Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectEffect and except as described in each of the Registration Statement, the Company’s Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, software, hardware, softwarecomputers, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectEffect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data, including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Data”) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost remedied, nor any incidents currently under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge Effect and except as described in each of the CompanyRegistration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and collected, stored, processed, transferred, disclosed or used by the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation Company or modificationits subsidiaries.

Cybersecurity; Data Protection. Except as would could not be expected, individually or in the aggregate, expected to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the Company and its subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, proprietary, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Sensitive Data”)) used in connection with their businesses (collectively, the “Confidential Data”)its business, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. Except as could not be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are is presently in compliance with all applicable laws or statutes (including without limitation all applicable privacy and security laws and regulations, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Sensitive Data and to the protection of such IT Systems and Confidential Sensitive Data from unauthorized use, access, misappropriation or modification. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systemscomputer systems and assets, networks, hardware, software, websites, applications, databases (including all Personal Data, and databases sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Data used in connection with their businesses businesses. (collectivelyi) Except as may be included or incorporated by reference in the Registration Statement and the Prospectus, the “Confidential Data”), and (iix) to the knowledge of Company’s knowledge, the Company, there have been no breachesCompany has not had any material security breach, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without or other material cost compromise of or liability or the duty relating to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free conducted and clear of, (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses. The Company and each of its subsidiaries maintain commercially reasonable disaster recovery and business continuity plans, the “Confidential Data”), procedures and (ii) facilities. Except as would not reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages violations or unauthorized uses of or accesses to such Confidential Datathe IT Systems or Personal Data (collectively, except for those that have been remedied without material cost “Security Incidents”), nor any Security Incidents under internal review or liability or the duty to notify any other personinvestigations. Except as could would not reasonably be expectedexpected to have, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systemscomputer systems and assets, networks, hardware, software, websites, applications, databases (including all Personal Data, and databases sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Data used in connection with their businesses businesses. (collectivelyi) Except as may be included or incorporated by reference in the Registration Statement, the “Confidential Data”)General Disclosure Package and the Prospectus, and (iix) to the knowledge of Company’s knowledge, the Company, there have been no breachesCompany has not had any material security breach, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without or other material cost compromise of or liability or the duty relating to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Parent Material Adverse Effect, : (a) the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned or used by Parent or any of its Subsidiaries (collectively, “Parent IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and Parent nor any of its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (ib) the Company Parent and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all Parent IT Systems and data (including all personal personal, personally identifiable, sensitive or confidential data and sensitive(“Parent Personal Data”)) collected, confidential or regulated data maintained used, stored or processed by the Company and its subsidiaries in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of Parent during the Company, past three (3) years there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedperson or entity, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the Company same; and (c) Parent and its subsidiaries Subsidiaries are presently in compliance in all material respects with all applicable laws or statutes Laws and all judgmentsOrders, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all as well as applicable internal policies and contractual obligations of the Company Parent and its subsidiariesSubsidiaries, governing relating to the privacy and security of Parent IT Systems and Confidential Data Parent Personal Data, and to the protection of such Parent IT Systems and Confidential Parent Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or used by the Company or its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained (“Personal Data”)) collected, used, stored or processed by the Company and its subsidiaries in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or entity, nor any incidents under internal review or investigations relating to the same. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries have complied with and are presently in compliance with all applicable laws or statutes (including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation (the “GDPR”) and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal policies external policies, and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential the collection, use, transfer, import, export, storage, disposal and disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligations”). Neither the Company nor any of its subsidiaries have received any notification of or complaint regarding non-compliance with any Data Security Obligation, and there is no pending or, to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have made all disclosures as required by applicable laws and regulatory rules or requirements in connection with such Data Security Obligations, and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the GDPR and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedcorruptants except those that would not, individually singly or in the aggregate, to have result in a Material Adverse Effect, (i) the . The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and appropriate safeguards designed to maintain and protect their material confidential information and the integrity, continuous operationavailability, redundancy and security of all IT Systems and all personal, personally identifiable, or otherwise regulated personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”) used in connection with their respective businesses (collectivelyreasonably consistent with industry standards and practices, the “Confidential Data”)or as required by applicable regulatory standards, and (ii) and, to the knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses access to such Confidential Datathe same, except nor any incidents under internal review or investigations relating to the same, except, in each case, for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually singly or in the aggregate, to have result in a Material Adverse Effect, to the knowledge of the Company, the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing authority relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification except where such non-compliance would not, would not, singly or in the aggregate, result in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have cause a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofand, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”), businesses; and (iiiii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential the Company and its subsidiaries’ IT Systems. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of their IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) reasonably consistent with industry standards and practices, except for those that have been remedied without material cost or liability or the duty to notify any other personas required by applicable regulatory standards. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”)business, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, . There are no privacy or security incidents under internal review or investigations relating to the knowledge of same that would, individually or in the Companyaggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and all (ii) internal policies and contractual obligations of the Company obligations, each (i) and its subsidiaries, governing (ii) relating to the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationCompany Data.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s (i) The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofare, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, same; and (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except, with respect to each of clauses (i) and (iii), as would not, individually or in the aggregate, have a Material Adverse Effect. The Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability as soon they take effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge Knowledge of the Company, its subsidiaries are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (collectively, “Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge operation of the Company’s and its subsidiaries’ businesses (“Breach”) and, there have has been no breachessuch Breach. The Company and its subsidiaries have not been notified of and have no Knowledge of any event or condition that would reasonably be expected to result in, violations, outages any such Breach. This representation is limited in each case to the extent that such breach or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could noncompliance would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to and except as otherwise disclosed in the knowledge of Registration Statement or the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationProspectus.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)) used in connection with their businesses. Except as would not, and (ii) individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost same nor any incidents under internal review or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business respective businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained controls, policies, procedures and safeguards consistent with industry standards and practices for similarly-situated companies to maintain and protect their confidential information and the integrity, continuous operation, redundancy and security of its IT Systems and data (including personal, personally identifiable, sensitive, confidential or regulated data) used or held for use in connection with their respective businesses (collectively, “Data”). There have been no breaches, violations, outages, unauthorized uses or accesses to the IT Systems or Data, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance compliance, with all applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority, authority and all internal policies and privacy policies, contractual obligations of the Company and its subsidiaries, governing industry standards relating to the privacy and security of the IT Systems and Confidential Data and or the protection of such IT Systems and Confidential Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal and disclosure of Data (“Data Security Obligations”) and (ii) there is no action, suit, investigation or modificationproceeding by or before any court, governmental agency, authority or body or other third party pending or, to the knowledge of the Company, threatened against the Company or any of its subsidiaries alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business respective businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained controls, policies, procedures and safeguards consistent with industry standards and practices for similarly-situated companies to maintain and protect their confidential information and the integrity, continuous operation, redundancy and security of its IT Systems and data (including personal, personally identifiable, sensitive, confidential or regulated data) used or held for use in connection with their respective businesses (collectively, “Data”). There have been no breaches, violations, outages, unauthorized uses or accesses to the IT Systems or Data, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance compliance, with all applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority, authority and all internal policies and privacy policies, contractual obligations of the Company and its subsidiaries, governing industry standards relating to the privacy and security of the IT Systems and Confidential Data and or the protection of such IT Systems and Confidential Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal and disclosure of Data (“Data Security Obligations”) and (ii) there is no action, suit, investigation or modificationproceeding by or before any court, governmental agency, authority or body or other third party pending or, to the knowledge of the Company, threatened against the Company or any of its subsidiaries alleging non-compliance with any Data Security Obligation,.