Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology and computer systems and assets, networks, hardware, software, websites, applications, databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology and computer systems and assets, equipment, systems, networks, software, hardware, softwarecomputers, websites, applications, applications and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data, including all personal, personally identifiable, sensitive, confidential or regulated data (“Data”) used in connection with their businesses. , and (iii) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied, nor any incidents currently under internal review or other material compromise of or investigations relating to any of the Company’s same. Except as would not, individually or its subsidiaries’ IT Systems and Datain the aggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect and except as described in each of the Registration Statement, any material security breach or other material compromise to their IT Systems the Pricing Disclosure Package and Data; (ii) the Prospectus, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized usecollected, accessstored, misappropriation processed, transferred, disclosed or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) used by the Company and or its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicessubsidiaries.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business respective businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards consistent with industry standards and practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all its IT Systems and Data data (including personal, personally identifiable, sensitive, confidential or regulated data) used or held for use in connection with their businesses. respective businesses (i) Except as may be included or incorporated by reference in the Registration Statementcollectively, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach“Data”). There have been no breaches, violations, outages or outages, unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and or Data, and except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (yi) the Company and its subsidiaries have not been notified ofcomplied, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance compliance, with all applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and all privacy policies, internal policies and contractual obligations and industry standards relating to the privacy and security of the IT Systems or the collection, use, transfer, import, export, storage, protection, disposal and disclosure of Data (“Data Security Obligations”) and (ii) there is no action, suit, investigation or proceeding by or before any court, governmental agency, authority or body or other third party pending or, to the protection knowledge of such IT Systems and Data from unauthorized usethe Company, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) threatened against the Company and or any of its subsidiaries have implemented backup and disaster recovery technology consistent alleging non-compliance with industry standards and practicesany Data Security Obligation.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology and computer systems and assets, equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except those that would not, singly or in the aggregate, result in a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and appropriate safeguards designed to maintain and protect their material confidential information and the integrity, continuous operationavailability, redundancy and security of all IT Systems and Data all personal, personally identifiable, or otherwise regulated personal data (“Personal Data”) used in connection with their businesses. (i) Except respective businesses reasonably consistent with industry standards and practices, or as may be included or incorporated required by reference in the Registration Statementapplicable regulatory standards, the General Disclosure Package and the Prospectusand, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses access to the same, nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Datasame, and (y) the Company and its subsidiaries have not been notified ofexcept, and have no knowledge of any event or condition in each case, for those that would reasonably be expected to not, singly or in the aggregate, result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the in a Material Adverse Effect. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations authority relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, modification except as where such non-compliance would not, in the case of this clause (ii)would not, individually singly or in the aggregate, have result in a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants designed to damage or corrupt the IT Systems; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their protect, in all material confidential information and respects, the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any there have been no material security breachbreaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any material compromise of incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Datasame; (iiiii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification; and (iv) the Company and its subsidiaries have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation (and to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability) as soon they take effect, except as would not, in the case of this each of clause (iii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. (i) The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, same; and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (iiiii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except except, with respect to each of clauses (i) and (iii), as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the . The Company and its subsidiaries have implemented backup taken commercially reasonable actions to prepare to comply with all applicable laws and disaster recovery technology consistent regulations with industry standards respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and practicesfor which any non-compliance with same would be reasonably likely to create a material liability as soon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and to the Knowledge of the Company, its subsidiaries as currently conducted, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (collectively, “Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeforegoing, the Company has not had any material and its subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, violationsdestruction, outages loss, unauthorized distribution, use, access, disablement, misappropriation or unauthorized uses of or accesses to samemodification, or other material compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s or and its subsidiaries’ IT Systems and Databusinesses (“Breach”) and, and (y) the there has been no such Breach. The Company and its subsidiaries have not been notified of, of and have no knowledge Knowledge of any event or condition that would reasonably be expected to result in, any material security such Breach. This representation is limited in each case to the extent that such breach or other material compromise noncompliance would not reasonably be expected to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; , and (iii) except as otherwise disclosed in the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesRegistration Statement or the Prospectus.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its Subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (collectively, “Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeforegoing, the Company has not had any material and its Subsidiaries have used commercially reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, violationsdestruction, outages loss, unauthorized distribution, use, access, disablement, misappropriation or unauthorized uses of or accesses to samemodification, or other material compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s or and its subsidiariesSubsidiaries’ IT Systems and Databusinesses (“Breach”) and, and (y) to the Knowledge of the Company, there has been no such Breach. The Company and its subsidiaries Subsidiaries have not been notified of, of and have no knowledge of any event or condition that would reasonably be expected to result in, any material security such Breach. This representation is limited in each case to the extent that such breach or other material compromise non-compliance would not reasonably be expected to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; , and (iii) except as otherwise disclosed in the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesRegistration Statement or the Prospectus.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business respective businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards consistent with industry standards and practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all its IT Systems and Data data (including personal, personally identifiable, sensitive, confidential or regulated data) used or held for use in connection with their businesses. respective businesses (i) Except as may be included or incorporated by reference in the Registration Statementcollectively, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach“Data”). There have been no breaches, violations, outages or outages, unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and or Data, and except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (yi) the Company and its subsidiaries have not been notified ofcomplied, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance compliance, with all applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and all privacy policies, internal policies and contractual obligations and industry standards relating to the privacy and security of the IT Systems or the collection, use, transfer, import, export, storage, protection, disposal and disclosure of Data (“Data Security Obligations”) and (ii) there is no action, suit, investigation or proceeding by or before any court, governmental agency, authority or body or other third party pending or, to the protection knowledge of such IT Systems and Data from unauthorized usethe Company, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) threatened against the Company and or any of its subsidiaries have implemented backup and disaster recovery technology consistent alleging non-compliance with industry standards and practicesany Data Security Obligation,.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, be material to the Company and its subsidiaries, taken as a whole, (A) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects their core functionality as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and (B), to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. . (A) The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards that are commercially reasonable for its industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used all personal, personally identifiable, or confidential data collected or processed by the Company or its subsidiaries in connection with their businesses. businesses (i) Except “Personal Data”), and except as may be included or incorporated by reference otherwise disclosed in the Registration Statement, the General Disclosure Package Time of Sale Information and the ProspectusOffering Memorandum, and except as otherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (xB) to the Company’s knowledge, the Company has not had any material security breach, violations, outages there have been no breaches or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ such IT Systems and or Personal Data. Except as would not, and (y) individually or in the Company and its subsidiaries have not been notified ofaggregate, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and statutes, all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all of the Company’s and its subsidiaries’ applicable internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except (i) as described in Registration Statement, the Pricing Disclosure Package and the Prospectus or (ii) as would not reasonably be expected to have a Material Adverse Effect, (A) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (B) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential, or regulated data (“Personal Data”)) used in connection with their businesses. ; (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (xC) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person or governmental or regulatory authority, and there are no incidents under internal review or investigations by governmental or regulatory authorities or other material compromise of or third parties relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Datasame; (iiD) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause ; (ii), individually or in the aggregate, have a Material Adverse Effect; and (iiiE) the Company and its subsidiaries have implemented backup at all times taken all reasonable steps to safeguard that any Personal Data of the Company and disaster recovery technology consistent its subsidiaries collected or handled by authorized third parties acting on behalf of the Company or its subsidiaries is protected with industry standards similar safeguards, in each case, in compliance with applicable laws and practicescontractual obligations; and (F) the Company and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation (and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon as they took effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential owned or regulated data, and used by the data of their respective customers, employees, suppliers, vendors and any third party data maintained by Company or on behalf of them), equipment or technology its subsidiaries (collectively, “IT Systems and DataSystems”) ), to the knowledge of the Company, are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected, used, stored or processed in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person or entity, nor any incidents under internal review or investigations relating to any of the Company’s same. Except as would not reasonably be expected, individually or its subsidiaries’ IT Systems and Datain the aggregate, and (y) to have a Material Adverse Effect, the Company and its subsidiaries have not been notified of, complied with and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes (including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation (the “GDPR”) and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, and contractual obligations relating to the privacy and security of IT Systems and the collection, use, transfer, import, export, storage, disposal and disclosure of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligations”). Neither the Company nor any of its subsidiaries have received any notification of or complaint regarding non-compliance with any Data Security Obligation, except as would notand there is no pending or, in to the case knowledge of this clause (ii)the Company, individually threatened, action, suit or in the aggregateproceeding by or before any court or governmental agency, have a Material Adverse Effect; and (iii) the authority or body alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have implemented backup made all disclosures as required by applicable laws and disaster recovery technology consistent regulatory rules or requirements in connection with industry standards such Data Security Obligations, and practicesno such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements. The Company and its subsidiaries have taken all necessary actions to prepare to comply with the GDPR and all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses. (i) . Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusreasonably be expected to have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, same nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its Subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (collectively, “Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeforegoing, the Company has not had any material and its Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, violationsdestruction, outages loss, unauthorized distribution, use, access, disablement, misappropriation or unauthorized uses of or accesses to samemodification, or other material compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s or and its subsidiariesSubsidiaries’ IT Systems and Databusinesses (“Breach”) and, and (y) to the Knowledge of the Company, there has been no such Breach. The Company and its subsidiaries Subsidiaries have not been notified of, of and have no knowledge of any event or condition that would reasonably be expected to result in, any material security such Breach. This representation is limited in each case to the extent that such breach or other material compromise non-compliance would not reasonably be expected to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; , and (iii) except as otherwise disclosed in the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesCommission Documents.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology and computer systems and assets, networks, hardware, software, websites, applications, databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and Data”i) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance compliance, in all material respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any legal obligations regarding the collection, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, accesstransfer, misappropriation or modificationimport, except as would notexport, in storage, protection, disposal and disclosure by the case Company and its subsidiaries of this clause Data (“Data Security Obligations”); (ii)) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and are aware of any other facts that, individually or in the aggregate, have a Material Adverse Effectwould reasonably indicate non-compliance with any Data Security Obligation; and (iii) there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance with any Data Security Obligation. The Company and its subsidiaries have implemented backup and disaster recovery technology consistent taken steps reasonably necessary in accordance with industry standards standard practices to protect such information against loss and practicesagainst unauthorized access, use, modification, disclosure or other misuse, except in each case to the extent that the failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. To the knowledge of the Company, except as disclosed in the Registration Statement, the Disclosure Package and the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there has been no unauthorized access to such information. The Company and its subsidiaries have taken or will take all necessary actions to comply with all applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, as soon they take effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statementbusiness, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except in each case as would not, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect. There are no privacy or security incidents under internal review or investigations relating to the same that would, any material security breach individually or other material compromise in the aggregate, reasonably be expected to their IT Systems and Data; (ii) have a Material Adverse Effect. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesData.

