Security and Access The Executive agrees and covenants (a) to comply with all Company security policies and procedures as in force from time to time including without limitation those regarding computer equipment, telephone systems, voicemail systems, facilities access, monitoring, key cards, access codes, Company intranet, internet, social media and instant messaging systems, computer systems, e-mail systems, computer networks, document storage systems, software, data security, encryption, firewalls, passwords and any and all other Company facilities, IT resources and communication technologies (“Facilities Information Technology and Access Resources”); (b) not to access or use any Facilities and Information Technology Resources except as authorized by the Company; and (iii) not to access or use any Facilities and Information Technology Resources in any manner after the termination of the Executive’s employment by the Company, whether termination is voluntary or involuntary. The Executive agrees to notify the Company promptly in the event he learns of any violation of the foregoing by others, or of any other misappropriation or unauthorized access, use, reproduction or reverse engineering of, or tampering with any Facilities and Information Technology Access Resources or other Company property or materials by others.
Information and Access (a) The Company and Parent each shall (and shall cause its Subsidiaries to, and shall use its commercially reasonable efforts to cause, its and their respective Representatives to), upon the reasonable request by the other, furnish to the other, as promptly as practicable, with all information concerning itself, its Representatives and such other matters as may be necessary or advisable in connection with the Schedule 14D-9 or Schedule TO (including with respect to Parent, information concerning the Investors) and any information or documentation to effect the expiration of all waiting periods under applicable Antitrust Laws and all filings, notices, reports, consents, registrations, approvals, permits and authorizations, made or sought by or on behalf of Parent, the Company or any of their respective Affiliates to or from any third party, including any Governmental Entity, in each case necessary or advisable in connection with the Transactions and, with respect to the information supplied in writing by or on behalf of Parent, its Affiliates or its or their respective Representatives for inclusion in or incorporation by reference into the Schedule 14D-9, including with respect to the Investors. Each of Parent and the Company acknowledges and agrees that such information supplied by it pursuant to this Section 7.8(a) (as applicable) will be correct and complete in all material respects at the time so supplied.
(b) In addition to and without limiting the rights and obligations set forth in Section 7.8(a), the Company shall (and shall cause its Subsidiaries to), upon reasonable prior notice, afford Parent and its Representatives reasonable access, during normal business hours, from the date of this Agreement and continuing until the earlier of the Effective Time and the termination of this Agreement pursuant to Article IX, to the Company Employees, agents, properties, offices and other facilities, Contracts, books and records, and, during such period, the Company shall (and shall cause its Subsidiaries to) furnish promptly to Parent all other information and documents concerning or regarding its businesses, properties and assets and personnel as may reasonably be requested by or on behalf of Parent; provided, however, that, subject to compliance with the obligations set forth in Section 7.8(c): (i) neither the Company nor any of its Subsidiaries shall be required to provide such access or furnish such information or documents to the extent doing so would, in the reasonable opinion of the Company’s outside legal counsel result in (A) a violation of applicable Law, (B) the breach of any contractual confidentiality obligations in any Contract with a third party entered into prior to the date of this Agreement or following the date of this Agreement in compliance with Section 7.1 and Section 7.2; (C) waive the protection of any attorney-client privilege or protection (including attorney-client privilege, attorney work-product protections and confidentiality protections) or any other applicable privilege or protection concerning pending or threatened Proceedings, in any material respect; or (D) such information or documents are reasonably pertinent to any adverse Proceeding between the Company and its Affiliates, on the one hand, and Parent and its Affiliates, on the other hand (subject to any rules or guidelines of discovery applicable to such adverse Proceeding); and (ii) in no event shall the work papers of the Company’s and its Subsidiaries’ independent accountants and auditors be accessible to Parent or any of its Representative unless and until such accountants and auditors have provided a consent related thereto in form and substance reasonably acceptable to such auditors or independent accountants. Any investigation conducted pursuant to the access contemplated by this Section 7.8(b) will be conducted in a manner that does not unreasonably interfere with the conduct of the business of the Company and its Subsidiaries and that would not reasonably be expected to create a risk of damage or destruction to any property or assets of the Company or its Subsidiaries. Any access to the properties of the Company and its Subsidiaries shall be subject to the Company’s reasonable security measures and insurance requirements and shall not include the right to perform any “invasive” testing or soil, air or groundwater sampling, including any Phase II environmental assessments. All requests for such access or information made pursuant to this Section 7.8(b) shall be initially directed to the Person set forth on Section 7.8(b) of the Company Disclosure Schedule, which Person may be replaced by the Company at any time by providing written notice to Parent, and any access granted in connection with a request made pursuant to this Section 7.8(b) shall be supervised by such Persons.
