Common use of Cybersecurity; Data Protection Clause in Contracts

Cybersecurity; Data Protection. The Company and its Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The To the best knowledge of the Company, the Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, and, to the best knowledge of the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable information technology, information security, cyber security and data protection controls, policies, procedures, and safeguards, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of, and to prevent the breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation, modification or other misuse of (“Breach”), all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data and all data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company or its subsidiaries (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, there . There have been no breachesBreaches, violations, outages or unauthorized uses of or accesses to sameany IT Systems and Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to any such IT Systems and Personal Data. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized useany Breach (“Privacy Laws”). Neither the Company nor any of its subsidiaries has received notice of any actual or potential liability under or relating to, accessor actual or potential violation of, misappropriation or modificationany Privacy Laws.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been (i) no breaches, violations, outages or unauthorized uses of or accesses to the same, except for those that have been remedied without material cost or liability or the duty to notify any other person, and (ii) no incidents under internal review or investigations relating to the same, except where such breach, violation, outage, unauthorized use or access, or incidents under internal review or investigation relating to the same, would not be reasonably expected to have, individually or in the aggregate, a Material Adverse Effect. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company and its subsidiaries, and all internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and Company, its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company (A) Except as disclosed in the Registration Statement, the General Disclosure Package and the Prospectus, there has been no actual or reasonably suspected security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company’s or its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, computer systems, networks, hardware, software, websitesSensitive Data, applicationsdata and databases (including the data and information of their respective customers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries, and databases any such data processed or stored by third parties on behalf of the Company and its subsidiaries), equipment or technology, including any such equipment or technology maintained or provided by any third parties to Company or its subsidiaries (collectively, “IT SystemsSystems and Data”); (B) are adequate forneither the Company nor its subsidiaries have been notified of, and operate and perform each of them have no knowledge of any fact, event or condition that could result in, any security breach or incident, unauthorized access or disclosure or other compromise to their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate Data; and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iiiC) the Company and its Controlled Entities subsidiaries have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable all appropriate controls, policies, procedures, and technological safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all their IT Systems and data (Data, including all personal, personally identifiable, sensitive, confidential as is customary under applicable regulatory or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to sameindustry standards. The Company and its Controlled Entities are presently in material compliance subsidiaries comply and have at all times complied with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, Policies, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unlawful or unauthorized use, access, destruction, loss, alteration, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, and, to the best knowledge of the Company’s knowledge, are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, household, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses. Without limiting the foregoing, andthe Company and its subsidiaries have used reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the best operation of the Company’s knowledge, and its subsidiaries’ businesses (“Breach”) and there have has been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Breach. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes subsidiaries have not been notified of and all judgments, orders, rules and regulations have no knowledge of any court event or arbitrator or governmental or regulatory authoritycondition that would reasonably be expected to result in, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of any such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are in the Company’s reasonable belief adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without, or would not reasonably be expected to result in, material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. To the extent applicable to the operations of the Company and its subsidiaries, the Company and its subsidiaries are in material compliance with the European Union General Data Protection Regulation (and all other laws and regulations applicable to the operations of the Company and its subsidiaries with respect to Personal Data, and for which any non-compliance with the same would be reasonably likely to create a material liability).

