Common use of Security Breach Clause in Contracts

Security Breach. 15.6.1. If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided as soon as possible after the execution of this Agreement. 15.6.2. In the event Affirm suffers or learns of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4. In the event of a Security Complaint directed at Affirm, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties shall promptly work in good faith to determine the appropriate actions to be taken in connection with such Security Complaint.

Security Breach. 15.6.1. If Affirm maintainsi. CoreWeave shall notify Customer at [*] immediately (and in any event, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided as soon as possible after the execution of this Agreement. 15.6.2. In the event Affirm suffers or learns of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within i) no more later than [***] or (except that notice ii) in accordance with the applicable Data Protection Requirements, whichever is shorter) following the discovery by CoreWeave of any Security Incident. CoreWeave shall provide to Shopify may Customer any and all information relating to such Security Incident and assistance Customer requires to enable it to discharge its obligations under Data Protection Requirements including all information required to be delayed if notified to the supervisory authority pursuant to applicable Data Protection Requirements and assistance as are required by law enforcement or other Regulatory Authority)Customer in connection with such notification and for Customer’s notification to the relevant data subjects of such Security Incident, Affirm as applicable. ii. CoreWeave’s notification of a Security Incident will notify its primary Shopify contact and provide an estimate describe: (a) the nature of the Security Breach’s effect on Shopify. Affirm will diligently investigate Incident including the cause of Customer resources impacted; the measures CoreWeave has taken, or plans to take, to address the Security Breach Incident and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In mitigate its potential risk; (b) the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what actionmeasures, if any, CoreWeave recommends that Customer take to address the Security Incident; and (c) details of a contact point where more information can be obtained. If it is not possible to provide all such information at the same time, CoreWeave’s initial notification will contain the information then available and further information will be takenprovided without undue delay as it becomes available. iii. To Unless required by Data Protection Requirements, CoreWeave shall not notify or make any statement (or provide any documents) to any third party (including the extent requested media, vendors, consumers, relevant regulators and supervisory authorities and individuals affected by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and Incident) about such Security Incident and/or matters concerning any known Customer Information or suspected criminal activityProcessed Customer Data, without the prior written approval of Customer. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4. In Where CoreWeave is legally required to make a statement (or provide any documents) without the event approval of a Security Complaint directed at AffirmCustomer, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties CoreWeave shall promptly work provide to Customer a copy of any such statements or documents unless prohibited by Applicable Law. Customer may take enforcement action against CoreWeave, including limiting, suspending, or terminating CoreWeave’s access to all or any portion of Customer Information or Processed Customer Data or taking other action that may be reasonably necessary to protect the privacy or security thereof, if: (i) Customer determines in good faith its reasonable discretion that CoreWeave has violated this Agreement; and/or (ii) CoreWeave fails to determine the appropriate actions reasonably cooperate with Customer’s reasonable request from time to be taken in connection with such Security Complainttime for information regarding CoreWeave’s privacy and security practices.

Security Breach. 15.6.1GRS shall promptly notify Client (and in any event within 48 hours) upon GRS becoming aware of any Security Breach. If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will Such notification must be provided as soon as possible after the execution of this Agreement. 15.6.2by email with a copy to GRS’s primary business contact within Client and shall include sufficient information to allow Client to meet any reporting obligations under applicable Data Protection Legislation. In the event Affirm suffers or learns GRS shall not inform any third party of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, except as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if strictly required by law enforcement or other Regulatory Authority)applicable law, Affirm will notify its primary Shopify contact and provide an estimate of without first obtaining Client’s prior written consent. To the extent the Security BreachBreach originates with GRS, GRS shall take steps to immediately identify and remediate the Security Breach and prevent any further Security Breach at GRS’s effect on Shopifysole expense. Affirm will diligently investigate GRS agrees that Client shall have the cause sole right to determine: (i) whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in Client’s discretion; and promptly create (ii) the contents of such notice, whether any type of remediation may be offered to affected persons, and enact a corrective action plan to prevent future breaches. 15.6.3the nature and extent of any such remediation. In the case of GRS shall reimburse Client for costs it incurs in responding to, remediating, and/or mitigating damages caused by a Security Breach involving Protected InformationBreach, Affirm will including all costs of notice and/or remediation, or in following up a complaint by an individual Data Subject or a regulator. GRS shall cooperate fully with Shopify Client in the investigation and response to correct any Security Breach Breach, including providing the name and notify each Customer as contact information for GRS’s primary security contact who shall be available to assist Client in resolving obligations associated with a Security Breach. In addition, GRS agrees to: (i) provide Client with physical access to the facts facilities and circumstances of operations affected; (ii) facilitate interviews with GRS’s employees and others involved in the breach of the Customer’s particular information. Affirm agrees not matter; and (iii) make available and/or preserve all relevant records, logs, files, data reporting and other materials required to notify any Regulatory Authoritycomply with applicable law orregulation, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm subject to provide such notification (such notification confidentiality and legal obligations applicable to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security BreachGRS. 15.6.4. In the event of a Security Complaint directed at Affirm, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties shall promptly work in good faith to determine the appropriate actions to be taken in connection with such Security Complaint.