(c) In the event that the Company objects to any request submitted pursuant to Section 7.8(b) on the basis of one or more of the matters set forth in clause (i) of Section 7.8(b), it must do so by providing Parent, in reasonable detail, the nature of what is being prevented and/or withheld and the reasons and reasonable support therefor, and prior to preventing such access or withholding such information or documents from Parent and its Representatives, the Company shall cooperate with Parent to make appropriate substitute arrangements to permit reasonable disclosure that does not suffer from any of the impediments expressly set forth in clause (i) of Section 7.8(b) (other than clause (D)) including through the use of commercially reasonable efforts to take such actions and implement appropriate and mutually agreeable measures to as promptly as practicable permit such access and the furnishing of such information and documents in a manner to remove the basis for the objection, including by arrangement of appropriate “counsel-to-counsel” disclosure, clean room procedures, redaction and other customary procedures, entry into a customary joint defense agreement and, with respect to the contractual confidentiality obligations contemplated by clause (i)(B) of Section 7.8(b), obtaining a waiver with respect to or consent under such contractual confidentiality obligations.
(d) Without limiting the generality of the other provisions of this Section 7.8, the Company and Parent, as each deems advisable and necessary, after consultation with their respective outside legal counsel, may reasonably designate competitively sensitive information and documents (including those that relate to valuation of the Company or Parent (as the case may be)) as “Outside Counsel Only Information.” Such information and documents shall only be provided to the outside legal counsel of the Company or Parent (as the case may be), or subject to such other similar restrictions mutually agreed to by the Company and Parent, and subject to any amendment, supplement or other modification to the Confidentiality Agreement or additional confidentiality or joint defense agreement between or among the Company and Parent; provided, however, that, subject to any applicable Laws relating to the exchange of information, the outside legal counsel receiving such information and documents may prepare one or more reports summarizing the results of any analysis of any such shared information and documents, and disclose such reports, other summaries or aggregated information derived from such shared information and documents to Representatives of such outside legal counsel’s client.
(e) No access or information provided to Parent or any of its Representatives or to the Company or any of its Representatives following the date of this Agreement, whether pursuant to this Section 7.8 or otherwise, shall affect or be deemed to affect, modify or waive the representations and warranties of the Parties set forth in this Agreement and, for the avoidance of doubt, all information and documents disclosed or otherwise made available pursuant to Section 7.5, Section 7.6, this Section 7.8 or otherwise in connection with this Agreement and the Transactions shall be governed by the terms and conditions of the Confidentiality Agreement mutatis mutandis as if Parent were Counterparty (as defined in the Confidentiality Agreement) and subject to applicable Laws relating to the exchange or sharing of information and any restrictions or requirements imposed by any Governmental Entity; provided, that, in the event of a conflict, the provisions of Section 7.13 shall override any conflicting provisions of the Confidentiality Agreement, and any Person who is a potential source of, or may provide, equity, debt or any other type of financing to Parent or any of its Representatives in connection with the Transactions shall be deemed a “Representative” for purposes of the Confidentiality Agreement without the prior written consent of the Company.
