Company: CIO
Filing Date: 2025-08-22
Form Type: PREM14A
Source: 0001193125-25-186443
Chunk: 191

Company: City Office REIT, Inc.
Filing Date: 2025-08-22
Form: PREM14A
Chunk 191
---
aries has, within the past three years, received any written or, to the Knowledge of the
Company, oral notice, or is or has been subject to any audit or investigation, in each case regarding the Processing of Personal Information or alleging a violation of any Data Protection Requirements.

(b) The Company and its Subsidiaries have established, implemented and maintain reasonable technical, physical, administrative and
organizational measures, including in compliance in all material respects

A-24

with applicable Data Protection Requirements designed to ensure the confidentiality, integrity, availability and security of all material Company data and all Personal Information that is
Processed by or on behalf of the Company or any of its Subsidiaries and to prevent any unlawful, accidental or unauthorized access thereto or use, disclosure, acquisition, exfiltration, theft, loss, alteration, corruption, destruction, or
unavailability thereof.

(c) Neither the Company nor any of its Subsidiaries have experienced any material incident, including any breach
of security, in which any Personal Information that is or was Processed by or on behalf of the Company or any of its Subsidiaries was or, to the Knowledge of the Company, may have been, accessed, used, disclosed, acquired, exfiltrated, stolen, lost,
altered, corrupted, destroyed or rendered unavailable unlawfully, accidentally or without authorization (a “”). Neither the Company nor any of its Subsidiaries has notified or, to the Knowledge of the Company,
been required by any Data Protection Requirement to notify any Person (including any Governmental Entity) of a Security Incident.

(d)
Following the Closing, Parent and the Surviving Company and its Subsidiaries will have the right to Process, on identical terms and conditions, all Personal Information that was Processed by or on behalf of the Company or its Subsidiaries prior to
the Closing.

Section 3.28 . The Company acknowledges that (a) none of the Parent
Parties or any other Person on behalf of the Parent Parties makes, or has made, any representation or warranty relating to itself or its business or otherwise in connection with this Agreement, the Merger or the other transactions contemplated by
this Agreement and the Company is not relying on any representation, warranty or other information of any Person except for those expressly set forth in this Agreement and (b) no Person has been authorized by the Parent Parties or any other
Person on behalf of the Parent Parties to make any representation or warranty relating to itself or its business or