Common use of Privacy and Data Security Clause in Contracts

Privacy and Data Security. (i) The Seller has a privacy policy regarding the collection, use, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retention, transfer or disposal of Personal Information). (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (v) The execution, delivery and performance of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Seller as it currently exists or as it existed at any time during which any Personal Information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in the Seller’s possession, custody or control, or otherwise held or processed on its behalf.

Privacy and Data Security. (ia) The Seller Each Acquired Company and each third party acting on behalf of any Acquired Company that has a privacy policy regarding or has had access to Personal Data collected by or on behalf of any Acquired Company (in the collectioncase of such third parties, useto the extent relating to their performance of services for any Acquired Company), materially complies, and disclosure of Personal Information in its possessionhas materially complied with (A) applicable Laws, custodyincluding all Privacy Laws, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes(B) contractual obligations (including, but is not limited to, those with identified customers) relating to data handling and/or security for Personal Data, (C) internal and public-facing privacy, data handling and/or security policies of any information that could potentially identify an individualAcquired Company, including nameand (D) binding rules of applicable self-regulatory organizations relating to privacy, addressdata handling and/or security policies relating to (x) the privacy of users of any web properties, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by products and/or services of any applicable Laws. Acquired Company; (iiy) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer disclosure, transfer, disposal, or any other processing of any Personal Data collected or used by any Acquired Company and/or disposal by third parties having access to such information; and (z) the transmission of Personal Informationmarketing and/or commercial messages through any means, including via email, text message and/or any other means (collectively, “Privacy Laws and Requirements”). Neither the execution, delivery or performance of this Agreement will result in any violation by the Acquired Companies of any applicable Privacy Laws and Requirements. (iiib) The Seller is in compliance in all material respects Acquired Companies maintain privacy policies with the terms of all contracts respect to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retention, transfer disclosure, transfer, disposal or disposal other processing of Personal Information)Data. True and correct copies of all such privacy policies have been made available to Parent. Each such privacy policy has included information and made disclosures to users or customers in compliance with Privacy Laws and Requirements, and no such disclosures made or contained in any such privacy policy has been materially inaccurate, misleading or deceptive or in violation of any Privacy Laws and Requirements. (ivc) No Person Acquired Company has received during the last five (including 5) years any Governmental Entity) has commenced any Action relating written notice of or, to the Seller’s information privacy Knowledge of the Company, oral notice of any complaint to, or data security practicesany audit, including Proceeding, investigation (formal or informal) or claim currently pending against, any Acquired Company by any private party, the Federal Trade Commission, any state attorney general or similar state official, or any other Governmental Body, foreign or domestic, with respect to the collection, use, retention, disclosure, transfer, storage, retention storage or disposal of Personal Information maintained Data. There has not been any unauthorized access to, disclosure of, or appropriation of and/or any other misuse of any Personal Data or any breach in security of the information systems used to store or otherwise process any Personal Data by or on behalf of the Sellerany Acquired Company that would require notification of individuals, or, to the Knowledge of the Seller, threatened any such Actionlaw enforcement, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to Governmental Body under any such Action described in the immediately preceding sentenceapplicable Privacy Laws and Requirements. (vd) All Company Systems have been maintained in accordance with standards set by the manufacturers or otherwise in accordance with industry standards, in all material respects, to ensure proper operation, monitoring and use. The executionCompany Systems are in good working condition to effectively perform all information technology operations materially necessary to conduct the Business as currently conducted. The Acquired Companies have not experienced any material disruption to, delivery and performance of this Asset Purchase Agreement and or material interruption in, the consummation conduct of the TransactionBusiness, including any transfer event, disruption or defect that resulted in the provision of Personal Information resulting from material service level credits or the like to any counterparty under any Contract, that is attributable to a defect, bug, breakdown or other failure or deficiency of the Company Systems. The Acquired Companies have taken commercially reasonable measures to provide for the back-up and recovery of the data and information necessary for the conduct of the Business (including such transactionsdata and information that is stored on magnetic or optical media in the Ordinary Course of Business) without material disruption to, will not violate any applicable Lawor material interruption in, the privacy policy conduct of the Seller Business as it currently exists or as it existed at any time during which any Personal Information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Dateconducted. (vie) The Seller has established Acquired Companies conduct their businesses in material compliance with HIPAA and implemented policiesapplicable regulations, programs including those regulations addressing the security of electronic Protected Health Information (“PHI”), notification obligations in the case of breaches of unsecured PHI, and procedures the privacy of individually identifiable health information that are commercially reasonable, including administrative, technical promulgated at 45 C.F.R. Parts 160 and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements164. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in the Seller’s possession, custody or control, or otherwise held or processed on its behalf.

