Benefit Plans Administrative Services 12/26/2018

101Pagc or propriety of any act or omission occurring prior to the date of this Agreement. BPAS shall accept data provided by the Plan Sponsor and Plan Administrator or their representatives as correct and will not audit these records for accuracy, compliance with government requirements or consistency. Section 3.06 Privacy Policy. BPAS is committed to the security of its clients' financial and personal information. All of BPAS' operational and data processing systems shall comply with commercially reasonable industry standards to protect account information from being accessed by third parties. BPAS shall maintain and grant access to Plan Sponsor and Plan Administrator information only in accordance with BPAS' internal security standards. All information furnished by or on behalf of the Plan Sponsor and Plan Administrator to BPAS shall be regarded as confidential. BPAS shall limit its employee access to personally identifiable client information to those employees with a business reason to know such information. BPAS employees shall be educated on the importance of maintaining the confidentiality of client information and on these privacy principles. BPAS shall not reveal specific information about the Trust or the Participants or other personally identifiable data to parties outside BPAS' affiliated companies for their independent use unless: 1) the Plan Sponsor or Plan Administrator requests or authorizes it in writing; or 2) the information is provided to complete an authorized transaction. Section 3.07 Audit. Upon reasonable advance written notice to BPAS, the Plan Sponsor or Plan Administrator or their agent may conduct a periodic audit of the benefits paid and services performed under this Agreement, and BPAS shall make all of its books and records maintained with respect to this Agreement available for inspection by the Plan Sponsor or Plan Administrator or their agent during regular business hours. . The scope of any audit will be limited to the books and records related to the services and any additional services that BPAS has agreed to perform under this Agreement. In addition, in the event that the Plan, Plan Sponsor, or Plan Administrator must comply with a government audit for which BPAS assistance is necessary or helpful, BPAS shall provide such assistance upon the Plan Sponsor or Plan Administrator's request. Section 3.08 HIPAA Business Associate. BPAS acknowledges its role as a business associate for purposes of the privacy and security standards under HIPAA. Attachment A (which is incorporated by reference herein) reflects the business associate contractual requirements. Section IV—Indemnification and Forces Beyond Control Section 4.01 Indemnification. BPAS shall indemnify, defend and hold the Plan Sponsor, Plan Administrator, the Plan, and the Trust (the "Trust Parties") harmless from and against any and all claims and losses that the Trust Parties may incur by reason of a BPAS' negligence, willful misconduct, or breach of this Agreement. To the extent permitted by law, the Plan Sponsor and Plan Administrator shall indemnify, defend and hold BPAS, its directors, officers, and employees (the "BPAS Parties"), harmless from and against any and all claims and losses which the BPAS Parties may incur by reason of this Agreement, as long as such loss is not a result of a BPAS' negligence, willful misconduct or breach of this Agreement. Notwithstanding anything herein to the contrary, each indemnifying party's total liability with respect to claims for damages arising under this Agreement, whether at law or in equity, during any Plan year, is limited to direct damages and shall not, during any Plan year, exceed an amount equal to the aggregate fees actually paid to BPAS during the six(6) months preceding the month in which the claim arose. Under no circumstances shall an indemnifying party be liable to the party seeking indemnification or any third party, regardless of the form of the action, for lost revenues or profits, loss of business or goodwill, investment, market or other economic losses, or any indirect or consequential damages of any nature, including without limitation, loss of data, whether or not foreseeable. This Section 4 states the parties' exclusive remedy with respect to any claim for indemnification. No Liability for Claims and Expenses. BPAS does not insure or underwrite the Plan or Trust liability and is not financially responsible for the claims payable under and/or expenses incident to the Plan. BPAS has no duty or obligation to defend any legal action or proceeding brought to recover benefits under the Plan; however, BPAS VEBA Administrative Service Agreement (405512)