Company: STAA
Filing Date: 2025-08-05
Form Type: DEFA14A
Source: 0001193125-25-173098
Chunk: 32

Company: STAAR SURGICAL CO
Filing Date: 2025-08-05
Form: DEFA14A
Chunk 32
---
 therein or processed or transmitted thereby) against any
unauthorized use, access, interruption, modification or corruption, including the implementation of commercially reasonable data backup, disaster avoidance and recovery procedures and business continuity procedures, and (iii) since July 1,
2022, to the knowledge of the Company, there has been no unauthorized use or access or security breaches, or interruption, modification, loss or corruption of any of the Company IT Systems (or any data or other information or transactions stored or
contained therein or processed or transmitted thereby).

(i) Except as would not reasonably be expected to be material to the Acquired
Corporations, taken as a whole, since July 1, 2022, each Acquired Corporation (and to the knowledge of the Company, any third party Processing personal data for or on behalf of an Acquired Corporation) has complied with all applicable Privacy
Requirements.

(j) Except as would not reasonably be expected to be material to the Acquired Corporations, taken as a whole, (i) each
Acquired Corporation has implemented and maintains commercially reasonable security measures, compliant with generally accepted industry standards, that are designed to protect against the accidental or unlawful destruction, theft, loss or
unauthorized Processing, access, use, modification or disclosure of Personal Information, including through the deployment of appropriate administrative, technical and physical safeguards and have used their commercially reasonable efforts to
require any third party Processing such Personal Information on its behalf to have implemented all of the foregoing requirements, including by entering into written agreements with any such third party processor requiring that they meet the
requirements of Data Privacy Laws, and (ii) there has been no unauthorized access, use or disclosure or other security incidents or adverse events relating to Personal Information affecting any Acquired Corporation in any material respect,
including that which would require notification of individuals or any Governmental Body or any remedial action under Data Privacy Laws.

17

(k) Since July 1, 2022, no investigation by any Governmental Body has been initiated
and no Legal Proceeding has been asserted or, to the knowledge of the Company, threatened in writing (including through receipt of any notice) against any Acquired Corporation by any Person (i) regarding any collection, use, storage, transfer,
dissemination or other Processing of Personal Information in connection with any Acquired Corporation’s business, or (ii) alleging a violation by any Acquired Corporation of Data Privacy Laws, in each case except as would not reasonably be
expected to be material to the Acquired Corporations