Privacy and Data Security. (ia) The Seller has Schedule 3.25(a) contains a true and complete copy of Seller’s privacy policy regarding the collection, use, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar personal information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (iib) The Seller has complied at all times with Seller’s privacy policy and all applicable Laws regarding the collection, use, disclosure, storage, retentiontransfer, transfer and/or or disposal of Personal Informationpersonal information. (iiic) The Seller is in compliance in all material respects with the terms of all contracts Contracts to which the Seller is a party relating to data privacy, security, and/or or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retentiontransfer, transfer or disposal of Personal Informationpersonal information). (ivd) No Person (including any Governmental EntityAuthority) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information personal information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation investigation, or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (ve) The execution, delivery delivery, and performance of this Asset Purchase Agreement and the consummation of the Transactiontransactions contemplated herein, including any transfer of Personal Information personal information resulting from such transactions, will not violate any applicable Law, Law or the privacy policy of the Seller as it currently exists or as it existed at any time during which any Personal Information personal information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller Seller, or any party Person acting on its behalf Seller’s behalf, under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing DateContracts. (vif) The Seller has established and implemented policies, programs programs, and procedures that are commercially reasonablein material compliance with applicable industry practices, including administrative, technical technical, and physical safeguards, to protect the confidentiality, integrity integrity, and security of Personal Information personal information in its possession, custody custody, or control against unauthorized access, use, modification, disclosure disclosure, or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (viig) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not not, in the past five (5) years, experienced any loss, damage damage, or unauthorized access, disclosure, use use, or breach of security of any Personal Information personal information in the Seller’s possession, custody custody, or control, or otherwise held or processed on its Seller’s behalf.

Privacy and Data Security. (ia) The Seller has a privacy policy regarding and, to Seller’s Knowledge, all vendors, processors, or other third parties acting for or on behalf of Seller in connection with the collection, use, and disclosure Processing of Personal Information or that otherwise have been authorized to have access to Personal Information in its possessionthe possession or control of Seller, custody, or control, or otherwise held or processed on its behalf comply and is and at all times in the past five three (3) years has been in compliance have complied, in all material respects with such privacy policy. True all of the following: (A) Privacy Laws; (B) industry standards, guidelines, and complete copies best practices including the National Institute of Standards and Technology (NIST) Cybersecurity Framework; (C) Seller Privacy and Data Security Policies; and (D) all privacy policies that have been used by obligations or restrictions concerning the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned privacy, security, or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal Processing of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts Information under any Contract to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on otherwise bound as of the collection, use, storage, retention, transfer or disposal of Personal Information)date hereof. (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (vb) The execution, delivery delivery, and performance of this Asset Purchase Agreement and the consummation of the Transactiontransactions contemplated hereby, including do not and will not: (A) conflict with or result in a violation or breach of any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Privacy Laws or Seller Privacy and Data Security Policies (as it currently exists existing or as it existed existing at any time during which any Personal Information was collected or obtained Processed by or for Seller); or (B) require the consent of or notice to any Person concerning such Person’s Personal Information. (c) Seller has posted to its website or published or otherwise made available in connection with any services of Seller a Seller Privacy and Data Security Policy. No disclosure or representation made or contained in any Seller Privacy and Data Security Policy has been materially inaccurate, misleading, deceptive, or in material violation of any Privacy Laws (including by containing any material omission), and the practices of Seller with respect to the Processing of Personal Information conform, and at all times have conformed, to Seller Privacy and Data Security Policies that govern the use of such Personal Information in all material respects. Seller has delivered or made available to Buyer true, complete, and correct copies of all Seller Privacy and Data Security Policies that are currently or in the past three (3) years were in effect. (d) In the past three (3) years, (A) to Seller’s Knowledge, no Personal Information in the possession or control of Seller or held or Processed by any vendor, processor, or other third party for or on behalf of Seller Seller, has been subject to any data or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage breach or unauthorized access, disclosure, use use, loss, denial or breach loss of security use, alteration, destruction, compromise, or Processing (a “Security Incident”), and (B) Seller has not notified and, to Seller’s Knowledge, there have been no facts or circumstances that would require Seller to notify, any Governmental Authority or other Person of any Security Incident. (e) In the past three (3) years, Seller has not received any notice, request, claim, complaint, correspondence, or other communication in writing from any Governmental Authority or other Person, and there has not been any audit, investigation, enforcement action (including any fines or other sanctions), or other action relating to, any actual, alleged, or suspected Security Incident or violation of any Privacy Law involving Personal Information in the possession or control of Seller’s possession, custody or control, or otherwise held or processed Processed by any vendor, processor, or other third party for or on its behalfbehalf of Seller. (f) Seller has at all times implemented and maintained, and required all vendors, processors, or other third parties that Process any Personal Information for or on behalf of Seller to implement and maintain, commercially reasonable and at a minimum industry standard security measures, plans, procedures, controls, and programs.