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable technical and organizational controls, policies, procedures, and safeguards to (i) maintain and protect their material Personal Data and sensitive, proprietary, confidential information or regulated data (collectively, the “Confidential Data”) from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access and (ii) maintain and protect the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Confidential Data used in connection with their businesses (collectivelybusinesses. Except as would not, individually or in the “Confidential Data”)aggregate, and (ii) reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages outages, security incidents, or violations of any Privacy Requirements in relation to Confidential Data, or unauthorized uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually government authority or in the aggregatesupervisory body, to have a Material Adverse Effect, nor any incidents under internal review or investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, data and databases (including the data and information of their respective clients, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries, and any such data processed or stored by third parties on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no, and no event or condition exists that would result in, breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, ordersOrders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in (A) To the aggregate, to have a Material Adverse Effectknowledge of the Company, the Operating Partnership and each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s and its ’s, the Operating Partnership or their respective subsidiaries’ information technology assets and equipment, computers, computer systems, networks, hardware, software, websitesdata and databases (including the data and information of their respective tenants, applicationscustomers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and databases any such data processed or stored by third parties on behalf of the Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT SystemsSystems and Data”); (B) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge none of the Company, all material bugsthe Operating Partnership or their respective subsidiaries have been notified of, errorsand have no knowledge of any event or condition that would result in, defectsany security breach or incident, Trojan horses, time bombs, malware unauthorized access or disclosure or other compromise to their IT Systems and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, Data and (iC) the Company Company, the Operating Partnership and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and all personal data Data reasonably consistent with industry standards and sensitivepractices, confidential or regulated data maintained or processed as required by the Company applicable regulatory standards, except with respect to clauses (A) and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”B), and (ii) to the knowledge of the Companyfor any such security breach or incident, there have been no breachesunauthorized access or disclosure, violationsor other compromises, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, to have a Material Adverse Effect, or with respect to clause (C), where the knowledge of failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Company Operating Partnership and its their respective subsidiaries are presently in material compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of, accesses to, encryptions of or accesses to such Confidential Datacompromises of same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently have been for the past five (5) years in compliance with all applicable laws or statutes statutes, binding guidance and standards (including the Payment Card Industry Data Security Standard) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. There are no pending or, to the knowledge of the Company, threatened Actions in relation to the matters of this Section 3(jj).

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its Subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (collectively, “Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries Subsidiaries have used commercially reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their the operation of the Company’s and its Subsidiaries’ businesses (collectively“Breach”) and, the “Confidential Data”), and (ii) to the knowledge Knowledge of the Company, there have has been no breachessuch Breach. The Company and its Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, violations, outages any such Breach. This representation is limited in each case to the extent that such breach or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could non-compliance would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to and except as otherwise disclosed in the knowledge of Registration Statement or the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationProspectus.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance compliance, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes statutes, and all judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any contractual or legal obligations regarding the collection, use, transfer, import, export, storage, protection, security, disposal and all internal policies disclosure by the Company and contractual obligations its subsidiaries of IT Systems and Data (“Data Security Obligations”); (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, or are aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation, except in the case of clause (iii), as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have taken steps reasonably necessary in accordance with industry standard practices to protect such information against loss and against unauthorized use, access, misappropriation, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, governing taken as a whole. To the privacy and security knowledge of IT Systems and Confidential Data the Company, except as disclosed in the Registration Statement, the Disclosure Package and the protection Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with all applicable laws and regulations with respect to Data that have been announced as of such IT Systems the date hereof as becoming effective within 12 months after the date hereof, and Confidential Data from unauthorized usefor which any non-compliance with same would be reasonably likely to have a Material Adverse Effect on the Company and its subsidiaries, accesstaken as a whole, misappropriation or modificationas soon as they take effect.

Cybersecurity; Data Protection. Except (i) as described in Registration Statement, the Pricing Disclosure Package and the Prospectus or (ii) as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (A) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofare, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iB) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential confidential, or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses businesses; (collectively, the “Confidential Data”), and (iiC) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedperson or governmental or regulatory authority, individually and there are no incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations by governmental or regulatory authorities or other third parties relating to the knowledge of the Company, same; (D) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, and all their own internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; (E) the Company and its subsidiaries have at all times taken all reasonable steps to safeguard that any Personal Data of the Company and its subsidiaries collected or handled by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (F) the Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon as they took effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or disclosed in the aggregate, to have a Material Adverse EffectRegistration Statement, the Company’s Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofare, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually corruptants designed to damage or in corrupt the aggregate, to have a Material Adverse Effect, IT Systems; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no material breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any material incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, same; (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iv) the Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability) as soon they take effect, except as would not, in the case of each of clause (i), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance compliance, in all material respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any legal obligations regarding the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company and its subsidiaries of Data (“Data Security Obligations”); (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and all internal policies are aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and contractual obligations (iii) there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have taken steps reasonably necessary in accordance with industry standard practices to protect such information against loss and against unauthorized access, use, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, governing taken as a whole. To the privacy and security knowledge of IT Systems and Confidential Data the Company, except as disclosed in the Registration Statement, the Disclosure Package and the protection Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of such IT Systems the date hereof as becoming effective within 12 months after the date hereof, and Confidential Data from unauthorized usefor which any non-compliance with same would be reasonably likely to have a Material Adverse Effect on the Company and its subsidiaries, accesstaken as a whole, misappropriation or modificationas soon they take effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate perform in all material respects in conformance with their functional specifications and perform as required in connection with have not materially malfunctioned or failed during the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of past three (3) years. To the Company’s knowledge, all material the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. Except as , in each case that could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) material impact on the business or operations of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries are presently and at all times have been in full compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its Subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (collectively, “Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their the operation of the Company’s and its Subsidiaries’ businesses (collectively“Breach”) and, the “Confidential Data”), and (ii) to the knowledge Knowledge of the Company, there have has been no breachessuch Breach. The Company and its Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, violations, outages any such Breach. This representation is limited in each case to the extent that such breach or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could non-compliance would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to and except as otherwise disclosed in the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationCommission Documents.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiariessubsidiaires’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the . The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal data and Personal Data, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”)respective businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and all (ii) internal policies and contractual obligations of the Company obligations, each (i) and its subsidiaries, governing (ii) relating to the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationCompany Data.