Common use of Confidentiality Data Security Clause in Contracts

Confidentiality Data Security. A. Supplier shall not disclose to third parties, or use for purposes other than performing its obligations hereunder, any Data, Inventions, or any other information that relates to the technical, legal, or business affairs or activities of Newmont or its affiliates which was obtained by or on behalf of Supplier in connection with the performance of the Services (collectively, “Confidential Information”), without the prior written consent of Newmont. Confidential Information shall not include information which: (1) is, or shall have been, in the possession of Supplier and not subject to a confidentiality obligation prior to Supplier’s acquisition thereof in connection with the performance of the Services; (2) through no act or omission of Supplier, becomes published or otherwise available to the public under circumstances such that the public may utilize the same without any direct or indirect confidentiality obligation to Newmont or its affiliates; or (3) is acquired by Supplier from any third party rightfully in possession of the same and having no direct or indirect confidentiality obligation to Newmont or its affiliates with respect to the same; provided, however, that the foregoing exceptions shall not apply with respect to Confidential Information which meets the definition of Personal Data (as set forth in Section 5.B., below), which is more specifically addressed in Section 5.B., below. All Confidential Information shall be delivered to Newmont or destroyed by Supplier, at Newmont’s discretion, upon the termination or expiration of this Agreement or at any earlier time upon Newmont’s request. Supplier shall not retain any copies of Confidential Information without Newmont’s express written authorization. Notwithstanding the foregoing, Supplier may retain one archival hard copy of the Confidential Information for such period of time that Supplier normally retains archival hard copies, and such hard copy shall remain subject to this Section 5.A. until it is destroyed. In addition, if Supplier’s computer system automatically retains back-up copies of Confidential Information, Supplier may retain such copies in Supplier’s archival computer storage for the period of time that Supplier normally archives backed-up computer records, and such computer copies shall remain subject to this Section 5.A. until they are destroyed or erased. Supplier acknowledges that the Confidential Information is an important asset of Newmont and/or its affiliates and that there is not an adequate remedy at law for a breach by Supplier of this Section 5.A. and Newmont and/or its affiliates will suffer irreparable harm as a result of such a breach. Therefore, Supplier agrees that Newmont and/or its affiliates shall be entitled to equitable relief, including temporary and permanent injunctive relief without the obligation of posting a bond (cash or otherwise), in the event of actual or threatened unauthorized disclosure or use of Confidential Information in breach of this Section 5.A. B. For purposes of this Agreement, “Personal Data” means information regarding any individual (whether an employee or agent of Newmont, its affiliates, or contractors of it or its affiliates, or other individuals) recorded in any format, which is obtained by Contractor in connection with this Agreement and that identifies or could identify an individual personally, either by itself or together with other information, including demographic information such as name, sex, age and contact information, financial information such as taxpayer identification numbers and bank account information, and health information such as medical records and insurance claims. Contractor shall, for as long as it has possession of any Personal Data or other Confidential Information (collectively, Sensitive Information”) on Contractor’s information technology systems, , maintain reasonable security procedures and practices that are both

Confidentiality Data Security. A. Supplier 14.1. Information exchanged under this Agreement will be treated as confidential if identified as such at disclosure or if the subject matter or circumstances of disclosure would reasonably indicate such treatment and shall not disclose to third partiesinclude, or use for purposes other than performing its obligations hereunderwithout limitation, any Data, Inventions, or any other information that relates to the technical, legal, or business affairs or activities of Newmont or its affiliates which was obtained by or on behalf of Supplier in connection with the performance of the Services Customer Data and Regulated Data (collectively, “Confidential Information”). Confidential Information may only be used for the purpose of fulfilling obligations or exercising rights under this Agreement, and shared with employees, agents or contractors with a need to know such information to support that purpose. The Parties will procure that any of its employees, agents or contractors to whom Confidential Information is disclosed