Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Effect. The Company and its subsidiariessubsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a wholeMaterial Adverse Effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) ), are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants (collectively, “Bugs”), except where such Bugs would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards as are generally maintained by similarly situated companies and which the Company and its subsidiaries believe are reasonably adequate to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses. Without limiting the foregoing, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans as are generally maintained by similarly situated companies that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). To the knowledge of the Company, taken as a wholethere has been no such Breach. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes have not been notified of and all judgments, orders, rules and regulations have no knowledge of any court event or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so condition that would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiariesresult in, taken as a wholeany such Breach.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. The Company and its Subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Sales Agent or to counsel for the Sales Agent shall be deemed to be a representation and warranty by the Company to the Sales Agent as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Except as could not be expected to have a Material Adverse Effect, the Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as could not be expected to have a Material Adverse Effect, the Company and its subsidiaries have, at all times, has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, proprietary, confidential or regulated data (collectively, the “Confidential Sensitive Data”)) used in connection with their businessesits business, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except same. Except as would could not individually or in the aggregate be expected to have a Material Adverse Effect on Effect, the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are is presently in material compliance with all applicable laws or statutes (including without limitation all applicable privacy and security laws and regulations, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Sensitive Data and to the protection of such IT Systems and Confidential Sensitive Data from unauthorized use, access, misappropriation or modification. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, except where failure to do so or actual or potential violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would not reasonably be expected to have result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a Material Adverse Effect on the Company and its subsidiariesparty to any order, taken as a wholedecree, or agreement that imposes any obligation or liability under any Privacy Law.

Cybersecurity; Data Protection. The Company Company’s and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data or any such data that may constitute trade secrets, important data and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security, public interest or lawful rights and interests of relevant individuals or organizations pursuant to the applicable laws (collectively, the “Personal and Confidential Data”)) used in connection with their businesses, andand/or the offering of the Shares, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no, and the Company and the Subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in, breaches, violations, outages outages, destruction, loss, leakage, misappropriation, modification or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityGovernmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal and Confidential Data (“Data Security Obligations”) and to the protection of such IT Systems and Personal and Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariesSubsidiaries have not received any notification of or complaint regarding and are unaware of any other facts that, taken as a wholeindividually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligations, and there have been no action, suit or proceeding by or before any court or government agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company Except as described in the Registration Statement, the Pricing Disclosure Package and its subsidiaries’ the Prospectus, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, ; to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the same Company’s or any of its subsidiaries’ Personal Data or IT Systems and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiariessubsidiaries have not been notified of, taken as a whole. The and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and Confidential the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, Disclosure Package and the Prospectus, or except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company and its subsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including confidential information, trade secrets or other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors, personal data and any third party data maintained by or on behalf of the Company and its subsidiaries (collectively, “IT SystemsSystems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantsconducted. The Company and its subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedureshave complied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations and any other legal obligations, in each case, relating to the privacy and security of IT Systems and Confidential Data Data, and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except where failure to do so as would not not, individually or in the aggregate, reasonably be expected to have result in a Material Adverse Effect on Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data in accordance with industry practices and as required by applicable regulatory standards. Except as disclosed in the Registration Statement, Disclosure Package and the Prospectus, the Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; the Company and its subsidiaries have not received notification of, and have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries, taken as a wholeand there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no, and the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in any, breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personsame (“Breach”), nor are there any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on any Breach. Neither the Company nor its subsidiaries has received any notice, claim, complaint, demand or letter from any person or governmental agency in respect of their businesses under applicable data protection laws, regulations and standards regarding any Breach of the IT Systems or any Personal Data used in connection with the operation of the Company’s and its subsidiaries’ businesses. Neither the Company nor its subsidiaries have been obligated to notify any third party, taken as a wholeincluding, without limitation, any individual or data protection authority, of any Breach. The Company and its subsidiaries have complied at all times and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and Confidential the privacy, security, collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the modification (“Data Security Obligation”). The Company and its subsidiariessubsidiaries have taken all necessary actions to comply with any Data Security Obligations to which it is obligated to comply. Neither the Company nor its subsidiaries have received any notice, taken as a wholeclaim, complaint, demand, letter, notification of or complaint regarding, and is unaware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with, any Data Security Obligation and there is no pending or threatened action, suit, investigation or proceeding by or before any court or governmental agency, authority or body alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not reasonably be expected to have a Material Adverse Effect, (A) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, for and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the best knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (B) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, household, confidential or regulated data or information collected, stored or processed by the Company or its subsidiaries (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to businesses and have contractual