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all applicable internal policies and contractual obligations of the Company and its subsidiariesany other legal obligations, governing in each case, relating to the privacy and security of IT Systems and Confidential Data Data, and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures designed to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data as required by applicable regulatory standards. The Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries, and there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except To the Company and its subsidiaries’ knowledge, except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Time of Sale Information and the Prospectus, (ii) have not malfunctioned or failed and (iii) are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, backdoors, drop dead devices, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their material IT Systems and all personal data and information (including all personal, personally identifiable, household, sensitive, confidential or regulated data maintained or information (“Personal Data”)) used in connection with their businesses, including as processed and stored thereon. There have been no destructions, losses, breaches, outages, compromises or unauthorized or unlawful uses or disclosures of or accesses to the Company’s IT Systems, Personal Data maintained, processed or stored or processed by thereon, or, to the Company and its subsidiaries’ knowledge any such data stored or processed by third parties for or on behalf of the Company or its subsidiaries in connection with their businesses (collectivelyeach, the a “Confidential DataBreach”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have result in a Material Adverse Effect, to the knowledge of the Company, the . The Company and its subsidiaries have not been notified of, and have no knowledge of, any material incidents under internal review or investigation relating to, any Breach. The Company and its subsidiaries have complied with and are presently in compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal policies external policies, contractual obligations, binding industry standards and contractual obligations of any other legal obligations, in each case, to the Company and its subsidiaries, governing extent relating to (x) the privacy and security of the IT Systems and Confidential Data and Personal Data, (y) the protection of such IT Systems and Confidential Personal Data from unauthorized any Breach, or (z) the collection, use, accesstransfer, misappropriation storage, protection, disposal, disclosure or modificationother processing by the Company or any of its subsidiaries of Personal Data, other than as would not reasonably be expected to result, individually or in the aggregate, in a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (A) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform in all respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofare, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iB) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses businesses; (collectively, the “Confidential Data”), and (iiC) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, same; (D) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (E) the Company and its subsidiaries have taken all necessary actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability as soon as they take effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or described in the aggregate, to have a Material Adverse EffectRegistration Statement, the Company’s Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses businesses; (collectively, the “Confidential Data”), and (iiiii) to the knowledge of the Company, there have been no breaches, violations, outages outages, or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, same; and (iv) the Company and its subsidiaries have complied and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal external policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data Personal Data, and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of Personal Data (collectively, the “Data Security Obligations”), except, in the case of each clause above, as would not reasonably be expected to have a Material Adverse Effect. Except as would not reasonably be expected to have a Material Adverse Effect, (i) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and is unaware of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and (ii) there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending, or to the Company’s knowledge, threatened, alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. Except as would has not had or could not reasonably be expectedexpected to have, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company’s Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free conducted and clear of, (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants designed to permit unauthorized access or activity. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person. Except as could not be expected, individually nor are there any incidents under internal review or in the aggregate, investigations relating to have a Material Adverse Effect, to the knowledge of the Company, such IT Systems or Personal Data and the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ The information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases used by or on behalf of the Company or any of its subsidiaries (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have caused to be implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except , nor any incidents under internal review or investigations relating to the same, except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the . The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, To the Company’s and its subsidiaries’ Knowledge, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its Subsidiaries (collectively, “IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, and to the Company’s Knowledge are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) ; the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or processed by the Company and its subsidiaries on behalf of them (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) businesses; to the knowledge of the Company’s Knowledge, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to such Confidential Dataany of the Company’s or any of its Subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any third party; there are no material incidents under internal review or investigations relating to any security breach or other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge compromise of the Company, ’s or any of its Subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its Subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, and all internal policies procedures and contractual obligations of relating to the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except (i) Except, in each case, as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) through which any such Personal Data is collected or processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its subsidiaries has received written notice asserting a violation by the Company or any of its subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its subsidiaries is (i) currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems are adequate for, and operate and perform in all respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Personal Data used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationbusinesses.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)) used in connection with their businesses. Except as would not, and (ii) individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost same nor any incidents under internal review or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or expected to result in the aggregate, to have a Material Adverse EffectChange, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Personal Data) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to except as has been disclosed in the knowledge of Registration Statement and the CompanyProspectus, there have been no breaches, violations, outages or known unauthorized uses of or known accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries have complied, and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all industry guidelines, standards, internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where the failure to be in compliance would not reasonably be expected to result in a Material Adverse Change. The Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practice.

Cybersecurity; Data Protection. Except as would not be expected, individually or in (A) To the aggregate, to have a Material Adverse Effectknowledge of the Company, the Operating Partnership and each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s and its ’s, the Operating Partnership or their respective subsidiaries’ information technology assets and equipment, computers, computer systems, networks, hardware, software, websitesdata and databases (including the data and information of their respective tenants, applicationscustomers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and databases any such data processed or stored by third parties on behalf of the Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT SystemsSystems and Data”); (B) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge none of the Company, all material bugsthe Operating Partnership or their respective subsidiaries have been notified of, errorsand have no knowledge of any event or condition that would result in, defectsany security breach or incident, Trojan horses, time bombs, malware unauthorized access or disclosure or other compromise to their IT Systems and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, Data and (iC) the Company Company, the Operating Partnership and its their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and all personal data Data reasonably consistent with industry standards and sensitivepractices, confidential or regulated data maintained or processed as required by the Company applicable regulatory standards, except with respect to clauses (A) and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”B), and (ii) to the knowledge of the Companyfor any such security breach or incident, there have been no breachesunauthorized access or disclosure, violationsor other compromises, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, to have a Material Adverse Effect, or with respect to clause (C), where the knowledge of failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Company Operating Partnership and its their respective subsidiaries are presently in material compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or described in the aggregate, to have a Material Adverse EffectRegistration Statement, the Company’s Offering Materials and its subsidiaries’ the Prospectus, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) ; the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or processed by the Company and its subsidiaries on behalf of them (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) businesses; to the knowledge of the Company, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to such Confidential Dataany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any third party; there are no material incidents under internal review or investigations relating to any security breach or other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge compromise of the Company’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, and all internal policies procedures and contractual obligations of relating to the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiariesThe Delek Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with necessary for the operation of the business of the Company and its subsidiaries Delek Parties as currently conducted, free except as would not, individually or in the aggregate, have a Material Adverse Change. The Delek Parties conduct industry-standard scans of their IT Systems to detect and clear of, to the knowledge of the Company, all address material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries The Delek Parties have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and sensitive data (including all personal data and sensitivepersonal, personally identifiable, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Sensitive Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the CompanyDelek Parties, there have been no breaches, violations, incidents, compromises, outages or unauthorized uses of or of, accesses to such Confidential Dataor disclosures of same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, to have a Material Adverse EffectChange, and the Delek Parties have not had a duty to the knowledge of the Companynotify any other person of, nor are there any incidents under internal review or investigation relating to, the Company and its subsidiaries same or any event or condition that would reasonably be expected to result in the same. The Delek Parties are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing applicable to the privacy and security of its IT Systems and Confidential Sensitive Data and to the protection of such IT Systems and Confidential Sensitive Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by the Company and its subsidiaries (collectively, “IT Company Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conducted, and are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable industry-standard controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Company Systems and data stored therein (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Private Data”)), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Company Systems and Private Data, except for those that have been remedied without material cost nor are there any incidents under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with (i) all applicable laws or statutes and statutes, (ii) all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, authority and (iii) all internal policies and contractual obligations of the Company and its subsidiariesobligations, governing the privacy and security of IT Systems and Confidential Data and in each case, relating to the protection of such IT Company Systems and Confidential Private Data from unauthorized or illegal use, access, destruction, disclosure, misappropriation or modificationmodification (collectively, the “Company Security and Privacy Obligations”). Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, there is no investigation, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance by the Company or its subsidiaries with any of the Company Security and Privacy Obligations.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained (including protected health information) (“Personal Data”)) collected, used, stored or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) except as would not reasonably be expected, individually or in the aggregate, to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost nor any incidents under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently presently, and since January 1, 2017 have been, in compliance with all applicable laws or statutes (including without limitation, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal policies external privacy policies, applicable industry standards and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, use, transfer, import, export, storage, disposal and disclosure by the Company and its subsidiaries of Personal Data (“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries have made all disclosures to users or customers required by applicable laws and regulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not , in each case that may reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the . The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there its business. There have been no material breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any such actual or in the aggregate, to have a Material Adverse Effect, reasonably suspected incidents under internal review or investigations relating to the same. The Company has no knowledge of any event, circumstances, or condition that would reasonably be expected to result in such breach, violation, outage, compromise, or unlawful or unauthorized acquisition of, disclosure of, use of or access to the Company, the Company Data. The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, and all internal policies and (iii) contractual obligations of the Company and its subsidiariesobligations, governing each (i) -(iii) relating to the privacy and security of IT Systems and Confidential Company Data and to the protection of such IT Systems and Confidential Company Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, the IT Systems are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (“Data”)) contained on the IT Systems and used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cybersecurity and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity, disaster recovery and security plans that are designed to protect against and prevent any breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of, or security incident relating to, any IT Systems or Data used in connection with their the operation of the respective businesses of the Company and its subsidiaries (collectively, the “Confidential DataBreach”), and (ii) to . To the knowledge of the Company, there have has been no breachesBreach, violationsand the Company and its subsidiaries have not been notified of any event or condition that would reasonably be expected to result in any Breach, outages or unauthorized uses of or accesses to such Confidential Datain each case, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not would reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse EffectThe Issuer, the CompanyGuarantor and the Guarantor’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Issuer, the Guarantor and its the Guarantor’s subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedThe Issuer, individually or in the aggregate, to have a Material Adverse Effect, (i) Guarantor and the Company and its Guarantor’s subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses. Except, in each case, as would not, singly or in the “Confidential Data”)aggregate, and (ii) reasonably be expected to the knowledge of the Companyresult in a Material Adverse Effect, there have been (i) no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor (ii) any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Companysame. The Issuer, the Company Guarantor and its the Guarantor’s subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expectedexpected to result in a material adverse effect, individually or in (i) the aggregate, to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT SystemsSystems and Data”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free conducted and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiariesany other legal obligations, governing in each case, relating to the privacy and security of IT Systems and Confidential Data (collectively, the “Data Security Obligations”). Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expected to result in a material adverse effect, (i) the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures to protect against and prevent security breaches of, unauthorized access to and other similar compromises of such IT Systems and Confidential Data from in accordance with industry practices and as required by applicable regulatory standards, (ii) the Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized useaccess or other similar compromise to their IT Systems and Data (“Breach”), access(iii) the Company and its subsidiaries have not received notification of, misappropriation and have no knowledge of, any event or modificationcondition that would reasonably be expected to result in a Breach to their IT Systems and Data, (iv) neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries and (v) there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened in writing alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectivelyare adequate for, “IT Systems”) and operate and perform in all respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except as could not be expectedwould not, individually or in the aggregate, be reasonably expected to have result in a Material Adverse Effect, (i) the Change. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material Personal Data, confidential information and the integrity, continuous operation, redundancy and security of all IT Systems information technology assets and all personal equipment, computers, systems, networks, hardware, software, websites, applications, and databases and data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for those such controls, policies, procedures and safeguards the failure to maintain, or such breaches, violations, outages or unauthorized uses or accesses that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectChange, nor any incidents under internal review or investigations relating to the knowledge same. Except where non-compliance would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Change, the Company and each of its subsidiaries are in compliance with all applicable data privacy and security and data protection laws and regulations regarding the Companycollection, use, transfer, storage, protection, disposal or disclosure of Personal Data (as defined below) processed, stored or collected by the Company and its subsidiaries are presently in compliance with all applicable laws or statutes (collectively, the “Privacy Laws”). “Personal Data” means personally identifiable information, protected health information, financial information, “personal data” as defined by the EU General Data Protection Regulations (EU 2016 679) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the other information subject to Privacy Laws. The Company and its subsidiariessubsidiaries have policies and procedures reasonably designed to (i) ensure compliance with Privacy Laws and its privacy policies on its website or other consumer facing communications; and (ii) reasonably protect the security and confidentiality of all Personal Data. Neither the Company nor any subsidiary has received written notice of any actual or potential material liability under or relating to, governing or actual or potential material violation of, any of the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationPrivacy Laws.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiariesCompany Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its subsidiaries their Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except corruptants except as could would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the . The Company Parties and its subsidiaries their Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitivepersonal, confidential personally identifiable or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to businesses. To the knowledge of the CompanyCompany Parties, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential the IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except , nor any incidents under internal review or investigations relating to the same and the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as could would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to the knowledge of the Company, the . The Company Parties and its subsidiaries their Subsidiaries are presently in compliance in all material respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company Parties and their Subsidiaries have used reasonable best efforts to implement backup and disaster recovery technology consistent with industry standards and practices in all material respects.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to the Agents, or to counsel for the Agents, pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the Company to the Agents as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the . The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal data and Personal Data, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”)respective businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and all (ii) internal policies and contractual obligations of the Company obligations, each (i) and its subsidiaries, governing (ii) relating to the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationCompany Data.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or ​ otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not , in each case that may reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the . The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there its business. There have been no material breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any such actual or in the aggregate, to have a Material Adverse Effect, reasonably suspected incidents under internal review or investigations relating to the same. The Company has no knowledge of any event, circumstances, or condition that would reasonably be expected to result in such breach, violation, outage, compromise, or unlawful or unauthorized acquisition of, disclosure of, use of or access to the Company, the Company Data. The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, and all internal policies and (iii) contractual obligations of the Company and its subsidiariesobligations, governing each (i) -(iii) relating to the privacy and security of IT Systems and Confidential Company Data and to the protection of such IT Systems and Confidential Company Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its Subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (collectively, “Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their the operation of the Company’s and its Subsidiaries’ businesses (collectively“Breach”) and, the “Confidential Data”), and (ii) to the knowledge Knowledge of the Company, there have has been no breachessuch Breach. The Company and its Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, violations, outages any such Breach. This representation is limited in each case to the extent that such breach or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could non-compliance would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, to and except as otherwise disclosed in the knowledge of Registration Statement or the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationProspectus.