Cybersecurity; Data Protection. The Company Each Sunnova Entity and its Controlled Entitiesrespective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company Sunnova Entity and its Controlled Entities respective subsidiaries as currently conducted, to . To the best knowledge of the Company’s knowledgeSunnova Entities, the IT Systems are free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptantscorruptants designed to permit unauthorized access or activity. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access Each Sunnova Entity and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best knowledge of the Company’s knowledgeeach Sunnova Entity, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to such IT Systems or Personal Data. The Company Each Sunnova Entity and its Controlled Entities respective subsidiaries are presently in material compliance with all applicable laws or statutes applicable to the Sunnova Entity and its respective subsidiaries and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Sunnova Entity and its respective subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled EntitiesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities Subsidiaries as currently conductedconducted and, to the best Knowledge of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages outages, interruptions, or unauthorized uses of or accesses to samethe Company’s or its subsidiaries’ IT Systems or any Personal Data held by the Company or any of its Subsidiaries in the last six (6) years except for those that have been remediated without material cost or liability. The Company and its Controlled Entities Subsidiaries are presently in material compliance with all applicable laws Laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. Neither the Company nor any of its subsidiaries has received any notification or allegation from any competent authority (including any information or enforcement notice, or any transfer prohibition notice) alleging that the Company or any of its Subsidiaries has not complied in any respect with any applicable Laws, statutes, rules or regulations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conductedconducted and, to the best of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in subsidiaries have, at all material respectstimes, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data (collectively, the “Personal Confidential Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, safeguards and safeguards backup and disaster recovery technology processes to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and the collection, use, storage, disclosure, processing or data security of Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. As of the date hereof, no claims have been asserted or threatened against the Company or any of its subsidiaries alleging a violation of laws, regulation or policies relating to Personal Data.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ respective information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third-party data maintained by or on behalf of the Company or any of its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted and as proposed to be conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company corruptants (collectively, “Bugs”), except where such Bugs would not, individually or in the aggregate, reasonably believes that (i) the Company, its Controlled Entities each own or be expected to have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standardsMaterial Adverse Effect. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards as are generally maintained by similarly situated companies (and which are consistent with industry standard practices) and which the Company and its subsidiaries believe are reasonably adequate to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses. Without limiting the foregoing, andthe Company and its subsidiaries have used commercially reasonable efforts to establish and maintain, and have established, maintained, implemented and complied with, reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans as are generally maintained by similarly situated companies (and which are consistent with industry standard practices) that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any IT System or Data used in connection with the best operation of the Company’s knowledgeand its subsidiaries’ respective businesses (“Breach”). To the knowledge of the Company, there have has been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Breach. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes subsidiaries have not been notified of, and all judgments, orders, rules and regulations have no knowledge of any court event or arbitrator or governmental or regulatory authoritycondition that would reasonably be expected to result in, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of any such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. The Company and its the Controlled Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its the Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) and the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Except as otherwise described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its the Controlled Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Teekay Entities’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Teekay Entities as currently conducted, and to the best of the Company’s knowledge, and the Guarantors’ knowledge are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Teekay Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Controlled Teekay Entities are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. The Teekay Entities have taken all necessary actions to prepare to comply with the European Union General Data Protection Regulation.

Cybersecurity; Data Protection. The Company Except as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and its Controlled Entities’ the Prospectus or as would not have a Material Adverse Effect, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its Controlled Entities their respective subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access Carnival plc and use its their respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except as may be described or incorporated by reference in the Registration Statement, the Pricing Disclosure Package and the Prospectus or those that have been or will be remedied without material cost or liability or the duty to notify any other person. The Company Company, Carnival plc and its Controlled Entities their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationData.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data and information of their respective users, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards safeguards, including commercially reasonable disaster recovery and security plans, procedures and facilities for their respective businesses, including, without limitation, for their IT Systems and data held or used by or for the Company or any of its subsidiaries, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses access to samesuch IT Systems and data, including Personal Data. The Company and its Controlled Entities subsidiaries are presently presently, and since their inception have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, “Privacy Obligations”). To ensure compliance with the Privacy Obligations, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). To the Company’s knowledge, it has at all times made all disclosures to users, employees or other applicable persons required by Privacy Obligations, and no such disclosures made or contained in any external written Policies have been materially inaccurate or in violation of any Privacy Obligations. The Company and its subsidiaries (i) have not received written notice of or complaint regarding or indicating non-compliance with, or any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Obligations, and there has not been any event or condition that would reasonably be expected to result in any such notice; (ii) are not currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Obligations; and (iii) are not party to any governmental order, decree, or agreement that imposes any obligation or liability under any Privacy Obligations. The Company and its subsidiaries have taken all necessary actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any noncompliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, and, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its Controlled Entities subsidiaries have implemented backup and disaster recovery technology consistent with industry standards and practices. The Company and its subsidiaries are presently presently, and for the past three (3) years have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, “Data Protection Requirements”), except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Data Protection Requirements, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of any Data Protection Requirements or Policies. To the Company’s knowledge, the Company and its subsidiaries have at all times made all material disclosures to users or customers required by applicable laws and regulatory rules or requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any regulatory body or governmental authority under any Data Protection Requirement.

