Company: TGE
Filing Date: 2025-02-19
Form Type: DRS
Source: 0001213900-25-015012
Chunk: 573

Company: Generation Essentials Group
Filing Date: 2025-02-19
Form: DRS
Chunk 573
---
 and such measures include commercially reasonable security protocol technologies, including the implementation of commercially reasonable (i) safeguards and security protocol technologies designed to protect against unauthorized access to, and unauthorized use, alteration, disclosure or distribution of Personally Identifiable Information, (ii) data backup, (iii) disaster avoidance and recovery procedures, (iv) security assessments, including penetration tests (and have fully remediated any critical or high risk vulnerabilities identified in its security assessments), and (v) business continuity procedures. There has been no Security Incident involving the Company IT Systems owned by or under the control of the Company or any of its Subsidiaries, or any data or information, including Personally Identifiable Information, stored or contained therein or transmitted thereby. Section 5.14. Data Privacy . (a)The Company and its Subsidiaries have developed, implemented and maintained a written data protection, data privacy and cybersecurity program (the “ Data Protection Program ”) that is in compliance with all material Privacy Requirements. Since January 1, 2022, no Person has received or, to the knowledge of the Company, claimed any compensation or damages from the Company or any of its Subsidiaries, or has brought, or, to the knowledge of the Company, threatened in writing to bring, any material Action against the Company or any of its Subsidiaries in relation to any Security Incident for or arising as a result of any actual or alleged violation, breach or other material non-compliance with or of any Privacy Requirement, and, to the Company’s knowledge, no facts or circumstances exist that might give rise to any such claim. (b)To the knowledge of the Company, the Company and its Subsidiaries have at all times complied, and are currently in compliance, in all material respects with all Privacy Requirements with respect to the Processing of Personally Identifiable Information, including (i) providing adequate notice and obtaining any necessary consents from customers (to the extent legally required under the Privacy Requirements) required for the Processing of the Company PII as conducted by or on behalf of the Company or any of its Subsidiaries and (ii) abiding by any privacy choices (including opt-outs, do-not-calls or similar choices) of end users relating to Personally Identifiable Information. The Company and its Subsidiaries are not, and since January 1, 2022, have not Annex A-30 been, subject to a Governmental Order of, and have not, since January 1, 2022, received