PERSONALLY IDENTIFIABLE INFORMATION WAS MASKED BY USCC.
10.2
WITHOUT LIMITING THE GENERALITY OF CONSULTANT'S OBLIGATIONS
ELSEWHERE IN THIS AGREEMENT, BUT SUBJECT TO SECTION 10.1 AND CONSULTANT'S
COMPLIANCE WITH EXHIBIT G, CONSULTANT SHALL:
(A) NOT USE OR DISCLOSE TO ANY
OTHER PARTY ANY PERSONALLY IDENTIFIABLE INFORMATION OF USCC THAT IT RECEIVES
FROM USCC, DIRECTLY OR INDIRECTLY, IN CONNECTION WITH THIS AGREEMENT EXCEPT IN
ACCORDANCE WITH THIS AGREEMENT; (B) NOT PERMIT ANY OFFICER, DIRECTOR, EMPLOYEE,
AGENT, SUBSIDIARY, AFFILIATE, OR ANY OTHER PERSON OR ENTITY ACTING ON BEHALF OF
CONSULTANT TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION UNLESS SUCH PROCESSING
IS IN COMPLIANCE WITH THIS AGREEMENT, CONDUCTED ONLY BY CONSULTANT'S EMPLOYEES
WHO HAVE A LEGITIMATE BUSINESS REASON TO PROCESS SUCH PERSONALLY IDENTIFIABLE
INFORMATION AND HAVE BEEN APPROPRIATELY TRAINED AND BOUND BY A LEGALLY
ENFORCEABLE CONFIDENTIALITY AGREEMENT CONTAINING OBLIGATIONS NO LESS STRINGENT
THAN THOSE CONTAINED IN THIS AGREEMENT; AND (C) PROCESS PERSONALLY IDENTIFIABLE
INFORMATION ONLY ON THE INSTRUCTION AND FOR PURPOSES OF USCC AND IN ACCORDANCE
WITH THIS AGREEMENT.
Page 23 of 66
***Information omitted and filed separately with the Securities and Exchange
Commission pursuant to a request for Confidential Treatment under Rule 24b-2
under the Securities Exchange Act of 1934, as amended.
10.3
CONSULTANT SHALL COMPLY WITH ISO 27001 WITH RESPECT TO INDIVIDUALS
OR ENTITIES WHOSE PERSONALLY IDENTIFIABLE INFORMATION WILL BE PROCESSED BY
CONSULTANT PURSUANT TO THIS AGREEMENT. CONSULTANT WILL REFRAIN FROM, BY ACT OR
OMISSION, PLACING USCC IN VIOLATION OF ANY APPLICABLE PRIVACY OR DATA PROTECTION
LAW (INCLUDING, WITHOUT LIMITATION, THE ISRAELI PROTECTION OF PRIVACY LAW) BY
PROVIDING SERVICES TO USCC IN ACCORDANCE WITH SECTION 7.3(A).
WITH RESPECT TO
ANY DATA PROCESSED IN ISRAEL, CONSULTANT SHALL PROCESS SUCH DATA SOLELY IN A
MANNER EXPRESSLY PERMITTED BY THIS AGREEMENT AND CONSISTENT WITH THE LAWS OF
ISRAEL.
10.4
CONSULTANT WILL NOT DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION
TO ANY THIRD PARTY (INCLUDING, WITHOUT LIMITATION, CONSULTANT'S SUBSIDIARIES AND
AFFILIATES AND ANY PERSON OR ENTITY ACTING ON BEHALF OF CONSULTANT) UNLESS WITH
RESPECT TO EACH DISCLOSURE:
(A) THE DISCLOSURE IS NECESSARY IN ORDER TO CARRY
OUT CONSULTANT'S OBLIGATIONS UNDER THIS AGREEMENT; (B) SUCH THIRD PARTY IS BOUND
BY THE SAME PROVISIONS AND OBLIGATIONS SET FORTH IN THIS AGREEMENT;
(C) CONSULTANT HAS RECEIVED PRIOR WRITTEN CONSENT FROM USCC; AND (D) CONSULTANT
SHALL REMAIN RESPONSIBLE FOR ANY BREACH OF THE OBLIGATIONS SET FORTH IN THIS
AGREEMENT AND ANY VIOLATION OF ISO 27001 TO THE SAME EXTENT AS IF CONSULTANT
CAUSED SUCH BREACH OR VIOLATION. CONSULTANT SHALL NOT DISCLOSE PERSONALLY
IDENTIFIABLE INFORMATION OUTSIDE OF THE UNITED STATES WITHOUT USCC'S PRIOR
WRITTEN CONSENT (INCLUDING BY E-MAIL).
10.5
CONSULTANT SHALL MAINTAIN COMMERCIALLY APPROPRIATE AND REASONABLE
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES (CONSISTENT WITH THE TYPE OF
PERSONALLY IDENTIFIABLE INFORMATION BEING PROCESSED AND THE SERVICES PROVIDED BY
CONSULTANT), WHICH SHALL INCLUDE PHYSICAL, ELECTRONIC AND PROCEDURAL SAFEGUARDS
TO PROTECT PERSONALLY IDENTIFIABLE INFORMATION SUPPLIED TO CONSULTANT AGAINST
ANY BREACH OF ITS OBLIGATIONS SET FORTH IN THIS SECTION 10 (SUCH BREACH, A "DATA
SECURITY BREACH") OR PROCESSING NOT EXPRESSLY AUTHORIZED BY OR FOR THE PURPOSES
OF USCC.
SUCH MEASURES