Cybersecurity; Data Protection. The Company Company, the Guarantors and its Controlled Entitiestheir respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate forfor the business of the Company, the Guarantors and their respective subsidiaries as currently conducted, and (ii) to the knowledge of the Company and the Guarantors, operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company Company, the Guarantors and its Controlled Entities their respective subsidiaries as currently conducted, to the best of the Company’s knowledge, conducted free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access the Guarantors and use its their respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or, the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company Company, the Guarantors and its Controlled Entities their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to the Representative or to counsel for the Initial Purchasers shall be deemed to be a representation and warranty by the Company to each Initial Purchaser as to the matters set forth therein.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data and information of their respective users, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards safeguards, including commercially reasonable disaster recovery and security plans, procedures and facilities for their respective businesses, including, without limitation, for their IT Systems and data held or used by or for the Company or any of its subsidiaries, to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses access to samesuch IT Systems and data, including Personal Data. The Company and its Controlled Entities subsidiaries are presently presently, and since their inception have been, in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively, “Privacy Obligations”). To ensure compliance with the Privacy Obligations, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). To the Company’s knowledge, it has at all times made all disclosures to users, employees or other applicable persons required by Privacy Obligations, and no such disclosures made or contained in any external written Policies have been materially inaccurate or in violation of any Privacy Obligations. The Company and its subsidiaries (i) have not received written notice of or complaint regarding or indicating non-compliance with, or any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Obligations, and there has not been any event or condition that would reasonably be expected to result in any such notice; (ii) are not currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Obligations; and (iii) are not party to any governmental order, decree, or agreement that imposes any obligation or liability under any Privacy Obligations. The Company and its subsidiaries have taken all commercially reasonable actions to prepare to comply with all other applicable laws and regulations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any noncompliance with same would create a material liability, as soon they take effect.

Cybersecurity; Data Protection. The Company Company, the Guarantors and its Controlled Entitiestheir respective subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) (i) are adequate forfor the business of the Company, the Guarantors and their respective subsidiaries as currently conducted, and (ii) to the knowledge of the Company and the Guarantors, operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company Company, the Guarantors and its Controlled Entities their respective subsidiaries as currently conducted, to the best of the Company’s knowledge, conducted free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access the Guarantors and use its their respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or, other than with respect to Aerogrow International, Inc., the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company Company, the Guarantors and its Controlled Entities their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. Any certificate signed by an officer of the Company and delivered to the Representative or to counsel for the Initial Purchasers shall be deemed to be a representation and warranty by the Company to each Initial Purchaser as to the matters set forth therein.