Data Security and Privacy (a) Each Group Member is, and at all times, has been, in compliance in all material respects with (i) all applicable Data Protection Laws, including, to the extent applicable, but not limited to the GDPR and those relating to cross-border transfers; (ii) all applicable contractual obligations of each Loan Party and its Subsidiaries concerning data privacy and security relating to Personal Data in the possession or control of any Group Member or maintained by third parties on behalf of such Group Member and having access to such information under contracts (or portions thereof) to which a Group Member is a party; and (iii) all applicable data transfer agreements and data processing agreements, including the EU standard contractual clauses, to which a Group Member is a party (collectively, “Privacy Agreements”):
(b) Each Group Member is, and has been, in compliance in all material respects with all applicable prior and current written internal and public-facing privacy policies and notices of the Group Members regarding the collection, retention, use, processing, disclosure and distribution of Personal Data by the Group Members or their respective agents (collectively, the “Privacy Policies”), and the Privacy Policies have been maintained to be consistent in all material respects with the actual practices of each Group Member. The Privacy Policies contemplate the Group Members’ current uses of the Personal Data, and to the extent required under applicable Data Protection Laws, each Group Member has sought and obtained the appropriate consent from the applicable data subject for such uses. The Privacy Policies have made all material disclosures to users, customers, employees, or other individuals required by Data Protection Laws.
(c) Each Group Member has implemented and maintains a commercially reasonable security program (“Security Program”) that (i) complies in all material respects with all applicable Data Protection Laws, applicable Privacy Policies, and applicable Privacy Agreements, and (ii) includes commercially reasonable administrative, technical, organization, and physical security procedures and measures designed to preserve the security and integrity of all Personal Data and any other sensitive or confidential information or data related to each Group Member (collectively, “Company Sensitive Information”) in such Group Member’s possession or control and to protect such Company Sensitive Information against unauthorized or unlawful processing, access, acquisition, use, theft, interruption, modification, disclosure, loss, destruction or damage.
(d) Except as disclosed on Schedule 4.23(d), there has been (i) no actual, suspected or alleged (in writing) incidents of unauthorized access, use, intrusion, disclosure or breach of the security of any information technology systems owned or controlled by a Group Member or any of their contractors and used by such contractors on behalf of a Group Member, and (ii) no actual, suspected or alleged (in writing) incidents of unauthorized acquisition, destruction, damage, disclosure, loss, corruption, alteration, or use of any Company Sensitive Information, in each case that could reasonably be expected to cause a Material Adverse Effect.
(e) Each Group Member has a valid and legal right (whether contractually, by applicable law or otherwise) to access or use all Personal Data that is accessed and used by or on behalf of a Group Member in connection with the sale, use and/or operation of their products, services and businesses.
(f) Except as would not reasonably be expected to have a Material Adverse Effect, there is no pending or to the knowledge of any Loan Party, threatened in writing, complaints, claims, demands, inquiries, proceedings, or other notices, including any notices of any investigation or other legal proceedings, regarding a Group Member, initiated by (i) any Governmental Authority, including the United States Federal Trade Commission, a state attorney general, data protection authority or similar state official, or a supervisory authority; (ii) any counterparty to, or subject of, a Privacy Agreement; or (iii) any self-regulatory authority or entity, alleging that any activity of a Group Member: (1) is in violation of any applicable Data Protection Laws, (2) is in violation of any Privacy Agreements, (3) is in violation of any Privacy Policies or (4) is otherwise in violation of any person’s privacy, personal or confidentiality rights.
Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.
Data Security The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security. The provider shall implement an adequate Cybersecurity Framework based on one of the nationally recognized standards set forth set forth in Exhibit “F”. Exclusions, variations, or exemptions to the identified Cybersecurity Framework must be detailed in an attachment to Exhibit “H”. Additionally, Provider may choose to further detail its security programs and measures that augment or are in addition to the Cybersecurity Framework in Exhibit “F”. Provider shall provide, in the Standard Schedule to the DPA, contact information of an employee who XXX may contact if there are any data security concerns or questions.
Data Security and Privacy Plan As more fully described herein, throughout the term of the Subscription Agreement, Vendor will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data it receives from the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with the terms of the District’s Bill of Rights for Data Security and Privacy, a copy of which is set forth below and has been signed by the Vendor. Additional components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Subscription Agreement are as follows:
(a) Vendor will implement all state, federal, and local data security and privacy requirements including those contained within the Subscription Agreement and this Data Sharing and Confidentiality Agreement, consistent with the District’s data security and privacy policy.
(b) Vendor will have specific administrative, operational and technical safeguards and practices in place to protect Protected Data that it receives from the District under the Subscription Agreement.
