Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted. To the Company’s knowledge, the IT systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants that would, individually or in the aggregate, reasonably be likely to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, identifiable information and sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or to the duty to notify any other personCompany, nor any and there are no incidents under internal review or investigations investigation relating to the same, except for those that would reasonably be expected to be able to remedied without material cost or liability to the Company. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their respective businesses, and/or and, to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatmodification except where such non-compliance would not, individually or in the aggregate, would reasonably indicate be expected to have a Material Adverse Effect. The Company and its subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance with any Data Security Obligationwould not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering of the SharesCompany’s knowledge, based on commercially reasonable security and monitoring, there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samesame and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The , except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatsubsidiaries, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants (collectively, “Bugs”), except where such Bugs would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards as are generally maintained by similarly situated companies and which the Company and its subsidiaries believe are reasonably adequate to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses. Without limiting the foregoing, and/or the offering of the Shares, and there have been no, and the Company and its subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans as are generally maintained by similarly situated companies that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the Subsidiaries operation of the Company’s and its subsidiaries’ businesses (“Breach”). To the knowledge of the Company, there has been no such Breach. The Company and its subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationBreach.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries its subsidiaries have not been notified of of, and have no knowledge of any event or condition that would reasonably be expected to result inin any, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personsame (“Breach”), nor are there any incidents under internal review or investigations relating to any Breach. Neither the sameCompany nor its subsidiaries has received any notice, claim, complaint, demand or letter from any person or governmental agency in respect of their businesses under applicable data protection laws, regulations and standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiaries’ businesses. Neither the Company nor its subsidiaries have been obligated to notify any third party, including, without limitation, any individual or data protection authority, of any Breach. The Company and its Subsidiaries subsidiaries have complied at all times and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligation”). The Company and its Subsidiaries subsidiaries have not taken all necessary actions to comply with any Data Security Obligations to which it is obligated to comply. Neither the Company nor its subsidiaries have received any notice, claim, complaint, demand, letter, notification of or complaint regarding regarding, and are is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with with, any Data Security Obligations, Obligation and there have been is no pending or threatened action, suit suit, investigation or proceeding by or before any court or government governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as could not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data maintained or any such data that may constitute trade secretsprocessed by the Company and its subsidiaries in connection with their businesses (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”), and (ii) used in connection with their businesses, and/or to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as could not be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same. The knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken commercially reasonable actions to comply with the European Union General Data Protection Regulation, and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligationssame would be reasonably likely to create a material liability, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationas soon as they take effect.

Cybersecurity; Data Protection. The Except as could not be expected to have a Material Adverse Effect, the Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as could not be expected to have a Material Adverse Effect, the Company and its Subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, proprietary, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Sensitive Data”)) used in connection with their businesses, and/or the offering of the Sharesits business, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Except as could not be expected to have a Material Adverse Effect, the Company and its Subsidiaries are is presently in compliance with all applicable laws or statutes (including without limitation all applicable privacy and security laws and regulations, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)) and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Sensitive Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Sensitive Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not further certifies that neither it nor any subsidiary: (i) has received any notification of or complaint regarding and are unaware notice of any other facts thatactual or potential liability under or relating to, individually or actual or potential violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in the aggregatepart, would reasonably indicate non-compliance with any Data Security Obligationsinvestigation, and there have been no actionremediation, suit or proceeding by other corrective action pursuant to any Privacy Law; or before (iii) is a party to any court order, decree, or government agency, authority agreement that imposes any obligation or body pending or threatened alleging non-compliance with liability under any Data Security ObligationPrivacy Law.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries as currently conducted, and to the Company’s knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their respective businesses, and/or and, to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. The Company and its Subsidiaries have not received taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts thatnon-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there be expected to have been no action, suit or proceeding a Company Material Adverse Effect. Any certificate signed by or before any court on behalf of the Company and delivered to the Sales Agent or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationto counsel for the Sales Agent shall be deemed to be a representation and warranty by the Company to the Sales Agent as to the matters covered thereby.