Cybersecurity; Data Protection. (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, Effect on the Company’s Company and its subsidiaries’ information technology assets , taken as a whole, (x) the Company and equipment, computers, its subsidiaries own or have a valid right to access and use all computer systems, networks, hardware, software, websitestechnical databases, applicationswebsites and equipment used to process, store, maintain and databases operate data, information and functions used in connection with the Company’s and its subsidiaries’ businesses (collectively, the “Company IT Systems”), and (y) the Company IT Systems are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company Company’s and its subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of, to the knowledge of the Company, all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. ; (ii) Except as could not be expecteddisclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) Effect on the Company and its subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries, policiestaken as a whole, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by neither the Company and nor any of its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including but not limited to the MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in connection any manner that requires or has required, with their businesses respect to any proprietary software authored and owned by or on behalf of the Company or its subsidiaries, any such software code to be (collectivelyx) disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the “Confidential Data”)Prospectus, and (ii) to the knowledge of the CompanyGeneral Disclosure Package, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, Effect on the Company and its subsidiaries, taken as a whole, (x) the Company and each of its subsidiaries are presently in compliance with all internal and external privacy policies, applicable laws or statutes and all contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any other legal obligations, in each case, relating to privacy or security with respect to the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company or any of its subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, sensitive, confidential or regulated data (“Data Security Obligations”, and all internal policies such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and contractual obligations of (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, governing taken as a whole, (i) the privacy Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (ii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security of IT Systems and Confidential Data data protection controls, policies and the protection of such IT Systems procedures that are designed to protect against and Confidential Data from prevent breach, destruction, loss, unauthorized distribution, use, accessdisablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus or as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free including in terms of functionality and clear ofperformance, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and confidential data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data, including, without limitation, any data maintained or processed which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Company Health Information Technology for Economic and its subsidiaries Clinical Health Act (collectively, “HIPAA”), “personal data” as defined by the European Union General Data Protection Regulation (EU 2016/679 or “GDPR”), and any other piece of information that allows the identification of a natural person, or his or her family, or data related to an identified person’s health or sexual orientation (collectively, “Personal Data”)) used in connection with their businesses businesses; (collectively, the “Confidential Data”), and (iiiii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential any IT Systems or Personal Data, except for those that have been remedied without material cost nor any incidents under internal review or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, same and (iv) the Company and its subsidiaries are presently and have been at all times in compliance with all applicable laws laws, directives or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or supragovernmental or regulatory authority, and all internal policies and policies, contractual obligations of the Company and its subsidiaries, governing industry standards relating to the privacy and security of IT Systems and Confidential Personal Data, including, without limitation, the GDPR, the UK Data Protection ▇▇▇ ▇▇▇▇, EU Directive 2002/58/EC and all applicable national implementing legislation (“Data Protection Laws”) and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (v) the Company and its subsidiaries have used commercially reasonable efforts to require their vendors, service providers or other third parties that have received access to any Personal Data from the Company or its subsidiaries to protect the privacy, security and confidentiality of such Personal Data.

Cybersecurity; Data Protection. Except as described in the Registration Statement and the Prospectus or would not be reasonably expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ subsidiary’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiary) (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiary, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, known Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; and (iii) the Company and its subsidiaries subsidiary have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (“Data”)) used in connection with their businesses, except as would not reasonably be excepted to result in a Material Adverse Effect. Without limiting the foregoing, the Company and its subsidiaries Subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, misuse, unauthorized access, disablement, misappropriation or modification, or other compromise of the IT Systems or Data used in connection with their the operation of the Company’s and its Subsidiaries’ businesses (collectively, the “Confidential DataBreach”), and (ii) to . To the knowledge of the Company, there have has been no breaches, violations, outages or unauthorized uses Breach and the Company has not been notified of or accesses to such Confidential Data, except for those that and have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the no knowledge of the Companyany event or condition that would reasonably be expected to result in, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ The information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or used by the Company or its subsidiaries (collectively, “IT Systems”) are reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofand, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants that would cause a material disruption to the operation of the business of the Company and its subsidiaries. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect the secrecy of their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in the Company’s possession or control (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained (“Personal Data”)) collected, used, stored or processed by the Company and its subsidiaries in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, in each case, except for those that as have been remedied without material cost or liability or the duty not had, and would not reasonably be expected to notify any other person. Except as could not be expectedhave, individually or in the aggregate, to have a Material Adverse Effect, nor any incidents under internal review or investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, in each case, except as have not had, and would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect.

Cybersecurity; Data Protection. Except as otherwise disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus or except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, : (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform as reasonably required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofand, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Data”)) used in connection with their businesses businesses; (collectively, iii) without limiting the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Companyforegoing, the Company and its subsidiaries are presently in compliance have used reasonable efforts to establish, maintain, implement and comply with all applicable laws or statutes reasonable information technology, information security, cyber security and all judgmentsdata protection controls, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any of the Company’s or its subsidiaries’ information technology system or Data (“Breach”) and there has been no such Breach; and (iv) the Company and its subsidiariessubsidiaries have not been notified of, governing the privacy and security have no knowledge of IT Systems and Confidential Data and the protection of any event or condition that would reasonably be expected to result in, any such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would not be expected, individually or disclosed in the aggregateRegistration Statement, to have a Material Adverse Effectthe Pricing Disclosure Package and the Prospectus, (i) the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as corruptants that could not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, ; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for (x) those that did not or would not reasonably be expected to result in a Material Adverse Effect and (y) those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any material incidents under internal review or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, investigation; (iii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes (including the European Union General Data Protection Regulation to the extent applicable) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, have a Material Adverse Effect; and (iv) the Company and its subsidiaries have initiated steps reasonably necessary to prepare to timely comply with applicable requirements under the California Consumer Privacy Act of 2018.

Cybersecurity; Data Protection. Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (A) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear ofare, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iB) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential household or regulated data maintained or information collected, stored or processed by the Company and or its subsidiaries (“Personal Data”)) used in connection with their businesses businesses; (collectively, the “Confidential Data”), and (iiC) to the best knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to such Confidential the IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedperson or governmental or regulatory authority, individually or in the aggregateand there are no incidents or, to have a Material Adverse EffectCompany’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the knowledge of the Company, same; (D) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, and all their own internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, loss, access, processing, misappropriation or modification, including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and all other laws and regulations with respect to Personal Data applicable to the Company or its subsidiaries (“Privacy Laws”); (E) the Company and its subsidiaries have not received notice of any actual or potential violation of any Privacy Laws and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened against the Company or its subsidiaries alleging non-compliance with Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken commercially reasonable steps to require that any Personal Data of the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear ofthe Prospectus, and (ii) to the knowledge of the Company’s knowledge, all material such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptantsharmful code. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries subsidiaries, taken as a whole, are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectEffect and except as described in each of the Registration Statement, the Company’s Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and assets, equipment, computers, systems, networks, software, hardware, softwarecomputers, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse EffectEffect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data, including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Data”) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost nor any incidents currently under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge Effect and except as described in each of the CompanyRegistration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and collected, stored, processed, transferred, disclosed or used by the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation Company or modificationits subsidiaries.

