(aa) (i) The Company and each of its subsidiaries have complied and are
presently in compliance, in all material respects, with all internal and external privacy policies, contractual obligations, industry standards, applicable laws, statutes, judgments, orders, rules and regulations of any court or arbitrator or other
governmental or regulatory authority and any other legal obligations, in each case, relating to the collection, use, transfer, import, export, storage, protection, disposal and disclosure by the Company or any of its subsidiaries of personal,
personally identifiable, household, sensitive, confidential or regulated data (Data Security Obligations, and such data, Data); (ii) the Company has not received any notification of or complaint regarding and is
unaware of any other facts that, individually or in the aggregate, would result in a material non-compliance with any Data Security Obligation; and (iii) of there is no action, suit or proceeding by or
before any court or governmental agency, authority or body pending or, to the knowledge of the Company, threatened alleging non-compliance with any Data Security Obligation.
(bb) The Company and each of its subsidiaries have, in all material respects, taken technical and organizational measures
necessary to protect the information technology systems and Data used in connection with the operation of the Companys and its subsidiaries businesses. Without limiting the foregoing, the Company and its subsidiaries have used reasonable
efforts to establish and maintain, and have established, maintained, implemented and complied with, in all material respects, reasonable information technology, information security, cyber security and data protection controls, policies and
procedures, including oversight, access controls, encryption, technological and physical safeguards and business continuity/disaster recovery and security plans that are designed to protect against and prevent breach, destruction, loss, unauthorized
distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of or relating to any information technology system or Data used in connection with the operation of the Companys and its
subsidiaries businesses (Breach). To the knowledge of the Company, there has been no material Breach, and the Company and its subsidiaries have not been notified of and have no knowledge of any event or condition that would
reasonably be expected to result in, any material Breach.
(cc) The Company and each of its subsidiaries have filed all
federal, state, local and foreign tax returns required to be filed through the date of this Agreement or have requested extensions thereof (except where the failure to file would not, singly or in the aggregate, reasonably be expected to have a
material adverse effect on the Company and its subsidiaries, taken as a whole) and have paid all taxes required to be paid thereon (except for cases in which the failure to file or pay would not, singly or in the aggregate, reasonably be expected to
have a material adverse effect on the Company and its subsidiaries, taken as a whole, or, except as currently being contested in good faith and for which reserves required by generally accepted accounting principles (U.S. GAAP)
have been created in the financial statements of the Company), and except as otherwise disclosed in the Registration Statement, the Time of Sale Prospectus or the Prospectus, there is no tax deficiency that has been asserted against the Company or
any of its subsidiaries or any of their respective properties or assets which, singly or in the aggregate, has had a material adverse effect on the Company and its subsidiaries, taken as a whole.
9