Cybersecurity; Data Protection. The Company’s WaterBridge Parties and its Subsidiariestheir respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company WaterBridge Parties and its Subsidiaries their respective subsidiaries as currently conducted, and, to the knowledge of each WaterBridge Party, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company WaterBridge Parties and its Subsidiaries their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and material data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering knowledge of the Shareseach WaterBridge Party, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or unauthorized accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company WaterBridge Parties and its Subsidiaries their respective subsidiaries are presently in compliance in all material respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations court or arbitrator or governmental or regulatory authority relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, except as would not, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there be expected to have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, Disclosure Package and the Prospectus, or except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company and its Subsidiariessubsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards are presently in compliance with all applicable laws and statutes and any judgments, orders, rules or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations and any other legal obligations, in each case, relating to maintain and protect their material confidential information and the integrity, continuous operation, redundancy privacy and security of all IT Systems and Data, and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (including all personalcollectively, personally identifiablethe “Data Security Obligations”), sensitiveexcept as would not, confidential individually or regulated data or any such data that may constitute trade secretsin the aggregate, important data reasonably be expected to result in a Material Adverse Effect. The Company and working secrets of any governmental authority or any other data that would otherwise be detrimental its subsidiaries have used reasonable efforts to national establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, public interest or lawful rights cyber security and interests data protection controls, policies and procedures to protect against and prevent security breaches of, unauthorized access to and other similar compromises of relevant individuals or organizations pursuant to IT Systems and Data in accordance with industry practices and as required by applicable regulatory standards. Except as disclosed in the applicable laws (“Personal Registration Statement, Disclosure Package and Confidential Data”)) used in connection with their businessesthe Prospectus, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries its subsidiaries have not been notified of experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses a Breach to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of their IT Systems and Personal and Confidential Data (“Data Security Obligations”) and that would reasonably be expected to result in a Material Adverse Effect. Neither the protection Company nor any of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not subsidiaries has received any written notification of or complaint regarding regarding, and are unaware has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security ObligationsObligation by the Company or any of its subsidiaries, and there have been is no action, suit or proceeding by or before any court or government governmental agency, authority or body body, pending or or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. The Company’s Except as described in the Registration Statement, the Pricing Disclosure Package and its Subsidiaries’ the Prospectus, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or any such data that may constitute trade secrets, important data and working secrets on behalf of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws them (“Personal and Confidential Data”)) used in connection with their businesses, and/or ; to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the same. The Company’s or any of its subsidiaries’ Personal Data or IT Systems and the Company and its Subsidiaries subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. (i) The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The ; and (iii) the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company , except, with respect to each of clauses (i) and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that(iii), as would not, individually or in the aggregate, would reasonably indicate have a Material Adverse Effect. The Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability as soon they take effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and to the Knowledge of the Company, its Subsidiaries as currently conducted, subsidiaries are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses. Without limiting the foregoing, and/or the offering of the Shares, and there have been no, and the Company and its subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the Subsidiaries operation of the Company’s and its subsidiaries’ businesses (“Breach”) and, there has been no such Breach. The Company and its subsidiaries have not been notified of and have no knowledge Knowledge of any event or condition that would reasonably be expected to result in, breachesany such Breach. This representation is limited in each case to the extent that such breach or noncompliance would not reasonably be expected to have a Material Adverse Effect, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, and except for those that have been remedied without material cost or liability as otherwise disclosed in the Registration Statement or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationProspectus.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply in all material respects with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon as they take effect.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, and, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the SharesPublic Securities, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. , except where the failure to comply would not, singularly or in the aggregate, result in a Material Adverse Change.. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable technical and organizational controls, policies, procedures, and safeguards to (i) maintain and protect their material Personal Data and sensitive, proprietary, confidential information or regulated data (collectively, the “Confidential Data”) from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access and (ii) maintain and protect the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) Data used in connection with their businesses. Except as would not, and/or individually or in the offering of the Sharesaggregate, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, there have been no breaches, violations, outages, destructionsecurity incidents, lossor violations of any Privacy Requirements in relation to Confidential Data, leakage, misappropriation, modification or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, government authority or supervisory body, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The ; (iii) the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The ; and (iv) the Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification non-compliance with same would be reasonably likely to create a liability) as soon they take effect, except as would not, in the case of or complaint regarding each of clause (i), (iii) and are unaware of any other facts that(iv), reasonably be expected, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there to have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, documented internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation and the California Consumer Privacy Act (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. Neither the Company nor any Data Security Obligationsof its subsidiaries, (i) has received written notice of any actual or potential liability of the Company or its subsidiaries from any governmental or regulatory agencies or bodies (or, except as would not be material to the Company and there have been no actionits subsidiaries, suit taken as a whole, any other person) under or proceeding relating to, or actual or potential violation by the Company or any of its subsidiaries of, any of such laws and regulations; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action by or before mandated by any court governmental or government agency, authority regulatory agency or body pending pursuant to any of such laws and regulations; or threatened alleging non-compliance (iii) is a party to any order, decree, or agreement with any Data Security Obligationgovernmental or regulatory agency or body that imposed any obligation or liability under any of such laws and regulations.