Security Breach. 15.6.1. 15.6.1 If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided as soon as possible after the execution of this Agreement. 15.6.2. 15.6.2 In the event Affirm suffers or learns of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. 15.6.3 In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4. 15.6.4 In the event of a Security Complaint directed at Affirm, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties shall promptly work in good faith to determine the appropriate actions to be taken in connection with such Security Complaint.

Security Breach. 15.6.1. If Affirm maintainsAvolve will notify Customer promptly and in no event later than one (1) business day following Avolve’s discovery of a Data Security Breach (defined below) and shall (i) undertake a reasonable investigation of the reasons for and the circumstances surrounding such Data Security Breach and (ii) reasonably cooperate with Customer in connection with such investigation, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies including by providing Customer with an initial summary of incident response policies and procedures and evidence the results of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided Avolve’s investigation as soon as possible possible, but in all cases within two (2) business days after the execution of this Agreement. 15.6.2. In date Avolve discovered or reasonably suspected a Data Security Breach, and then regular updates on the event Affirm suffers or learns of investigation as it progresses; (iii) not make any actual public announcements relating to such Data Security Breach without Customer’s prior written approval, which shall not be unreasonably withheld; (including any unauthorized acquisitioniv) use commercially reasonable efforts to take all necessary and appropriate corrective action reasonably possible on Avolve’s part designed to prevent a recurrence of such Data Security Breach; (v) collect and preserve evidence concerning the discovery, accessingcause, usevulnerability, alterationremedial actions and impact related to such Data Security Breach, disclosurewhich shall meet reasonable expectations of forensic admissibility; and (vi) if requested by Customer, compromise or loss of any Protected Information or Merchant Information)at Customer’s cost, then, as soon as practicable but within no more than [***] (except that provide notice to Shopify individuals or entities whose Confidential Information was or may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be have been affected in a form approved manner and format specified by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4Customer. In the event of a any Data Security Complaint directed at AffirmBreach is caused by Avolve, thenCustomer shall have, as soon as practicable but within no more in addition to all other rights and remedies available under this Agreement, law and equity, the right to terminate the Agreement upon thirty (30) days prior written notice. For purposes of this Agreement, the term “Data Security Breach” shall mean any of the following occurring in connection with Customer Data in connection with Customer’s and its Users’ authorized use of the Avolve SAAS Solution: (a) the loss or misuse of Customer Data; and (b) disclosure to, or acquisition, access or use by, any person not authorized to receive Customer Data, other than [***]in circumstances in which the disclosure, Affirm will notify its primary Shopify contact and the Parties shall promptly work acquisition, access or use is made in good faith to determine and within the appropriate actions to be taken course and scope of the employment with Avolve or other professional relationship with Avolve and does not result in connection with such Security Complaintany further unauthorized disclosure, acquisition, access or use of Customer Data.