are bound by contractual obligations equivalent to those in this Clause 14.1. Confidential information will be protected using a reasonable degree of care to prevent unauthorised use or disclosure for five (5) years from the date of receipt or (if longer) for such period as the information remains confidential. These obligations do not cover information that: (i) was known or becomes known to the receiving Party without obligation of confidentiality, provided that (A) such recipient has no knowledge that such information is subject to a confidentiality agreement and (B) such information is not of a type or character that a reasonable person would have regarded it as confidential; (ii) is independently developed by the receiving Party without violating the disclosing Party’s rights; (iii) is or becomes publicly known (other than through unauthorised disclosure by or through a Party); (iv) is disclosed by the owner of such information to a third party free of any obligation of confidentiality; or (v) where disclosure is required by law or a governmental agency provided that, to the extent lawful so to do, the receiving Party shall notify the disclosing Party of the request giving it reasonable opportunity to respond, and cooperate with the disclosing Party’s reasonable, lawful efforts to resist, limit or delay disclosure at the disclosing Party’s expense, and provided that except for making such required disclosure, such information shall otherwise continue to be Confidential Information. Additionally, without limiting Customer’s obligation to maintain the confidentiality of Darktrace’s Intellectual Property, these obligations do not require Customer to treat as confidential information a Report or any other information specifically about Customer’s Data or Customer network systems, including any threats thereto or analysis thereof. 14.2. The Parties acknowledge that the Offering may be used to process information regulated by applicable privacy or data protection laws. Solely to the extent relevant to Darktrace’s provision of Services, Darktrace shall act only on the instructions of Customer in processing any Regulated Data as a data processor. Customer hereby instructs Darktrace to take such steps in the processing of Regulated Data as are reasonably necessary to the performance of Darktrace’s obligations under this Agreement, and agrees that such instructions constitute its full and complete instructions as to the means by which Regulated Data shall be processed by Darktrace. Each Party agrees that it shall comply with the Data Privacy Laws in exercising its rights and performing its obligations under this Agreement. Specifically, Xxxxxxxxx agrees that it shall: 14.2.1. not use Regulated Data save for the purposes of delivering the Offering and Services as instructed by this Agreement and in accordance with the documented instructions of Customer. Further Darktrace shall immediately inform Customer if, in Darktrace’s reasonable opinion, an instruction from Customer infringes Data Privacy Laws 14.2.2. taking into account the nature, scope, context and purposes of processing, it shall take, implement and maintain appropriate administrative, physical, technical and organisational measures to protect any Regulated Data accessed or processed by it against unauthorised or unlawful processing or accidental loss, destruction, damage or disclosure to the which are at least equal to the most stringent of the following: (a) those set out in Darktrace’s Information Security Standards, and (b) any highest standard required by law or regulation applicable to Darktrace;ensure, having regard to the state of art (including technological development) and the cost of implementing such measures and the nature, scope, context and purposes of processing as well as the severity of the risk to the rights and freedoms of natural persons, procure that such measures (as set out in Clause 13.2.3) ensure a level of security appropriate to: (a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction, disclosure, access or damage; and (b) the nature of the data to be protected; 14.2.3. if the Customer is based in the European Union, not transfer Regulated Data outside the European Economic Area without the prior written consent of NewmontCustomer and not without procuring provision of adequate safeguards (as defined by the European Commission from time to time); 14.2.4. Confidential Information take reasonable steps to ensure the reliability of its agents and employees who have access to any Regulated Data;not engage a subcontractor without the general written authorisation of the Customer , and procure that any of its subcontractors who process Regulated Data enter into a data processing agreement ensuring that the subcontractor shall not include abide by data protection requirements no less stringent than in this Clause 14. Darktrace shall be fully liable for any breach by the subcontractor of any data protection obligations set out in this Clause; 14.2.5. upon termination of this Agreement, it shall delete or return all such Regulated Data in