Cybersecurity; Data Protection. The Company (A) To the knowledge of the Company, the Operating Partnership and its each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s, the Operating Partnership or their respective subsidiaries’ information technology and computer systems and assetssystems, networks, hardware, software, websites, applications, data and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data and information of their respective tenants, customers, employees, suppliers, vendors and any third party data maintained maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and any such data processed or stored by third parties on behalf of themthe Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT Systems and Data”); (B) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any none of the Company’s , the Operating Partnership or its subsidiaries’ IT Systems and Data, and (y) the Company and its their respective subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or incident, unauthorized access or disclosure or other material compromise to their IT Systems and Data; Data and (iiC) the Company Company, the Operating Partnership and its their respective subsidiaries have implemented controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of their IT Systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, except with respect to clauses (A) and (B), for any such security breach or incident, unauthorized access or disclosure, or other compromises, that have been remedied without material cost or liability or as would not, individually or in the aggregate, have a Material Adverse Effect, or with respect to clause (C), where the failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Operating Partnership and their respective subsidiaries are presently in material compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained commercially reasonable technical and organizational controls, policies, procedures, and safeguards to (i) maintain and protect their material Personal Data and sensitive, proprietary, confidential information or regulated data (collectively, the “Confidential Data”) from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access and (ii) maintain and protect the integrity, continuous operation, redundancy and security of all IT Systems and Confidential Data used in connection with their businesses. (i) . Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusreasonably be expected to have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, security incidents, or violations of any Privacy Requirements in relation to Confidential Data, or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, government authority or supervisory body, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the same. The Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. , and (iii) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of, accesses to, encryptions of or accesses to compromises of same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s same. Except as would not reasonably be expected, individually or its subsidiaries’ IT Systems and Datain the aggregate, and (y) to have a Material Adverse Effect, the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; for the past five (ii5) the Company and its subsidiaries are presently years in compliance with all applicable laws or statutes statutes, binding guidance and standards (including the Payment Card Industry Data Security Standard) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. There are no pending or, except as would notto the knowledge of the Company, threatened Actions in relation to the case matters of this clause (iiSection 3(jj), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses. businesses (i) Except as may be included or incorporated by reference in the Registration Statementcollectively, the General Disclosure Package “Confidential Data”), and the Prospectus, (xii) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person. Except as would not reasonably be expected, individually or relating in the aggregate, to any have a Material Adverse Effect, to the knowledge of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case . Any certificate signed by an officer of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup delivered to Virtu, or to counsel for Virtu, pursuant to or in connection with this Agreement, shall be deemed to be a representation and disaster recovery technology consistent with industry standards and practiceswarranty by the Company to Virtu as to the matters set forth therein.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) . Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusreasonably be expected to have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or Company and its subsidiaries’ IT Systems and or data (including Personal Data), and (y) nor any incidents under internal review or investigations relating to the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the same. The Company and its subsidiaries are presently in material compliance with (i) all applicable worldwide laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and (ii) their internal policies and contractual obligations obligations, in each case of (i) and (ii), relating to the privacy and security of IT Systems and Data Personal Data, including the creation, collection, receipt, acquisition, storage, maintenance, use, disclosure, transfer, transmission, disposition, retention, and processing of Personal Data, and to the security and protection of such IT Systems and Personal Data from unauthorized use, access, disclosure, acquisition, misappropriation or modification, except . Except as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; and (iii) , the Company and its subsidiaries have implemented backup taken all necessary actions to prepare to comply with all applicable laws and disaster recovery technology consistent regulations with industry standards and practicesrespect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof.

Cybersecurity; Data Protection. The Company Issuer, the Guarantor and its the Guarantor’s subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Issuer, the Guarantor and its the Guarantor’s subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company Issuer, the Guarantor and its the Guarantor’s subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. . Except, in each case, as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, there have been (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachno breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Dataperson, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; nor (ii) any incidents under internal review or investigations relating to the Company same. The Issuer, the Guarantor and its the Guarantor’s subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Company’s information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable and appropriate controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and data (including all sensitive, confidential or regulated data and all data that comes within a definition of “personal information,” “personal data” or other similar term under Data Protection Requirements) (collectively, “Company Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statementbusiness, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except in each case as would not, individually or other in the aggregate, reasonably be expected to have a material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) impact on the Company and its subsidiaries have not been notified ofSubsidiary, and have considered as a whole. There are no knowledge of any event privacy or condition security incidents under internal review or investigations relating to the same that would would, individually or in the aggregate, reasonably be expected to result in, any have a material security breach or other material compromise to their IT Systems and Data; (ii) impact on the Company and its subsidiaries are Subsidiary, considered as a whole. Except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company is presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Company Data and to the protection of such IT Systems and (“Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (iiProtection Requirements”), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Data”)) contained on the IT Systems and used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeforegoing, the Company has not had and its subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cybersecurity and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity, disaster recovery and security plans that are designed to protect against and prevent any material security breach, violationsdestruction, outages loss, unauthorized distribution, use, access, disablement, misappropriation or unauthorized uses of or accesses to samemodification, or other material compromise or misuse of, or security incident relating to, any IT Systems or Data used in connection with the operation of or relating to any the respective businesses of the Company and its subsidiaries (“Breach”). To the knowledge of the Company’s or its subsidiaries’ IT Systems and Data, there has been no Breach, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, in any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would notBreach, in the case of this clause (ii)each case, individually or in the aggregate, that would reasonably be expected to have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiariessubsidiaires’ information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and Data data (including all Personal Data, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their respective businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except in each case as would not, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect. Except in each case as would not, any material security breach individually or other material compromise in the aggregate, reasonably be expected to their IT Systems and Data; (ii) have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesData.

