Company: RPTX
Filing Date: 2025-11-17
Form Type: DEFA14A
Source: 0001193125-25-284040
Chunk: 128

Company: Repare Therapeutics Inc.
Filing Date: 2025-11-17
Form: DEFA14A
Chunk 128
---
 have complied with all applicable Data Security and Privacy Requirements 
 pertaining to the business of the Company and its Subsidiary.                                           |

| (b) | Neither the Company nor its Subsidiary has been subject to any order or proceeding with respect to any actual                                                                                                                                          
 or alleged non-compliance with any Data Security and Privacy Requirements. No such proceeding has been threatened in writing against either the Company or its Subsidiary, and neither the Company nor its                                             
 Subsidiary is aware of any facts or circumstances that may reasonably be anticipated to give rise to any such order or of any proceeding or notification or reporting requirement under any Data Security and Privacy Requirement. Neither the Company 
 nor its Subsidiary has received within the past two years any written complaint alleging a violation of any Data Security and Privacy Requirement.                                                                                                     |

| (c) | Neither the Company nor its Subsidiary has suffered, discovered or been notified of any loss, unauthorized                                                                         
 access to or acquisition, use, disclosure or breach of any Personal Information, including any incident that (i) either constitutes (A) a breach of Personal Information, or (B) a |

E-15

| security breach, under any Data Security and Privacy Requirement, or (ii) materially compromises (individually or in the aggregate) the confidentiality, security or privacy of any Personal                                                       
 Information. Neither the Company nor its Subsidiary has notified or had any obligation under any applicable Data Security and Privacy Requirement to notify, any affected person (including any Governmental Entity) or the media of any breach of 
 Personal Information.                                                                                                                                                                                                                              |

| (d) | All computer hardware and their associated firmware and operating systems, application software, database                                                                                                                                            
 engines and processed data, technology infrastructure and other computer systems (collectively, the “Technology”) used in connection with the Company’s and the Subsidiary’s operations are reasonable for conducting the                            
 operations related thereto except where it would not reasonably be expected to have a Material Adverse Change on the Company. Except where it would not be reasonably be expected to have a Material Adverse Change on the Company or its Subsidiary 
 (i) own or have validly licensed (and is not in breach of such licenses in any material respect) such Technology, (ii) has put in place reasonable virus protection and security measures in relation to such Technology, and (iii) have             
 reasonable back-up systems and audit procedures and disaster recovery and cybersecurity strategies in relation to the continued