) Parent . Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries are presently in compliance in all material respects with (i) all applicable Laws laws or statutes, (ii) all judgments, orders, rules and Orders, as well as applicable regulations of any court or arbitrator or governmental or regulatory authority and (iii) all internal policies and contractual obligations of Parent and its Subsidiariesobligations, in each case, relating to the privacy and security protection of Parent IT Company Systems and Parent Personal Data, and to the protection of such Parent IT Systems and Parent Personal Private Data from unauthorized or illegal use, access, destruction, disclosure, misappropriation or modificationmodification (collectively, the “Company Security and Privacy Obligations”). Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, there is no investigation, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance by the Company or its subsidiaries with any of the Company Security and Privacy Obligations.

Cybersecurity; Data Protection. Except (A) To the knowledge of the Company, there has been no material security breach or other compromise of the Company’s or its Subsidiaries’ information technology and computer systems, networks, hardware, software and databases (collectively “IT Systems”) or data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”) and information of their respective customers, employees, suppliers, vendors and any third parties maintained, processed or stored by the Company and its Subsidiaries, and any such data processed or stored by third parties on behalf of the Company and its Subsidiaries); (B) neither the Company nor its Subsidiaries have been notified of, and each of them have no knowledge of any material event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; (C) except as would not, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect: (a) , the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of Parent nor any of its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (b) Parent Company and its Subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures procedures, and technical safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent their IT Systems and data Personal Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards; (including D) the Company and its Subsidiaries have at all personal, personally identifiable, sensitive or confidential data (“Parent Personal Data”)) collected, used, stored or processed times in connection with their businesses, and, to the knowledge of Parent during the past three (3) years there have been no breachesin material compliance with, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person or entity, nor any incidents under internal review or investigations relating to the same; and (c) Parent and its Subsidiaries are presently in material compliance in all material respects with with, all applicable Laws laws or statutes and Ordersall judgments, as well as applicable orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations of Parent and its Subsidiaries, relating to the privacy and security of Parent IT Systems and Parent Personal Data, Data and to the protection of such Parent IT Systems and Parent Personal Data from unauthorized use, access, misappropriation or modificationmodification and all applicable legal obligations regarding the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company and its Subsidiaries of Personal Data (“Data Security Obligations”); and (E) except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any applicable court or governmental agency, authority or body alleging non-compliance by the Company or its subsidiaries with any Data Security Obligations.