Cybersecurity; Data Protection. Except as would not be expected, individually or disclosed in the aggregateRegistration Statement, to have a Material Adverse Effectin the Prospectus and in the Pricing Disclosure Package, the Company’s Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or disclosed in the aggregateRegistration Statement, to have a Material Adverse Effectin the Prospectus and in the Pricing Disclosure Package, (i) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to except as disclosed in the knowledge of Registration Statement, in the CompanyProspectus and in the Pricing Disclosure Package and except as would not, individually or in the aggregate, have a Material Adverse Change, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. Except as could not be expected, individually or disclosed in the aggregateRegistration Statement, to have a Material Adverse Effect, to in the knowledge of Prospectus and in the CompanyPricing Disclosure Package, the Company and its subsidiaries the Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except as would not, individually or in the aggregate, have a Material Adverse Change.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expectedexpected to result in a material adverse effect, individually or in (i) the aggregate, to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free conducted and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiariesany other legal obligations, governing in each case, relating to the privacy and security of IT Systems and Confidential Data (collectively, the “Data Security Obligations”). Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expected to result in a material adverse effect, (i) the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures to protect against and prevent security breaches of, unauthorized access to and other similar compromises of such IT Systems and Confidential Data from in accordance with industry practices and as required by applicable regulatory standards, (ii) the Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized useaccess or other similar compromise to their IT Systems and Data (“Breach”), access(iii) the Company and its subsidiaries have not received notification of, misappropriation and have no knowledge of, any event or modificationcondition that would reasonably be expected to result in a Breach to their IT Systems and Data, (iv) neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries and (v) there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened in writing alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries. Any certificate signed by any officer of the Company and delivered to the Managers or to counsel for the Managers in connection with this Agreement or any Terms Agreement shall be deemed a representation and warranty by the Company, as to matters covered thereby, to the Managers.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the . The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal data and Personal Data, personally identifiable, sensitive, confidential or regulated data maintained or processed by the data) (“Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”)its business, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are is presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and all (ii) internal policies and contractual obligations of the Company obligations, each (i) and its subsidiaries, governing (ii) relating to the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationCompany Data.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to Virtu, or to counsel for Virtu, pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the Company to Virtu as to the matters set forth therein.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Disclosure Package, and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have established, implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and material data (including all personal data and personal, personally identifiable, household, sensitive, confidential or regulated data maintained or processed by the information (“Company and its subsidiaries Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”), in compliance with all applicable laws and (ii) to regulatory standards in all material respects. To the knowledge of the Company, there have been no material breaches, violations, outages outages, security incidents or unauthorized uses of or accesses to such Confidential any IT Systems or Company Data. The Company and its subsidiaries own or have a valid right to access and use all IT Systems and Company Data, except for those that and have been remedied without complied in all material cost respects and are presently in material compliance with all applicable laws and statutes, judgments, rules and regulations of any court or liability or the duty to notify other governmental authority, binding industry standards, internal and external policies and notices, contractual obligations and any other personlegal obligations, in each case relating to the collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing by or on behalf of the Company or any of its subsidiaries of Company Data (“Data Security Obligations”). Except as could not be expectedNeither the Company nor any of its subsidiaries have received any notification of or complaint regarding, individually or in otherwise have knowledge of any facts that would indicate, any material non-compliance by the aggregateCompany or any of its subsidiaries with any Data Security Obligation. There is no action, to have a Material Adverse Effectsuit, investigation or proceeding against the Company or any of its subsidiaries by or before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened, against the Company and or any of its subsidiaries are presently in alleging material non-compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of Data Security Obligations by the Company and or any of its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free conducted and clear of, (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses, disabling code and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by (“Data”)) used in connection with the business of the Company and its subsidiaries in connection with their businesses (collectivelyas currently conducted, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datathe same, except for those that, individually or in the aggregate, would not reasonably be expected to have a Material Adverse Effect or that have been remedied without material cost or liability or the duty to notify any other person. Except , nor have there been any incidents under internal review or investigations related to the same, except for any such incidents or investigations as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the . The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except for such failures as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not be expected, individually or in the aggregate, to aggregate have a Material Adverse EffectEffect on the Company and its subsidiaries, taken as a whole, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not be expectedhave, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, household, sensitive, confidential or regulated data maintained or processed by (“Personal Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries have used commercially reasonable efforts to establish and maintain and have established, maintained, implemented and complied with, except as would not have, individually or in the aggregate, a Material Adverse Effect, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their the operation of the Company’s and its subsidiaries’ businesses (collectively“Breach”). Except as disclosed in the Registration Statement, the “Confidential Data”)Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, and (ii) taken as a whole, to the knowledge of the Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would not reasonably be expectedexpected to have, individually or in the aggregate, to have a Material Adverse Effect, the CompanyIssuer’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries Issuer as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have The Issuer has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained (including protected health information) (“Personal Data”)) collected, used, stored or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) except as would not reasonably be expected to have, individually or in the knowledge of the Companyaggregate, a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost nor any incidents under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could would not reasonably be expectedexpected to have, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of Issuer has been for the Company, the Company past three (3) years and its subsidiaries are presently in compliance with all applicable laws Laws or statutes (including the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal policies external privacy policies, applicable industry standards and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, use, transfer, import, export, storage, disposal and disclosure by the Issuer of Personal Data (“Data Protection Obligations”). The Issuer has not received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Issuer, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Issuer has taken commercially reasonable steps in accordance with industry standard practices (including implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Issuer. Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, the Issuer has made all disclosures to users or customers required by applicable Laws and regulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable Laws or regulatory rules and requirements.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as reasonably required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and confidential data (including all personal data and sensitive, confidential sensitive or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)) used in connection with their businesses. Except as would not, and (ii) individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost same nor any incidents under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the The Company’s and its subsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data maintained and all data that comes within a definition of “personal information,” “personal data” or processed by the other similar term under Data Protection Requirements) (collectively, “Company and its subsidiaries Data”) used in connection with their businesses (collectively, the “Confidential Data”)business, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to such Confidential Datathe same, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except in each case as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a material impact on the Company and its Subsidiary, considered as a whole. There are no privacy or security incidents under internal review or investigations relating to the same that would, individually or in the aggregate, reasonably be expected to have a material impact on the Company and its Subsidiary, considered as a whole. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are is presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and all (ii) internal policies and contractual obligations of the Company obligations, each (i) and its subsidiaries, governing (ii) relating to the privacy and security of IT Systems and Confidential Company Data and the protection of such IT Systems and Confidential (“Data from unauthorized use, access, misappropriation or modificationProtection Requirements”).

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, to have result in a Material Adverse Effect, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in capacity and operation for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, to the Company’s knowledge, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained collected, used or otherwise processed by the Company and it or on its subsidiaries behalf in connection with their businesses (collectively, the “Confidential Personal Data”), and (ii) to in each case except as would not, individually or in the knowledge of aggregate, result in a Material Adverse Effect. Except as would not, individually or in the Companyaggregate, result in a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of of, or accesses to to, such Confidential IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, to have result in a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are is presently in compliance with all applicable laws or statutes and all applicable and binding judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and with all of the Company’s internal policies and contractual obligations of the Company and its subsidiariesobligations, governing in each case, relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. Neither the Company nor any of its subsidiaries (i) is subject to any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the CSRC, or any other relevant governmental authority of the PRC, or (ii) has received notice of any pending or, to the knowledge of the Company, threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental or regulatory authorities of the PRC on the Company, its subsidiaries or any of their respective directors, officers and employees.