Privacy and Data Security. (ia) The Seller has a privacy policy regarding the collection, use, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and in For the past five years four (4) years, Seller, to the extent Related to the Business, has been in and is in now compliance in all material respects with such privacy policy. True all Privacy and complete copies of all privacy policies that have been used by the Seller Security Requirements and does not engage in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retention, transfer or disposal of Personal Information). (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal undisclosed collection of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practicesits website. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (v) The execution, delivery and performance execution of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, transactions hereunder will not violate any Privacy and Data Security Requirements in any material respects. (b) For the past four (4) years, Seller, to the extent Related to the Business, has not experienced any Security Breaches, and the Seller is not aware of any notices or complaints from any Person regarding a Security Breach. For the past four (4) years, Seller, to the extent Related to the Business, has not received any notices or complaints from any Person (including any Governmental Authority) regarding the unauthorized Processing of Protected Data or non-compliance with applicable Privacy and Security Requirements. For the past four (4) years, Seller, to the extent Related to the Business, has complied with all individual rights requests relating to the Processing of Personal Information under applicable Law, . The Seller has the privacy policy rights in all material respects to Personal Information to grant the rights and transfers thereof pursuant to this Agreement and the consummation of the Seller as it currently exists or as it existed at any time during which any transaction hereunder. (c) Seller, to the extent Related to the Business, has implemented, and has required all third parties that receive Personal Information was collected or obtained by from or on behalf of Seller or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing DateBusiness to implement, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrativereasonable physical, technical and physical safeguardsadministrative safeguards consistent with industry standards that are designed to protect Protected Data from unauthorized access by any Person. Except as described in Seller’s privacy policy, Seller, to protect the confidentialityextent Related to the Business, integrity and security does not engage in the sale, as defined by applicable Law, of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangementsInformation. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in the Seller’s possession, custody or control, or otherwise held or processed on its behalf.

