Company: RPTX
Filing Date: 2025-11-17
Form Type: DEFA14A
Source: 0001193125-25-284040
Chunk: 129

Company: Repare Therapeutics Inc.
Filing Date: 2025-11-17
Form: DEFA14A
Chunk 129
---
 availability of the functionality provided by the Technology.                                                        |

| (e) | The Company and its Subsidiary have implemented and maintained an appropriate information security program that                                                                                                                                          
 includes documented cybersecurity measures and policies that: (i) are designed to ensure compliance with applicable Data Security and Privacy Requirements and are consistent with industry standards and practices of a business operating in a         
 similar industry; (ii) identify internal and external risks to the security of any proprietary or confidential information (including Personal Information) in the Company’s or its Subsidiary’s possession; (iii) implement,                            
 monitor, and maintain appropriate administrative, organizational, technical, and physical safeguards to control the risks described above in (ii); (iv) assess the Company’s and its Subsidiary’s data security practices, programs and                  
 risks; and (v) maintain incident response and notification procedures to facilitate compliance with applicable Data Security and Privacy Requirements, including in the case of any breach of security compromising Personal Information. The            
 Company and its Subsidiary take and have at all times taken commercially reasonable steps designed to ensure that any Personal Information Processed by service providers acting on behalf of the Company or its Subsidiary provides similar safeguards. |

| (f) | To the knowledge of the Company, there is no deficiency in the Company’s or its Subsidiary cybersecurity                                                                                                                                          
 measures or policies that is likely to result in a loss of data or a breach of security of the Company or its Subsidiary in any material respect. The Company and its Subsidiary have performed security risk assessments no less frequently than 
 annually for the past five years (collectively, the “Security Risk Assessment”). The Company and its Subsidiary have addressed and fully remediated all critical and high risk threats and deficiencies identified in each Security               
 Risk Assessment.                                                                                                                                                                                                                                  |

| 39. | Real Property |

| (a) | The Company and its Subsidiary have never owned, do not own and are not bound by or subject to any agreement or  
 option to own, in any case, directly or indirectly, any real property or any freehold interest in real property. |

| (b) | Schedule 39 to the Disclosure Letter sets forth a complete and accurate list of all Leased Properties, in each 
 case by reference to their municipal addresses.                                                                |

| (c) | Neither the Company nor its Subsidiary is in violation of any material covenants or not in compliance with any 
 material condition or