commitments from third parties who process Personal Data on their behalf regarding the Company’s knowledge, based on commercially reasonable security and monitoring, same; (C) there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to samethe IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or governmental or regulatory authority, nor any and there are no incidents or, to Company’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same and except as would not individually or in same; (D) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, loss, access, processing, misappropriation or modification, except where failure including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and all other laws and regulations with respect to do so would not reasonably be expected Personal Data applicable to have a Material Adverse Effect on the Company or its subsidiaries (“Privacy Laws”); (E) the Company and its subsidiariessubsidiaries have not received notice of any actual or potential violation of any Privacy Laws and there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened against the Company or its subsidiaries alleging non-compliance with Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken as a wholecommercially reasonable steps to require that any Personal Data of the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. The Company Except as has not had or could not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, (i) the Company’s and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted and, and (ii) to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants designed to permit unauthorized access or activity. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person, nor are there any incidents under internal review or investigations relating to the same such IT Systems or Personal Data and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. (A) The Company and its subsidiaries’ information technology assets Subsidiaries have complied and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential data, confidentiality and archive administration (including all personal, personally identifiable, sensitive, confidential or regulated data, or any such data that may constitute trade secrets and working secrets of any governmental authority or any other data that would otherwise be detrimental to national security or public interest pursuant to the applicable laws used in connection with their businesses and/or the offering of the Class A ordinary shares) (“Data Protection Laws”, and such data, “Data”) and to the protection of such IT Systems and Confidential Data from loss and against unauthorized use, access, misappropriation or misappropriation, modification, except where failure disclosure or other misuse; (B) neither the Company nor any of its Subsidiaries is subject to do so any sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the CSRC, or any other relevant governmental authority; (C) neither the Company nor any of its Subsidiaries has received any investigation, inquiry, notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice), letter, complaint or allegation from the relevant cybersecurity, data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance by it of the applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (D) neither the Company nor any of its Subsidiaries has received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (E) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (F) neither the Company nor its Subsidiaries has received any communication, enquiry, notification of, warning or complaint regarding any Data Protection Laws (including, without limitation, the CSRC Archive Rules) or from the CAC; (G) neither the Company nor its Subsidiaries is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Protection Laws; (H) the Company is not reasonably be expected aware of any pending or threatened investigation, inquiry or sanction relating to have a Material Adverse Effect cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, officers and employees; (I) the Company and its subsidiariesSubsidiaries have adequate and effective internal control measures and internal systems consistent with applicable regulatory standards and customary industry practices (including, taken without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used, gathered or accessed in connection with their businesses and/or the offering of the Class A ordinary shares, and there have been no breaches, violations, outages, leakages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same; (J) neither the Company nor any of its Subsidiaries is, or is expected to be classified as a whole“critical information infrastructure operator” under the Revised Cybersecurity Review Measure; (K) neither the Company nor any of its Subsidiaries has received any objection to the offering of the Class A ordinary shares or the transactions contemplated under this Agreement from the CSRC, the CAC or any governmental authority.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries and the Consolidated Affiliated Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantsmaterial corruptions. The Company and its subsidiaries have, at all times, Subsidiaries and the Consolidated Affiliated Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries and the Consolidated Affiliated Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariesSubsidiaries and the Consolidated Affiliated Entities have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. The Company and its Subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Representatives or to counsel for the Underwriters shall be deemed to be a representation and warranty by the Company to the Underwriters as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Except (i) as described in Registration Statement, the Pricing Disclosure Package and the Prospectus or (ii) as would not reasonably be expected to have a Material Adverse Effect, (A) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (B) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential confidential, or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, ; (C) to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or governmental or regulatory authority, nor any and there are no incidents under internal review or investigations by governmental or regulatory authorities or other third parties relating to the same and except as would not individually or in same; (D) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on ; (E) the Company and its subsidiariessubsidiaries have at all times taken all reasonable steps to safeguard that any Personal Data of the Company and its subsidiaries collected or handled by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (F) the Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a wholematerial liability) as soon as they took effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, documented internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation and the California Consumer Privacy Act (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. Neither the Company nor any of its subsidiaries, (i) has received written notice of any actual or potential liability of the Company or its subsidiaries from any governmental or regulatory agencies or bodies (or, except where failure to do so as would not reasonably be expected material to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, any other person) under or relating to, or actual or potential violation by the Company or any of its subsidiaries of, any of such laws and regulations; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action by or mandated by any governmental or regulatory agency or body pursuant to any of such laws and regulations; or (iii) is a party to any order, decree, or agreement with any governmental or regulatory agency or body that imposed any obligation or liability under any of such laws and regulations.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure . The Company and its subsidiaries have taken all necessary actions to do so would not reasonably be expected prepare to have a Material Adverse Effect on comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and its subsidiariessubsidiaries (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as soon as they take effect. In addition, any certificate signed by any executive officer of the Company and delivered to the Underwriters or counsel for the Underwriters in connection with the offering of the Securities shall be deemed to be a wholerepresentation and warranty by the Company, as to matters covered thereby, to each of the Underwriters.