Cybersecurity; Data Protection. The (i) Each Company Party and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the such Company Party and its subsidiaries as currently conducted, and are, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) each Company Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Datasame; (iiiii) the each Company Party and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of this each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries’ information technology , taken as a whole, (x) the Company and its subsidiaries own or have a valid right to access and use all computer systems and assetssystems, networks, hardware, software, websitestechnical databases, applicationswebsites and equipment used to process, databases store, maintain and operate data, information and functions used in connection with the Company’s and its subsidiaries’ businesses (including all Personal Datathe “Company IT Systems”), and sensitive, confidential or regulated data, and (y) the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “Company IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company Company’s and its subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. ; (iii) Except as may be included or incorporated by reference disclosed in the Registration Statement, the Prospectus, the General Disclosure Package Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, neither the Company nor any of its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including but not limited to the MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in any manner that requires or has required, with respect to any proprietary software authored and owned by or on behalf of the Company or its subsidiaries, any such software code to be (x) disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge each of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all internal and external privacy policies, applicable laws or statutes and all contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any other legal obligations, internal policies and contractual obligations in each case, relating to the privacy and or security of IT Systems and Data and with respect to the protection of such IT Systems and Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal and disclosure by the Company or modificationany of its subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, except sensitive, confidential or regulated data (“Data Security Obligations,” and such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; Effect on the Company and its subsidiaries, taken as a whole, (i) the Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (iiiii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented backup and disaster recovery technology consistent with industry standards complied with, reasonable information technology, information security, cyber security and practicesdata protection controls, policies and procedures that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, disablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. The Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus or as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, including in terms of functionality and performance, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and confidential data (including all personal, personally identifiable, sensitive, confidential or regulated data, including, without limitation, any data which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”), “personal data” as defined by the European Union General Data Protection Regulation (EU 2016/679 or “GDPR”), and any other piece of information that allows the identification of a natural person, or his or her family, or data related to an identified person’s health or sexual orientation (collectively, “Personal Data”)) used in connection with their businesses. ; (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (xiii) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to sameany IT Systems or Personal Data, nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, same and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (iiiv) the Company and its subsidiaries are presently and have been at all times in compliance with all applicable laws laws, directives or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or supragovernmental or regulatory authority, internal policies and policies, contractual obligations and industry standards relating to the privacy and security of IT Systems and Personal Data, including, without limitation, the GDPR, the UK Data Protection ▇▇▇ ▇▇▇▇, EU Directive 2002/58/EC and all applicable national implementing legislation (“Data Protection Laws”) and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iiiv) the Company and its subsidiaries have implemented backup used commercially reasonable efforts to require their vendors, service providers or other third parties that have received access to any Personal Data from the Company or its subsidiaries to protect the privacy, security and disaster recovery technology consistent with industry standards and practicesconfidentiality of such Personal Data.

Cybersecurity; Data Protection. The Company Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, in each case that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any its business. There have been no material security breachbreaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any such actual or reasonably suspected incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified of, and have has no knowledge of any event event, circumstances, or condition that would reasonably be expected to result inin such breach, any material security breach violation, outage, compromise, or other material compromise unlawful or unauthorized acquisition of, disclosure of, use of or access to their IT Systems and the Company Data; (ii) the . The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, internal policies and (iii) contractual obligations obligations, each (i) -(iii) relating to the privacy and security of IT Systems and Company Data and to the protection of such IT Systems and Company Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiariesParties’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company Parties and its subsidiaries their Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its subsidiaries their Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . To the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, knowledge of the Company has not had any material security breachParties, there have been no breaches, violations, outages or unauthorized uses of or accesses to samethe IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems same and Data, and (y) the Company Parties and its subsidiaries Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their the IT Systems and Personal Data; (ii) the , except as would not reasonably be expected to have a Material Adverse Effect. The Company Parties and its subsidiaries their Subsidiaries are presently in compliance in all material respects with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, . The Company Parties and their Subsidiaries have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented used reasonable best efforts to implement backup and disaster recovery technology consistent with industry standards and practicespractices in all material respects.

Cybersecurity; Data Protection. The Company (i) Each SDC Party and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects their core functionality as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, except as would not, individually or in the aggregate, be material to each SDC Party and its subsidiaries, taken as a whole, (ii) to the knowledge of the SDC Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company , except as would not, individually or in the aggregate, be material to each SDC Party and its subsidiaries, taken as a whole; (iii) the SDC Parties and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards that are commercially reasonable for their industry in an effort to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used all personal, personally identifiable, regulated (including Protected Health Information under HIPAA) or confidential data collected or processed by the Company or its subsidiaries in connection with their businesses. businesses (i“Personal Data”) Except and (iv) except as may be included or incorporated by reference otherwise disclosed in the Registration Statement, the General Pricing Disclosure Package and the Prospectus, (x) and except as otherwise would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, to the Company’s knowledge, the Company has not had any material security breach, violations, outages there have been no breaches or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ such IT Systems and or Personal Data. Except as would not, and (y) individually or in the Company and its subsidiaries have not been notified ofaggregate, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all statutes, payment card industry data security standards, judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all the Company’s and its subsidiaries’ applicable internal and customer-facing policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. No SDC Party or any of their subsidiaries is under investigation by any Governmental Authority or has received any oral, except as would notwritten or other claim, complaint, inquiry, or notice from any third party or any Governmental Authority related to whether the Company’s collection, processing, use, storage, security and/or disclosure of Personal Data is in the case violation of this clause (ii)any applicable laws or privacy policies, individually or in the aggregateotherwise constitutes an unfair, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesdeceptive or misleading trade practice.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal data and sensitive, confidential or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses. (i) . Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusreasonably be expected to have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, same nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as reasonably required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data confidential data (including all personal data and sensitive or regulated data (collectively, the “Confidential Data”)) used in connection with their businesses. (i) . Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusreasonably be expected to have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, same nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s same. Except as would not, individually or its subsidiaries’ IT Systems and Datain the aggregate, and (y) reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as has not had or could not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, (i) the Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants designed to permit unauthorized access or activity. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ such IT Systems and or Personal Data, and (y) except for those that have been remedied without material cost to or liability of the Company and its subsidiaries have not been notified ofSubsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person, and have no knowledge of nor are there any event incidents under internal review or condition that would reasonably be expected investigations relating to result in, any material security breach or other material compromise to their such IT Systems or Personal Data and Data; (ii) the Company and its subsidiaries Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiaries’ respective information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including all Personal Dataconfidential information, and sensitive, confidential trade secrets or regulated data, and the other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors vendors, personal data and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries (collectively, “IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or and statutes and all any judgments, orders, rules and or regulations of any court or arbitrator or other governmental or regulatory authority, and all applicable internal policies and contractual obligations and any other legal obligations, in each case, relating to the privacy and security of IT Systems and Data Data, and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modificationmodification and the collection, use, transfer, processing, import, export, storage, protection, disposal and disclosure of data (collectively, the “Data Security Obligations”), except as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security and data protection controls, policies and procedures designed to protect against and prevent security breaches of, unauthorized access to and other similar compromises of IT Systems and Data as required by applicable regulatory standards. The Company and its subsidiaries have not experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), which attack, breach, unauthorized access, or similar compromise that would reasonably be expected to result in a Material Adverse Effect. There have been no Breaches, violations, outages, or unauthorized uses of or accesses to any IT Systems and Data used in connection with the operation of the Company’s and its subsidiaries’ businesses that would reasonably be expected to result in a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup not received notification of, and disaster recovery technology consistent have no knowledge of, any event or condition that would reasonably be expected to result in, a Breach to their IT Systems and Data that would reasonably be expected to result in a Material Adverse Effect. Neither the Company nor any of its subsidiaries has received any written notification of or complaint regarding, and has no knowledge of any facts that, individually or in the aggregate, would reasonably indicate non-compliance with industry standards any Data Security Obligation by the Company or any of its subsidiaries, and practicesthere is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries.

Cybersecurity; Data Protection. The Company Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses. businesses (i) Except as may be included or incorporated by reference in the Registration Statementcollectively, the General Disclosure Package “Confidential Data”), and the Prospectus, (xii) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and such Confidential Data, and (y) except for those that have been remedied without material cost or liability or the Company and its subsidiaries duty to notify any other person. Except as would not be expected, individually or in the aggregate, to have not been notified ofa Material Adverse Effect, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case . Any certificate signed by any officer or other authorized signatory of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup delivered to the Underwriters or to counsel for the Underwriters shall be deemed a representation and disaster recovery technology consistent with industry standards and practiceswarranty by the Company to the Underwriters as to the matters covered thereby.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not have, individually or in the aggregate, a Material Adverse Effect or as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus, the Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, household, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statementforegoing, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, used commercially reasonable efforts to establish and maintain and have no knowledge of any event or condition that would reasonably be expected to result inestablished, any material security breach or other material compromise to their IT Systems maintained, implemented and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modificationcomplied with, except as would not, in the case of this clause (ii)not have, individually or in the aggregate, a Material Adverse Effect or as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect; and (iii) Effect on the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicessubsidiaries, taken as a whole, to the knowledge of the Company, there has been no such Breach.