Cybersecurity; Data Protection. The Company’s Except as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and its Subsidiaries’ the Prospectus or as would not have a Material Adverse Effect, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its Subsidiaries their respective subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Company, Carnival plc and its Subsidiaries their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and the Prospectus or those that have been or will be remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company Company, Carnival plc and its Subsidiaries their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies court or arbitrator or governmental or regulatory authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samea Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented business continuity / disaster recovery plans and technology consistent with industry standards and practice. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company modification including the Data Privacy and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatSecurity Laws (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Data Protection Requirements, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The Company and its subsidiaries have at all times made all material disclosures to patients or other individuals required by applicable Data Protection Requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable Data Protection Requirements in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach or violation of any Data Protection Requirements or Policies, except where such breach or violation would not, individually or in the aggregate, have a Material Adverse Effect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably indicate non-compliance with be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Security ObligationsProtection Requirement; or (iii) is a party to any order, and there have been no actiondecree, suit or proceeding agreement that imposes any obligation or liability by or before any court or government agency, governmental authority or body pending or threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”i) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance compliance, in all material respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes and all laws, statutes, #95429626v5 #95429626v9 judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or other governmental or regulatory authority and any legal obligations regarding the collection, internal policies use, transfer, import, export, storage, protection, disposal and contractual obligations relating to disclosure by the privacy Company and security its subsidiaries of IT Systems and Personal and Confidential Data (“Data Security Obligations”); (ii) and to neither the protection Company nor any of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not subsidiaries has received any notification of or complaint regarding regarding, and are unaware aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security ObligationsObligation; and (iii) there is no pending, and there have been no or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or government governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have taken steps reasonably necessary in accordance with industry standard practices to protect such information against loss and against unauthorized access, use, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. To the knowledge of the Company, except as disclosed in the Registration Statement, the Disclosure Package and the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, as soon they take effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samea Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented business continuity / disaster recovery plans and technology consistent with industry standards and practice. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company modification including the Data Privacy and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatSecurity Laws (“Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Data Protection Requirements, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The Company and its subsidiaries have at all times made all material disclosures to patients or other individuals required by applicable Data Protection Requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable Data Protection Requirements in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach or violation of any Data Protection Requirements or Policies, except where such breach or violation would not, individually or in the aggregate, have a Material Adverse Effect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably indicate non-compliance with be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Security ObligationsProtection Requirement; or (iii) is a party to any order, and there have been no actiondecree, suit or proceeding agreement that imposes any obligation or liability by or before any court or government agency, governmental authority or body pending or threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. (i) The Company’s Company and its Subsidiaries’ information subsidiaries have implemented backup and disaster recovery technology assets reasonably consistent with industry standards and equipment, computers, systems, networks, hardware, software, websites, applications, practices; and databases (collectively, “IT Systems”ii) are adequate for, and operate and perform as required in connection with to the operation knowledge of the business Company, there has been no security breach or other compromise to the personal data and sensitive, confidential or regulated data, including the data of the Company and its Subsidiaries as currently conductedsubsidiaries’ respective employees, free suppliers, vendors and clear of all material bugsthird parties, errorsin each case, defects, Trojan horses, time bombs, malware and other corruptants. The maintained or processed by the Company and its Subsidiaries have implemented and maintained commercially reasonable controlssubsidiaries in connection with their businesses (collectively, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those any breach or compromise that have has been remedied without material cost or liability or the duty to notify or disclose such breach or compromise to any other person, nor any incidents under internal review governmental entity or investigations relating regulatory agency or which otherwise would not be expected, individually or in the aggregate, to have a Material Adverse Effect. Except as described in the Registration Statement, the Disclosure Package and the Prospectus, to the same. The knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of information technology and computer systems, networks, hardware, software, data, equipment or technology of the Company and its subsidiaries (collectively, “IT Systems and Personal Systems”) and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have , except as would not received any notification of or complaint regarding and are unaware of any other facts thatbe expected, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there to have been no action, suit or proceeding a Material Adverse Effect. Any certificate signed by or before any court on behalf of the Company and delivered to the Underwriter or government agencyto counsel for the Underwriter shall be deemed to be a representation and warranty by the Company to the Underwriter as to the matters covered thereby. The Company acknowledges that the Underwriter and, authority or body pending or threatened alleging non-compliance with any Data Security Obligationfor purposes of the opinions to be delivered pursuant to Section 6 hereof, counsel to the Company and to the Underwriter, will rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Sharesbusiness, and there have been no, and the Company and the Subsidiaries its subsidiaries have not been notified of and have no knowledge of of, any event or condition that would reasonably be expected to result in, in any breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samethe same (“Breach”), except for those a Breach that have has been remedied without material cost or liability or the duty to notify any other person, nor are there any incidents under internal review or investigations relating to any Breach. Neither the sameCompany nor its subsidiaries has received any written notice, claim, complaint, demand or letter from any person or governmental agency in respect of their business under applicable data protection laws, regulations and standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiaries’ business. Neither the Company nor its subsidiaries have been obligated to notify any third party, including, without limitation, any individual or data protection authority, of any Breach. The Company and its Subsidiaries subsidiaries have complied at all times and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligation”), except where the violation of such Data Security Obligations would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have not taken all necessary actions to comply with any Data Security Obligation, including the European Union General Data Protection Regulation, the Health Insurance Portability and Accountability Act, except where the failure to take any such action would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor its subsidiaries have received any written notice, claim, complaint, demand, letter, notification of or complaint regarding regarding, and are is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with with, any Data Security ObligationsObligation, and there have been is no pending or, to the knowledge of the Company, threatened, action, suit suit, investigation or proceeding by or before any court or government governmental agency, authority or body pending or threatened alleging non-compliance by the Company or any of its subsidiaries with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the its business of the Company and its Subsidiaries as currently conducted, in each case, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company has implemented, maintained and its Subsidiaries have implemented and maintained complied with commercially reasonable information technology, information security, cybersecurity and data protection controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential information or regulated data or any such data that may constitute trade secretssecrets (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Sensitive Data”)) used collected, used, stored or processed by, or to the knowledge of the Company, on behalf of the Company in connection with their businessesits business, and/or and, to the offering of the SharesCompany’s knowledge, and there have been nono breaches, violations, outages or unauthorized uses of or accesses to any IT Systems and Sensitive Data, except for those that have been remedied without material cost or liability. The Company is presently in compliance with all applicable laws or statutes and all other applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies, and contractual obligations relating to the Company privacy and security of IT Systems and the Subsidiaries collection, use, transfer, import, export, storage, disposal and disclosure of Sensitive Data and to the protection of such IT Systems and Sensitive Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”) except where the failure to comply would not, individually or in the aggregate, have a Material Adverse Effect. The Company (i) has not been notified received any notification of or complaint regarding any actual or potential liability under or relating to, or actual or potential violation of any Data Security Obligation and have has no knowledge of any event or condition that would reasonably be expected to result inin any such notice, breaches(ii) is not currently conducting or paying for, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually whole or in the aggregatepart, would reasonably indicate non-compliance with any investigation, remediation or other corrective action pursuant to any Data Security ObligationsObligation, (iii) is not a party to any order, decree, or agreement that imposed any obligation or liability under any Data Security Obligation and there have been no (iv) is not subject to any pending or, to the knowledge of the Company, threatened action, suit suit, investigation or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationObligation by the Company.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering of the SharesCompany’s knowledge, based on commercially reasonable security and monitoring, there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samesame and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The , except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatsubsidiaries, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its Subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses. Without limiting the foregoing, and/or the offering of the Shares, and there have been no, and the Company and its Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its Subsidiaries’ businesses (“Breach”) and, to the Knowledge of the Company, there has been no such Breach. The Company and its Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating such Breach. This representation is limited in each case to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws extent that such breach or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligationswould not reasonably be expected to have a Material Adverse Effect, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationexcept as otherwise disclosed in the Commission Documents.

Cybersecurity; Data Protection. The Company’s Except as would not reasonably be expected to have a Material Adverse Effect, (A) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are designed to be adequate for, and designed to operate and perform perform, in all respects, as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and (B) to the knowledge of the Company, all IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personal and personally identifiable, sensitive, confidential or regulated identifiable data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have . Except as would not been notified of and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, and to the knowledge of the Company, there have been no breaches, violations, outages, destruction, loss, leakage, misappropriation, modification violations or unauthorized uses of or accesses to sameIT Systems and Personal Data, except for those that have been remedied without material cost or liability or the mandatory legal duty to notify any other person, nor are any such incidents under internal review or investigations relating investigation as of the date hereof. Except as would not reasonably be expected to have a Material Adverse Effect, the same. The Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations to which the Company and its subsidiaries are bound relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in taken all commercially reasonable actions to comply with the aggregate, would reasonably indicate non-compliance with any European Union General Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationProtection Regulation.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and its subsidiaries (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. In addition, any Data Security Obligationscertificate signed by any executive officer of the Company and delivered to the Underwriters or counsel for the Underwriters in connection with the offering of the Securities shall be deemed to be a representation and warranty by the Company, and there have been no actionas to matters covered thereby, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationto each of the Underwriters.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply, in all material respects, with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon they take effect.

Cybersecurity; Data Protection. The Company’s and its SubsidiariesCompany Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its their Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its their Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential identifiable or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or . To the offering knowledge of the SharesCompany Parties, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samesame and the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its their Subsidiaries are presently in compliance in all material respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company Parties and its their Subsidiaries have not received any notification of or complaint regarding used reasonable best efforts to implement backup and are unaware of any other facts that, individually or disaster recovery technology consistent with industry standards and practices in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationall material respects.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with in all material respects all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, in each case, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businessesits business, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, approved and released internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (collectively, the “Data Protection Requirements”). The Company is in material compliance with the European Union General Data Protection Regulation. Except as would not reasonably be expected to have a Material Adverse Effect, the Company has at all times made all disclosures required by applicable Data Protection Requirements, and its Subsidiaries have none of such disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable Data Protection Requirements in any material respect. The Company: (i) has not received any notification of or complaint regarding and are unaware written notice of any other facts thatactual or potential liability under or relating to, individually or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in the aggregatepart, would reasonably indicate non-compliance with any investigation, remediation, or other corrective action pursuant to any Data Security ObligationsProtection Requirement; or (iii) is not a party to any order, and there have been no actiondecree, suit or proceeding agreement that imposes any obligation or liability by any governmental or before any court or government agency, regulatory authority or body pending or threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. The Company’s and its SubsidiariesCompany Parties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its their Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except as would not reasonably be expected to have an Issuer Material Adverse Effect. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential identifiable or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or . To the offering knowledge of the SharesCompany Parties, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samesame and the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as would not reasonably be expected to have an Issuer Material Adverse Effect. The Company Parties and its Subsidiaries are presently in compliance in all material respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company Parties and its their Subsidiaries have not received any notification of or complaint regarding used reasonable best efforts to implement backup and are unaware of any other facts that, individually or disaster recovery technology consistent with industry standards and practices in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationall material respects.

Cybersecurity; Data Protection. The Company’s To the knowledge of the Company and its Subsidiaries’ subsidiaries, its information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable information technology, information security, cyber security and data protection controls, policies, procedures, and safeguards, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans, designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of, and to prevent the breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation, modification or other misuse of (“Breach”), all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data and all data of their respective customers, employees, suppliers, vendors and any third party data maintained by or any such data that may constitute trade secrets, important data and working secrets on behalf of any governmental authority the Company or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws its subsidiaries (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there . There have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breachesBreaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to sameany IT Systems and Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the sameany such IT Systems and Personal Data. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationany Breach (“Privacy Laws”). The Neither the Company and nor any of its Subsidiaries have not subsidiaries has received any notification of or complaint regarding and are unaware notice of any other facts thatactual or potential liability under or relating to, individually or in the aggregateactual or potential violation of, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationPrivacy Laws.

Cybersecurity; Data Protection. The Company’s Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as reasonably required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and confidential data (including all personal, personally identifiable, sensitive, confidential personal data and sensitive or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses. Except as would not, and/or individually or in the offering of the Sharesaggregate, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, there have been no breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, same nor any incidents under internal review or investigations relating to the same. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data maintained or any such data that may constitute trade secretsprocessed by the Company and its subsidiaries in connection with their businesses (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”), and (ii) used in connection with their businesses, and/or to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as would not reasonably be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same. The knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Any certificate signed by an officer of the Company and its Subsidiaries have not received any notification of delivered to Virtu, or complaint regarding and are unaware of any other facts thatto counsel for Virtu, individually pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationCompany to Virtu as to the matters set forth therein.

Cybersecurity; Data Protection. The Company’s Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its Subsidiaries subsidiaries own the IT Systems free from encumbrances and other third party rights, or in the case of any IT Systems not owned by the Company or its subsidiaries, have a valid license to use the IT Systems; (iii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and (iv) there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or supervisory authority, nor any incidents under internal review or investigations relating to the same. The ; and (v) the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification, including Data Protection Laws (as defined below). The Neither the Company nor its subsidiaries have received written notification from a supervisory authority asserting a violation by the Company or its subsidiaries of the European Union General Data Protection Regulation (and its Subsidiaries all other applicable laws and regulations governing the privacy and security of Personal Data) (“Data Protection Laws”), or have not received any notification of or written complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-relation with their compliance with any the Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationProtection Laws.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently subsidiaries are, and have been in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (collectively, the “Privacy Laws”). The To the extent required by the Privacy Laws, the Company and its Subsidiaries subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with Company policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, and handling, of Personal Data (the “Policies”). In each case, except as would not received any notification of or complaint regarding and are unaware of any other facts thatreasonably be expected, individually singly or in the aggregate, to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries have made all disclosures to individuals required by applicable Privacy Laws, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable Privacy Laws. Neither the Company nor any subsidiary: (i) has received written notice of any actual or alleged liability under or relating to, or actual or alleged violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably indicate non-compliance with be expected to result in any Data Security Obligationssuch written notice; (ii) is currently conducting or paying for, and there have been no actionin whole or in part, suit any investigation, remediation, or proceeding other corrective action required pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or before regulatory authority under any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationPrivacy Law.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariesthe Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries the Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries the Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries the Controlled Entities have not received taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and the Controlled Entities (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon as they take effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws data) (“Personal and Confidential Company Data”)) used in connection with their businesses, and/or the offering of the Sharesbusiness, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destructioncompromises, loss, leakage, misappropriation, modification or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that in each case as would not (a) individually or in the aggregate, reasonably be expected to have been remedied without material cost a Material Adverse Effect, or liability or the (b) result in a duty to notify any other person, nor any . There are no privacy or security incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any Governmental Entitycourt, arbitrator, governmental or regulatory authority; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, in each case, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businessesits business, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, approved and released internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (collectively, the “Data Protection Requirements”). The Company is in material compliance with the European Union General Data Protection Regulation. Except as would not reasonably be expected to have a Material Adverse Effect, the Company has at all times made all disclosures required by applicable Data Protection Requirements, and its Subsidiaries have none of such disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable Data Protection Requirements in any material respect. The Company: (i) has not received any notification of or complaint regarding and are unaware written notice of any other facts thatactual or potential liability under or relating to, individually or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in the aggregatepart, would reasonably indicate non-compliance with any investigation, remediation, or other corrective action pursuant to any Data Security ObligationsProtection Requirement; or (iii) is not a party to any order, and there have been no actiondecree, suit or proceeding agreement that imposes any obligation or liability by any governmental or before any court or government agency, regulatory authority or body pending or threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (collectively “Privacy Obligations”), and no disclosures in any publicly posted privacy policy of the Company or any of its subsidiaries has been materially inaccurate, misleading or deceptive (including by containing any material omission). Neither the Company nor any of its subsidiaries has received any complaint alleging that it has improperly collected, received, created, processed, stored, maintained, used, disclosed, transmitted, secured, transferred, disposed of or destroyed or has received any notice or other communication from any governmental or regulatory authority or self-regulatory body regarding any actual or possible violation of, investigation (formal or informal) or failure to comply with any applicable Privacy Obligation. The Company and its Subsidiaries subsidiaries have not received taken all actions it reasonably believes necessary to prepare to comply with all other applicable Privacy Obligations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon they take effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, documented internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to comply with the European Union General Data Protection Regulation and the California Consumer Privacy Act (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with same would be reasonably likely to create a material liability). Neither the Company nor any Data Security Obligationsof its subsidiaries, (i) has received written notice of any actual or potential liability of the Company or its subsidiaries from any governmental or regulatory agencies or bodies ( except as would not be material to the Company and there have been no actionits subsidiaries, suit taken as a whole) under or proceeding relating to, or actual or potential violation by the Company or any of its subsidiaries of, any of such laws and regulations; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action by or before mandated by any court governmental or government agency, authority regulatory agency or body pending pursuant to any of such laws and regulations; or threatened alleging non-compliance (iii) is a party to any order, decree, or agreement with any Data Security Obligationgovernmental or regulatory agency or body that imposed any obligation or liability under any of such laws and regulations.