Cybersecurity; Data Protection. The Company Each RSG Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company each RSG Party and its subsidiaries as currently conducted andconducted, and to the Company’s RSG Parties’ knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Each RSG Party and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company Each RSG Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, except where failure to do so the “Data Security Obligations”). Each RSG Party and its subsidiaries have taken all necessary actions as would not reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a Material Adverse Effect on material liability) as soon they take effect. None of the Company RSG Parties has to their knowledge received any notification of or complaint regarding and its subsidiariesis unaware of any other facts that, taken as a wholeindividually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in same; (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iv) the Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability) as soon they take effect, except where failure to do so as would not not, in the case of each of clause (i), (iii) and (iv), reasonably be expected expected, individually or in the aggregate, to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect.

Cybersecurity; Data Protection. (i) The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same same; and except as would not individually or in (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure except, with respect to do so each of clauses (i) and (iii), as would not reasonably be expected to not, individually or in the aggregate, have a Material Adverse Effect on the Effect. The Company and its subsidiariessubsidiaries have taken commercially reasonable actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability as a wholesoon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and to the Knowledge of the Company, its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses. Without limiting the foregoing, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”) and, taken as a wholethere has been no such Breach. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes have not been notified of and all judgments, orders, rules and regulations have no Knowledge of any court event or arbitrator or governmental or regulatory authoritycondition that would reasonably be expected to result in, internal policies and contractual obligations relating any such Breach. This representation is limited in each case to the privacy and security of IT Systems and Confidential Data and to the protection of extent that such IT Systems and Confidential Data from unauthorized use, access, misappropriation breach or modification, except where failure to do so noncompliance would not reasonably be expected to have a Material Adverse Effect on Effect, and except as otherwise disclosed in the Company and its subsidiaries, taken as a wholeRegistration Statement or the Prospectus.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in all material respects for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombsbombs and malware. Except as would not, malware and other corruptants. The individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person. To the knowledge of the Company, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company and its subsidiaries, and all internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon they take effect.

Cybersecurity; Data Protection. The Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus or as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted conducted, including in terms of functionality and performance, and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and confidential data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data, including, without limitation, any data which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”), “personal data” as defined by the European Union General Data Protection Regulation (EU 2016/679 or “Confidential GDPR”), and any other piece of information that allows the identification of a natural person, or his or her family, or data related to an identified person’s health or sexual orientation (collectively, “Personal Data”)) used in connection with their businesses, and, ; (iii) to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other personPersonal Data, nor any incidents under internal review or investigations relating to the same and except as would not individually or in (iv) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently and have been at all times in material compliance with all applicable laws laws, directives or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or supragovernmental or regulatory authority, internal policies and policies, contractual obligations and industry standards relating to the privacy and security of IT Systems and Confidential Personal Data, including, without limitation, the GDPR, the UK Data Protection ▇▇▇ ▇▇▇▇, EU Directive 2002/58/EC and all applicable national implementing legislation (“Data Protection Laws”) and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on ; and (v) the Company and its subsidiariessubsidiaries have used commercially reasonable efforts to require their vendors, taken as a wholeservice providers or other third parties that have received access to any Personal Data from the Company or its subsidiaries to protect the privacy, security and confidentiality of such Personal Data.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”i) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, implemented and maintained commercially reasonable controls, policies, procedureshave complied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance compliance, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes statutes, and all judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any contractual or legal obligations regarding the collection, internal policies use, transfer, import, export, storage, protection, security, disposal and contractual obligations relating to disclosure by the privacy Company and security its subsidiaries of IT Systems and Confidential Data (“Data Security Obligations”); (ii) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, or are aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no pending, or to the protection knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation, except in the case of clause (iii), as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have taken steps reasonably necessary in accordance with industry standard practices to protect such IT Systems information against loss and Confidential Data from against unauthorized use, access, misappropriation or misappropriation, modification, disclosure or other misuse, except where in each case to the extent that the failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. To the knowledge of the Company, except as disclosed in the Registration Statement, the Disclosure Package and the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with all applicable laws and regulations with respect to Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, as soon as they take effect.