Cybersecurity; Data Protection. The Except as described in the Registration Statement and the Prospectus or would not be reasonably expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries’ subsidiary’s information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiary) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiary, free and clear of all material bugs, errors, defects, known Trojan horses, time bombs, malware and other corruptants. The ; and (ii) the Company and its subsidiaries subsidiary have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Data”)) used in connection with their businesses. (i) Except , except as may would not reasonably be included or incorporated by reference excepted to result in a Material Adverse Effect. Without limiting the Registration Statementforegoing, the General Disclosure Package Company and its Subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, misuse, unauthorized access, disablement, misappropriation or modification, or other compromise of the Prospectus, (x) to IT Systems or Data used in connection with the operation of the Company’s knowledgeand its Subsidiaries’ businesses (“Breach”). To the knowledge of the Company, there has been no Breach and the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, of and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesBreach.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and Data data (including all Personal Data, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their respective businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except in each case as would not, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect. Except in each case as would not, any material security breach individually or other material compromise in the aggregate, reasonably be expected to their IT Systems and Data; (ii) have a Material Adverse Effect, the Company and its subsidiaries are presently and, at all times, have been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesData.

Cybersecurity; Data Protection. The Company Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or ​ otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, cloud resources, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, conducted and as proposed to be conducted as described in the Registration Statement and the Prospectus. The IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, in each case that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards (including contractual obligations on third party service providers) to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all essential IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any its business. There have been no material security breachbreaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any such actual or reasonably suspected incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified of, and have has no knowledge of any event event, circumstances, or condition that would reasonably be expected to result inin such breach, any material security breach violation, outage, compromise, or other material compromise unlawful or unauthorized acquisition of, disclosure of, use of or access to their IT Systems and the Company Data; (ii) the . The Company and its subsidiaries are presently are, and since their inception have been, in material compliance with all (i) applicable laws or statutes and all laws, industry standards, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority; (ii) internal policies, internal policies and (iii) contractual obligations obligations, each (i) -(iii) relating to the privacy and security of IT Systems and Company Data and to the protection of such IT Systems and Company Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedsubsidiaries, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not have, individually or in the aggregate, a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained all commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, household, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statementforegoing, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, used commercially reasonable efforts to establish and maintain and have no knowledge of any event or condition that would reasonably be expected to result inestablished, any material security breach or other material compromise to their IT Systems maintained, implemented and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modificationcomplied with, except as would not, in the case of this clause (ii)not have, individually or in the aggregate, a Material Adverse Effect, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s and its subsidiaries’ businesses (“Breach”). Except as disclosed in the Registration Statement, the Time of Sale Information or the Prospectus or as would not individually or in the aggregate have a Material Adverse Effect; and (iii) Effect on the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicessubsidiaries, taken as a whole, to the knowledge of the Company, there has been no such Breach.

Cybersecurity; Data Protection. The Except as would not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware malware, viruses, disabling code and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Data”)) used in connection with their businesses. (i) Except the business of the Company and its subsidiaries as may be included or incorporated by reference in the Registration Statementcurrently conducted, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, and (y) the Company and its subsidiaries have would not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect or that have been remedied without material cost or liability or the duty to notify any other person, nor have there been any material security breach incidents under internal review or other material compromise investigations related to their IT Systems and Data; (ii) the same, except for any such incidents or investigations as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except for such failures as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The (i) Each Company Party and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the such Company Party and its subsidiaries as currently conducted, and are, to the knowledge of the Company Parties, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) each Company Party and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Datasame; (iiiii) the each Company Party and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification; and (iv) each Company Party and its subsidiaries have taken all necessary actions to comply with the European Union General Data Protection Regulation and have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof and for which any non-compliance with same would be reasonably likely to create a liability, as soon they take effect, except as would not, in the case of this each of clause (i), (ii), (iii) and (iv), reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, to the knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. ; (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (xiii) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, or unauthorized uses of or accesses to the same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, ; and (yiv) the Company and its subsidiaries have not been notified of, complied and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and Data Personal Data, and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification and the collection, except as would notuse, transfer, processing, import, export, storage, protection, disposal and disclosure of Personal Data (collectively, the “Data Security Obligations”), except, in the case of this each clause above, as would not reasonably be expected to have a Material Adverse Effect. Except as would not reasonably be expected to have a Material Adverse Effect, (ii)i) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding, and is unaware of any facts that, individually or in the aggregate, have a Material Adverse Effect; would reasonably indicate non-compliance with any Data Security Obligation and (iiiii) there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending, or to the Company and its subsidiaries have implemented backup and disaster recovery technology consistent Company’s knowledge, threatened, alleging non-compliance with industry standards and practicesany Data Security Obligation.

Cybersecurity; Data Protection. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used data (including all personal, personally identifiable, sensitive, confidential or regulated data (including protected health information) (“Personal Data”)) collected, used, stored or processed in connection with their businesses. (i) Except , and except as may would not reasonably be included expected, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusto have a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have same. Except as would not been notified of, and have no knowledge of any event or condition that would reasonably be expected expected, individually or in the aggregate, to result inhave a Material Adverse Effect, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently presently, and since January 1, 2017 have been, in compliance with all applicable laws or statutes (including without limitation, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external privacy policies, applicable industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, except as would notuse, in transfer, import, export, storage, disposal and disclosure by the case Company and its subsidiaries of this clause Personal Data (ii“Data Protection Obligations”). Neither the Company nor any of its subsidiaries has received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Company and its subsidiaries have taken commercially reasonable steps in accordance with industry standard practices (including, without limitation, implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Company or any of its subsidiaries. Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect; and (iii) , the Company and its subsidiaries have implemented backup made all disclosures to users or customers required by applicable laws and disaster recovery technology consistent with industry standards regulatory rules or requirements and practicesno such disclosures have been inaccurate or in violation of any applicable laws or regulatory rules and requirements.

Cybersecurity; Data Protection. The Except as would not reasonably be expected to result in a Material Adverse Change, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all Personal Data) used in connection with their businesses. (i) Except , and except as may be included or incorporated by reference has been disclosed in the Registration Statement, the General Disclosure Package Statement and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or known unauthorized uses of or known accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified ofcomplied, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all industry guidelines, standards, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as where the failure to be in compliance would not, not reasonably be expected to result in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Change. The Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicespractice.

Cybersecurity; Data Protection. The Company (A) To the knowledge of the Company, the Operating Partnership and its each of their respective subsidiaries, there has been no security breach or incident, unauthorized access or disclosure, or other compromise of the Company’s, the Operating Partnership or their respective subsidiaries’ information technology and computer systems and assetssystems, networks, hardware, software, websites, applications, data and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data and information of their respective tenants, customers, employees, suppliers, vendors and any third party data maintained maintained, processed or stored by the Company, the Operating Partnership or their respective subsidiaries, and any such data processed or stored by third parties on behalf of themthe Company, the Operating Partnership and their respective subsidiaries), equipment or technology (collectively, “IT Systems and Data”); (B) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any none of the Company’s , the Operating Partnership or its subsidiaries’ IT Systems and Data, and (y) the Company and its their respective subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or incident, unauthorized access or disclosure or other material compromise to their IT Systems and Data; Data and (iiC) the Company Company, the Operating Partnership and its their respective subsidiaries have implemented controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of their IT Systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards, except with respect to clauses (A) and (B), for any such security breach or incident, unauthorized access or disclosure, or other compromises, as would not, individually or in the aggregate, have a Material Adverse Effect, or with respect to clause (C), where the failure to do so would not, individually or in the aggregate, have a Material Adverse Effect. The Company, the Operating Partnership and their respective subsidiaries are presently in material compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except (i) as described in the Registration Statement, the Time of Sale Prospectus and the Prospectus or (ii) as would not reasonably be expected to have a Material Adverse Effect, (A) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, for and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and are, to the best knowledge of the Company, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; (B) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, household or regulated data or information collected, stored or processed by the Company or its subsidiaries (“Personal Data”)) used in connection with their businesses. ; (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (xC) to the best knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses use or disclosure of or accesses access to samethe IT Systems and/or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person or governmental or regulatory authority, and there are no incidents or, to Company’s knowledge, threatened incidents under internal review or investigations by governmental or regulatory authorities or other material compromise of or third parties relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Datasame; (iiD) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or court, arbitrator or governmental or regulatory authority, their own internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, loss, access, processing, misappropriation or modification, except including, without limitation, the European Union General Data Protection Regulation 2016/679 and/or any implementing or supplementing local law of a European Union member state, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002, the Federal Trade Commission Act, the Health Insurance Portability and Accountability of 1996, as would notamended by the Health Information Technology for Economic and Clinical Health Act, in the case of this clause California Consumer Privacy Act and all other laws and regulations with respect to Personal Data applicable to the Company or its subsidiaries (ii“Privacy Laws”), individually or in the aggregate, have a Material Adverse Effect; and (iiiE) the Company and its subsidiaries have implemented backup not received notice of any actual or potential violation of any Privacy Laws and disaster recovery technology consistent there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened against the Company or its subsidiaries alleging non-compliance with industry standards Privacy Laws; (F) the Company has provided notice of its privacy policy on its websites where required by Privacy Laws and such privacy policies do not contain any misrepresentations of the Company’s then-current privacy practices; (G) the Company and its subsidiaries has taken commercially reasonable steps to require that any Personal Data of the Company and its subsidiaries processed by authorized third parties acting on behalf of the Company or its subsidiaries is protected with similar safeguards, in each case, in compliance with applicable laws and contractual obligations; and (H) the Company and its subsidiaries have in place safeguards and measures for the international transfer of Personal Data outside the European Economic Area that are adequate and comply with Privacy Laws.

Cybersecurity; Data Protection. The Except as would not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material the Prospectus, and (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptantsharmful code. The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified ofsubsidiaries, and have no knowledge of any event or condition that would reasonably be expected to result intaken as a whole, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries’ information technology and computer systems and assets, equipment, systems, networks, software, hardware, softwarecomputers, websites, applications, applications and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect and except as described in each of the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data, including all personal, personally identifiable, sensitive, confidential or regulated data (“Data”) used in connection with their businesses. , and (iii) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied nor any incidents currently under internal review or other material compromise of or investigations relating to any of the Company’s same. Except as would not, individually or its subsidiaries’ IT Systems and Datain the aggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect and except as described in each of the Registration Statement, any material security breach or other material compromise to their IT Systems the Pricing Disclosure Package and Data; (ii) the Prospectus, the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized usecollected, accessstored, misappropriation processed, transferred, disclosed or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) used by the Company and or its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicessubsidiaries.

Cybersecurity; Data Protection. The To the Company and its subsidiaries’ knowledge, except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) (i) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted in the Registration Statement, the Time of Sale Information and the Prospectus, (ii) have not malfunctioned or failed and (iii) are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, backdoors, drop dead devices, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and technological safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their material IT Systems and Data data and information (including all personal, personally identifiable, household, sensitive, confidential or regulated data or information (“Personal Data”)) used in connection with their businesses. (i) Except , including as may be included processed and stored thereon. There have been no destructions, losses, breaches, outages, compromises or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) unauthorized or unlawful uses or disclosures of or accesses to the Company’s knowledgeIT Systems, Personal Data maintained, processed or stored or processed thereon, or, to the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or and its subsidiaries’ IT Systems and Dataknowledge any such data stored or processed by third parties for or on behalf of the Company or its subsidiaries (each, and (y) a “Breach”), except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect. The Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inof, any material security breach incidents under internal review or other material compromise to their IT Systems and Data; (ii) the investigation relating to, any Breach. The Company and its subsidiaries have complied with and are presently in compliance with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, contractual obligations obligations, binding industry standards and any other legal obligations, in each case, to the extent relating to (x) the privacy and security of the IT Systems and Data and to Personal Data, (y) the protection of such IT Systems and Personal Data from unauthorized any Breach, or (z) the collection, use, accesstransfer, misappropriation storage, protection, disposal, disclosure or modificationother processing by the Company or any of its subsidiaries of Personal Data, except other than as would not, in the case of this clause (ii)not reasonably be expected to result, individually or in the aggregate, have in a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company Except as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, (i) the Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are are, in the Company’s reasonable belief, adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The corruptants that could reasonably be expected to have a Material Adverse Effect; (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for (x) those that did not or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have would not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inin a Material Adverse Effect and (y) those that have been remedied without material cost or liability or the duty to notify any other person, nor any material security breach incidents under internal review or other material compromise to their IT Systems and Datainvestigation; (iiiii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes (including the European Union General Data Protection Regulation to the extent applicable) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iiiiv) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent initiated steps reasonably necessary to prepare to timely comply with industry standards and practicesapplicable requirements under the California Consumer Privacy Act of 2018.

Cybersecurity; Data Protection. The Except as would not reasonably be expected to have a Material Adverse Effect, (i) the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conductedconducted as described in the Registration Statement, free the Pricing Disclosure Package and clear of all material the Prospectus, and (ii) to the Company’s knowledge, such IT Systems are not infected by viruses, bugs, errorsmalware, defects, Trojan horses, time bombs, malware and disabling code or other corruptantsharmful code. The Company and its subsidiaries have implemented taken commercially reasonable actions, consistent with current industry standards and maintained their obligations to third parties, to implement and maintain commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material trade secrets and confidential information and the integrity, continuous operation, redundancy integrity and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the same. The Company and its subsidiaries have not been notified ofsubsidiaries, and have no knowledge of any event or condition that would reasonably be expected to result intaken as a whole, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology reasonably consistent with industry standards and practices, except to the extent that any inconsistency would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, owned or controlled by the Company and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology its subsidiaries (collectively, “IT Systems and DataCompany Systems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conducted, and are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company and its subsidiaries have implemented and maintained commercially reasonable industry-standard controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Company Systems and Data used in connection with their businesses. data stored therein (i) Except as may be included including all personal, personally identifiable, sensitive, confidential or incorporated by reference in the Registration Statementregulated data (“Private Data”)), the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Company Systems and Private Data, nor are there any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have same. Except as would not been notified of, and have no knowledge of any event or condition that would reasonably be expected expected, individually or in the aggregate, to result inhave a Material Adverse Effect, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with (i) all applicable laws or statutes and statutes, (ii) all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, authority and (iii) all internal policies and contractual obligations obligations, in each case, relating to the privacy and security of IT Systems and Data and to the protection of such IT Company Systems and Private Data from unauthorized or illegal use, access, destruction, disclosure, misappropriation or modificationmodification (collectively, except the “Company Security and Privacy Obligations”). Except as would not, in the case of this clause (ii)not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect; and (iii) , there is no investigation, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance by the Company and or its subsidiaries have implemented backup with any of the Company Security and disaster recovery technology consistent with industry standards and practicesPrivacy Obligations.

Cybersecurity; Data Protection. The Company and its Brilliant Earth and their subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) (i) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business businesses of the Company and its Brilliant Earth and their subsidiaries as currently conducted, (ii) have not malfunctioned or failed and, (iii) to the Company’s or Brilliant Earth’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants, including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems, in each case (i) – (iii), except as would not reasonably be expected to, individually or in the aggregate, have a material adverse effect on the Company and Brilliant Earth and their subsidiaries’, taken as a whole. The Company and its Brilliant Earth and their subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards consistent with applicable regulatory standards and customary industry practices designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data and information (including all personal, personally identifiable, sensitive, confidential or regulated data and information of their respective customers, employees, suppliers, vendors or any other third-party data, to the extent such data is personal, personally identifiable, sensitive, confidential or regulated, collected, used, stored, maintained or otherwise processed by or on behalf of the Company or Brilliant Earth or any of their subsidiaries) (collectively, “Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the Company’s or Brilliant Earth’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, destructions, losses, misappropriations, modifications, misuses or unauthorized uses or disclosures of or accesses to samesame (each, a “Breach”), except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the person. The Company and its Brilliant Earth and their subsidiaries have not been notified of, and have no knowledge of of, any event or condition that would reasonably be expected to result inin any Breach, or any incidents under internal review or investigations relating to the same, except as would not reasonably be expected to, individually or in the aggregate, have a material security breach or other material compromise to their IT Systems and Data; (ii) adverse effect on the Company and its Brilliant Earth and their subsidiaries’, taken as a whole. The Company and Brilliant Earth and their subsidiaries have complied and are presently in material compliance with all applicable laws or statutes laws, rules, regulations, industry standards and all judgmentsstatutes, orders, rules judgments and regulations orders of any court or arbitrator or governmental or regulatory authority, internal external policies and contractual obligations obligations, in each case, relating to the collection, use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of IT Systems and Data (collectively, the “Data Security Obligations”) and to the protection of such IT Systems and Data from unauthorized usea Breach. Neither the Company nor Brilliant Earth nor any of their subsidiaries has received any written notification of or written complaint from any governmental or regulatory agency, accessauthority or body regarding, misappropriation or modification, except as would not, in the case is aware of this clause (ii)any other facts that, individually or in the aggregate, have a Material Adverse Effect; that would reasonably indicate non-compliance with any Data Security Obligation and (iii) there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s or Brilliant Earth’s knowledge, threatened alleging non-compliance with any Data Security Obligation. The Company and its Brilliant Earth and their subsidiaries have implemented reasonable backup and disaster recovery technology consistent with industry applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. The Company and its subsidiariesDelek Parties’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, applications and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with necessary for the operation of the business of the Company and its subsidiaries Delek Parties as currently conducted, free except as would not, individually or in the aggregate, have a Material Adverse Change. The Delek Parties conduct industry-standard scans of their IT Systems to detect and clear of all address material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries Delek Parties have implemented and maintained commercially reasonable controls, policies, procedures, procedures and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data sensitive data (including all personal, personally identifiable, confidential or regulated data (“Sensitive Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeknowledge of the Delek Parties, the Company has not had any material security breachthere have been no breaches, violations, incidents, compromises, outages or unauthorized uses of or of, accesses to or disclosures of same, except as would not, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, have a Material Adverse Change, and (y) the Company and its subsidiaries Delek Parties have not been notified had a duty to notify any other person of, and have no knowledge of nor are there any incidents under internal review or investigation relating to, the same or any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) in the Company and its subsidiaries same. The Delek Parties are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating applicable to the privacy and security of its IT Systems and Sensitive Data and to the protection of such IT Systems and Sensitive Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection conformance with their functional specifications and have not materially malfunctioned or failed during the operation of past three (3) years. To the business of Company’s knowledge, the Company and its subsidiaries as currently conducted, free and clear of all material IT Assets do not contain any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants, in each case that could have a material impact on the business or operations of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the same . The Company and its subsidiaries are presently and at all times have been in full compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (“Data Protection Requirements”), except as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Neither the Company nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; and (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesis a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, the Issuer’s information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Issuer as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have Issuer has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used data (including all personal, personally identifiable, sensitive, confidential or regulated data (including protected health information) (“Personal Data”)) collected, used, stored or processed in connection with their businesses. (i) Except , and except as may would not reasonably be included expected to have, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusa Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor any incidents under internal review or other material compromise of or investigations relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have same. Except as would not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave, any material security breach individually or other material compromise to their IT Systems in the aggregate, a Material Adverse Effect, the Issuer has been for the past three (3) years and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws Laws or statutes (including the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”)) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external privacy policies, applicable industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification and regarding the collection, except as would notuse, in transfer, import, export, storage, disposal and disclosure by the case Issuer of this clause Personal Data (ii“Data Protection Obligations”). The Issuer has not received any written notification of or written complaint regarding, or is aware of any other facts that, individually or in the aggregate, have would reasonably indicate non-compliance in any material respect with any Data Protection Obligation. There is no pending, or to the knowledge of the Issuer, threatened, action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened alleging non-compliance in any material respect with any Data Protection Obligation. The Issuer has taken commercially reasonable steps in accordance with industry standard practices (including implementing and monitoring compliance with adequate measures with respect to technical and physical security) designed to protect Personal Data collected, used or otherwise processed by the Issuer. Except as would not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect; , the Issuer has made all disclosures to users or customers required by applicable Laws and (iii) the Company regulatory rules or requirements and its subsidiaries no such disclosures have implemented backup been inaccurate or in violation of any applicable Laws or regulatory rules and disaster recovery technology consistent with industry standards and practicesrequirements.

Cybersecurity; Data Protection. The (i) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries’ information technology , taken as a whole, (x) the Company and its subsidiaries own or have a valid right to access and use all computer systems and assetssystems, networks, hardware, software, websitestechnical databases, applicationswebsites and equipment used to process, databases store, maintain and operate data, information and functions used in connection with the Company’s and its subsidiaries’ businesses (including all Personal Datathe “Company IT Systems”), and sensitive, confidential or regulated data, and (y) the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “Company IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company Company’s and its subsidiaries subsidiaries’ businesses as currently conducted, conducted and are free and clear of all material any bugs, errors, defects, Trojan horses, time bombs, malware and or other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. ; (iii) Except as may be included or incorporated by reference disclosed in the Registration Statement, the Prospectus, the General Disclosure Package Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, neither the Company nor any of its subsidiaries uses or distributes or has used or distributed any “free,” “open source,” or similar licensing model (including but not limited to the MIT License, Apache License, GNU General Public License, GNU Lesser General Public License and GNU Affero General Public License) in any manner that requires or has required, with respect to any proprietary software authored and owned by or on behalf of the Company or its subsidiaries, any such software code to be (x) disclosed or distributed in source code form, (y) licensed for the purpose of making derivative works or (z) redistributed at no charge; (iii) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge each of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all internal and external privacy policies, applicable laws or statutes and all contractual obligations, binding industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other governmental or regulatory authorityauthority and any other legal obligations, internal policies and contractual obligations in each case, relating to the privacy and or security of IT Systems and Data and with respect to the protection of such IT Systems and Data from unauthorized collection, use, accesstransfer, misappropriation import, export, storage, protection, disposal and disclosure by the Company or modificationany of its subsidiaries of any information that is defined as “personal information” or “personally identifiable information” including household, except sensitive, confidential or regulated data (“Data Security Obligations”, and such data, “Data”); (y) the Company has not received any written notification of or written complaint alleging non-compliance with any Data Security Obligation; and (z) to the Company’s knowledge, there is no action, suit or proceeding by or before any court or governmental agency, authority or body pending or threatened in writing alleging non-compliance by the Company or its subsidiaries with any Data Security Obligation; and (iv) Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; Effect on the Company and its subsidiaries, taken as a whole, (i) the Company and each of its subsidiaries have taken reasonable technical and organizational measures designed to protect the information technology systems and Data used by the Company and its subsidiaries in the operation of their businesses and (iiiii) without limiting the foregoing, the Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented backup and disaster recovery technology consistent with industry standards complied with, reasonable information technology, information security, cyber security and practicesdata protection controls, policies and procedures that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, disablement, misappropriation or modification, or other compromise or misuse of the Company IT Systems or Data used by the Company and its subsidiaries in the operation of their businesses (“Breach”). Except as disclosed in the Registration Statement, the Prospectus, the General Disclosure Package, or as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole, there here has been no such Breach, and the Company and its subsidiaries have not been notified in writing of any ongoing threat that is reasonably expected to result in any such Breach.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as disclosed in the Registration Statement, in the Prospectus and in the Pricing Disclosure Package, the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) used in connection with their businesses. (i) Except , and except as may be included or incorporated by reference disclosed in the Registration Statement, in the General Prospectus and in the Pricing Disclosure Package and except as would not, individually or in the Prospectusaggregate, (x) to the Company’s knowledgehave a Material Adverse Change, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person, nor any incidents under internal review or investigations relating to any of the Company’s or its subsidiaries’ IT Systems same. Except as disclosed in the Registration Statement, in the Prospectus and Datain the Pricing Disclosure Package, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesChange.

Cybersecurity; Data Protection. The Company and (A) To the knowledge of the Company, there has been no material security breach or other compromise of the Company’s or its subsidiariesSubsidiaries’ information technology and computer systems and assetssystems, networks, hardware, software, websites, applications, software and databases (collectively “IT Systems”) or data (including all Personal Datapersonal, and personally identifiable, sensitive, confidential or regulated data, data (“Personal Data”) and the data information of their respective customers, employees, suppliers, vendors and any third party parties maintained, processed or stored by the Company and its Subsidiaries, and any such data maintained processed or stored by or third parties on behalf of them), equipment or technology (collectively, “IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with their businesses. Subsidiaries); (iB) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, neither the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or nor its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries Subsidiaries have not been notified of, and each of them have no knowledge of any material event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and or Personal Data; (iiC) except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its Subsidiaries have implemented appropriate controls, policies, procedures, and technical safeguards to maintain and protect the integrity, continuous operation, redundancy and security of their IT Systems and Personal Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards; (D) the Company and its subsidiaries Subsidiaries have at all times in the past three years been in material compliance with, and are presently in material compliance with with, all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification and all applicable legal obligations regarding the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company and its Subsidiaries of Personal Data (“Data Security Obligations”); and (E) except as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; and (iii) , there is no pending, or to the knowledge of the Company, threatened, action, suit or proceeding by or before any applicable court or governmental agency, authority or body alleging non-compliance by the Company and or its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesany Data Security Obligations.

Cybersecurity; Data Protection. The Company and its subsidiaries’ To the Company’s Knowledge, the information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applicationsapplications and databases owned by, databases (including all Personal Dataor leased or licensed to, and sensitive, confidential the Company or regulated data, and the data any of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology its Subsidiaries (collectively, “IT Systems and DataSystems”) ), are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries Subsidiaries as currently conducted, and to the Company’s Knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The ; the Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of them (“Personal Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) ; to the Company’s knowledgeKnowledge, the Company has not had any there have been no material security breachbreaches, violations, outages or outages, unauthorized uses of or of, accesses to same, or other material compromise of or relating to any of the Company’s or any of its subsidiariesSubsidiaries’ Personal Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any third party; there are no material incidents under internal review or investigations relating to any security breach or other compromise of the Company’s or any of its Subsidiaries’ Personal Data or IT Systems and Data, and (y) the Company and its subsidiaries Subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and or Personal Data; (ii) the Company and its subsidiaries Subsidiaries have implemented commercially reasonable backup and disaster recovery technology consistent with industry standards and practices; and the Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority and internal policies, internal policies procedures and contractual obligations relating to the privacy and security of IT Systems and the privacy, collection, use, transfer, storage, protection, disposal or disclosure of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company Except as would not, individually or in the aggregate, have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and computer systems and assetsinformation technology equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) (i) are adequate in capacity and level of performance for, and operate and perform in all material respects as required in connection with with, the operation of the business businesses of the Company and its subsidiaries as currently conducted, (ii) in the past five years have not malfunctioned or failed and (iii) to the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, back doors, drop dead devices, malware and other corruptants, including software or hardware components that are designed to interrupt use of, permit unauthorized access to or disable, damage or erase the IT Systems. The Except as would not, individually or in the aggregate, have a Material Adverse Effect, (i) the Company and its subsidiaries have in the past five years implemented and maintained commercially reasonable controls, policies, procedures, and safeguards consistent with applicable regulatory requirements and customary industry practices for similarly-situated companies to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used in connection with data and information (including all personal, personally identifiable, sensitive, confidential or regulated data and information of their businesses. respective customers, employees, suppliers, vendors or other third parties collected, used, stored, maintained or otherwise processed by or on behalf of the Company or any of its subsidiaries (icollectively, “Data”) Except as may be included within their possession or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusoperational control, (xii) to there have been no breaches of the Company’s knowledgesecurity of, the Company has not had any material security breachoutages, violationsdestructions, outages losses, misappropriations, misuses or unauthorized uses uses, modifications or disclosures of or unauthorized accesses to samesame (each, a “Breach”), except for those that have been remedied without cost or liability or the duty to notify any other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, person; and (yiii) the Company and its subsidiaries have not been notified of, and have no knowledge of of, any event or condition that would reasonably be expected to result inin any Breach, or any material security breach incidents under internal review or other material compromise investigations relating to their IT Systems and Data; the same. Except as would not have a Material Adverse Effect, during the past five years (iii) the Company and its subsidiaries have complied and are presently in compliance with all applicable laws or and statutes and all judgmentsrules, ordersregulations, rules industry standards and regulations statutes, judgments and orders of any applicable court or arbitrator or governmental or regulatory authority, the Company’s and its subsidiaries’ internal and external policies and contractual obligations and other legal obligations, in each case, relating to privacy, data protection or cybersecurity with respect to the privacy use, protection, and security of IT Systems and the collection, use, transfer, import, export, storage, protection, disposal, disclosure, processing, privacy and security of Data (collectively, the “Data Security Obligations”) and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause a Breach; (ii)) neither the Company nor any of its subsidiaries has received any notification of or complaint regarding its, or is aware of any other facts that, individually or in the aggregate, have a Material Adverse Effectwould reasonably indicate its non-compliance with any Data Security Obligation, and there is no action, suit, proceeding or claim by or before any court or governmental or regulatory agency, authority or body pending or, to the Company’s knowledge, threatened alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries; and (iii) the Company and its subsidiaries have implemented reasonable backup and disaster recovery technology consistent with industry applicable regulatory standards and customary industry practices.

Cybersecurity; Data Protection. The Company and its subsidiariesSubsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology the Company and its Subsidiaries) (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, Subsidiaries and to the Knowledge of the Company are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data data (including all personal, personally identifiable, sensitive, confidential or regulated data (collectively, “Data”)) used in connection with their businesses. (i) Except as may be included or incorporated by reference in . Without limiting the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledgeforegoing, the Company has not had any material and its Subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, violationsdestruction, outages loss, unauthorized distribution, use, access, disablement, misappropriation or unauthorized uses of or accesses to samemodification, or other material compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Company’s or and its subsidiariesSubsidiaries’ IT Systems and Databusinesses (“Breach”) and, and (y) to the Knowledge of the Company, there has been no such Breach. The Company and its subsidiaries Subsidiaries have not been notified of, of and have no knowledge of any event or condition that would reasonably be expected to result in, any material security such Breach. This representation is limited in each case to the extent that such breach or other material compromise non-compliance would not reasonably be expected to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; , and (iii) except as otherwise disclosed in the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesRegistration Statement or the Prospectus.

Cybersecurity; Data Protection. (i) Except, in each case, as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries’ subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) through which any such Personal Data is collected or processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its subsidiaries has received written notice asserting a violation by the Company or any of its subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its subsidiaries is (i) currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Personal Data used in connection with their its businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Company Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, the Company’s and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of, to the knowledge of the Company, all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Except as would not reasonably be expected, individually or in the aggregate, to have a Material Adverse Effect, (i) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used all personal data and sensitive, confidential or regulated data maintained or processed by the Company and its subsidiaries in connection with their businesses. businesses (i) Except as may be included or incorporated by reference in the Registration Statementcollectively, the General Disclosure Package “Confidential Data”), and the Prospectus, (xii) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Confidential Data, except for those that have been remedied without material cost or liability or the duty to notify any other material compromise of person. Except as would not reasonably be expected, individually or relating in the aggregate, to any have a Material Adverse Effect, to the knowledge of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and all internal policies and contractual obligations relating to of the Company and its subsidiaries, governing the privacy and security of IT Systems and Confidential Data and to the protection of such IT Systems and Confidential Data from unauthorized use, access, misappropriation or modification, except as would not, in the case . Any certificate signed by an officer of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup delivered to the Agents, or to counsel for the Agents, pursuant to or in connection with this Agreement, shall be deemed to be a representation and disaster recovery technology consistent with industry standards and practiceswarranty by the Company to the Agents as to the matters set forth therein.

Cybersecurity; Data Protection. The Except as would not, individually or in the aggregate, result in a Material Adverse Effect, the Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate in capacity and operation for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, to the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data all personal, personally identifiable, sensitive, confidential or regulated data collected, used or otherwise processed by it or on its behalf in connection with their businesses. businesses (i) “Personal Data”), in each case except as would not, individually or in the aggregate, result in a Material Adverse Effect. Except as may be included would not, individually or incorporated by reference in the Registration Statementaggregate, the General Disclosure Package and the Prospectusresult in a Material Adverse Effect, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of of, or accesses to sameto, or other material compromise of or relating to any of the Company’s or its subsidiaries’ such IT Systems and or Personal Data. Except as would not, and (y) individually or in the aggregate, result in a Material Adverse Effect, the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are is presently in compliance with all applicable laws or statutes and all applicable and binding judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, and with all of the Company’s internal policies and contractual obligations obligations, in each case, relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. Neither the Company nor any of its subsidiaries (i) is subject to any sanction relating to cybersecurity, except as would notdata privacy, in confidentiality or archive administration, or any cybersecurity review by the case CAC, the CSRC, or any other relevant governmental authority of this clause the PRC, or (ii)) has received notice of any pending or, individually to the knowledge of the Company, threatened investigation, inquiry or in sanction relating to cybersecurity, data privacy, confidentiality or archive administration, or any cybersecurity review, by the aggregateCAC, have a Material Adverse Effect; and (iii) the Company and CSRC, or any other relevant governmental or regulatory authorities of the PRC on the Company, its subsidiaries have implemented backup or any of their respective directors, officers and disaster recovery technology consistent with industry standards and practicesemployees.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential owned or regulated data, and used by the data of their respective customers, employees, suppliers, vendors and any third party data maintained by Company or on behalf of them), equipment or technology its subsidiaries (collectively, “IT Systems and DataSystems”) are reasonably adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, and, to the knowledge of the Company, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants that would cause a material disruption to the operation of the business of the Company and its subsidiaries. The Company and its subsidiaries have implemented and maintained maintain commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect the secrecy of their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Data used data in the Company’s possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected, used, stored or processed in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectusand, (x) to the knowledge of the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Datain each case, except as have not had, and (y) the Company and its subsidiaries have would not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave, individually or in the aggregate, a Material Adverse Effect, nor any material security breach incidents under internal review or other material compromise investigations relating to their IT Systems and Data; (ii) the same. The Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification, in each case, except as have not had, and would not, in the case of this clause (ii)not reasonably be expected to have, individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. (i) Except, in each case, as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries comply and have at all times complied with applicable privacy, data security and data protection laws and regulations, contractual obligations, applicable industry guidelines and codes of conduct including, to the extent applicable, the Payment Card Industry Data Security Standard and Company policies applicable to the Company’s and its subsidiaries’ collection, handling, usage, disclosure and storage of all personally identifiable data (“Personal Data”) (collectively, the “Privacy Requirements”). (ii) The Company and its subsidiaries’ subsidiaries have policies and procedures in place in accordance in all material respects with applicable Privacy Requirements and takes appropriate steps which are reasonably designed to comply in all material respects with such policies and procedures. (iii) To the extent required under applicable Privacy Requirements, the Company and its subsidiaries have required and do require third parties to which they provide any Personal Data to maintain the privacy and security of such Personal Data, including by contractually requiring such third parties to protect such Personal Data from unauthorized access by and/or disclosure to any unauthorized third parties, except where a failure to do so would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect. Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, neither the Company nor any of its subsidiaries has experienced any security incident breaches, violations, or outages that has compromised the privacy and/or security of any Personal Data and/or the information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) through which any such Personal Data is collected or processed or on which the Personal Data is stored, nor has there been any unauthorized uses of the same, except for those that have been remedied without material costs or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. (iv) Neither the Company nor any of its Subsidiaries has received written notice asserting a violation by the Company or any of its subsidiaries of any of the Privacy Requirements. Neither the Company nor any of its Subsidiaries is (i) currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Requirements; or (ii) a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Privacy Requirements. (v) Except as would not, singly or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company’s and its subsidiaries’ IT Systems are adequate for, and operate and perform in all material respects as required in connection with with, the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its subsidiaries have has implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and Personal Data used in connection with their its businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breach, violations, outages or unauthorized uses of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices.