Cybersecurity; Data Protection. The Company’s Except as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and its Subsidiaries’ the Prospectus or as would not have a Material Adverse Effect, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its Subsidiaries their respective subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Company, Carnival plc and its Subsidiaries their respective subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for as may be described in or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and the Prospectus or those that have been or will be remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company Company, Carnival plc and its Subsidiaries their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies court or arbitrator or governmental or regulatory authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationData.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards are presently in compliance with all applicable laws and statutes and any judgments, orders, rules or regulations of any court or arbitrator or other governmental or regulatory authority, and all applicable internal policies and contractual obligations and any other legal obligations, in each case, relating to maintain and protect their material confidential information and the integrity, continuous operation, redundancy privacy and security of all IT Systems and Data, and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (including all personalcollectively, personally identifiablethe “Data Security Obligations”), sensitiveexcept as would not, confidential individually or regulated data or any such data that may constitute trade secretsin the aggregate, important data reasonably be expected to result in a Material Adverse Effect. The Company and working secrets of any governmental authority or any other data that would otherwise be detrimental its subsidiaries have used reasonable efforts to national establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, public interest or lawful rights cyber security and interests data protection controls, policies and procedures designed to protect against and prevent security breaches of, unauthorized access to and other similar compromises of relevant individuals or organizations pursuant to the IT Systems and Data as required by applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the regulatory standards. The Company and the Subsidiaries its subsidiaries have not been notified of experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses a Breach to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of their IT Systems and Personal and Confidential Data (“Data Security Obligations”) and that would reasonably be expected to result in a Material Adverse Effect. Neither the protection Company nor any of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not subsidiaries has received any written notification of or complaint regarding regarding, and are unaware has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security ObligationsObligation by the Company or any of its subsidiaries, and there have been is no action, suit or proceeding by or before any court or government governmental agency, authority or body body, pending or or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security ObligationObligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. The Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of its business as currently conducted, in each case, to the business knowledge of the Company and its Subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented implemented, maintained and maintained complied with commercially reasonable information technology, information security, cybersecurity and data protection controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential information or regulated data or any such data that may constitute trade secretssecrets (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Sensitive Data”)) used collected, used, stored or processed by, or to the knowledge of the Company, on behalf of the Company in connection with their businessesits business, and/or and, to the offering of the SharesCompany’s knowledge, and there have been nono breaches, violations, outages or unauthorized uses of or accesses to any IT Systems and Sensitive Data, except for those that have been remedied without material cost or liability. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all other applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies, and contractual obligations relating to the privacy and security of IT Systems and the collection, use, transfer, import, export, storage, disposal and disclosure of Sensitive Data and to the protection of such IT Systems and Sensitive Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”) except where the failure to comply would not, individually or in the aggregate, have a Material Adverse Effect. The Company and the Subsidiaries its subsidiaries (i) have not been notified received any notification of or complaint regarding any actual or potential liability under or relating to, or actual or potential violation of any Data Security Obligation and have no knowledge of any event or condition that would reasonably be expected to result inin any such notice, breaches(ii) are not currently conducting or paying for, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually whole or in the aggregatepart, would reasonably indicate non-compliance with any investigation, remediation or other corrective action pursuant to any Data Security ObligationsObligation, (iii) are not a party to any order, decree, or agreement that imposed any obligation or liability under any Data Security Obligation and there have been no (iv) are not subject to any pending or, to the knowledge of the Company or its subsidiaries, threatened action, suit suit, investigation or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationObligation by the Company or its subsidiaries.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform perform, in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The ; (iii) the Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The ; and (iv) the Company and its Subsidiaries subsidiaries have not received taken all necessary actions to comply, in all material respects, with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon they take effect.