Cybersecurity; Data Protection. Except as would not reasonably be expected, individually or in the aggregate, expected to have a Material Adverse Effect, (i) the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear ofthe Prospectus, and (ii) to the knowledge of the Company’s knowledge, all material such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptantsharmful code. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries subsidiaries, taken as a whole, are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s (i) Each SDC Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform their core functionality as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free except as would not, individually or in the aggregate, be material to each SDC Party and clear ofits subsidiaries, taken as a whole, (ii) to the knowledge of the CompanySDC Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except , except as could not be expectedwould not, individually or in the aggregate, be material to have each SDC Party and its subsidiaries, taken as a Material Adverse Effect, whole; (iiii) the Company SDC Parties and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards that are commercially reasonable for their industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal personal, personally identifiable, regulated (including Protected Health Information under HIPAA) or confidential data and sensitive, confidential or regulated data maintained collected or processed by the Company and or its subsidiaries in connection with their businesses (collectively“Personal Data”) and (iv) except as otherwise disclosed in the Registration Statement, the “Confidential Data”)Pricing Disclosure Package and the Prospectus, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedotherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge Company’s knowledge, there have been no breaches or unauthorized uses of or accesses to such IT Systems or Personal Data. Except as would not, individually or in the Companyaggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all statutes, payment card industry data security standards, judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all the Company’s and its subsidiaries’ applicable internal and customer-facing policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. No SDC Party or any of their subsidiaries is under investigation by any Governmental Authority or has received any oral, written or other claim, complaint, inquiry, or notice from any third party or any Governmental Authority related to whether the Company’s collection, processing, use, storage, security and/or disclosure of Personal Data is in violation of any applicable laws or privacy policies, or otherwise constitutes an unfair, deceptive or misleading trade practice.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and information technology equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate in capacity and level of performance for, and operate and perform as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conducted, (ii) in the past five years have not malfunctioned or failed and (iii) to the Company’s knowledge, are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants, including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems. Except as could not be expectedwould not, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have in the past five years implemented and maintained commercially reasonable controls, policies, procedures, and safeguards consistent with applicable regulatory requirements and customary industry practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and information (including all personal, personally identifiable, sensitive, confidential or regulated data and information of their respective customers, employees, suppliers, vendors or other third parties collected, used, stored, maintained or otherwise processed by or on behalf of the Company and or any of its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)) within their possession or operational control, and (ii) to the knowledge of the Company, there have been no breachesbreaches of the security of, violationsoutages, outages destructions, losses, misappropriations, misuses or unauthorized uses uses, modifications or disclosures of or unauthorized accesses to such Confidential Datasame (each, a “Breach”), except for those that have been remedied without material cost or liability or the duty to notify any other person; and (iii) the Company and its subsidiaries have not been notified of, and have no knowledge of, any event or condition that would reasonably be expected to result in any Breach, or any incidents under internal review or investigations relating to the same. Except as could would not be expected, individually or in the aggregate, to have a Material Adverse Effect, to during the knowledge of the Company, past five years (i) the Company and its subsidiaries have complied and are presently in compliance with all applicable laws or and statutes and all judgmentsrules, ordersregulations, rules industry standards and regulations statutes, judgments and orders of any applicable court or arbitrator or governmental or regulatory authority, the Company’s and all its subsidiaries’ internal and external policies and contractual obligations of and other legal obligations, in each case, relating to privacy, data protection or cybersecurity with respect to the Company and its subsidiariesuse, governing the privacy protection, and security of IT Systems and Confidential the collection, use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of Data (collectively, the “Data Security Obligations”) and to the protection of such IT Systems and Confidential Data from unauthorized usea Breach; (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding its, accessor is aware of any other facts that, misappropriation individually or modificationin the aggregate, would reasonably indicate its non-compliance with any Data Security Obligation, and there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries; and (iii) the Company and its subsidiaries have implemented reasonable backup and disaster recovery technology consistent with applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. Except as would not be expected, individually or described in the aggregate, to have a Material Adverse EffectRegistration Statement and the Prospectus, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) ; the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or processed by the Company and its subsidiaries on behalf of them (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”), and (ii) businesses; to the knowledge of the Company, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to such Confidential Dataany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any third party; there are no material incidents under internal review or investigations relating to any security breach or other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge compromise of the Company’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, and all internal policies procedures and contractual obligations of relating to the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, Effect on the Company’s Company and its subsidiaries’ information technology assets , taken as a whole, (x) the Company and equipment, computers, its subsidiaries own or have a valid right to access and use all computer systems, networks, hardware, software, websitestechnical databases, applicationswebsites and equipment used to process, store, maintain and databases operate data, information and functions used in connection with the Company’s and its subsidiaries’ businesses (collectively, the “Company IT Systems”), and (y) the Company IT Systems are adequate for, and operate and perform as required in connection with with, the operation of the business of the Company Company’s and its subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of, to the knowledge of the Company, all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. ; (ii) Except as could not be expecteddisclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) Effect on the Company and its subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries, policiestaken as a whole, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by neither the Company and nor any of its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including but not limited to the MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in connection any manner that requires or has required, with their businesses respect to any proprietary software authored and owned by or on behalf of the Company or its subsidiaries, any such software code to be (collectivelyx) disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the “Confidential Data”)Prospectus, and (ii) to the knowledge of the CompanyGeneral Disclosure Package, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, Effect on the Company and its subsidiaries, taken as a whole, (x) the Company and each of its subsidiaries are presently in compliance with all internal and external privacy policies, applicable laws or statutes and all contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any other legal obligations, in each case, relating to privacy or security with respect to the collection, use, transfer, import, export, storage, protection, disposal and all internal policies disclosure by the Company or any of its subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, sensitive, confidential or regulated data (“Data Security Obligations,” and contractual obligations such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, governing taken as a whole, (i) the privacy Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (ii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security of IT Systems and Confidential Data data protection controls, policies and the protection of such IT Systems procedures that are designed to protect against and Confidential Data from prevent breach, destruction, loss, unauthorized distribution, use, accessdisablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could would not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by any officer or other authorized signatory of the Company and delivered to the Underwriters or to counsel for the Underwriters shall be deemed a representation and warranty by the Company to the Underwriters as to the matters covered thereby.