Security Breach. 15.6.1. If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided as soon as possible after the execution of this Agreement. 15.6.2. In the event Affirm suffers or learns of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4. In the event of a “Security Complaint directed Breach,” which means an unauthorized disclosure, access, alteration, or use of Customer Content or Confidential Student Information or circumstances that could have resulted in such unauthorized disclosure, access, alteration or use, Company shall promptly institute the following: i. Provide the Customer with the name and contact information for an employee of Company who shall serve as its primary security contact and shall be available to assist Customer as a contact in resolving obligations associated with a Security Breach; ii. Notify the Customer of a Security Breach by telephone at Affirm▇▇▇-▇▇▇-▇▇▇▇, thene-mail with a read receipt at ▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇.▇▇▇ and with a copy by e-mail to Company’s primary business contact at the Customer, as soon as practicable practicable, but within no more later than [***]seventy-two (72) hours of confirmation of the Security Breach; and iii. Promptly following Company’s notification to the Customer of a Security Breach, Affirm will notify the parties shall coordinate with each other to investigate the Security Breach. Company agrees to fully cooperate with the Customer in the handling of the matter, including, without limitation: a. Assisting with any investigation; b. Facilitating interviews with Company’s employees and others involved in the matter; c. Making available all relevant records, logs, files, data reporting and other materials required to comply with Laws, or as otherwise reasonably required by the Customer; and d. Assisting the Customer with any notifications it deems necessary related to the Security Breach. Company shall not, unless required by law, provide any notices to any individual or entity without prior written permission from the Customer. If the Security Breach is attributable to Company, Company shall reimburse and indemnify the Customer for any reasonable costs incurred by the Customer, or reasonably undertaken by the Customer at its primary Shopify contact discretion, in investigating and remediating the Parties Security Breach. Such costs and expenses shall promptly work in good faith include, but are not limited to, the costs associated with providing notification to determine the appropriate parents of those students whose Confidential Student Information or Customer Content was compromised, or providing other notifications as are required by any governmental agency or Laws, fees paid by the Customer related to providing credit monitoring to affected individuals if data exposed during the Security Breach could be used to commit identity theft. Furthermore, Company shall indemnify Customer from and against all third party claims liabilities, damages and costs including payment of reasonable legal fees, audit costs, fines, and other fees or damages imposed against the Customer as a result of the actions or omissions of Company related to be taken in connection with such the Security ComplaintBreach.

Security Breach. 15.6.1. If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided as soon as possible after the execution of this Agreement. 15.6.2. In the event Affirm suffers or learns of any actual Security Breach (including any unauthorized acquisition, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm ▇▇▇▇▇▇ agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4. In the event of a Security Complaint directed at Affirm, then, as soon as practicable but within no more than [***]] days, Affirm will notify its primary Shopify contact and the Parties shall promptly work in good faith to determine the appropriate actions to be taken in connection with such Security Complaint.

Security Breach. 15.6.1. If Affirm maintainsService Provider shall: Provide District with the name and contact information for an employee of Service Provider who shall serve as District’s primary security contact and shall be available to assist District twenty-four (24) hours per day, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies seven (7) days per week as a contact in resolving obligations associated with a Security Breach; Notify District of incident response policies and procedures and evidence of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided a Security Breach as soon as possible practicable, but no later than twenty-four (24) hours after the execution Service Provider becomes aware of this Agreement. 15.6.2. In the event Affirm suffers or learns it; and Notify District of any actual Security Breach (including any unauthorized acquisitionBreaches by [NOTIFICATION INSTRUCTIONS]. Immediately following Service Provider’s notification to District of a Security Breach, accessing, use, alteration, disclosure, compromise or loss of any Protected Information or Merchant Information), then, as soon as practicable but within no more than [***] (except that notice the parties shall coordinate with each other to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of investigate the Security Breach. Service Provider agrees to fully cooperate with District in District’s effect on Shopifyhandling of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing District with physical access to the facilities and operations affected; (iii) facilitating interviews with Service Provider’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or as otherwise required by District. Affirm will diligently investigate Service Provider shall use best efforts to immediately remedy any Security Breach and prevent any further Security Breach at Service Provider’s expense in accordance with applicable privacy rights, laws, regulations and standards. Service Provider shall reimburse District for actual costs incurred by District in responding to, and mitigating damages caused by, any Security Breach, including all costs of notice and/or remediation pursuant to Section 10(d). Service Provider agrees that it shall not inform any third party of any Security Breach without first obtaining District’s prior written consent, other than to inform a complainant that the cause matter has been forwarded to District’s legal counsel. Further, Service Provider agrees that District shall have the sole right to determine: (i) whether notice of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be takenprovided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in District’s discretion; and (ii) the contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation. To Service Provider agrees to fully cooperate, at its own expense, with District in any litigation or other formal action deemed necessary by District protect its rights relating to the extent requested by Shopifyuse, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach disclosure, protection and any known or suspected criminal activity. Affirm shall be responsible for all Security Breach Costs associated with its Security Breach. 15.6.4maintenance of District Data. In the event of a any Security Complaint directed at AffirmBreach, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties Service Provider shall promptly work in good faith use its best efforts to determine the appropriate actions to be taken in connection with prevent a recurrence of any such Security ComplaintBreach.