accordance with the Customer’s written instructions); 14.2.6. document disclosures to third parties of Regulated Data and information which: (1) isrelated to such disclosures as would be required for Customer to respond to a request by an individual for an accounting of disclosures of their Regulated Data; 14.2.7. provide reasonable support to Customer in complying with any legally mandated request for access to or correction of any Regulated Data by any individual, or shall have beenaccess or demand made by any court or governmental authority responsible for enforcing privacy or data protection laws, and where such request or demand is submitted to Darktrace, promptly notify the Customer of it; and 14.2.8. in the event that Darktrace suffers a breach of security (which for the avoidance of doubt shall include, without limitation, any breach of Darktrace’s obligations under this Clause 14.2 and/or any loss, destruction, damage of, or compromise to, any Customer Data in Darktrace’s possession of Supplier and not subject to a confidentiality obligation prior to Supplier’s acquisition thereof in connection with or control), inform the performance of the Services; (2) through no act or omission of Supplier, becomes published or otherwise available to the public under circumstances such that the public may utilize the same without any direct or indirect confidentiality obligation to Newmont or its affiliates; or (3) is acquired by Supplier from any third party rightfully in possession Customer immediately upon learning of the same and having no direct reasonably cooperate with the Customer in respect of the measures that should be taken in response. 14.3. Neither Party will make any public statement or indirect confidentiality obligation to Newmont issue any public communication regarding any incident described in this Clause, without the other Party’s prior written consent, except as strictly required by law or its affiliates with respect regulation. 14.4. To the extent there are changes to the same; providedData Privacy Laws which materially affect the costs or risk profile of a Party, howeverthe Parties will meet in good faith to discuss any changes to this Agreement. For the avoidance of doubt, that the foregoing exceptions shall not apply with respect to Confidential Information which meets the definition of Personal Data (as set forth in Section 5.B., below), which is more specifically addressed in Section 5.B., below. All Confidential Information this Agreement shall be delivered updated as and to Newmont or destroyed by Supplier, at Newmont’s discretion, upon the termination or expiration of this Agreement or at any earlier time upon Newmont’s request. Supplier shall not retain any copies of Confidential Information without Newmont’s express written authorization. Notwithstanding extent required to comply with the foregoing, Supplier may retain one archival hard copy of the Confidential Information for such period of time that Supplier normally retains archival hard copies, and such hard copy shall remain subject General Data Protection Regulation (EU 2016/679) prior to this Section 5.A. until it is destroyed. In addition, if Supplier’s computer system automatically retains back-up copies of Confidential Information, Supplier may retain such copies in Supplier’s archival computer storage for the period of time that Supplier normally archives backed-up computer records, and such computer copies shall remain subject to this Section 5.A. until they are destroyed or erased. Supplier acknowledges that the Confidential Information is an important asset of Newmont and/or its affiliates and that there is not an adequate remedy at law for a breach by Supplier of this Section 5.A. and Newmont and/or its affiliates will suffer irreparable harm as a result of such a breach. Therefore, Supplier agrees that Newmont and/or its affiliates shall be entitled to equitable relief, including temporary and permanent injunctive relief without the obligation of posting a bond (cash or otherwise), in the event of actual or threatened unauthorized disclosure or use of Confidential Information in breach of this Section 5.A. B. For purposes of this Agreement, “Personal Data” means information regarding any individual (whether an employee or agent of Newmont, its affiliates, or contractors of it or its affiliates, or other individuals) recorded in any format, which is obtained by Contractor in connection with this Agreement and that identifies or could identify an individual personally, either by itself or together with other information, including demographic information such as name, sex, age and contact information, financial information such as taxpayer identification numbers and bank account information, and health information such as medical records and insurance claims. Contractor shall, for as long as it has possession of any Personal Data or other Confidential Information (collectively, Sensitive Information”) on Contractor’s information technology systems, , maintain reasonable security procedures and practices that are both25 May 2018.