Cybersecurity; Data Protection. The Company’s Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or ; (iii) to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The ; and (iv) the Company and its Subsidiaries subsidiaries have complied and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) Data, and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of Personal Data (collectively, the “Data Security Obligations”), except, in the case of each clause above, as would not reasonably be expected to have a Material Adverse Effect. The Except as would not reasonably be expected to have a Material Adverse Effect, (i) neither the Company and nor any of its Subsidiaries have not subsidiaries has received any notification of or complaint regarding regarding, and are is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, Obligation and (ii) there have been is no action, suit or proceeding by or before any court or government governmental agency, authority or body pending pending, or threatened to the Company’s knowledge, threatened, alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data or any such data that may constitute trade secrets(collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses. Except as would not, and/or individually or in the offering of the Sharesaggregate, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, there have been no breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, same nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and except as disclosed in the offering of Registration Statement, in the SharesProspectus and in the Pricing Disclosure Package and except as would not, and individually or in the aggregate, have a Material Adverse Change, there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its the Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, except as would not, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Change.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are commercially reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all material IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and to the offering of the Shares, and Company’s knowledge there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, except as would not, individually or in the aggregateaggregate have a Material Adverse Effect. Any certificate signed by an officer of the Company and delivered to ▇▇▇▇▇ or to counsel for ▇▇▇▇▇ shall be deemed to be a representation and warranty by the Company to ▇▇▇▇▇ as to the matters set forth therein. The Company acknowledges that ▇▇▇▇▇ and, would reasonably indicate non-compliance with any Data Security Obligationsfor purposes of the opinions to be delivered pursuant to Section 7 hereof, counsel to the Company and there have been no actioncounsel to ▇▇▇▇▇, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationwill rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and all personal data (including all personal, personally identifiable, and sensitive, confidential or regulated data maintained or any such data that may constitute trade secretsprocessed by the Company and its subsidiaries in connection with their businesses (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”), and (ii) used in connection with their businesses, and/or to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other person. Except as would not reasonably be expected, nor any incidents under internal review individually or investigations relating in the aggregate, to have a Material Adverse Effect, to the same. The knowledge of the Company, the Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Any certificate signed by an officer of the Company and its Subsidiaries have not received any notification of delivered to the Agents, or complaint regarding and are unaware of any other facts thatto counsel for the Agents, individually pursuant to or in connection with this Agreement, shall be deemed to be a representation and warranty by the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationCompany to the Agents as to the matters set forth therein.

Cybersecurity; Data Protection. The To the best knowledge of the Company after all due inquiry/investigation, the Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The , except where the failure of any of the foregoing would not have a Material Adverse Change. (A) Each of the Company and its Subsidiaries have not has complied with all applicable laws concerning cybersecurity, data protection, confidentiality and archive administration (collectively, the “Data Protection Laws”); (B) neither the Company nor any Subsidiaries is, or is expected to be classified as, a “critical information infrastructure operator” under the Cybersecurity Law of the PRC; (C) neither the Company nor any of its Subsidiaries is subject to any investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the CSRC, or any other relevant governmental authority; (D) neither the Company nor any of its Subsidiaries has received any notification notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice), letter, complaint or allegation from the relevant cybersecurity, data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance by it of the applicable Data Protection Laws or complaint regarding prohibiting the transfer of data to a place outside the relevant jurisdiction; (E) neither the Company nor any of its Subsidiaries has received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and are unaware industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (F) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (G) neither the Company nor any of its Subsidiaries has received any communication, enquiry, notice, warning or sanctions with respect to the Cybersecurity Law of the PRC or from the CAC or pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (H) the Company is not aware of any pending or threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other facts thatrelevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, individually officers and employees; (I) the Company is not aware of any pending or threatened actions, suits, claims, demands, investigations, judgments, awards and proceedings on the Company and any of its Subsidiaries or any of their respective directors, officers and employees pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); and (J) neither the Company nor any of its Subsidiaries has received any objection to the transactions contemplated under this Agreement and the Deposit Agreement from the CSRC, the CAC or any other relevant governmental authority , except where in the case of (A), (D), (E), (F), (G), (H) and (I), any such breach, violation or default would not, in dividually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s Except as would not reasonably be expected to result in a Material Adverse Change, the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and except as has been disclosed in the offering of Registration Statement and the SharesProspectus, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or known unauthorized uses of or known accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries have complied, and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, and all industry guidelines, standards, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification, except where the failure to be in compliance would not reasonably be expected to result in a Material Adverse Change. The Company and its Subsidiaries subsidiaries have not received any notification of or complaint regarding implemented backup and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance disaster recovery technology consistent with any Data Security Obligations, industry standards and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationpractice.