(c) Vendor will comply with all obligations contained within the section set forth in this Exhibit below entitled “Supplemental Information about a Subscription Agreement between [Xxxxx-Fultonville Central School District] and [Vendor Name].” Vendor’s obligations described within this section include, but are not limited to:
(i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Subscription Agreement shall apply to the subcontractor, and
(ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Subscription Agreement.
(d) Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, prior to their receiving access.
(e) Vendor will manage data security and privacy incidents that implicate Protected Data and will develop and implement plans to identify breaches and unauthorized disclosures. Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 5 of this Data Sharing and Confidentiality Agreement.
Cooperation and Access The Cooperative Member agrees that it will cooperate in compliance with any reasonable requests for information and/or records made by the Cooperative. The Cooperative reserves the right to audit the relevant records of any Cooperative Member. Any breach of this provision shall be considered material and shall make the Agreement subject to termination on ten (10) days written notice to the Cooperative Member.
Power Supply Information and Access to Information POWER SUPPLY INFORMATION
Limited Access If necessary for the fulfillment of the Agreement, NBU may provide the Professional with non-exclusive, limited access to NBU’s information technology infrastructure. The Professional understands and agrees to abide by NBU policies, standards, regulations and restrictions regarding access and usage of NBU’s information technology infrastructure. The Professional shall reasonably enforce such policies, standards, regulations and restrictions with all the Professional’s employees, agents or any tier of subcontractor granted access in the performance of this Agreement, and shall be granted and authorize only such access as may be necessary for the purpose of fulfilling the requirements of the Agreement. The Professional’s employees, agents and subcontractors must receive prior, written approval from NBU before being granted access to NBU’s information technology infrastructure and data and NBU, in its sole determination, shall determine accessibility and limitations thereto. The Professional agrees that the requirements of this Section shall be incorporated into all subcontractor agreements entered into by the Professional. It is further agreed that a violation of this Section shall be deemed to cause irreparable harm that justifies injunctive relief in court. A violation of this Section may result in immediate termination of this Agreement without notice.
Confidentiality and Data Security (a) The Custodian agrees to keep confidential, and to cause its employees and agents to keep confidential, all records of the Funds and information relating to the Funds, including without limitation information as to their respective shareholders and their respective portfolio holdings, unless the release of such records or information is made (i) in connection with the services provided under this Agreement, (ii) at the written direction of the applicable Fund or otherwise consented to, in writing, by the respective Funds, (iii) in response to a request of a governmental, regulatory or self-regulatory authority or agency or pursuant to a subpoena, court order or other legal process, in each case with respect to which the Custodian has determined, on the advice of counsel, that it is required to comply, or (iv) where the Custodian has determined, on the advice of counsel, that the failure to release such information would expose the Custodian to civil or criminal contempt proceedings; provided in the case of clause (iii) or (iv) the Custodian provides the applicable Fund written notice of such requirement to release such records or information, to the extent such notice is permitted. The foregoing shall not be applicable to any information that is publicly available when provided and shall cease to be applicable to any information that thereafter becomes publicly available, other than through a breach of this Section 10(a), or that is independently derived by any party hereto without the use of any information derived in connection with the services provided under this Agreement. Notwithstanding the foregoing but subject to Section 10(d), (1) the Custodian may use information regarding the Funds in connection with certain functions performed on a centralized basis by the Custodian, its affiliates or its or their service providers (including audit, accounting, risk, legal, compliance, sales, administration, product communication, relationship management, compilation and analysis of customer-related data and storage) and disclose such information to its affiliates and to its or their service providers who are subject to the confidentiality obligations hereunder with respect to such information, but only for the purpose of servicing the Funds in connection with the relationship contemplated by this Agreement or providing additional services to the Funds, and (2) the Custodian may aggregate Fund or Portfolio data with similar data of other customers of the Custodian (“Aggregated Data”) and may use Aggregated Data so long as such Aggregated Data represents such a sufficiently large sample that no Fund or Portfolio data can be identified either directly or by inference or implication.