Cybersecurity; Data Protection. The Except as disclosed in the Registration Statement and the Prospectus, or except as would not reasonably be expected to result in a material adverse effect, (i) the Company and its subsidiaries’ respective information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including all Personal Dataconfidential information, and sensitive, confidential trade secrets or regulated data, and the other data of the Company or any of its subsidiaries or their respective users, customers, employees, suppliers, vendors vendors, personal data and any third party data maintained by or on behalf of them), equipment or technology the Company and its subsidiaries (collectively, “IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free conducted and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The (ii) the Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedurescomplied, and safeguards are presently in compliance with all applicable laws and statutes and any judgments, orders, rules or regulations of any court or arbitrator or other governmental or regulatory authority, and all internal policies and contractual obligations and any other legal obligations, in each case, relating to maintain and protect their material confidential information and the integrity, continuous operation, redundancy privacy and security of all IT Systems and Data used in connection with their businesses. (i) collectively, the “Data Security Obligations”). Except as may be included or incorporated by reference disclosed in the Registration Statement, the General Disclosure Package Statement and the Prospectus, or except as would not reasonably be expected to result in a material adverse effect, (xi) to the Company’s knowledge, the Company has not had any material and its subsidiaries have used reasonable efforts to establish and maintain, and have established, implemented, maintained and complied with, commercially reasonable information technology, information security, cyber security breachand data protection controls, violationspolicies and procedures to protect against and prevent security breaches of, outages or unauthorized uses access to and other similar compromises of or accesses to same, or other material compromise of or relating to any of the Company’s or its subsidiaries’ IT Systems and DataData in accordance with industry practices and as required by applicable regulatory standards, and (yii) the Company and its subsidiaries have not been notified experienced and have no knowledge of any cyber-attack, security breach, unauthorized access or other similar compromise to their IT Systems and Data (“Breach”), (iii) the Company and its subsidiaries have not received notification of, and have no knowledge of of, any event or condition that would reasonably be expected to result in, any material security breach or other material compromise in a Breach to their IT Systems and Data; , (iiiv) neither the Company and nor any of its subsidiaries are presently in compliance with all applicable laws has received any written notification of or statutes complaint regarding, and all judgments, orders, rules and regulations has no knowledge of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii)facts that, individually or in the aggregate, have a Material Adverse Effect; would reasonably indicate non-compliance with any Data Security Obligation by the Company or any of its subsidiaries and (iiiv) there is no action, suit or proceeding by or before any court or governmental agency, authority or body, pending or, to the Company’s knowledge, threatened in writing alleging non-compliance with any Data Security Obligation by the Company or any of its subsidiaries. Any certificate signed by any officer of the Company and its subsidiaries have implemented backup delivered to the Managers or to counsel for the Managers in connection with this Agreement or any Terms Agreement shall be deemed a representation and disaster recovery technology consistent with industry standards and practiceswarranty by the Company, as to matters covered thereby, to the Managers.

Cybersecurity; Data Protection. The Company and its subsidiaries’ Company’s information technology assets and computer systems and assetsequipment, including, without limitation, those owned, licensed or otherwise used (excluding any public networks), such as its data communications lines, computers, systems, networks, hardware, servers, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and DataSystems”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conductedconducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have has at all times implemented and maintained commercially reasonable all reasonably necessary controls, policies, procedures, and safeguards consistent with industry standards and practices for similarly situated companies to maintain and protect their material confidential information and the integrity, availability, privacy, continuous operation, redundancy and security of all IT Systems and Data data (including all Personal Data, personally identifiable, sensitive, confidential or regulated data) (“Company Data”) used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statementits business, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages outages, compromises, or unlawful or unauthorized acquisitions of, disclosures of, uses of or accesses to the same, except in each case as would not, individually or other material compromise of or relating to any of in the Company’s or its subsidiaries’ IT Systems and Dataaggregate, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition that would reasonably be expected to result inhave a Material Adverse Effect. Except in each case as would not, any material security breach individually or other material compromise in the aggregate, reasonably be expected to their IT Systems and Data; (ii) have a Material Adverse Effect, the Company and its subsidiaries are is presently and, at all times, has been in compliance with all (i) applicable laws or statutes and all laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or court, arbitrator, governmental or regulatory authority, ; and (ii) internal policies and contractual obligations obligations, each (i) and (ii) relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, have a Material Adverse Effect; and (iii) the Company and its subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practicesData.

Cybersecurity; Data Protection. The Company and its subsidiaries’ information technology assets and computer systems and assetsequipment, computers, systems, networks, hardware, software, websites, applications, and databases (including all Personal Data, and sensitive, confidential or regulated data, and the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “IT Systems and Data”) are adequate for, and operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiaries as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants, except as would not, individually or in the aggregate, be reasonably expected to result in a Material Adverse Change. The Company and its subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material Personal Data, confidential information and the integrity, continuous operation, redundancy and security of all IT Systems information technology assets and Data equipment, computers, systems, networks, hardware, software, websites, applications, and databases and data used in connection with their businesses. (i) Except as may be included or incorporated by reference in the Registration Statement, the General Disclosure Package and the Prospectus, (x) to the Company’s knowledge, the Company has not had any material security breachthere have been no breaches, violations, outages or unauthorized uses of or accesses to the same, except for such controls, policies, procedures and safeguards the failure to maintain, or other material compromise of such breaches, violations, outages or relating to any of the Company’s unauthorized uses or its subsidiaries’ IT Systems and Data, and (y) the Company and its subsidiaries have not been notified of, and have no knowledge of any event or condition accesses that would reasonably be expected to result in, any material security breach or other material compromise to their IT Systems and Data; (ii) the Company and its subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropriation or modification, except as would not, in the case of this clause (ii), individually or in the aggregate, reasonably be expected to have a Material Adverse Effect; Change, nor any incidents under internal review or investigations relating to the same. Except where non-compliance would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Change, the Company and each of its subsidiaries are in compliance with all applicable data privacy and security and data protection laws and regulations regarding the collection, use, transfer, storage, protection, disposal or disclosure of Personal Data (iiias defined below) processed, stored or collected by the Company and its subsidiaries (collectively, the “Privacy Laws”). “Personal Data” means personally identifiable information, protected health information, financial information, “personal data” as defined by the EU General Data Protection Regulations (EU 2016 679) and all other information subject to Privacy Laws. The Company and its subsidiaries have implemented backup policies and disaster recovery technology consistent procedures reasonably designed to (i) ensure compliance with industry standards Privacy Laws and practicesits privacy policies on its website or other consumer facing communications; and (ii) reasonably protect the security and confidentiality of all Personal Data. Neither the Company nor any subsidiary has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws.