Bank of America 12/30/2021 (2) - Laserfiche WebLink

BANK OFAMERICA " , 21. INFORMATION SECURITY/DATA PROTECTION 21.1 Overall Data Security Regulations. As a financial institution, we are required to comply with the information security standards established under national and international legal and regulatory requirements applicable to us. We are evaluated regularly for compliance with these obligations by various US and international regulators as applicable. 21.2 Security and Confidentiality.We maintain an Information Security Policy that i. contains appropriate administrative, technical and physical safeguards designed to protect against Information Security Events; ii. conforms as required to the requirements of applicable Data Protection Laws;and iii. sets forth policies and procedures that are designed to be consistent with,to the extent applicable to the Services, PCI-DSS standards;the card networks rules and regulations;and Financial Services Industry Best Practices. 21.3 Data Protection. You hereby represent and warrant to us now and on each day on which we provide a Service to you that you are in compliance with all Data Protection Laws and where required under such Data Protection Laws you will maintain at all times during the term of the Agreement a valid registration or authorization with any applicable Data Protection Authority.You shall inform us of any requirement of which you are aware which would require us to be registered or authorized with any applicable Data Protection Authority in order to provide the Services to you.You shall obtain on your and, as applicable,our behalf all necessary and valid consents, including Cardholder consents, and provide all necessary data protection notices in order for us to process the Personal Data using such forms as we may prescribe for the purposes described in the Agreement, and to disclose the Personal Data to the types of recipients described in the Agreement, including if applicable where the recipients are located outside of the EEA.You shall retain,and upon request provide us with,copies of such notices and consents. With regard to our processing of Personal Data, we will comply with our obligations as a financial institution as set out in Section 21.1 and all applicable Data Protections Laws. We may process Personal Data for the following purposes: i. to provide and manage the Services; ii. to help monitor,assess and carry out statistical product analysis and development; iii. to develop for our own use internal data on the types of clients and the markets we service; iv. to perform system testing and training; v. to manage our business; vi. as part of any internal or external audit or compliance review that we or any of our affiliates may undertake; vii. to help prevent crime,fraud and terrorism;and viii. to comply with card networks rules and all applicable laws and other legal and regulatory requirements. We will never use Personal Data for direct marketing to Cardholders. You agree that we may disclose Personal Data to: i. our affiliates, agents,auditors and service providers; ii. card networks and fraud prevention agencies; iii. to any other person if legally required, including to law enforcement agencies,authorities,regulators and courts;and iv. any other person to whom we may transfer or intend to transfer, assign or sell any of our rights or obligations under the Agreement. Any disclosures of Personal Data that we make will be made in compliance with applicable Data Protection Laws. Where we are deemed to be processing Personal Data on your behalf,we agree to the following: i. We will process the Personal Data only as required for the purposes providing the Services or as otherwise set out in the Agreement. We will only act on your instructions in relation to the processing of the Personal Data in accordance with the terms of the Agreement. You are responsible for providing us with any relevant instructions concerning the Processing of Personal Data in connection with Services. ii. During the term of the Agreement,we take appropriate technical and organizational measures to protect the Personal Data against accidental or unlawful destruction or accidental loss,alteration, unauthorized disclosure or access and against other unlawful forms of processing having regard to the state of technological developments and the cost of implementing those measures, so as to ensure a level of security appropriate to the harm that may result from breach of those measures and the nature of the Personal Data to be protected. In addition,we will ensure that our staff processing Personal Data hereunder keep any Personal Data strictly confidential and not use such Personal Data for any other purposes other than for the provision of Services to you or as otherwise set out in the Agreement. You acknowledge and agree that data processing related to a Service and your Card Accounts may take place in countries other than those where you and your accounts with us are located. You further understand that information concerning your relationship with us may be available on our electronic data system both for information management purposes and in order to enable you to benefit from our electronic banking services. You understand and agree that,as a result, your banking relationship information may be available to some of our officers outside the country or countries where you and your accounts are located. You authorize us to transmit your banking relationship information across national borders, notwithstanding the banking secrecy laws of any of the countries involved, as necessary or appropriate to provide a Service. 00-35-6182NSBW 02-28-2020 AK Page 12 of 16 Bank of America — Confidential C 2020 Bank of America Corporation