Cybersecurity; Data Protection. The Company and its subsidiariesthe Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, the Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personthird party, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries the Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure . The Company and the Controlled Entities have taken all necessary actions to do so would not reasonably be expected prepare to have a Material Adverse Effect on comply with the European Union General Data Protection Regulation to the extent that it is applicable to the Company and its subsidiariesthe Controlled Entities (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon as they take effect.

Cybersecurity; Data Protection. The Company and its subsidiariesParties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its subsidiaries their Subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except as would not reasonably be expected to have an Issuer Material Adverse Effect. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitivepersonal, confidential personally identifiable or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to . To the Company’s knowledge, based on commercially reasonable security and monitoringknowledge of the Company Parties, there have been no breaches, violations, outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as would not individually or in the aggregate reasonably be expected to have a an Issuer Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect. The Company Parties and its subsidiaries Subsidiaries are presently in compliance in all material compliance respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure . The Company Parties and their Subsidiaries have used reasonable best efforts to do so would not reasonably be expected to have a Material Adverse Effect on the Company implement backup and its subsidiaries, taken as a wholedisaster recovery technology consistent with industry standards and practices in all material respects.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries have taken all necessary actions to prepare to comply, taken in all material respects, with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a wholematerial liability) as soon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiariesParties’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its subsidiaries their Subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its subsidiaries have, at all times, their Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitivepersonal, confidential personally identifiable or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to . To the Company’s knowledge, based on commercially reasonable security and monitoringknowledge of the Company Parties, there have been no breaches, violations, outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and the Company Parties and its Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to the IT Systems and Personal Data, except as would not individually or in the aggregate reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect. The Company Parties and its subsidiaries their Subsidiaries are presently in compliance in all material compliance respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure . The Company Parties and their Subsidiaries have used reasonable best efforts to do so would not reasonably be expected to have a Material Adverse Effect on the Company implement backup and its subsidiaries, taken as a wholedisaster recovery technology consistent with industry standards and practices in all material respects.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to samesame (“Security Incidents”), except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies policies, public notices and statements, and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized useSecurity Incidents, accessincluding the European Union General Data Protection Regulation (collectively, misappropriation “Privacy Requirements”). The Company and its subsidiaries have taken all necessary actions to prepare to comply, in all material respects, with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect. Neither the Company nor any of its subsidiaries have received written notices of, are subject to, or, to the Company’s knowledge, have been threatened with any Actions arising out of or modificationin connection with any Security Incident or any actual or alleged violation of any Privacy Requirement, except where failure to do so as would not reasonably be expected expected, individually or in the aggregate, to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or |US-DOCS\149255760.3|| regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect, except where failure to do so as has not and would not reasonably be expected to have a Material Adverse Effect on result in liability material to the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. The Company and its Subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Representatives or counsel for the Underwriters shall be deemed to be a representation and warranty by the Company to the Underwriters as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Except in each case as would not, individually or in the aggregate, have a Material Adverse Effect: (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in same; (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on ; and (iv) the Company and its subsidiariessubsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect. Any certificate signed by an officer of the Company and delivered to the Managers or to counsel for the Underwriters shall be deemed to be a wholerepresentation and warranty by the Company to each Underwriter as to the matters set forth therein.

Cybersecurity; Data Protection. The Company Except as described in the Registration Statement, the Offering Materials and its subsidiaries’ the Prospectus, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned by, or leased or licensed to, the Company or any of its subsidiaries (collectively, “IT Systems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, ; to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or outages, unauthorized uses of, accesses to or other compromise of or accesses relating to sameany of the Company’s or any of its subsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the same Company’s or any of its subsidiaries’ Personal Data or IT Systems and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiariessubsidiaries have not been notified of, taken as a whole. The and have no knowledge of any event or condition that would reasonably be expected to result in, any security breach or other compromise to their IT Systems or Personal Data; the Company and its subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and Confidential the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. The Company and its subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Representative or to counsel for the Underwriters shall be deemed to be a representation and warranty by the Company to the Underwriters as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The , and (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson or supervisory authority, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries comply in all material respects with all applicable laws and regulations with respect to Personal Data currently in effect and have taken commercially reasonable actions designed to comply, taken on the date that such compliance is required, in all material respects with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a wholematerial liability, including, without limitation, the Swiss Data Protection Act (and its implementing ordinance), the European Union General Data Protection Regulation and the California Consumer Privacy Act. Neither the Company nor its subsidiaries have been subject to a control or a notification from a supervisory authority, or have received any complaint in relation with their compliance with the Swiss Data Protection Act (and its implementing ordinance) and the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data).

Cybersecurity; Data Protection. The Company and its subsidiaries’ Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate in all material respects for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, and to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so as would not reasonably be expected to have a Material Adverse Effect on Effect. Any certificate signed by any officer of the Company and its subsidiariesdelivered to any Underwriter or to counsel for the Underwriters in connection with the offering, taken or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has a wholereasonable basis for making each of the representations set forth in this Section 1. The Company acknowledges that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 6 hereof, counsel to the Company and counsel to the Underwriters, will rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company has implemented and its subsidiaries have, at all times, maintained or caused to be implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their its businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are is presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company has taken all necessary actions to comply with the European Union General Data Protection Regulation and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof (“Privacy Laws”), except where failure and for which any non-compliance with same would be reasonably likely to do so would create a material liability. The Company has not reasonably be expected received written notice of any claim, action, suit, proceeding, hearing, enforcement, investigation, arbitration or other action from or by any court or arbitrator or governmental or regulatory authority or third party alleging any material violation of any Privacy Laws or policies and procedures relating to have a Material Adverse Effect on data privacy and security and the Company collection, use, disclosure and its subsidiariesother processing of Personal Data and, taken as a wholeto the Company’s knowledge, no such claim, action, suit, proceeding, hearing, enforcement, investigation, arbitration or other action is threatened.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, data and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andand as proposed to be conducted in the Registration Statement, to the Company’s knowledgeDisclosure Package, based on commercially reasonable security and monitoringthe Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants. The Company and its subsidiaries have, at all timeshave established, implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and material data (including all personal data and personal, personally identifiable, household, sensitive, confidential or regulated data or information (collectively, the “Confidential Company Data”)) used in connection with their businesses, and, to in compliance with all applicable laws and regulatory standards in all material respects. To the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages outages, security incidents or unauthorized uses of or accesses to same, except for those that have been remedied without material cost any IT Systems or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeData. The Company and its subsidiaries own or have a valid right to access and use all IT Systems and Company Data, and have complied in all material respects and are presently in material compliance with all applicable laws or statutes and all statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authority, binding industry standards, internal and external policies and notices, contractual obligations and any other legal obligations, in each case relating to the privacy and security collection, use, transfer, import, export, storage, protection, disposal, disclosure or other processing by or on behalf of IT Systems and Confidential the Company or any of its subsidiaries of Company Data and (“Data Security Obligations”). Neither the Company nor any of its subsidiaries have received any notification of or complaint regarding, or otherwise have knowledge of any facts that would indicate, any material non-compliance by the Company or any of its subsidiaries with any Data Security Obligation. There is no action, suit, investigation or proceeding against the Company or any of its subsidiaries by or before any court or governmental agency, authority or body pending or, to the protection knowledge of such IT Systems and Confidential Data from unauthorized usethe Company, accessthreatened, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on against the Company and or any of its subsidiaries alleging material non-compliance with any Data Security Obligations by the Company or any of its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. (i) The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same same; and except as would not individually or in (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure except, with respect to do so each of clauses (i) and (iii), as would not reasonably be expected to not, individually or in the aggregate, have a Material Adverse Effect on the Effect. The Company and its subsidiariessubsidiaries have taken commercially reasonable actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability as a wholesoon as they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all its IT Systems and material data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same same; and except as would not individually or in (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries have taken all customary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon as they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, documented internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and the California Consumer Privacy Act (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability). Neither the Company nor any of its subsidiaries, (i) has received written notice of any actual or potential liability of the Company or its subsidiaries from any governmental or regulatory agencies or bodies ( except where failure to do so as would not reasonably be expected material to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole) under or relating to, or actual or potential violation by the Company or any of its subsidiaries of, any of such laws and regulations; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action by or mandated by any governmental or regulatory agency or body pursuant to any of such laws and regulations; or (iii) is a party to any order, decree, or agreement with any governmental or regulatory agency or body that imposed any obligation or liability under any of such laws and regulations.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except as could not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential confidential, or regulated data (collectively, the “Confidential Personal or Sensitive Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and same, except as would could not reasonably be expected, individually or in the aggregate aggregate, to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect. The Company and its subsidiaries are presently presently, and at all times have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal or Sensitive Data and to the protection of such IT Systems and Confidential Personal or Sensitive Data from unauthorized use, access, misappropriation or modification, except where failure to do so would as could not reasonably be expected expected, individually or in the aggregate, to have a Material Adverse Effect on Effect. The Company and its subsidiaries have taken commercially reasonable actions to comply with any applicable laws and regulations with respect to Personal or Sensitive Data that are effective as of the date hereof, and to prepare to comply with applicable laws and regulations with respect to Personal or Sensitive Data that will become effective within 12 months after the date hereof, in each case for which any non-compliance with the same would be reasonably likely to create a material liability to the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the including protected health information) (“Confidential Personal Data”)) used collected, used, stored or processed in connection with their businesses, andand except as would not reasonably be expected, individually or in the aggregate, to the Company’s knowledge, based on commercially reasonable security and monitoringhave a Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except same. Except as would not reasonably be expected, individually or in the aggregate aggregate, to have a Material Adverse Effect on Effect, the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently presently, and since January 1, 2017 have been, in material compliance with all applicable laws or statutes (including without limitation, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external privacy policies, applicable industry standards and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, except where failure use, transfer, import, export, storage, disposal and disclosure by the Company and its subsidiaries of Personal Data (“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to do so the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not reasonably be expected expected, individually or in the aggregate, to have a Material Adverse Effect on Effect, the Company and its subsidiaries, taken as a wholesubsidiaries have made all disclosures to users or customers required by applicable laws and regulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform perform, in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in same; (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on ; and (iv) the Company and its subsidiariessubsidiaries have taken all necessary actions to comply, taken in all material respects, with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a wholematerial liability) as soon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Representatives or to counsel for the Underwriters shall be deemed to be a representation and warranty by the Company to the Underwriters as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Company Company, CTWS and its their respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Company, CTWS and its their respective subsidiaries as currently conducted conducted, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Company, CTWS and its their respective subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company Company, CTWS and its their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. To the Company’s knowledge, except where failure the Company, CTWS and their respective subsidiaries have taken all necessary actions, to do so would not reasonably be expected the extent required to have a Material Adverse Effect on the Company and its subsidiaries, been taken as of the date hereof, to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a wholematerial liability.

Cybersecurity; Data Protection. (i) The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and are, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no material breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in same; (iii) the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iv) the Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect, except where failure to do so as would not not, in the case of each of clause (i), (iii) and (iv), reasonably be expected expected, individually or in the aggregate, to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect.

Cybersecurity; Data Protection. The Company Company’s and its subsidiariesSubsidiaries’ and Affiliated Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries and Affiliated Entities as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries and Affiliated Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries and Affiliated Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariesSubsidiaries and Affiliated Entities have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or of, accesses to or other compromises of the same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson (other than those notifications provided in accordance with applicable law and which did not result in material cost or liability), nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external privacy and security policies, binding industry standards and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries have taken all necessary actions to comply in all material respects with the European Union General Data Protection Regulation (and to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon as they take effect.

Cybersecurity; Data Protection. The Company Company, the Guarantor and its their subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries the Subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, singly or in the aggregate, result in a Material Adverse Effect. The Company Company, the Guarantor and its their subsidiaries have, at all times, (i) (x) have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and sensitivepersonal, confidential or regulated personally identifiable data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, (y) there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its subsidiaries same; (ii) are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification; and (iii) have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, except where failure and for which any non-compliance with same would be reasonably likely to do so create a material liability) as soon they take effect; except, with respect to each of the foregoing clauses (i), (ii) and (iii), as would not reasonably be expected to have not, singly or in the aggregate, result in a Material Adverse Effect on Effect. Any certificate signed by an officer of the Company or the Guarantor and delivered to the Representative or to counsel for the Initial Purchasers shall be deemed to be a representation and warranty by the Company and its subsidiaries, taken the Guarantor to each Initial Purchaser as a wholeto the matters set forth therein.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect Effect. The Company and its subsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a Company Material Adverse Effect. Any certificate signed by or on behalf of the Company and its subsidiaries, taken delivered to the Representative or to counsel for the Underwriters shall be deemed to be a representation and warranty by the Company to the Underwriters as a wholeto the matters covered thereby.