Cybersecurity; Data Protection. Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not be expected, individually or in the aggregate, to aggregate have a Material Adverse EffectEffect on the Company and its subsidiaries, taken as a whole, the Company’s Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could would not be expectedhave, individually or in the aggregate, to have a Material Adverse EffectEffect or as disclosed in the Registration Statement, (i) the Time of Sale Information or the Prospectus, the Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, household, sensitive, confidential or regulated data maintained or processed by (“Personal Data”)) used in connection with their businesses. Without limiting the foregoing, the Company and its subsidiaries have used commercially reasonable efforts to establish and maintain and have established, maintained, implemented and complied with, except as would not have, individually or in the aggregate, a Material Adverse Effect or as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with their the operation of the Company’s and its subsidiaries’ businesses (collectively“Breach”). Except as disclosed in the Registration Statement, the “Confidential Data”)Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, and (ii) taken as a whole, to the knowledge of the Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses. Except as would not, individually or in the “Confidential Data”)aggregate, and (ii) reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential the Company and its subsidiaries’ IT Systems or data (including Personal Data), except for those that have been remedied without material cost nor any incidents under internal review or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same. The Company and its subsidiaries are presently in material compliance with (i) all applicable worldwide laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all (ii) their internal policies and contractual obligations obligations, in each case of the Company (i) and its subsidiaries(ii), governing relating to the privacy and security of IT Systems and Confidential Data Personal Data, including the creation, collection, receipt, acquisition, storage, maintenance, use, disclosure, transfer, transmission, disposition, retention, and processing of Personal Data, and to the security and protection of such IT Systems and Confidential Personal Data from unauthorized use, access, disclosure, acquisition, misappropriation or modification. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have taken all necessary actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof.

Cybersecurity; Data Protection. Except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of the Company or any of its subsidiaries ) (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained (including protected health information) (“Personal Data”)) collected, used, stored or otherwise processed by the Company and its subsidiaries in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) except as would not, individually or in the aggregate, reasonably be expected to the knowledge of the Companyhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost nor any incidents under internal review or liability or investigations relating to the duty to notify any other personsame. Except as could not be expectedwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently presently, and since formation have been, in compliance with all applicable laws or statutes (including without limitation, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and all internal policies external privacy policies, applicable industry standards and contractual obligations of the Company and its subsidiariesobligations, governing in each case, relating to the privacy and security of IT Systems and Confidential Data and Personal Data, the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification or the collection, use, transfer, import, export, storage, disposal, disclosure or other processing by the Company and its subsidiaries of Personal Data (“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have made all disclosures to users or customers required by the Data Protection Obligations, including applicable laws and regulatory rules or requirements, and no such disclosures have been inaccurate or in violation of any such Data Protection Obligations, applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate perform in all material respects in conformance with their functional specifications and perform as required in connection with have not materially malfunctioned or failed during the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of past three (3) years. To the Company’s knowledge, all material the IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. Except as , in each case that could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) material impact on the business or operations of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same . The Company and its subsidiaries are presently and at all times have been in full compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s (i) Each Company Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the such Company Party and its subsidiaries as currently conducted, free and clear ofare, to the knowledge of the CompanyCompany Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the each Company Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same; (iii) each Company Party and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except (A) To the knowledge of the Company, there has been no material security breach or other compromise of the Company’s or its Subsidiaries’ information technology and computer systems, networks, hardware, software and databases (collectively “IT Systems”) or data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”) and information of their respective customers, employees, suppliers, vendors and any third parties maintained, processed or stored by the Company and its Subsidiaries, and any such data processed or stored by third parties on behalf of the Company and its Subsidiaries); (B) neither the Company nor its Subsidiaries have been notified of, and each of them have no knowledge of any material event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; (C) except as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and technical safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and all personal data Personal Data reasonably consistent with industry standards and sensitivepractices, confidential or regulated data maintained or processed as required by applicable regulatory standards; (D) the Company and its subsidiaries Subsidiaries have at all times in connection with their businesses (collectively, the “Confidential Data”)past three years been in material compliance with, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in material compliance with with, all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and all applicable legal obligations regarding the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company and its Subsidiaries of Personal Data (“Data Security Obligations”); and (E) except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any applicable court or governmental agency, authority or body alleging non-compliance by the Company or its subsidiaries with any Data Security Obligations.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s (i) Each Company Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the such Company Party and its subsidiaries as currently conducted, free and clear ofare, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, ; (iii) the each Company Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries (“Personal Data”)) used in connection with their businesses (collectively, the “Confidential Data”)businesses, and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Datasame, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually nor any incidents under internal review or in the aggregate, to have a Material Adverse Effect, investigations relating to the knowledge of the Company, the same; (iii) each Company Party and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect.

Cybersecurity; Data Protection. Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s The Company and its Brilliant Earth and their subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business businesses of the Company and its Brilliant Earth and their subsidiaries as currently conducted, (ii) have not malfunctioned or failed and, (iii) to the Company’s or Brilliant Earth’s knowledge, are free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants. Except , including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems, in each case (i) – (iii), except as could would not reasonably be expectedexpected to, individually or in the aggregate, to have a Material Adverse Effect, (i) material adverse effect on the Company and its Brilliant Earth and their subsidiaries’, taken as a whole. The Company and Brilliant Earth and their subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards consistent with applicable regulatory standards and customary industry practices designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and information (including all personal, personally identifiable, sensitive, confidential or regulated data and information of their respective customers, employees, suppliers, vendors or any other third-party data, to the extent such data is personal, personally identifiable, sensitive, confidential or regulated, collected, used, stored, maintained or otherwise processed by or on behalf of the Company and its subsidiaries or Brilliant Earth or any of their subsidiaries) (collectively, “Data”) used in connection with their businesses (collectivelybusinesses, the “Confidential Data”)and, and (ii) to the knowledge of the Company’s or Brilliant Earth’s knowledge, there have been no breaches, violations, outages outages, destructions, losses, misappropriations, modifications, misuses or unauthorized uses or disclosures of or accesses to such Confidential Datasame (each, a “Breach”), except for those that have been remedied without material cost or liability or the duty to notify any other person. Except The Company and Brilliant Earth and their subsidiaries have not been notified of, and have no knowledge of, any event or condition that would reasonably be expected to result in any Breach, or any incidents under internal review or investigations relating to the same, except as could would not reasonably be expectedexpected to, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, material adverse effect on the Company and its Brilliant Earth and their subsidiaries’, taken as a whole. The Company and Brilliant Earth and their subsidiaries have complied and are presently in material compliance with all applicable laws or statutes laws, rules, regulations, industry standards and all judgmentsstatutes, orders, rules judgments and regulations orders of any court or arbitrator or governmental or regulatory authority, and all internal external policies and contractual obligations of obligations, in each case, relating to the Company and its subsidiariescollection, governing the use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of IT Systems and Confidential Data (collectively, the “Data Security Obligations”) and to the protection of such IT Systems and Confidential Data from unauthorized usea Breach. Neither the Company nor Brilliant Earth nor any of their subsidiaries has received any written notification of or written complaint from any governmental or regulatory agency, accessauthority or body regarding, misappropriation or modificationis aware of any other facts that, individually or in the aggregate, that would reasonably indicate non-compliance with any Data Security Obligation and there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s or Brilliant Earth’s knowledge, threatened alleging non-compliance with any Data Security Obligation. The Company and Brilliant Earth and their subsidiaries have implemented reasonable backup and disaster recovery technology consistent with applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. Except (i) Except, in each case, as would not be expectednot, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) through which any such Personal Data is collected or processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its Subsidiaries has received written notice asserting a violation by the Company or any of its subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its Subsidiaries is (i) currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems are adequate for, and operate and perform in all respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the The Company and its subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries Personal Data used in connection with their businesses (collectively, the “Confidential Data”), and (ii) to the knowledge of the Company, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, to the knowledge of the Company, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationbusinesses.