Company: NWBI
Filing Date: 2025-02-20
Form Type: S-4/A
Source: 0001193125-25-030716
Chunk: 167

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-20
Form: S-4/A
Chunk 167
---
 its Subsidiaries have timely and reasonably remediated and addressed any and all material audit or security
assessment findings relating to its implementation of administrative, technical, and physical security measures. Each of PWOD’s and its Subsidiaries’ employees have received training regarding information security that is relevant to each
such employee’s role and responsibility within the business and such employee’s access to Personal Information, Business Data and Systems.

(iii) Each of PWOD and its Subsidiaries and, to PWOD’s Knowledge, each Third Party Service Provider, has (i) at all
times and remains in compliance with all Privacy and Security Requirements, and (ii) taken commercially reasonable measures to ensure that all Personal Information in its possession or control is protected against loss, damage, and unauthorized
access, use, modification, or other misuse. There

A-33

has been no loss, damage, or unauthorized access, use, modification, or other misuse of any such Personal Information by PWOD and its Subsidiaries or any other Person. PWOD and its Subsidiaries
have implemented and maintain documented policies and procedures to ensure compliance with the Privacy and Information Security Requirements. Each of PWOD and its Subsidiaries has provided all requisite notices and obtained all required consents,
and satisfied all other requirements, necessary for the conduct of the business as currently conducted and in connection with the consummation of the transaction contemplated hereunder. The consummation of the transaction contemplated hereunder will
comply with the Privacy and Information Security Requirements.

(iv) Each of PWOD and its Subsidiaries has contractually
obligated all Third Party Service Providers to appropriate contractual terms relating to the protection and use of Personal Information and Systems, including obligations to (i) comply with applicable Privacy and Information Security
Requirements, (ii) implement an appropriate information security program that includes reasonable administrative, technical, and physical safeguards, and (iii) restrict processing of Personal Information and ensure the return or adequate
disposal or destruction of Personal Information. Each of PWOD and its Subsidiaries has taken reasonable measures to ensure that Third Party Service Providers have complied with their contractual obligations.

(v) There is not currently pending or threatened litigation against PWOD and its Subsidiaries, including by any privacy
regulator or other Regulatory Authority, with respect to privacy, cybersecurity, or the Processing of Personal Information, and there are no facts upon which such litigation could be based.

(vi) Each of PWOD and its