Cybersecurity; Data Protection. The Company Each ▇▇▇▇ Party and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company each ▇▇▇▇ Party and its subsidiaries as currently conducted andconducted, and to the Company’s ▇▇▇▇ Parties’ knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Each ▇▇▇▇ Party and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any governmental or regulatory authority or any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company Each ▇▇▇▇ Party and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, except where failure to do so the “Data Security Obligations”). Each ▇▇▇▇ Party and its subsidiaries have taken all necessary actions as would not reasonably be expected to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same could be reasonably likely to create a Material Adverse Effect on material liability) as soon they take effect. None of the Company ▇▇▇▇ Parties has to their knowledge received any notification of or complaint regarding and its subsidiariesis unaware of any other facts that, taken as a wholeindividually or in the aggregate, would reasonably indicate non-compliance with any Data Security Obligation and to their knowledge there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect, except where failure to do so as has not and would not reasonably be expected to have a Material Adverse Effect on result in liability material to the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except as would not, individually or in the aggregate, be reasonably expected to result in a Material Adverse Change. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material Personal Data, confidential information and the integrity, continuous operation, redundancy and security of all IT Systems information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases and data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those such controls, policies, procedures and safeguards the failure to maintain, or such breaches, violations, outages or unauthorized uses or accesses that would not, individually or in the aggregate, reasonably be expected to have been remedied without material cost or liability or the duty to notify any other persona Material Adverse Change, nor any incidents under internal review or investigations relating to the same and except as same. Except where non-compliance would not not, individually or in the aggregate have aggregate, reasonably be expected to result in a Material Adverse Effect on Change, the Company and each of its subsidiaries are in compliance with all applicable data privacy and security and data protection laws and regulations regarding the collection, use, transfer, storage, protection, disposal or disclosure of Personal Data (as defined below) processed, stored or collected by the Company and its subsidiariessubsidiaries (collectively, taken the “Privacy Laws”). “Personal Data” means personally identifiable information, protected health information, financial information, “personal data” as a wholedefined by the EU General Data Protection Regulations (EU 2016 679) and all other information subject to Privacy Laws. The Company and its subsidiaries are presently in material have policies and procedures reasonably designed to (i) ensure compliance with Privacy Laws and its privacy policies on its website or other consumer facing communications; and (ii) reasonably protect the security and confidentiality of all applicable laws or statutes and all judgments, orders, rules and regulations Personal Data. Neither the Company nor any subsidiary has received written notice of any court actual or arbitrator potential material liability under or governmental relating to, or regulatory authorityactual or potential material violation of, internal policies and contractual obligations relating to any of the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholePrivacy Laws.

Cybersecurity; Data Protection. The To the best knowledge of the Company after all due inquiry/investigation, the Company’s and its subsidiariesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityGovernmental Entity, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where the failure to do so of any of the foregoing would not reasonably be expected to have a Material Adverse Effect Change. (A) Each of the Company and its Subsidiaries has complied with all applicable laws concerning cybersecurity, data protection, confidentiality and archive administration (collectively, the “Data Protection Laws”); (B) neither the Company nor any Subsidiaries is, or is expected to be classified as, a “critical information infrastructure operator” under the Cybersecurity Law of the PRC; (C) neither the Company nor any of its Subsidiaries is subject to any investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review by the CAC, the CSRC, or any other relevant governmental authority; (D) neither the Company nor any of its Subsidiaries has received any notice (including, without limitation, any enforcement notice, de-registration notice or transfer prohibition notice), letter, complaint or allegation from the relevant cybersecurity, data privacy, confidentiality or archive administration governmental authority alleging any breach or non-compliance by it of the applicable Data Protection Laws or prohibiting the transfer of data to a place outside the relevant jurisdiction; (E) neither the Company nor any of its Subsidiaries has received any claim for compensation from any person in respect of its business under the applicable Data Protection Laws and industry standards in respect of inaccuracy, loss, unauthorized destruction or unauthorized disclosure of data and there is no outstanding order against the Company or any of its Subsidiaries in respect of the rectification or erasure of data; (F) no warrant has been issued authorizing the cybersecurity, data privacy, confidentiality or archive administration governmental authority (or any of its officers, employees or agents) to enter any of the premises of the Company or any of its Subsidiaries for the purposes of, inter alia, searching them or seizing any documents or other materials found there; (G) neither the Company nor any of its Subsidiaries has received any communication, enquiry, notice, warning or sanctions with respect to the Cybersecurity Law of the PRC or from the CAC or pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); (H) the Company is not aware of any pending or threatened investigation, inquiry or sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the CAC, the CSRC, or any other relevant governmental authority on the Company or any of its Subsidiaries or any of their respective directors, officers and employees; (I) the Company is not aware of any pending or threatened actions, suits, claims, demands, investigations, judgments, awards and proceedings on the Company and any of its subsidiariesSubsidiaries or any of their respective directors, taken as officers and employees pursuant to the Data Protection Laws (including, without limitation, the CSRC Archive Rules); and (J) neither the Company nor any of its Subsidiaries has received any objection to the transactions contemplated under this Agreement and the Deposit Agreement from the CSRC, the CAC or any other relevant governmental authority , except where in the case of (A), (D), (E), (F), (G), (H) and (I), any such breach, violation or default would not, in dividually or in the aggregate, have a wholeMaterial Adverse Effect.