Privacy and Data Security. (ia) The Seller has a privacy policy regarding the collection, use, complies and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and at all times in the past five (5) years has been in compliance complied, in all material respects with such privacy policy. True and complete copies all of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individualfollowing: (A) Privacy Laws; (B) rules of self-regulatory organizations, including namethe Payment Card Industry Data Security Standard (PCI-DSS); (C) industry standards, addressguidelines, social security numberand best practices, birth information including the National Institute of Standards and similar informationTechnology (NIST) Cybersecurity Framework; (D) Seller Privacy and Data Security Policies; and (E) all obligations or restrictions concerning the privacy, as well as personal health informationsecurity, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal or Processing of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts Information under any Contract to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on otherwise bound as of the collection, use, storage, retention, transfer or disposal of Personal Information)date hereof. (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (vb) The execution, delivery delivery, and performance of this Asset Purchase Agreement and the consummation of the Transactiontransactions contemplated hereby, including any the transfer of all Personal Information resulting from such transactionsin the possession or control of Seller to Buyer or its Subsidiaries, do not and will not violate not: (A) conflict with or result in a violation or breach of any applicable Law, the privacy policy of the Privacy Laws or Seller Privacy and Data Security Policies (as it currently exists existing or as it existed existing at any time during which any Personal Information was collected or obtained Processed by or on behalf for Seller; or (B) require the consent of or notice to any Person concerning such Person’s Personal Information. (c) No disclosure or representation made or contained in any Seller Privacy and Data Security Policy has been materially inaccurate, misleading, deceptive, or other privacy in violation of any Privacy Laws (including by containing any material omission), and data security requirements imposed on the practices of the with respect to the Processing of Personal Information conform, and at all times in the past five (5) years have conformed, to Seller or any party acting on its behalf under any contracts. Upon Privacy and Data Security Policies that govern the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use of such Personal Information on identical terms in all material respects. Seller has delivered or made available to Buyer true, complete, and conditions as correct copies of all Seller Privacy and Data Security Policies that are currently or in the Seller enjoyed immediately prior to the Closing Datepast five (5) years were in effect. (vid) The Seller has established and implemented policiesIn the past five (5) years, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except except as set forth on Paragraph 6(tin Section 2.25(d) of the Disclosure ScheduleSchedules, (A) no Personal Information in the possession or control of Seller has not experienced been subject to any loss, damage data or security breach or unauthorized access, disclosure, use use, loss, denial or breach loss of security use, alteration, destruction, compromise, or Processing (a “Security Incident”), and (B) Seller has not notified and, there has been no facts or circumstances that would require Seller to notify, any Governmental Authority or other Person of any Security Incident. (e) In the past five (5) years, except as set forth in Section 2.25(e) of the Disclosure Schedules, Seller has not received any notice, request, claim, complaint, correspondence, or other communication in writing from any Governmental Authority or other Person, and there has not been any audit, investigation, enforcement action (including any fines or other sanctions), or other Action relating to, any actual, alleged, or suspected Security Incident or violation of any Privacy Law involving Personal Information in the possession or control of Seller’s possession, custody or control, or otherwise held or processed Processed by any vendor, processor, or other third party for or on its behalfbehalf of Seller.

Privacy and Data Security. (ia) The Seller has NORCAL and each NORCAL Subsidiary, and, to the Knowledge of NORCAL, all vendors, processors, or other third parties acting for or on behalf of NORCAL or a privacy policy regarding NORCAL Subsidiary in connection with the collection, use, and disclosure Processing of Personal Information or that otherwise have been authorized to have access to Personal Information in its possession, custody, the possession or control, control of NORCAL or otherwise held or processed on its behalf any NORCAL Subsidiary comply and is and at all times in the past five three years has been in compliance have complied, in all material respects with such privacy policy. True all of the following: (A) Privacy Laws; (B) the Payment Card Industry Data Security Standard; (C) NORCAL Privacy and complete copies Data Security Policies; and (D) all obligations or restrictions concerning the privacy, security, or Processing of all privacy policies that have been used by Personal Information under any contracts or other written agreements, arrangements, commitments, or understandings to which NORCAL or any NORCAL Subsidiary is a party or otherwise bound as of the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Lawsdate hereof. (iib) The Seller has complied at execution, delivery, and performance of this Agreement and the consummation of the transactions contemplated hereby, including the transfer of all times Personal Information in the possession or control of NORCAL or any NORCAL Subsidiary to PRA or its Subsidiaries, do not and will not: (A) conflict with all applicable or result in a material violation or breach of any Privacy Laws regarding or NORCAL Privacy and Data Policies; or (B) require the collection, use, storage, retention, transfer and/or disposal consent of or notice to any Person concerning such Person’s Personal Information. (iiic) The Seller is NORCAL and each NORCAL Subsidiary, in compliance with Privacy Laws in all material respects respects, has posted to each of their websites and mobile applications and published or otherwise made available in connection with any products or services offered by NORCAL, NORCAL Privacy and Data Policies. No disclosure or representation made or contained in any such policy has been materially inaccurate, misleading, deceptive, or in material violation of any Privacy Laws (including by containing any material omission), and the terms practices of NORCAL and the NORCAL Subsidiaries with respect to the Processing of Personal Information conform, and at all times in the past three years have conformed, to NORCAL Privacy and Data Policies that govern the use of such Personal Information in all material respects. NORCAL has delivered or made available to PRA true, complete, and correct copies of all contracts NORCAL Privacy and Data Policies that are in effect as of the date hereof or have been in effect in the past three years. (d) Except as set forth in Section 5.23(d) of the NORCAL Disclosure Schedules to which the Seller is a Knowledge of NORCAL, no Personal Information in the possession or control of NORCAL or any NORCAL Subsidiary, or held or Processed by any vendor, processor, or other third party relating for or on behalf of NORCAL or any NORCAL Subsidiary, has been subject to any data privacyor security breach or unauthorized access, security, and/or breach notification (including provisions that impose conditions or restrictions on the collectiondisclosure, use, storageloss, retentiondenial or loss of use, transfer alteration, destruction, compromise, or disposal of Personal InformationProcessing that NORCAL or any NORCAL Subsidiary is required to report to a Governmental Authority or other Person (a “Security Incident”). (ive) No Person (including any Governmental EntityExcept as set forth in Section 5.23(e) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the SellerNORCAL Disclosure Schedules, in the past three years, NORCAL and the NORCAL Subsidiaries have not received any written or, to the Knowledge of the SellerNORCAL, threatened any such Actionoral notice, request, claim, complaint, correspondence, or made other communication from any complaintGovernmental Authority or other Person, investigation or inquiry relating and to such practices. To the Knowledge of NORCAL there has not been any audit, investigation, enforcement action (including any fines or other sanctions), or other Action relating to, any actual, alleged, or suspected Security Incident or violation of any Privacy Law involving Personal Information in the Sellerpossession or control of NORCAL or any NORCAL Subsidiary, there are no facts or circumstances that could held or Processed by any vendor, processor, or other third party for or on behalf of NORCAL or any NORCAL Subsidiary, except as would not, individually or in the aggregate, reasonably be expected to give rise to any such Action described in the immediately preceding sentencehave a Material Adverse Effect. (vf) The executionNORCAL and each NORCAL Subsidiary has at all times in the past three years implemented and maintained, delivery and performance of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Seller as it currently exists or as it existed at any time during which required all vendors that Process any Personal Information was collected or obtained by for or on behalf of Seller or other privacy and data security requirements imposed on Seller NORCAL or any party acting on its behalf under any contracts. Upon the Closing DateNORCAL Subsidiary to implement and maintain, ▇▇▇▇▇▇▇▇▇ will continue commercially reasonable security measures, plans, procedures, controls, and programs, including written information security programs, designed to have the right to use such Personal Information on identical terms (A) identify and conditions as the Seller enjoyed immediately prior reasonably address internal and external risks to the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity privacy and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in the Seller’s possession, custody their possession or control, or otherwise held or processed on its behalf.;

Privacy and Data Security. Section 3.15(q) of the Seller Disclosure Schedule identifies and describes each distinct electronic or other database containing (iin whole or in part) The Private Information and Customer Data maintained by or for Seller has a privacy policy regarding at any time, the collectiontypes of Private Information and Customer Data in each such database, usethe means by which the Private Information and Customer Data was collected, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy security policies that have been used by the Seller in the past five years have been provided adopted and maintained with respect to ▇▇▇▇▇▇▇▇▇each such database. The Seller has established privacy policies which are in the past five years posted a conformance with reputable industry practice and all applicable Legal Requirements. At all times since inception, Seller has provided accurate notice of its privacy policy in a clear and conspicuous location practices on all of its websites (and through client-side and web interface products) and these notices have not contained any mobile applications owned material omissions of Seller's privacy practices and have not been misleading, deceptive, or operated by the Sellerin violation of applicable Legal Requirements. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with and is in compliance with all applicable Laws regarding the Legal Requirements, all rules, policies, and requirements of self-regulatory organizations, and its internal and external privacy policies, and with any contractual obligations and consumer-facing statements on its Web site and in any marketing or promotional materials relating to its use, collection, useretention, storage, retention, transfer and/or disposal of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retention, transfer or disposal of Personal Information). (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, usedisclosure, transfer, storagedisposal, retention or disposal and other processing of Personal any Private Information maintained by or on behalf of and Customer Data, and the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (v) The execution, delivery and performance of this Asset Purchase Agreement and the consummation will not result in a breach or violation of any of the Transaction, including any transfer foregoing. Seller has obtained all consents necessary from providers of Personal Customer Data and Personally Identifiable Information resulting from (a) to collect and use such transactions, will not violate any applicable Law, Customer Data and Personally Identifiable Information in the privacy policy conduct of the Business as currently conducted and as proposed by Seller as it currently exists or as it existed at to be conducted and (b) to transfer such Customer Data and Personally Identifiable Information to Seller. Seller has not received, and to the knowledge of Seller, there has been no, complaint to any time during which any Personal Information was collected or obtained by or on behalf of Seller regulatory or other privacy and data security requirements imposed on governmental body or official, foreign or domestic, or any audit, proceeding, investigation (formal or informal), or claim against, Seller or any party acting on of its behalf under any contracts. Upon customers (in the Closing Datecase of customers, ▇▇▇▇▇▇▇▇▇ will continue to have the right extent relating to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to Products) by any private party or any regulatory or other governmental body or official, foreign or domestic, regarding the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized accesscollection, use, modificationretention, storage, transfer, disposal, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangementsprocessing of Private Information or Customer Data. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in the Seller’s possession, custody or control, or otherwise held or processed on its behalf.

Privacy and Data Security. (a) The computer systems, including the software, hardware and networks (collectively, the “Systems”), currently used by Seller with respect to the Program are sufficient for the current needs of the Program, including as to capacity and ability to process current peak volumes in a timely manner. In the past 12 months, there have been no bugs in, or failures, breakdowns, or continued substandard performance of, any such Systems that has caused the substantial disruption or interruption in or to the use of such Systems by Seller or the conduct of its business in respect of the Program Candidate. (b) Each privacy policy or other policy or terms published by Seller that relates to Personal Data has been delivered or made available to Purchaser. Seller is in material compliance with all applicable Privacy Laws, its own privacy policies, terms of use, and other terms or policies or Contracts binding on Seller to the extent relating to the Program and with respect to, in each case, data security, Data Breach notification requirements, the privacy of service providers, users, visitors, and customers, or the Processing of any Personal Data or other data, in each case in the operation of the Program (collectively, the “Privacy Requirements”). No material claims are currently pending or, to Seller’s Knowledge, are threatened against Seller by any Person alleging a violation of any Privacy Requirements in respect of the Program. The execution and delivery of this Agreement and the Ancillary Documents, the performance by Seller of its obligations hereunder and thereunder, and the consummation of the transactions contemplated hereby and thereby (i) The will comply with all Privacy Requirements in all material respects, (ii) will not impair any material rights of, or impose any material obligations or restrictions on, Seller with respect to any use, disclosure, commercialization or exploitation of, or otherwise relating to, any Personal Data or other data in the operation of the Program, and (iii) will not give rise to any material right on the part of any Person to impair any such rights or impose any such obligations or restrictions. None of Seller or any software tool created or used by or on behalf of Seller, has used false log-on credentials with respect to any third-party website or other false representation or statement or unauthorized or unlawful mechanism, code (including markup languages, programming languages, or scripts), or action to access (including access in excess of authorization), obtain, damage, exploit, Process, or otherwise use any Personal Data or other data, in each case, relating to the Program. Since January 1, 2021, Seller has not received a privacy policy written complaint or been the subject of any Proceeding or investigation regarding the collection, use, and disclosure its Processing of Personal Information Data or other data in each case, in respect of the operation of the Program or its privacy or data security policies, practices, or activities as it relates to the Program. In material compliance with the Privacy Requirements, Seller has adequate security measures in place to protect Personal Data and other data in its possession, custody, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, control as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retention, transfer or disposal of Personal Information). (iv) No Person (including any Governmental Entity) has commenced any Action relating it relates to the Seller’s information privacy or data security practicesProgram. Since January 1, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (v) The execution, delivery and performance of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Seller as it currently exists or as it existed at any time during which any Personal Information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Date. (vi) The Seller has established and implemented policies, programs and procedures that are commercially reasonable, including administrative, technical and physical safeguards, to protect the confidentiality, integrity and security of Personal Information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule2021, Seller has not experienced any loss, damage or unauthorized access, disclosure, use or breach of security of any Personal Information in Data Breach as it relates to the Seller’s possession, custody or control, or otherwise held or processed on its behalfProgram.

Privacy and Data Security. (ia) The Seller has a privacy policy regarding the collection, usecomplies, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and at all times in the past five (5) years has been in compliance complied, in all material respects with such privacy policy. True and complete copies all of all privacy policies that have been used by the following: (A) Privacy Laws; (B) the Seller in Privacy and Data Security Policies; and (C) all obligations or restrictions concerning the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned privacy, security, or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (ii) The Seller has complied at all times with all applicable Laws regarding the collection, use, storage, retention, transfer and/or disposal Processing of Personal Information. (iii) The Seller is in compliance in all material respects with the terms of all contracts Information under any Contract to which the Seller is a party relating to data privacy, security, and/or breach notification (including provisions that impose conditions or restrictions on otherwise bound as of the collection, use, storage, retention, transfer or disposal of Personal Information)date hereof. (iv) No Person (including any Governmental Entity) has commenced any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (vb) The execution, delivery delivery, and performance of this Asset Purchase Agreement and the consummation of the Transactiontransactions contemplated hereby, including do not and will not: (A) conflict with or result in a violation or breach of any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Privacy Laws or Seller Privacy and Data Security Policies (as it currently exists existing or as it existed existing at any time during which any Personal Information was collected or obtained Processed by or on behalf for the Seller); or (B) require the consent of Seller or other privacy and data security requirements imposed on Seller or notice to any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use Person concerning such Person’s Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing DateInformation. (vic) The Seller has established delivered or made available to Buyer true, complete, and implemented policies, programs correct copies of all Seller Privacy and procedures Data Security Policies that are commercially reasonablecurrently in effect, including administrativeand the Seller has complied in all material respects with such Seller Privacy and Data Security Policies. (d) In the past five (5) years, technical and physical safeguards(A) to, to protect the confidentiality, integrity and security of no Personal Information in its possession, custody the possession or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not experienced been subject to any loss, damage data or security breach or unauthorized access, disclosure, use use, loss, denial or breach loss of security use, alteration, destruction, compromise, or Processing (a “Security Incident”), and (B) the Seller has not notified and there have been no facts or circumstances that would require the Seller to notify, any Governmental Authority or other Person of any Security Incident. (e) In the past five (5) years, the Seller has not received any notice, request, claim, complaint, correspondence, or other communication in writing from any Governmental Authority or other Person, and there has not been any audit, investigation, enforcement action (including any fines or other sanctions), or other Action relating to, any actual, alleged, or suspected Security Incident or violation of any Privacy Law involving Personal Information in the possession or control of the Seller’s possession, custody or control, or otherwise held or processed Processed by any vendor, processor, or other third party for or on its behalfbehalf of the Seller.

Privacy and Data Security. (ia) The Seller has a privacy policy regarding the collection, use, and disclosure of Personal Information personal information in its possession, custody, or control, or otherwise held or processed on its behalf connection with the operation of the Business and is and in the past five two years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five two years have been provided to ▇▇▇▇▇▇▇▇▇the Buyer. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (iib) The Seller has and its Subsidiaries have complied at all times in all material respects with all Laws applicable Laws to the Business or the Acquired Assets regarding the collection, use, storage, retentiontransfer, transfer and/or or disposal of Personal Information. (iii) personal information. The Seller is in compliance in all material respects with the terms of all contracts agreements to which the Seller is a party applicable to the Business or the Acquired Assets relating to data privacy, security, and/or or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retentiontransfer, transfer or disposal of Personal Informationpersonal information). (ivc) No Person (including any Governmental Entity) has commenced any Action action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information personal information maintained by or on behalf of the Seller, or, or to the Knowledge knowledge of the Seller, threatened any such Actionaction, or made any complaint, investigation investigation, or inquiry relating to such practices. To , except as would not, individually or in the Knowledge of the Selleraggregate, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described have, individually or in the immediately preceding sentenceaggregate, a Business Material Adverse Effect. (v) The execution, delivery and performance of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, will not violate any applicable Law, the privacy policy of the Seller as it currently exists or as it existed at any time during which any Personal Information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller or any party acting on its behalf under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing Date. (vid) The Seller has established and implemented policies, programs programs, and procedures that are commercially reasonablein material compliance with industry practice, including administrative, technical technical, and physical safeguards, to protect the confidentiality, integrity and security of Personal Information personal information in its possession, custody or control against unauthorized access, use, modification, disclosure or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (vii) Except as set forth on Paragraph 6(t) To the knowledge of the Disclosure ScheduleSeller, Seller has not not, in the past two years, experienced any loss, damage damage, or unauthorized access, disclosure, use use, or breach of security of any Personal Information personal information relating to the Business or the Acquired Assets in the Seller’s possessionpossession of the Seller or any of its Subsidiaries, custody or control, control or otherwise held or processed on its behalf.