Cybersecurity; Data Protection. The Company and its Controlled EntitiesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities Subsidiaries as currently conducted, to . To the best knowledge of the Company’s knowledge, the IT Systems are free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own corruptants designed to permit unauthorized access or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standardsactivity. The Company and its Controlled Entities Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to samesuch IT Systems or Personal Data, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to such IT Systems or Personal Data. The Company and its Controlled Entities Subsidiaries are presently in material compliance with all applicable laws or statutes applicable to the Company or its Subsidiaries and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entitiesthe Significant Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities the Significant Subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) and the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities Significant Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Except as otherwise described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its Controlled Entities the Significant Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled EntitiesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities Subsidiaries as currently conductedconducted and, to the best Knowledge of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages outages, interruptions, or unauthorized uses of or accesses to samethe Company’s or its Subsidiaries’ IT Systems or any Personal Data held by the Company or any of its Subsidiaries in the last three years except for those that have been remediated without material cost or liability. The Company and its Controlled Entities Subsidiaries are presently in material compliance with all applicable laws Laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification. Neither the Company nor any of its Subsidiaries has received any notification or allegation from any competent authority (including any information or enforcement notice, or any transfer prohibition notice) alleging that the Company or any of its Subsidiaries has not complied in any respect with any applicable Laws, statutes, rules or regulations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conductedconducted and, to the best of the Company’s knowledge, based on commercially reasonable security and monitoring, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in subsidiaries have, at all material respectstimes, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, personal data and sensitive, confidential or regulated data (collectively, the “Personal Confidential Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, based on commercially reasonable security and monitoring, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same and except as would not individually or in the aggregate have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Confidential Data and to the protection of such IT Systems and Personal Confidential Data from unauthorized use, access, misappropriation or modification, except where failure to do so would not reasonably be expected to have a Material Adverse Effect on the Company and its subsidiaries, taken as a whole. Any certificate signed by any officer of the Company and delivered to any Underwriter or to counsel for the Underwriters in connection with the offering, or the purchase and sale, of the Offered Shares shall be deemed a representation and warranty by the Company to each Underwriter as to the matters covered thereby. The Company has a reasonable basis for making each of the representations set forth in this Section 1. The Company acknowledges that the Underwriters and, for purposes of the opinions to be delivered pursuant to Section 6 hereof, counsels to the Company and counsel to the Underwriters, will rely upon the accuracy and truthfulness of the foregoing representations and hereby consents to such reliance.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Controlled Entities subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationmodification (collectively “Privacy Obligations”), and no disclosures in any publicly posted privacy policy of the Company or any of its subsidiaries has been materially inaccurate, misleading or deceptive (including by containing any material omission). Neither the Company nor any of its subsidiaries has received any complaint alleging that it has improperly collected, received, created, processed, stored, maintained, used, disclosed, transmitted, secured, transferred, disposed of or destroyed or has received any notice or other communication from any governmental or regulatory authority or self-regulatory body regarding any actual or possible violation of, investigation (formal or informal) or failure to comply with any applicable Privacy Obligation. The Company and its subsidiaries have taken all actions it reasonably believes necessary to prepare to comply with all other applicable Privacy Obligations with respect to Personal Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) as soon they take effect.

Cybersecurity; Data Protection. The Company Except as may be described in the Registration Statement, the Pricing Disclosure Package and its Controlled Entities’ the Prospectus or as would not have a Material Adverse Effect, the information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases owned or controlled by, or operated on behalf of, the Company, Carnival plc and their respective subsidiaries (collectively, the “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company Company, Carnival plc and its Controlled Entities their respective subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access Carnival plc and use its their respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data in their possession or control (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best of the Company’s knowledge, and there have been no breaches, violations, outages or unauthorized uses of or accesses to same, nor incidents under internal review or investigation, in each case, except for those that have been remedied without material cost or liability or the duty to notify any other person. The Company Company, Carnival plc and its Controlled Entities their respective subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies authority and contractual obligations relating to the privacy privacy, security and security protection of the IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationData.

Cybersecurity; Data Protection. The (A) There has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, technology, data and databases (including the data and information of their respective customers, employees, suppliers, vendors and any third party data maintained, processed or stored by the Company and its subsidiaries, Sensitive Data (defined below) and any such data processed or stored by third parties on behalf of the Company and its subsidiaries) collectively, “IT SystemsSystems and Data”); (B) The IT Systems and Data are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities the subsidiaries as currently conducted, to the best of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that ; and (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iiiC) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable appropriate controls, policies, procedures, and administrative, technical, and physical safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data Data (including all personal, personally identifiablePersonal Data, sensitive, confidential or regulated data (“Personal Sensitive Data”)) collected reasonably consistent with industry standards and practices or processed as required by the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to sameapplicable regulatory standards. The Company and its Controlled Entities subsidiaries have been and are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (including the data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of the Company and its subsidiaries) (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, subsidiaries and to the best knowledge of the Company’s knowledge, Company are free and clear of all material bugs, errors, errors ,defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards necessary to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses. Without limiting the foregoing, andthe Company and its subsidiaries have used reasonable efforts to establish, maintain, implement and comply with reasonable information technology, information security, cyber security and data protection controls, policies and procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the best operation of the Company’s knowledge, and its subsidiaries’ businesses (“Breach”) and there have has been no breaches, violations, outages or unauthorized uses of or accesses to samesuch Breach. The Company and its Controlled Entities are presently in material compliance with all applicable laws or statutes subsidiaries have not been notified of and all judgments, orders, rules and regulations have no knowledge of any court event or arbitrator or governmental or regulatory authoritycondition that would reasonably be expected to result in, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of any such IT Systems and Personal Data from unauthorized use, access, misappropriation or modificationBreach.

Cybersecurity; Data Protection. The Company and (A) (i) There has been no security breach, improper use, loss, access, disclosure, interruption, modification, corruption (including ransomware attacks) or other compromise of or relating to (collectively, a “Security Breach”) any of the Company’s or its Controlled Entitiessubsidiaries’ information technology assets and equipment, computers, computer systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all the personal, personally identifiable, sensitive, confidential or regulated information or other data of their respective customers, employees, suppliers, vendors and any third party data maintained by or on behalf of them), equipment or technology (collectively, “Personal IT Systems and Data”)) collected or processed by and (ii) the Company or the Controlled Entities in connection with their businesses, and, to the best of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The Company and its Controlled Entities are presently in material compliance subsidiaries have not been notified of, and have no knowledge of any event that would reasonably be expected to result in, any Security Breach and (B) the Company and its subsidiaries have complied with all applicable laws or and statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies policies, current and former public-facing privacy policies, and contractual obligations relating to privacy, data protection, breach notification, processing of personal information or the privacy security of the IT Systems and Data (“Privacy and Data Security Requirements”), except in such case in (A)(i) and (ii) and (B) as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have taken reasonable and appropriate actions, consistent with applicable industry standards (including implementing and monitoring compliance with administrative, technical and physical safeguards, policies, procedures and security measures that conform with all Privacy and Data Security Requirements) to protect the operation, confidentiality, integrity and security of the IT Systems and Personal Data (and to the protection of such IT Systems all data and Personal Data from information and transactions stored or contained therein or transmitted thereby, including personal information) against any unauthorized or improper use, loss, access, misappropriation disclosure, interruption, modification or modificationcorruption. The Company and its subsidiaries have implemented backup and disaster recovery technology reasonably adequate for their businesses and consistent with industry standards and practices. No actions have been asserted or, to the knowledge of the Company or its subsidiaries, threatened against, and no written notices or claims (including any communication from any governmental authority) have been received by, the Company or its subsidiaries (nor, to the knowledge of the Company or its subsidiaries, by any third parties processing personal information on their behalf) alleging a violation of any Privacy and Data Security Requirements.