(b) Each Fund agrees to keep confidential all information obtained hereunder relating to the Custodian’s business (it being understood, however, that the existence and the terms of this Agreement are required to be publicly disclosed by the Funds), unless the release of such records or information is (i) necessary to facilitate the receipt of services provided under this Agreement, (ii) in response to a request of a governmental, regulatory or self-regulatory authority or agency or pursuant to a subpoena, court order or other legal process, in each case with respect to which the Fund has determined, on the advice of counsel, that it is required to comply, or (iii) where the Fund has determined, on the advice of counsel, that the failure to release such information would expose the Fund to civil or criminal contempt proceedings; provided in the case of clause (ii) or (iii) the Fund provides the Custodian written notice of such requirement to release such records or information, to the extent such notice is permitted. The foregoing shall not be applicable to any information that is publicly available when provided and shall cease to be applicable to any information that thereafter becomes publicly available, other than through a breach of this Agreement, or that is independently derived by any party hereto without the use of any information derived in connection with the services provided under this Agreement.
(c) Notwithstanding any provision herein to the contrary, each party hereto agrees that any Nonpublic Personal Information, as defined under Section 248.3(t) of Regulation S-P (“Regulation S-P”), promulgated under the Xxxxx-Xxxxx-Xxxxxx Act (the “GLB Act”), disclosed or otherwise made accessible by a party hereunder is for the specific purpose of permitting the other party to perform its duties as set forth in this Agreement. Each party agrees that, with respect to such information, it will comply with Regulation S-P and the GLB Act and that it will not disclose any Nonpublic Personal Information received in connection with this Agreement to any other party, except to the extent necessary to carry out the services set forth in this Agreement or as otherwise permitted by Regulation S-P or the GLB Act.
(d) Without limiting the generality of Section 10(a) hereof, the Custodian acknowledges and agrees that the Funds are prohibited by law from making selective public disclosure of information regarding portfolio holdings, that disclosure of any and all such information to the Custodian hereunder is made strictly under the conditions of confidentiality set forth in Section 10(a) hereof and solely for the purposes of the performance of custodial services hereunder, that any unauthorized disclosure or misuse of such information (including by the Custodian or any of its employees or agents, or any trading on the basis of such information by anyone in receipt of such information) may constitute a criminal offense of trading on or tipping of material inside information regarding publicly traded securities, that access to any and all such information regarding portfolio holdings of the Funds shall be restricted to those persons needing such information in the course of the performance of duties hereunder, and that the Custodian shall apprise all such persons having access of the obligation hereunder and under applicable law to prevent unauthorized disclosure of such confidential information.
(e) The parties acknowledge and agree that any breach of Section 10(a) hereof would cause not only financial damage, but irreparable harm to the other party, for which money damages will not provide an adequate remedy. Accordingly, in the event of a breach of Section 10(a) hereof, the non-breaching party shall (in addition to all other rights and remedies it may have pursuant to this Agreement, including without limitation Section 8(g) hereof, and at law and in equity) be entitled to an injunction, without the necessity of posting any bond or surety, to restrain disclosure or misuse, in whole or in part, of any information in violation of Section 10(a) hereof.
(f) The Custodian will implement and maintain a written information security program (the “Security Program”) that contains appropriate security measures designed to safeguard confidential records and information of the Funds consistent with applicable statutes, laws, rules and regulations, and definitive and binding guidance or interpretations by applicable authorities of any of the foregoing from time to time, including without limitation the personal information of the Funds’ shareholders, employees, trustees, directors and/or officers that the Custodian receives, stores, maintains, processes or otherwise accesses in connection with the provision of services hereunder. For these purposes, “personal information” shall mean (i) an individual’s name (first initial and last name or first name and last name), plus (a) social security number, (b) driver’s license number, (c) state identification card number, (d) debit or credit card number, (e) financial account number or (f) personal identification number or password that would permit access to a person’s account or (ii) any combination of the foregoing that would allow a person to log onto or access an individual’s account with the Custodian. Notwithstanding the foregoing “personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
(g) The Security Program shall have administrative, technical and physical safeguards, appropriate to the type of information concerned, designed: (i) to maintain the security and confidentiality of records and information of the Funds; (ii) to protect against anticipated threats or hazards to the security or integrity of such records and information; and (iii) to protect against unauthorized access to or use of such records and information. The Custodian shall develop, implement and maintain, at its sole expense, a system or methodology to audit for compliance with the requirements of the preceding sentence that is consistent with the SOC controls framework. Such safeguards will include, but shall not be limited to, virus protection, password protection and encryption of data in transmission at a minimum standard of AES 256. The Custodian will provide the Fund, at least annually, with the most recent SOC reports of its systems and methodologies prepared by an independent third party, and will provide executive summaries of its most recent penetration and ethical hack testing of its internet-facing environment relevant to the systems used to provide services under this Agreement (in the form generally provided by the Custodian to other similarly situated customers of services similar to the services provided under this Agreement), as conducted by a qualified, independent third party selected by the Custodian. The Custodian shall maintain books and records sufficient to demonstrate its compliance with the terms of this Section 10(g).