Cybersecurity; Data Protection. The Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted. To the Company’s knowledge, the IT systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants that would, individually or in the aggregate, reasonably be likely to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, identifiable information and sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or to the duty to notify any other person, nor any Company and there are no incidents under internal review or investigations investigation relating to the same, except for those that would reasonably be expected to be able to remedied without material cost or liability to the Company. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus or in each case as would not otherwise result in a Material Adverse Effect, the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform perform, as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, Prospectus and Pricing Disclosure Package, and are, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws information (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been nono breaches, and violations, destructions, losses, outages, disablements, misappropriations, modifications or unauthorized uses of or accesses to the same (“Breaches”), except for those that would not, individually or in the aggregate, result in a Material Adverse Effect. The Company and the Subsidiaries its subsidiaries have not been notified of notified, and have no knowledge of of, any event or condition that would reasonably be expected to result inin a Breach. Without limiting the foregoing, breachesthe Company and its subsidiaries have established, violationsmaintained, outagesimplemented and complied with commercially reasonable information technology, destructioninformation security, losscybersecurity and data protection controls, leakagepolicies and procedures, misappropriationincluding oversight, modification or unauthorized uses of or accesses access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the sameprotect against Breaches. The Company and its Subsidiaries subsidiaries have complied, and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to (i) the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of Personal Data by the Company or any of its subsidiaries, (ii) the privacy and security of IT Systems and Personal Data and Confidential Data (“Data Security Obligations”iii) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized useBreaches (the “Data Security Obligations”), accessin each case, misappropriation or modificationexcept as would not reasonably be expected to have a Material Adverse Effect. The Neither the Company and nor any of its Subsidiaries have not subsidiaries has received any notification of or complaint regarding regarding, and are is unaware of any other facts that, individually or in the aggregate, would reasonably indicate indicate, material non-compliance with any Data Security Obligations, and there have been Obligation. There is no action, suit or proceeding by or before any court or government governmental agency, authority or body pending or threatened or, to the knowledge of the Company, threatened, alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. (i) The Company’s Company and each of its Subsidiaries’ subsidiaries have complied and are presently in compliance with all internal and external privacy policies, contractual obligations, industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority and any other legal obligations, in each case, relating to the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company or any of its subsidiaries of personal, personally identifiable, household, sensitive, confidential or regulated data (“Data Security Obligations”, and such data, “Data”); (ii) the Company has not received any notification of or complaint regarding and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and each of its subsidiaries have taken all technical and organizational measures necessary to protect the information technology assets systems and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required Data used in connection with the operation of the business of Company’s and its subsidiaries’ businesses. Without limiting the foregoing, the Company and its Subsidiaries as currently conductedsubsidiaries have used reasonable efforts to establish and maintain, free and clear of all material bugshave established, errorsmaintained, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially complied with, reasonable information technology, information security, cyber security and data protection controls, policies, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data relating to any information technology system or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) Data used in connection with their businesses, and/or the offering operation of the Shares, Company’s and there have its subsidiaries’ businesses (“Breach”). There has been nono such Breach, and the Company and the Subsidiaries its subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security ObligationBreach.

Cybersecurity; Data Protection. The Company’s and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. To the Company’s knowledge, no claims have been asserted or threatened against the Company or its subsidiaries alleging a violation relating to Personal Data or data rights and the consummation of the transactions contemplated hereby will not breach or otherwise cause any violation of any law related to privacy, data protection, or the collection and use of Personal Data collected, used, or held for use by the Company or its subsidiaries in the conduct of their businesses, except where any such breach or violation would not reasonably be expected to result in a Material Adverse Effect. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the collection and use of Personal Data, privacy and security of IT Systems and Personal Data and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering of the SharesCompany’s knowledge, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that as would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the samea Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices. The Company and its subsidiaries are presently presently, and for the past three (3) years have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts thatmodification (collectively, “Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Data Protection Requirements, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of any Data Protection Requirements or Policies. To the Company’s knowledge, the Company and its subsidiaries have at all times made all material disclosures to users or customers required by applicable laws and regulatory rules or requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably indicate non-compliance with be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Security ObligationsProtection Requirement; or (iii) is a party to any order, and there have been no actiondecree, suit or proceeding agreement that imposes any obligation or liability by any regulatory body or before any court or government agency, governmental authority or body pending or threatened alleging non-compliance with under any Data Security ObligationProtection Requirement.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. Any certificate signed by any officer of the Company and delivered to any Underwriter or to counsel for the Underwriters in connection with the offering, or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has a reasonable basis for making each of the representations set forth in this Section 1. The Company acknowledges that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 6 hereof, counsel to the Company and its Subsidiaries have not received any notification counsel to the Underwriters, will rely upon the accuracy and truthfulness of or complaint regarding the foregoing representations and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationhereby consents to such reliance.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their respective businesses, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or of, accesses to or other compromises of the same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson (other than those notifications provided in accordance with applicable law and which did not result in material cost or liability), nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and external privacy and security policies, binding industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to comply in all material respects with the European Union General Data Protection Regulation (and to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon as they take effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or used by the Company or its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used collected, used, stored or processed in connection with their businesses, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or entity, nor any incidents under internal review or investigations relating to the same. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries have complied with and are presently in compliance with all applicable laws or statutes (including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation (the “GDPR”) and all applicable judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and external policies, and contractual obligations relating to the privacy and security of IT Systems and the collection, use, transfer, import, export, storage, disposal and disclosure of Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligations”). The Neither the Company and nor any of its Subsidiaries subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security ObligationsObligation, and there have been is no pending or, to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or government governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have made all disclosures as required by applicable laws and regulatory rules or requirements in connection with such Data Security Obligations, and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the GDPR and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. The Company’s (i) Each Company Party and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the such Company Party and its Subsidiaries subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) each Company Party and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The ; (iii) each Company Party and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The ; and (iv) each Company Party and its Subsidiaries subsidiaries have not received taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of or complaint regarding each of clause (i), (ii), (iii) and are unaware of any other facts that(iv), reasonably be expected, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there to have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the knowledge of the Company, such IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or . To the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same, except as otherwise disclosed in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus. The Except as would not reasonable be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The To the Company’s best knowledge after all due inquiry, the Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and and, after all due inquiry, have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Except as would not reasonably be expected to have a Material Adverse Effect, (i) the Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its Subsidiaries subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material the Prospectus, and (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptantsharmful code. The Company and its Subsidiaries have implemented subsidiaries taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries, taken as a whole, are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The ; and the Company and its Subsidiaries subsidiaries have not received implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any notification of or complaint regarding and are unaware of any other facts thatinconsistency would not, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there be expected to have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, servers, hardware, software, websites, applications, and databases used in the Company’s and its subsidiaries’ business (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the such business of the Company and its Subsidiaries as currently conducted, and such IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operationoperation (including commercially reasonable disaster recovery), redundancy and security of all IT Systems and data (including all personalany personally identifiable information and regulated data) maintained, personally identifiableprocessed or stored by the Company or its subsidiaries, sensitive, confidential or regulated data or and any such data that may constitute trade secretsprocessed or stored by third parties on behalf of the Company or its subsidiaries (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Company Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been nono breaches, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breachesincidents, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of use, access or accesses disclosure or other compromise to samethe IT Systems or the Company Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the sameliability. The Company and its Subsidiaries subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal or publicly posted policies of the Company and its subsidiaries, and contractual obligations obligations, in each case, relating to the privacy and privacy, protection or security of IT Systems and Personal and Confidential or Company Data (“Data Security Privacy Legal Obligations”) and or to the protection collection, processing, sharing, transfer, usage, disposal or storage of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationCompany Data. The Neither the Company and nor any of its Subsidiaries have not subsidiaries has received any notification notice, request or other communication from any governmental or regulatory authority or claim from any person, or has been subject to any enforcement action, in each case, relating to a breach or alleged breach of or complaint regarding and are unaware of any other facts thatPrivacy Legal Obligations, individually except as would not, individual or in the aggregate, would aggregate reasonably indicate non-compliance with any Data Security Obligations, and there be expected to have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationa Material Adverse Effect.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in all material respects for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, and to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, material breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are is presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not reasonably be expected to have a Material Adverse Effect. Any certificate signed by any officer of the Company and delivered to any Underwriter or to counsel for the Underwriters in connection with the offering, or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has a reasonable basis for making each of the representations set forth in this Section 1. The Company acknowledges that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 6 hereof, counsel to the Company and its Subsidiaries have not received any notification counsel to the Underwriters, will rely upon the accuracy and truthfulness of or complaint regarding the foregoing representations and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationhereby consents to such reliance.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or |US-DOCS\149255760.3|| regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligationssame would be reasonably likely to create a material liability) as soon they take effect, except as has not and there have been no actionwould not reasonably be expected to result in liability material to the Company and its subsidiaries, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationtaken as a whole.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiaries’ subsidiary’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiary as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants. The Company and its Subsidiaries subsidiary have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries its subsidiary have not been notified of of, and have no knowledge of any event or condition that would reasonably be expected to result inin any, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personsame (“Breach”), nor are there any incidents under internal review or investigations relating to any Breach. Neither the sameCompany nor its subsidiary has received any notice, claim, complaint, demand or letter from any person or governmental agency in respect of their businesses under applicable data protection laws, regulations and standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiary’s businesses. Neither the Company nor its subsidiary have been obligated to notify any third party, including, without limitation, any individual or data protection authority, of any Breach. The Company and its Subsidiaries subsidiary have complied at all times and are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligation”), except where the failure to so comply would not result in a Material Adverse Effect. The Company and its Subsidiaries subsidiary have not taken all necessary actions to comply with any Data Security Obligation, including the European Union General Data Protection Regulation, the Health Insurance Portability and Accountability Act, and the California Consumer Privacy Act. Neither the Company nor its subsidiary have received any notice, claim, complaint, demand, letter, notification of or complaint regarding regarding, and are unaware the Company has no knowledge of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with with, any Data Security Obligations, Obligation and there have been is no pending or threatened action, suit suit, investigation or proceeding by or before any court or government governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except as could not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential confidential, or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential or Sensitive Data”)) used in connection with their businesses, and/or the offering of the Shares, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same, except as could not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect. The Company and its Subsidiaries subsidiaries are presently presently, and at all times have been, in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential or Sensitive Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential or Sensitive Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have , except as could not received any notification of or complaint regarding and are unaware of any other facts thatreasonably be expected, individually or in the aggregate, would reasonably indicate to have a Material Adverse Effect. The Company and its subsidiaries have taken commercially reasonable actions to comply with any applicable laws and regulations with respect to Personal or Sensitive Data that are effective as of the date hereof, and to prepare to comply with applicable laws and regulations with respect to Personal or Sensitive Data that will become effective within 12 months after the date hereof, in each case for which any non-compliance with any Data Security Obligations, the same would be reasonably likely to create a material liability to the Company and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationits subsidiaries.