Cybersecurity; Data Protection. The Company and its Controlled Entities’ Company’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, applications and databases owned or controlled by the Company (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality in all material respects as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, in each case, to the best knowledge of the Company’s knowledge, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Companyhas implemented, its Controlled Entities each own or have a valid right to access maintained and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent complied with applicable regulatory standards. The Company and its Controlled Entities have implemented and maintained commercially reasonable information technology, information security, cybersecurity and data protection controls, policies, procedures, and safeguards designed to maintain and protect their its material confidential information and the integrity, continuous operation, redundancy and security of all the IT Systems and data (including all personal, personally identifiable, sensitive, confidential information, or regulated data trade secrets (collectively, “Personal Sensitive Data”)) collected collected, used, stored or processed by by, or to the knowledge of the Company, on behalf of the Company or the Controlled Entities in connection with their businessesits business, and, to the best knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to sameany IT Systems and Sensitive Data, except for those that have been remedied without material cost or liability. The Company and its Controlled Entities are is presently in compliance, in all material compliance respects, with all applicable laws or statutes statutes, including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, the California Consumer Privacy Act and the European Union General Data Protection Regulation and all other applicable judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and external policies, and contractual obligations of the Company relating to the privacy and security of its IT Systems and Personal the collection, use, transfer, import, export, storage, disposal and disclosure of Sensitive Data and to the protection of such IT Systems and Personal Sensitive Data from unauthorized use, access, misappropriation or modificationmodification (“Data Security Obligations”). The Company (i) has not received any notification of or complaint regarding any actual or potential liability under or relating to, or actual or potential violation of any Data Security Obligation and has no knowledge of any event or condition that would reasonably be expected to result in any such notice, (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action pursuant to any Data Security Obligation, (iii) is not a party to any order, decree, or agreement that imposed any obligation or liability under any Data Security Obligation or (iv) is not subject to any pending or, to the knowledge of the Company, threatened action, suit, investigation or proceeding by or before any court or government agency, or body alleging non-compliance with any Data Security Obligation by the Company. The Company has made all disclosures as required by applicable laws and regulatory rules and requirements. The Company has taken all necessary actions to comply with all applicable laws and regulations with respect to Sensitive Data that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability, as soon they take effect.

Cybersecurity; Data Protection. The Except as has not had or could not reasonably be expected to have, individually or in the aggregate, a Material Adverse Effect, (i) the Company and its Controlled EntitiesSubsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in connection with the operation of the business of the Company and its Controlled Entities as currently conducted, to the best of the Company’s knowledge, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform material respects as required in connection with, the operation of the business of the Company and its Controlled Entities Subsidiaries as currently conducted in and (ii) to the knowledge of the Company, the IT Systems are free and clear of all material respectsbugs, (iii) the Company errors, defects, Trojan horses, time bombs, malware and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standardsother corruptants designed to permit unauthorized access or activity. The Company and its Controlled Entities Subsidiaries have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data (“Personal Data”)) collected or processed by the Company or the Controlled Entities used in connection with their businesses, and, to the best knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same. The such IT Systems or Personal Data, except for those that have been remedied without material cost to or liability of the Company and its Controlled Entities Subsidiaries or the duty of the Company or any of its Subsidiaries to notify any other person, nor are there any incidents under internal review or investigations relating to such IT Systems or Personal Data and the Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authorityauthority having jurisdiction over the Company or its Subsidiaries, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

Cybersecurity; Data Protection. The Company and its Controlled Entities’ subsidiary’s information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform their core functionality as required in all material respects in connection with the operation of the business of the Company and its Controlled Entities subsidiary as currently conducted, to . To the best knowledge of the Company’s knowledge, the IT Systems are free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company reasonably believes that (i) the Company, its Controlled Entities each own or have a valid right to access and use its respective IT Systems; (ii) the IT Systems are adequate for, and operate and perform as required in connection with, the operation of the business of the Company and its Controlled Entities as currently conducted in all material respects, (iii) the Company and its Controlled Entities have implemented reasonable backup, security and disaster recovery technology consistent with applicable regulatory standards. The Company and its Controlled Entities subsidiary have implemented and maintained commercially reasonable controls, policies, procedures, and safeguards designed to maintain and protect their material confidential information and the integrity, continuous operation, redundancy operation and security of all IT Systems and data (including all personal, personally identifiable, sensitive, confidential or regulated data and trade secrets (“Personal Protected Data”)) collected used by or processed by on behalf of the Company or the Controlled Entities its subsidiary in connection with their businesses, and, and to the best knowledge of the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that individually or in the aggregate would not be expected to have a Material Adverse Effect or as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus. The Except as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its Controlled Entities subsidiary are presently in material compliance with all applicable laws or statutes (including the European Union General Data Protection Regulation) and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and contractual obligations relating to the privacy and security of IT Systems and Personal Protected Data and to the protection of such IT Systems and Personal Protected Data from unauthorized use, access, misappropriation or modification.