Privacy and Data Security. (ia) The Seller has Schedule 3.26(a) contains a true and complete copy of Seller’s privacy policy regarding the collection, use, and disclosure of Personal Information in its possession, custody, or control, or otherwise held or processed on its behalf and is and in the past five years has been in compliance in all material respects with such privacy policy. True and complete copies of all privacy policies that have been used by the Seller in the past five years have been provided to ▇▇▇▇▇▇▇▇▇. The Seller has in the past five years posted a privacy policy in a clear and conspicuous location on all websites and any mobile applications owned or operated by the Seller. As used herein, “Personal Information” includes, but is not limited to, any information that could potentially identify an individual, including name, address, social security number, birth information and similar personal information, as well as personal health information, protected health information and personally identifiable information as defined by any applicable Laws. (iib) The Seller has complied at all times times, in all material respects, with Seller’s privacy policy and all applicable Laws regarding the collection, use, disclosure, storage, retentiontransfer, transfer and/or or disposal of Personal Informationpersonal information. (iiic) The Seller is in compliance in all material respects with the terms of all contracts Contracts to which the Seller is a party relating to data privacy, security, and/or or breach notification (including provisions that impose conditions or restrictions on the collection, use, storage, retentiontransfer, transfer or disposal of Personal Informationpersonal information). (ivd) No Seller has not received notice of any Person (including any Governmental EntityAuthority) has commenced commencing, any Action relating to the Seller’s information privacy or data security practices, including with respect to the collection, use, transfer, storage, retention or disposal of Personal Information personal information maintained by or on behalf of the Seller, or, to the Knowledge of the Seller, threatened any such Action, or made any complaint, investigation investigation, or inquiry relating to such practices. To the Knowledge of the Seller, there are no facts or circumstances that could reasonably be expected to give rise to any such Action described in the immediately preceding sentence. (ve) The execution, delivery delivery, and performance of this Asset Purchase Agreement and the consummation of the Transaction, including any transfer of Personal Information resulting from such transactions, transactions contemplated herein will not violate any applicable Law, Law or the privacy policy of the Seller as it currently exists or as it existed at any time during which any Personal Information personal information was collected or obtained by or on behalf of Seller or other privacy and data security requirements imposed on Seller Seller, or any party Person acting on its behalf Seller’s behalf, under any contracts. Upon the Closing Date, ▇▇▇▇▇▇▇▇▇ will continue to have the right to use such Personal Information on identical terms and conditions as the Seller enjoyed immediately prior to the Closing DateContracts. (vif) The Seller has established and implemented policies, programs programs, and procedures that are commercially reasonablein material compliance with applicable industry practices, including administrative, technical technical, and physical safeguards, to protect the confidentiality, integrity integrity, and security of Personal Information personal information in its possession, custody custody, or control against unauthorized access, use, modification, disclosure disclosure, or other misuse. The policies, programs and procedures described in this subsection address and apply to remote working arrangements. (viig) Except as set forth on Paragraph 6(t) of the Disclosure Schedule, Seller has not not, in the past five (5) years, experienced any loss, damage damage, or unauthorized access, disclosure, use use, or breach of security of any Personal Information personal information in the Seller’s possession, custody custody, or control, or otherwise held or processed on its Seller’s behalf.