Confidentiality Data Security. A. Supplier shall not disclose to third parties, or use for purposes other than performing its obligations hereunder, any Data, Inventions, or any other information that relates to the technical, legal, or business affairs or activities of Newmont or its affiliates which was obtained by or on behalf of Supplier in connection with the performance of the Services (collectively, “Confidential Information”), without the prior written consent of Newmont. Confidential Information shall not include information which: (1) is, or shall have been, in the possession of Supplier and not subject to a confidentiality obligation prior to Supplier’s acquisition thereof in connection with the performance of the Services; (2) through no act or omission of Supplier, becomes published or otherwise available to the public under circumstances such that the public may utilize the same without any direct or indirect confidentiality obligation to Newmont or its affiliates; or (3) is acquired by Supplier from any third party rightfully in possession of the same and having no direct or indirect confidentiality obligation to Newmont or its affiliates with respect to the same; provided, however, that the foregoing exceptions shall not apply with respect to Confidential Information which meets the definition of Personal Data (as set forth in Section 5.B., below), which is more specifically addressed in Section 5.B., below. All Confidential Information shall be delivered to Newmont or destroyed by Supplier, at Newmont’s discretion, upon the termination or expiration of this Agreement or at any earlier time upon Newmont’s request. Supplier shall not retain any copies of Confidential Information without Newmont’s express written authorization. Notwithstanding the foregoing, Supplier may retain one archival hard copy of the Confidential Information for such period of time that Supplier normally retains archival hard copies, and such hard copy shall remain subject to this Section 5.A. until it is destroyed. In addition, if Supplier’s computer system automatically retains back-up copies of Confidential Information, Supplier may retain such copies in Supplier’s archival computer storage for the period of time that Supplier normally archives backed-up computer records, and such computer copies shall remain subject to this Section 5.A. until they are destroyed or erased. Supplier acknowledges that the Confidential Information is an important asset of Newmont and/or its affiliates and that there is not an adequate remedy at law for a breach by Supplier of this Section 5.A. and Newmont and/or its affiliates will suffer irreparable harm as a result of such a breach. Therefore, Supplier agrees that Newmont and/or its affiliates shall be entitled to equitable relief, including temporary and permanent injunctive relief without the obligation of posting a bond (cash or otherwise), in the event of actual or threatened unauthorized disclosure or use of Confidential Information in breach of this Section 5.A. B. For purposes of this Agreement, “Personal Data” means information regarding any individual (whether an employee or agent of Newmont, its affiliates, or contractors of it or its affiliates, or other individuals) recorded in any format, which is obtained by Contractor Supplier in connection with this Agreement and that identifies or could identify an individual personally, either by itself or together with other information, including demographic information such as name, sex, age and contact information, financial information such as taxpayer identification numbers and bank account information, and health information such as medical records and insurance claims. Contractor Supplier shall, for as long as it has possession of any Personal Data or other Confidential Information (collectively, Sensitive Information”) on Contractor’s information technology systems, Data, maintain reasonable security procedures and practices that are bothboth (1) appropriate to the nature of the Personal Data, and (2) reasonably designed to help protect the Personal Data from unauthorized access, use, modification, disclosure, or destruction. For purposes of this Agreement, Supplier is the processor and Newmont is the controller of any Personal Data. Without limiting the generality of the requirements set forth above in this Section, if Supplier has any Personal Data or other Confidential Information (collectively, “Sensitive Information”) on Supplier’s information technology systems, Supplier shall, for as long as any Sensitive Information resides on Supplier’s information technology system: (a) employ industry-standard firewall and encryption protection for its information technology systems, and (b) use commercially reasonable efforts to scan its information technology system for viruses and malware and promptly mitigate the effects of any viruses or malware detected. Supplier immediately shall notify Newmont if it becomes aware, or has reason to believe, that any breach of this Section 5.B. has occurred, that any unauthorized access to or use of, or any security breach relating to or otherwise affecting, any Sensitive Information has occurred, or that any person who has had access to Sensitive Information has violated or intends to violate the terms of this Agreement. Supplier shall, at its own expense, cooperate with Newmont in investigating and responding to the foregoing.

Confidentiality Data Security. A. Supplier shall not disclose a. Each Party acknowledges that it and its employees or agents, in the course of the projects and services contemplated by this Agreement, may be exposed to third parties, or use for purposes other than performing its obligations hereunder, any Data, Inventions, or any other acquire information that relates is proprietary or confidential to the technical, legal, or business affairs or activities of Newmont or its affiliates which was obtained by or on behalf of Supplier in connection with the performance of the Services other Party (collectively, “Confidential Information”), without the prior written consent of Newmont. Each Party agrees to hold Confidential Information shall of the other Party in strict confidence and not include to use such Confidential Information or discuss or disclose such Confidential Information to any third party. The Parties agree that Confidential Information does not include: (i) information which: (1) which at the time of disclosure is, or without fault of the recipient becomes, generally available; (ii) information which either Party can show was in its possession at the time of disclosure or was independently developed by it; (iii) information received from a third party which had the right to transmit same without violation of any confidentiality agreement with the other party; and (iv) information which is required to be disclosed pursuant to court order or by law. The per-User pricing provided under this Agreement is Confidential Information. b. TeamDynamix will implement reasonable and appropriate security measures for the Applications, as determined by TeamDynamix, designed to help Client secure Client content against accidental or unlawful loss, access, or disclosure. TeamDynamix may modify its security measures from time to time, but will continue to provide at least the same level of security, on an aggregate basis, as is in place on the Effective Date. TeamDynamix shall have beenundergo a third-party security audit on no less than an annual basis. c. TeamDynamix will not access or use Client content except as necessary to maintain or provide the services under this Agreement, or as necessary to comply with the law or a binding order of a governmental body. TeamDynamix will not (i) disclose Client content to any government or third party, or (ii) move Client content from the TeamDynamix servers; except in each case as necessary to comply with the possession law or a binding order of Supplier a governmental body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, TeamDynamix will give Client reasonable notice of any legal requirement or order referred to in this Section 8(c), to allow Client to seek a protective order or other appropriate remedy. TeamDynamix will only use personal information and billing information in accordance with its privacy policy (available at xxxxx://xxx.xxxxxxxxxxx.xxx/privacy-policy-terms), and Client consents to such usage. TeamDynamix will not subject to a confidentiality obligation collect or use any personal information prior to Supplier’s acquisition thereof in connection with the performance of the Services; (2) through no act or omission of Supplier, becomes published or otherwise available to the public under circumstances such that the public may utilize the same without any direct or indirect confidentiality obligation to Newmont or its affiliates; or (3) is acquired by Supplier from any third party rightfully in possession of the same and having no direct or indirect confidentiality obligation to Newmont or its affiliates with respect to the same; provided, however, that the foregoing exceptions shall not apply with respect to Confidential Information which meets the definition of Personal Data (as set forth in Section 5.B., below), which is more specifically addressed in Section 5.B., below. All Confidential Information shall be delivered to Newmont or destroyed by Supplier, at Newmont’s discretion, upon the termination or expiration of this Agreement or at any earlier time upon Newmont’s request. Supplier shall not retain any copies of Confidential Information without Newmont’s express written authorization. Notwithstanding the foregoing, Supplier may retain one archival hard copy of the Confidential Information for such period of time that Supplier normally retains archival hard copies, and such hard copy shall remain subject to this Section 5.A. until it is destroyed. In addition, if Supplier’s computer system automatically retains back-up copies of Confidential Information, Supplier may retain such copies in Supplier’s archival computer storage for the period of time that Supplier normally archives backed-up computer records, and such computer copies shall remain subject to this Section 5.A. until they are destroyed or erased. Supplier acknowledges that the Confidential Information is an important asset of Newmont and/or its affiliates and that there is not an adequate remedy at law for a breach by Supplier of this Section 5.A. and Newmont and/or its affiliates will suffer irreparable harm as a result of such a breach. Therefore, Supplier agrees that Newmont and/or its affiliates shall be entitled to equitable relief, including temporary and permanent injunctive relief without the obligation of posting a bond (cash or otherwise), in the event of actual or threatened unauthorized disclosure or use of Confidential Information in breach of this Section 5.A. B. For purposes Effective Date of this Agreement, “Personal Data” means and Client will not submit or otherwise make available any personal information regarding any individual (whether an employee or agent of Newmont, its affiliates, or contractors of it or its affiliates, or other individuals) recorded in any format, which is obtained by Contractor in connection with this Agreement and that identifies or could identify an individual personally, either by itself or together with other information, including demographic information to TeamDynamix prior to such as name, sex, age and contact information, financial information such as taxpayer identification numbers and bank account information, and health information such as medical records and insurance claims. Contractor shall, for as long as it has possession of any Personal Data or other Confidential Information (collectively, Sensitive Information”) on Contractor’s information technology systems, , maintain reasonable security procedures and practices that are bothdate.