Cybersecurity; Data Protection. The Company Company’s and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted conducted, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same same. To the Company’s knowledge, no claims have been asserted or threatened against the Company or its subsidiaries alleging a violation relating to Personal Data or data rights and the consummation of the transactions contemplated hereby will not breach or otherwise cause any violation of any law related to privacy, data protection, or the collection and use of Personal Data collected, used, or held for use by the Company or its subsidiaries in the conduct of their businesses, except as where any such breach or violation would not individually or reasonably be expected to result in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the collection and use of Personal Data, privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, the Issuer’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Issuer as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, Issuer has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the including protected health information) (“Confidential Personal Data”)) used collected, used, stored or processed in connection with their businesses, andand except as would not reasonably be expected to have, to individually or in the Company’s knowledgeaggregate, based on commercially reasonable security and monitoringa Material Adverse Effect, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except same. Except as would not reasonably be expected to have, individually or in the aggregate have aggregate, a Material Adverse Effect on Effect, the Company Issuer has been for the past three (3) years and its subsidiaries, taken as a whole. The Company and its subsidiaries are presently in material compliance with all applicable laws Laws or statutes (including the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external privacy policies, applicable industry standards and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, except where failure use, transfer, import, export, storage, disposal and disclosure by the Issuer of Personal Data (“Data Protection Obligations”). The Issuer has not received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to do so the knowledge of the Issuer, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Issuer has taken commercially reasonable steps in accordance with industry standard practices (including implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Issuer. Except as would not reasonably be expected to have have, individually or in the aggregate, a Material Adverse Effect on Effect, the Company Issuer has made all disclosures to users or customers required by applicable Laws and its subsidiaries, taken as a wholeregulatory rules or requirements and no such disclosures have been inaccurate or in violation of any applicable Laws or regulatory rules and requirements.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the Company’s knowledge, based on commercially reasonable security and monitoring, knowledge free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their respective businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, modification except where failure to do so such non-compliance would not not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Effect. The Company and its subsidiariessubsidiaries have taken all necessary actions to materially comply with the European Union General Data Protection Regulation if and to the extent applicable (and to prepare to materially comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within twelve months after the date hereof, taken and for which any non-compliance with the same would be reasonably likely to create a material liability) as soon they take effect except where such non-compliance would not, individually or in the aggregate, reasonably be expected to have a wholeMaterial Adverse Effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted conducted, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not not, individually or in the aggregate aggregate, reasonably be expected to have a Material Adverse Effect on the Effect. The Company and its subsidiaries, taken as a wholesubsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices. The Company and its subsidiaries are presently presently, and for the past three (3) years have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, “Data Protection Requirements”), except where failure to do so as would not not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on Effect. To ensure compliance with the Data Protection Requirements, the Company and its subsidiariessubsidiaries have in place, taken as comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a wholebreach of any Data Protection Requirements or Policies. To the Company’s knowledge, the Company and its subsidiaries have at all times made all material disclosures to users or customers required by applicable laws and regulatory rules or requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any regulatory body or governmental authority under any Data Protection Requirement.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted andconducted, and to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the knowledge of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other personperson (other than those notifications provided in accordance with applicable law and which did not result in material cost or liability), nor any material incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the . The Company and its subsidiariessubsidiaries have taken all necessary actions to comply in all material respects with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, taken and for which any non-compliance with same would be reasonably likely to create a material liability) as a wholesoon as they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted and, to the Company’s knowledge, based on commercially reasonable security and monitoringconducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have, at all times, have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal data and personal, personally identifiable, sensitive, confidential or regulated data (collectively, the “Confidential Personal Data”)) used in connection with their businesses, and, to the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholesame. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Personal Data and to the protection of such IT Systems and Confidential Personal Data from unauthorized use, access, misappropriation or modification. The Company and its subsidiaries have taken all reasonably necessary actions to prepare to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, except where failure to do so and for which any non-compliance with same would not be reasonably be expected likely to have a Material Adverse Effect on the Company and its subsidiaries, taken as a wholeEffect.