Security Breach. 15.6.1. If Affirm maintains, processes or otherwise is permitted access to Protected Information, Affirm will maintain and, upon request, produce copies Contractor shall notify OSOS of incident response policies and procedures and evidence a breach of incident response testing conducted within the last year. Notwithstanding the foregoing, initial evidence of incident response testing will be provided system (security breach) as soon as possible practicable, but not later than 24 hours after Contractor becomes aware of a breach. A security breach is any unauthorized acquisition of data that compromises the execution of this Agreement. 15.6.2. In the event Affirm suffers security, confidentiality, or learns integrity of any actual personal information maintained by Contractor on behalf of OSOS. Contractor agrees that it shall not inform any third party of any Security Breach breach without first obtaining OSOS’ prior written consent. Further, Contractor agrees that OSOS, in coordination with the Washington State Office of CyberSecurity (including OCS), shall have the sole right to determine: (i) whether notice of the security breach is to be provided to any unauthorized acquisitionindividuals, accessingregulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise at OSOS’ discretion; and (ii) the contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation. Immediately following Contractor’s notification to OSOS of a security breach, the parties shall coordinate with each other to investigate the security breach. Contractor agrees to fully cooperate with OSOS and OCS in the handling of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing OSOS and/or OCS with physical access to the facilities and operations affected; (iii) facilitating interviews with Contractor’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or as otherwise required by OSOS or OCS. Contractor shall immediately remedy any security breach and prevent any further security breach at Contractor’s expense in accordance with applicable privacy rights, laws, regulations and standards. Contractor agrees to fully cooperate, at its own expense, with OSOS in any litigation or other formal action deemed necessary by OSOS to protect its rights relating to the use, alteration, disclosure, compromise or loss protection and maintenance of any Protected Information or Merchant Personal Information), then, as soon as practicable but within no more than [***] (except that notice to Shopify may be delayed if required by law enforcement or other Regulatory Authority), Affirm will notify its primary Shopify contact and provide an estimate of the Security Breach’s effect on Shopify. Affirm will diligently investigate the cause of the Security Breach and promptly create and enact a corrective action plan to prevent future breaches. 15.6.3. In the case of a Security Breach involving Protected Information, Affirm will cooperate fully with Shopify to correct any Security Breach and notify each Customer as to the facts and circumstances of the breach of the Customer’s particular information. Affirm agrees not to notify any Regulatory Authority, nor any Customer, on behalf of Shopify unless Shopify specifically requests Affirm to provide such notification (such notification to be in a form approved by Shopify in writing). If Affirm reasonably determines that Regulatory Authority or Customer notification is required by it under Applicable Law, then Affirm must provide Shopify prior notice, and if Shopify disagrees, Shopify and Affirm will then negotiate in good faith to make a final determination regarding what action, if any, is to be taken. To the extent requested by Shopify, Affirm will cooperate fully with all Regulatory Authorities investigating a Security Breach and any known or suspected criminal activity. Affirm Contractor shall be responsible for all Security Breach costs incurred in responding to, and mitigating damages caused by, any security breach, including all costs of notice and/or remediation. Costs associated include those incurred in providing individuals affected by a security breach with its Security Breachnotice of the breach, reissued payment cards, complimentary access for 1 year credit monitoring services, credit protection services, credit fraud alerts and/or similar services, which OSOS deems necessary to protect such affected individuals/in consultation with Contractor, shall determine is reasonable to protect such affected individuals in light of the risks posed by the security breach. 15.6.4. In the event of a Security Complaint directed at Affirm, then, as soon as practicable but within no more than [***], Affirm will notify its primary Shopify contact and the Parties shall promptly work in good faith to determine the appropriate actions to be taken in connection with such Security Complaint.