(h) Upon reasonable notice to the Custodian, the Custodian will arrange for its relevant subject matter experts to meet with the relevant subject matter experts of the Funds once annually and at such other times as the Funds may reasonably request to review the Custodian’s security controls and any deficiencies identified in the SSAE-18 audit reports, and for the Custodian to review with the Funds the penetration testing results and provide such additional information concerning the penetration tests as the Custodian determines to be prudent. At such meeting, the Funds may view the Custodian’s security-related policies and procedures; however, no documentation may be copied, shared, transmitted or removed from the Custodian’s premises, except as mutually agreed. In the event that the Funds identify any control deficiencies, the Custodian will discuss such findings with the Funds and will use reasonable efforts to develop a mutually agreeable remediation plan. All nonpublic documentation and information disclosed to the Funds in accordance with this Section 10(h) shall be deemed proprietary and confidential information of the Custodian. The Funds shall not disclose such documentation or information to any third party (except to the extent permitted, necessary or required pursuant to Section 10(b)) or use it for any purpose other than evaluating the Custodian’s security controls, except that the Funds may disclose the Custodian’s SSAE-18 summary to the Funds’ external auditors provided that such external auditors are required to maintain the confidentiality of the summary and any related information.
(i) In the event of any actual or reasonably suspected, based on Custodian’s experience, breach of security of its systems resulting in the actual, probable or reasonably suspected unauthorized access to or acquisition, use, loss, destruction, compromise or disclosure of any of the confidential records or information of a Fund (each, a “Security Breach”), upon learning of the Security Breach, the Custodian shall notify such Fund as promptly as reasonably possible of the relevant facts related to such Security Breach then known to the Custodian, and of additional relevant facts promptly after they become known to the Custodian, in the manner provided in Section 12 hereof and also by sending notice to xxxxxxxxxxxxx@xxxxxxxxx.xxx and/or such other electronic mail address or addresses as a Fund may specify by written notice to the Custodian. The Custodian shall at its sole cost: (i) promptly investigate such Security Breach; (ii) resolve or mitigate the vulnerability that facilitated the Security Breach to the extent possible; (iii) restore any lost or damaged data using generally accepted data restoration techniques; and (iv) conduct a root cause analysis to provide the Fund with a summary of the findings and actions taken to prevent recurrence of such Security Breach. If a Security Breach occurs with respect to personal information in the possession or under the control of the Custodian or any of its affiliates, subsidiaries, agents or employees the Custodian shall be responsible for each Fund’s reasonable costs associated with responding to such Security Breach, including, but not limited to, the costs of notifying affected individuals and taking any remedial action required by applicable statutes, laws, rules and regulations and any such other remedial action that the Custodian reasonably deems necessary (with due regard for industry standards, if any).
(j) If the Custodian uses any subsidiary or affiliate or, pursuant to Section 2.6(a), agent to perform the duties assigned to the Custodian by this Agreement, such subsidiary, affiliate or agent shall have appropriate controls in place to meet the objectives of this Section 10, and the Custodian shall exercise oversight over each such subsidiary, affiliate or agent to ensure ongoing compliance with the objectives of this Section 10. The Custodian will require each Foreign Sub-Custodian that it engages to provide services under this Agreement to establish and maintain reasonably designed safeguards and controls against the unauthorized access to and use of Fund data and information.