Confidentiality Data Security. A. Supplier shall not disclose a. Each Party acknowledges that it and its employees or agents, in the course of the projects and services contemplated by this Agreement, may be exposed to third parties, or use for purposes other than performing its obligations hereunder, any Data, Inventions, or any other acquire information that relates is proprietary or confidential to the technical, legal, or business affairs or activities of Newmont or its affiliates which was obtained by or on behalf of Supplier in connection with the performance of the Services other Party (collectively, “Confidential Information”), without the prior written consent of Newmont. Each Party agrees to hold Confidential Information shall of the other Party in strict confidence and not include to use such Confidential Information or discuss or disclose such Confidential Information to any third party. The Parties agree that Confidential Information does not include: (i) information which: (1) which at the time of disclosure is, or shall have beenwithout fault of the recipient becomes, generally available; (ii) information which either Party can show was in its possession at the possession time of Supplier disclosure or was independently developed by it; (iii) information received from a third party which had the right to transmit same without violation of any confidentiality agreement with the other party; and (iv) information which is required to be disclosed pursuant to court order or by law. The per-User pricing provided under this Agreement is Confidential Information. b. TeamDynamix will implement reasonable and appropriate measures for the TeamDynamix Applications (as determined by TeamDynamix) (the “Security Standards”) designed to help Client secure Client content against accidental or unlawful loss, access, or disclosure (the “Security Objectives”) in accordance with the TeamDynamix Security Standards. TeamDynamix may modify the TeamDynamix Security Standards from time to time but will continue to provide at least the same level of security as is in place on the Effective Date. c. TeamDynamix will not subject access or use Client content except as necessary to maintain or provide the services under this Agreement, or as necessary to comply with the law or a confidentiality obligation binding order of a governmental body. TeamDynamix will not (i) disclose Client content to any government or third party, or (ii) move Client content from the TeamDynamix servers; except in each case as necessary to comply with the law or a binding order of a governmental body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, TeamDynamix will give Client reasonable notice of any legal requirement or order referred to in this Section 8(c), to allow Client to seek a protective order or other appropriate remedy. TeamDynamix will only use personal information and billing information in accordance with its privacy policy (available at xxxxx://xxx.xxxxxxxxxxx.xxx/privacy-policy-terms), and Client consents to such usage. TeamDynamix will not collect or use any personal information prior to Supplier’s acquisition thereof in connection with the performance of the Services; (2) through no act or omission of Supplier, becomes published or otherwise available to the public under circumstances such that the public may utilize the same without any direct or indirect confidentiality obligation to Newmont or its affiliates; or (3) is acquired by Supplier from any third party rightfully in possession of the same and having no direct or indirect confidentiality obligation to Newmont or its affiliates with respect to the same; provided, however, that the foregoing exceptions shall not apply with respect to Confidential Information which meets the definition of Personal Data (as set forth in Section 5.B., below), which is more specifically addressed in Section 5.B., below. All Confidential Information shall be delivered to Newmont or destroyed by Supplier, at Newmont’s discretion, upon the termination or expiration of this Agreement or at any earlier time upon Newmont’s request. Supplier shall not retain any copies of Confidential Information without Newmont’s express written authorization. Notwithstanding the foregoing, Supplier may retain one archival hard copy of the Confidential Information for such period of time that Supplier normally retains archival hard copies, and such hard copy shall remain subject to this Section 5.A. until it is destroyed. In addition, if Supplier’s computer system automatically retains back-up copies of Confidential Information, Supplier may retain such copies in Supplier’s archival computer storage for the period of time that Supplier normally archives backed-up computer records, and such computer copies shall remain subject to this Section 5.A. until they are destroyed or erased. Supplier acknowledges that the Confidential Information is an important asset of Newmont and/or its affiliates and that there is not an adequate remedy at law for a breach by Supplier of this Section 5.A. and Newmont and/or its affiliates will suffer irreparable harm as a result of such a breach. Therefore, Supplier agrees that Newmont and/or its affiliates shall be entitled to equitable relief, including temporary and permanent injunctive relief without the obligation of posting a bond (cash or otherwise), in the event of actual or threatened unauthorized disclosure or use of Confidential Information in breach of this Section 5.A. B. For purposes effective date of this Agreement, “Personal Data” means and Client will not submit or otherwise make available any personal information regarding any individual (whether an employee or agent of Newmont, its affiliates, or contractors of it or its affiliates, or other individuals) recorded in any format, which is obtained by Contractor in connection with this Agreement and that identifies or could identify an individual personally, either by itself or together with other information, including demographic information to TeamDynamix prior to such as name, sex, age and contact information, financial information such as taxpayer identification numbers and bank account information, and health information such as medical records and insurance claims. Contractor shall, for as long as it has possession of any Personal Data or other Confidential Information (collectively, Sensitive Information”) on Contractor’s information technology systems, , maintain reasonable security procedures and practices that are bothdate.