Cybersecurity; Data Protection. The Company’s and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the its business of the Company and its Subsidiaries as currently conducted, in each case, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company has implemented, maintained and its Subsidiaries have implemented and maintained complied with commercially reasonable information technology, information security, cybersecurity and data protection controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential information or regulated data or any such data that may constitute trade secretssecrets (collectively, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Sensitive Data”)) used collected, used, stored or processed by, or to the knowledge of the Company, on behalf of the Company in connection with their businessesits business, and/or and, to the offering of the SharesCompany’s knowledge, and there have been nono breaches, violations, outages or unauthorized uses of or accesses to any IT Systems and Sensitive Data, except for those that have been remedied without material cost or liability. The Company is presently in compliance with all applicable laws or statutes and all other applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies, and contractual obligations relating to the Company privacy and security of IT Systems and the Subsidiaries collection, use, transfer, import, export, storage, disposal and disclosure of Sensitive Data and to the protection of such IT Systems and Sensitive Data from unauthorized use, access, misappropriation or modification (“Data Security Obligations”) except where the failure to comply would not, individually or in the aggregate, have a Material Adverse Effect. The Company (i) has not been notified received any notification of or complaint regarding any actual or potential liability under or relating to, or actual or potential violation of any Data Security Obligation and have has no knowledge of any event or condition that would reasonably be expected to result inin any such notice, breaches(ii) is not currently conducting or paying for, violations, outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, individually whole or in the aggregatepart, would reasonably indicate non-compliance with any investigation, remediation or other corrective action pursuant to any Data Security ObligationsObligation, (iii) is not a party to any order, decree, or agreement that imposed any obligation or liability under any Data Security Obligation and there have been no (iv) is not subject to any pending or, to the knowledge of the Company, threatened action, suit suit, investigation or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.Obligation by the Company. (jj)

Cybersecurity; Data Protection. The Company’s Company and its Subsidiariessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its Subsidiaries subsidiaries as currently conducted, and to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (“Personal and Confidential Data”)) used in connection with their businesses, and/or and, to the offering knowledge of the SharesCompany, and there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages, destruction, loss, leakage, misappropriation, modification outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson (other than those notifications provided in accordance with applicable law and which did not result in material cost or liability), nor any material incidents under internal review or investigations relating to the same. The Company and its Subsidiaries subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any Governmental Entitycourt or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification. The Company and its Subsidiaries subsidiaries have not received taken all necessary actions to comply in all material respects with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any notification of or complaint regarding and are unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligationsame would be reasonably likely to create a material liability) as soon as they take effect.